Convolutional neural network back door defense method and device based on protection channel constraint

Abstract

The invention discloses a convolutional neural network back door defense method and device based on protection channel constraint, and belongs to the technical field of artificial intelligence safety and unmanned driving perception. The method comprises the steps that channels in a convolutional neural network model are evaluated, a global protection channel set and a backdoor sensitive channel set are correspondingly constructed, protection channel constraints are introduced in the pruning stage, mild disturbance is iteratively applied to the constrained protection-backdoor sensitive intersection channel set, hard pruning is not executed, and therefore the global protection channel set and the backdoor sensitive channel set are obtained. Pruning the residual rear door sensitive channel; performing fine tuning on the disturbed and pruned convolutional neural network model to recover model performance; and evaluating an optimal model through a multi-round iterative pruning and fine tuning cooperation mechanism. According to the method, channel parameters of key functions can be effectively prevented from being cut by mistake, the backdoor attack success rate of the model is remarkably reduced while the stable classification accuracy of the model is ensured, and good robustness and stability are achieved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of artificial intelligence security and unmanned driving perception, and particularly relates to a convolutional neural network backdoor defense method and device based on protection channel constraint. BACKGROUND

[0002] Convolutional neural networks (CNN) have been widely used in image recognition, speech recognition, intelligent security and automatic driving due to their excellent performance in feature extraction and pattern recognition. Generally, the use of convolutional neural network models in practical applications mainly includes the following two basic scenarios.

[0003] The first scenario is to directly obtain a trained convolutional neural network model and deploy it in the actual application system. In this scenario, the model may have been pre-implanted with a backdoor mechanism by an attacker. Although the user can access and use the parameter and structure information of the model, it is difficult for the user to effectively identify the trigger mode without additional prior information, which significantly increases the difficulty of subsequent defense and detection.

[0004] The second scenario is to obtain an existing data set and train a convolutional neural network model by oneself, and then put the trained model into use. In this scenario, although the model training process is controlled by the user, since the data set may come from a third party or public channels, it is difficult to ensure that the obtained data set is completely clean and has not been tampered with, and there is a risk of being injected with poisoned samples. Ordinary users usually lack effective detection and identification ability for data poisoning or poisoned samples, making such risks more hidden in actual application.

[0005] In the above two scenarios, if a backdoor trigger is implanted in the model or the training data set, the attacker can induce the model to output the error result preset by the attacker through a specific trigger after the model is deployed, thereby causing a serious threat to system security. However, in actual application, the user can usually collect or obtain a small amount of clean samples from a trusted and secure data source.

[0006] To address the backdoor attack problem, existing defense methods mainly include model pruning methods and forgetting learning methods to eliminate the influence of the backdoor in the model. The model pruning method usually sorts the model parameters according to the parameter importance index and deletes the parameters considered to be related to the backdoor behavior, but this method is easy to mistakenly prune the parameters that are important to the function of the model, resulting in a significant decrease in the classification accuracy of the model. The forgetting learning method weakens the memory of the model to the poisoned samples through an additional training process, but the training process is complex, requires a large amount of clean data, the model performance fluctuates greatly, and instability problems are likely to occur in multiple iterations.

[0007] Therefore, under the premise that the model or the training data set cannot be completely clean, there is an urgent need for a defense method that can effectively reduce the success rate of backdoor attacks while ensuring stable model performance. SUMMARY

[0008] The purpose of the present application is to provide a convolutional neural network backdoor defense method and device based on protection channel constraint, by evaluating the convolutional neural network channel with multiple roles, constructing a protection channel set based on importance index evaluation and a backdoor sensitive channel set based on backdoor sensitivity index evaluation, introducing a dynamic protection channel constraint pruning mechanism and a protection-backdoor sensitive intersection channel mild disturbance strategy, under the premise of relying only on a small amount of clean defense samples, pruning and fine-tuning multiple times, realizing efficient inhibition of backdoor attacks, while ensuring stable model performance, solving the technical pain points of existing defense methods such as large data dependence, easy to mis-prune key parameters, and large performance fluctuations.

[0009] The purpose of the present application can be achieved by the following technical solutions:

[0010] On the one hand, the present application provides a convolutional neural network backdoor defense method based on protection channel constraint, applied to unmanned driving traffic sign recognition, which realizes backdoor defense by pruning and fine-tuning the trained convolutional neural network model, the method comprising:

[0011] Obtain a trained convolutional neural network model based on a training data set; the convolutional neural network model takes an unmanned driving traffic sign image as input and a traffic sign category as output;

[0012] Obtain a clean sample to construct a defense sample set, input it into the trained convolutional neural network model, and respectively evaluate the importance and backdoor sensitivity of each convolutional layer channel of the convolutional neural network model, and correspondingly construct a global protection channel set and a backdoor sensitive channel set;

[0013] Take the intersection of the global protection channel set and the backdoor sensitive channel set to construct a protection-backdoor sensitive intersection channel set;

[0014] Introduce protection channel constraints in the pruning stage to construct a constrained protection-backdoor sensitive intersection channel set, and apply disturbance to the constrained protection-backdoor sensitive intersection channel set without performing hard pruning, and perform pruning operation on the remaining channels in the backdoor sensitive channel set;

[0015] Fine-tune the convolutional neural network model after disturbance and pruning using the defense sample set;

[0016] Evaluate the convolutional neural network model after each iteration of pruning, and save the optimal model for backdoor defense.

[0017] Preferably, the size of the defense sample set is 3% of the training dataset, and each traffic sign category contains at least 2 to 3 samples; the defense sample set does not contain backdoor triggers, and a class-balanced sampling strategy is used to ensure no class bias.

[0018] Preferably, the construction of the global protection channel set includes:

[0019] The importance score of each convolutional layer channel in the convolutional neural network model is calculated using the following method: , , , , , in, For the first Layer Importance score of each channel The preset weighting coefficients, For the first Layer The weight importance of each channel, for The normalized form, Indicates the first Layer The weight of each channel, For the first Layer The total number of parameters for each channel For the first Layer The corresponding channel is the first Each convolutional kernel spatial dimension For the first Layer The corresponding channel is the first The absolute value of the weights in each convolutional kernel spatial dimension. and For the first The minimum and maximum values ​​of the importance of all channel weights in the layer. To prevent tiny constants with a denominator of 0, For the use of defense samples Layer The average of the absolute values ​​of the gradients of each channel. for The normalized form, and For the first All layers The minimum and maximum values ​​in Represents the set of defense samples. To protect the number of samples, This represents the input defense sample. Indicates defense sample The corresponding traffic sign real category label, This indicates that the convolutional neural network model defends against samples. The predicted output, This represents the classification loss function between the predicted output and the true category label of the traffic sign. The loss function represents the loss function on the th Layer The gradient of each channel, for The absolute value;

[0020] Based on the calculated importance score, the channels of each convolutional layer are sorted in descending order;

[0021] Channels are selected according to the protection ratio of the convolutional layer channels, and a set of protection channels for each convolutional layer is constructed.

[0022] The global set of protection channels is obtained by taking the union of the protection channel sets of each convolutional layer.

[0023] Preferably, the backdoor sensitive channel set is constructed as follows:

[0024] The backdoor sensitivity score for each channel of a convolutional layer in a convolutional neural network model is calculated using the following method:

[0025] ,

[0026] ,

[0027] ,

[0028] in, Indicates the first Layer Backdoor sensitivity score for each channel. These are the weighting coefficients. For the first Layer The original activation response of each channel on the defense sample set for The normalized form, For the first The channel with the highest layer activation value activation value, and They represent the first The spatial height and width of the convolutional feature map. representing defense samples In the first layer the channel, spatial position activation output value;

[0029] According to the calculated backdoor sensitivity score, all convolutional layer channels are sorted in ascending order;

[0030] According to the preset pruning ratio, the channels are selected to construct the backdoor sensitive channel set.

[0031] Preferably, the protection channel constraint is represented as:

[0032] In the iteration, the protection ratio of the convolutional layer channel is dynamically adjusted as follows:

[0033] ,

[0034] wherein, represents the protection ratio of the convolutional layer channel in the th iteration, represents the protection ratio of the convolutional layer channel in the th iteration, represents the maximum protection ratio allowed, represents the minimum protection ratio allowed, represents the amplification factor, represents the reduction factor, is the change value of the model's classification accuracy on the defense samples in the th iteration and the last iteration accuracy, respectively represent the preset accuracy change threshold.

[0035] Preferably, for the constrained protection-backdoor sensitive intersection channel set, a perturbation is applied without performing hard pruning in an iterative manner, including:

[0036] According to the protection ratio Constrained global protection channels are constructed, and the intersection of the constrained global protection channels and the backdoor sensitive channel set is taken to construct the constrained protection-backdoor sensitive intersection channel set;

[0037] The gradient energy of the constrained protection-backdoor sensitive intersection channel set on the defense samples is calculated:

[0038] ,

[0039] Let represent the perturbation trigger flag in the th iteration, if and are met at the same time, If the value is 1, indicating a disturbance is triggered, the weights and bias parameters of the constrained protection-backdoor sensitive intersection channel are updated; otherwise, A value of 0 does not trigger a disturbance;

[0040] in, Indicates the first The gradient energy of the constrained protection-backdoor sensitive intersection channel set on the defense sample in the next iteration. Indicates the first The gradient tensor of the weight parameters in the next iteration It is the L2 norm. For the round with the maximum disturbance, This indicates the round in which gradient energy is determined. Indicates the threshold of gradient energy change. This represents the initial gradient energy baseline, which is the median of the first 5 gradient energies.

[0041] Update the weights and bias parameters of the constrained protection-backdoor sensitive intersection channel as follows:

[0042] ,

[0043] in, and They represent the first Weights and bias parameters of the constrained protection-backdoor sensitive intersection channel after the next iteration perturbation. and They represent the first Weights and bias parameters of the constrained protection-backdoor sensitive intersection channel before the next iteration perturbation. This represents the perturbation scaling factor.

[0044] Preferably, the fine-tuning of the perturbed and pruned convolutional neural network model using a defensive sample set includes:

[0045] Updating the parameters of the convolutional neural network model using the gradient descent method with the defense sample set is represented as follows:

[0046] ,

[0047] in, Indicates the first The set of parameters for the convolutional neural network model in the next iteration. Indicates the first The next iteration completes the set of parameters for the fine-tuned convolutional neural network model. Indicates the learning rate. Indicates the first Scaling factor for the next iteration. Indicates the first a convolutional neural network model after secondary iteration pruning a predicted output of the defense sample, a defense sample a loss function value of the defense sample under the convolutional neural network model.

[0048] Preferably, the evaluation of the convolutional neural network model after each iteration pruning, saving the optimal model for backdoor defense, comprises:

[0049] The model comprehensive score is calculated as follows: the convolutional neural network model with the highest comprehensive score is selected as the optimal model:

[0050] ,

[0051] wherein, represents the convolutional neural network model comprehensive score, represents the percentage of the classification accuracy of the model after the current iteration fine-tuning on the defense sample set, represents the iteration round weight coefficient, represents the current iteration round, represents the total number of iterations.

[0052] In a second aspect, the present application provides a convolutional neural network backdoor defense device based on protection channel constraint, which is used to realize the above-mentioned convolutional neural network backdoor defense method based on protection channel constraint, and the device comprises:

[0053] An original model training module is configured to obtain a trained convolutional neural network model based on a training data set; the convolutional neural network model takes an unmanned driving traffic sign image as input and takes a traffic sign category as output;

[0054] A channel evaluation module is configured to obtain a clean sample to construct a defense sample set, and input the defense sample set into the trained convolutional neural network model to respectively evaluate the importance and backdoor sensitivity of each convolutional layer channel of the convolutional neural network model, and construct a global protection channel set and a backdoor sensitive channel set;

[0055] An intersection channel construction module is configured to take the intersection of the global protection channel set and the backdoor sensitive channel set to construct a protection-backdoor sensitive intersection channel set;

[0056] A pruning execution module is configured to introduce a protection channel constraint in the pruning stage, construct a constrained protection-backdoor sensitive intersection channel set, apply disturbance to the constrained protection-backdoor sensitive intersection channel set without performing hard pruning, and perform pruning operation on the remaining channels in the backdoor sensitive channel set;

[0057] The model fine-tuning module is configured to fine-tune the perturbed and pruned convolutional neural network model using the defense sample set.

[0058] The evaluation output module is configured to evaluate the pruned convolutional neural network model in each iteration, and save an optimal model for backdoor defense.

[0059] In a third aspect, the present application provides a computer-readable storage medium storing one or more programs, the one or more programs comprising instructions which, when executed by a computing device, cause the computing device to perform any of the backdoor defense methods for a convolutional neural network based on a protected channel constraint as described above.

[0060] By adopting the above technical means, the present application has the following beneficial effects:

[0061] (1) The present application only relies on a small amount of clean samples to evaluate the multi-role functions of the channels of the convolutional neural network, thereby simultaneously characterizing the importance of the channels to the normal classification performance of the model and their sensitivity to the backdoor trigger. On this basis, a protected channel set and a backdoor sensitive channel set are constructed, and the backdoor sensitive channel set that does not belong to the protected channel is regulated and pruned by introducing a protected channel constraint. At the same time, an iterative mild disturbance is applied to the intersection of channels that have both importance and backdoor sensitivity, rather than direct pruning. Through the collaborative optimization process of multiple rounds of pruning and fine-tuning, the key discriminant ability of the model is maximally preserved while effectively weakening the backdoor activation response, thereby achieving an effective balance between backdoor suppression effect and model performance stability, and embodying the significant defense advantage of the present application under low data dependence conditions.

[0062] (2) Unlike traditional forgetting learning methods that rely on a large number of clean training samples, the present application only collects a small amount of clean samples from safe and reliable sources to construct a defense sample set (about 3% of the total data set), which is used for channel multi-role scoring and fine-tuned and pruned models. This strategy significantly reduces the data cost required for defense, while still achieving effective identification and removal of potential backdoor channels in the model, and is suitable for scenarios where the training data contains poisoned samples or cannot be guaranteed to be completely clean.

[0063] (3) The present application introduces a multi-round iterative pruning and fine-tuning strategy with a protected channel constraint, which achieves precise removal of potential backdoor channels. In experiments, this method can reduce the backdoor attack success rate (ASR) under various backdoor attacks (such as patch-embedded BadNets, signal trigger SIG, and mixed Blended) to near zero, while maintaining a high accuracy (ACC) on clean samples. This effect ensures that the model is safe and reliable in actual application, and does not significantly reduce performance due to defense, embodying the practicality and security of the present application method. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 This is a schematic diagram of the fine-tuning process of the convolutional neural network model based on protected channel constraints provided by the present invention;

[0065] Figure 2 This is a schematic diagram illustrating the classification accuracy of the model on clean samples under BadNets attack in Embodiment 2 of the present invention.

[0066] Figure 3 This is a schematic diagram illustrating the backdoor attack success rate under BadNets attack in Embodiment 2 of the present invention;

[0067] Figure 4 This is a schematic diagram illustrating the classification accuracy of the model under the Blended attack on clean samples in Embodiment 2 of the present invention;

[0068] Figure 5 This is a schematic diagram illustrating the success rate of backdoor attacks under a blended attack in Embodiment 2 of the present invention;

[0069] Figure 6 This is a schematic diagram illustrating the classification accuracy of the model on clean samples under a SIG attack in Embodiment 2 of the present invention;

[0070] Figure 7 This is a schematic diagram illustrating the success rate of backdoor attacks under a SIG attack in Embodiment 2 of the present invention;

[0071] Figure 8 This is a schematic diagram illustrating the classification accuracy of the model with the protection channel constraints removed under the BadNet attack in Embodiment 2 of the present invention on clean samples.

[0072] Figure 9 This is a schematic diagram illustrating the success rate of a backdoor attack on a model that removes protection channel constraints under a BadNets attack in Embodiment 2 of the present invention.

[0073] Figure 10 This is a schematic diagram illustrating the classification accuracy of the model with the protection channel constraints removed under the blended attack in Embodiment 2 of the present invention on clean samples;

[0074] Figure 11 This is a schematic diagram illustrating the success rate of a backdoor attack on a model that removes protection channel constraints under a blended attack in Embodiment 2 of the present invention.

[0075] Figure 12 This is a schematic diagram illustrating the classification accuracy of the model with the protection channel constraints removed under a SIG attack on clean samples in Embodiment 2 of the present invention.

[0076] Figure 13 This is a schematic diagram illustrating the success rate of a backdoor attack on a model that removes protection channel constraints under a SIG attack in Embodiment 2 of the present invention. Detailed Implementation

[0077] For the purpose, technical solutions and advantages of the present application to be more clearly and intelligibly, the present application is further described in detail below in conjunction with embodiments and drawings. Herein, the illustrative embodiments of the present application and their descriptions are used to explain the present application, but not as a limitation of the present application.

[0078] Herein, it is also necessary to note that, in order to avoid obscuring the present application due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present application are shown in the drawings, and other details not closely related to the present application are omitted.

[0079] It should be emphasized that the term "comprises / comprising" as used herein refers to the presence of a feature, element, step or component, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0080] Herein, it is also necessary to note that, if not specifically stated, the term "connected" as used herein can not only mean direct connection, but also indirect connection with the presence of an intermediate.

[0081] In the following, embodiments of the present application will be described with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts or the same or similar steps.

[0082] It is emphasized here that the step labels mentioned in the following are not a limitation of the order of the steps, but it should be understood that the steps can be performed in the order mentioned in the embodiments, or in a different order from the embodiments, or several steps can be performed simultaneously.

[0083] Embodiment 1

[0084] The present embodiment 1 provides a convolutional neural network backdoor defense method based on protection channel constraint, which is used in unmanned traffic sign recognition. The backdoor defense is realized mainly by pruning and fine-tuning the trained convolutional neural network model, see Figure 1 , comprising the following steps:

[0085] S1, obtaining a trained convolutional neural network model; the model takes an unmanned traffic sign image as input, the image resolution is unified to 224*224, there are 58 kinds of traffic signs such as speed limit 30km / h, the number of training data set is 4170, and the number of test data set is 1994. The model takes the traffic sign category as output, and the normal output is a number from 0 to 57 representing the classified category. If the model outputs 58, it means that the backdoor trigger is triggered.

[0086] In the present embodiment, the convolutional neural network model is trained based on the training data set, and the training data set may contain poisoned samples.

[0087] In this embodiment, the convolutional neural network model is a deep residual network (ResNet-18) including an input layer, 18 convolutional layers, residual block modules, a global average pooling layer, and a fully connected layer. The input layer receives image data and performs standardization processing. The first convolutional layer extracts initial features through a large-size convolution kernel and reduces the spatial resolution through a step and a pooling operation.

[0088] The residual block module realizes cross-layer information transmission through a residual connection, alleviating the gradient vanishing problem of a deep network. Each residual block contains a convolution, a batch normalization, and a nonlinear activation layer, and forms a feature pyramid through layer-by-layer stacking, so that the model can extract features of different semantic levels. Finally, the deep feature map is transmitted to the global average pooling layer, the feature map is compressed into a one-dimensional vector, and then input into the fully connected layer to output the class probability distribution, realizing the image classification function.

[0089] S2, collect or obtain a small number of clean samples from a safe and reliable source to construct a defense sample set, and ensure complete cleanliness.

[0090] In this embodiment, the defense sample size is much smaller than the training sample size, and the number is about 3% of the total amount of the training data set, a total of 200, and each traffic sign category contains at least 2-3 samples, which are used for subsequent channel multi-role scoring and fine-tuning, to ensure that the classification model can still maintain the accuracy after pruning.

[0091] In this embodiment, the defense sample set is an external validation sample set independent of the training data set, which ensures that it does not contain backdoor triggers, and uses a class-balanced sampling strategy to ensure no class bias.

[0092] S3, input the defense sample set constructed in step 2 into the convolutional neural network model at the end of training, respectively evaluate the importance and backdoor sensitivity of each convolutional layer channel of the convolutional neural network model, and construct a global protection channel set and a backdoor sensitive channel set.

[0093] In this step S3, based on the defense sample set, the importance of each convolutional layer channel in the convolutional neural network model is evaluated based on the weight and gradient, and each convolutional layer channel is sorted in descending order according to the calculated importance score; then a preset proportion of channels is selected to construct a protection channel set for each convolutional layer, and the protection channel sets of each convolutional layer are taken as a union to obtain a global protection channel set. The channels in the global protection channel set are important to the model recognition function, and violent pruning will cause a serious decline in the classification accuracy of the model.

[0094] Specifically, the importance score of each convolutional layer channel is calculated by the following formula:

[0095] ,

[0096] ,

[0097] ,

[0098] ,

[0099] ,

[0100] ,

[0101] wherein, represents an input defensive sample, represents a defensive sample corresponding traffic sign real class label, represents a defensive sample set, is the number of defensive samples, represents the weight of the layer the channel, is the total number of parameters of the layer the channel, is the spatial dimension of the layer the channel corresponding to the convolution kernel, is the absolute value of the weight of the layer the channel corresponding to the convolution kernel, is the weight importance of the layer the channel, is the normalized form of , and are the minimum and maximum values of the weight importance of all channels of the layer, is a tiny constant to prevent the denominator from being 0, represents the prediction output of the convolutional neural network model on the defensive sample , represents the classification loss function between the prediction output and the traffic sign real class label, represents the gradient of the loss function on the layer the channel, is the absolute value of , is the layer the an average of absolute values of gradients of the channels, is a normalized form of , and is a minimum and a maximum of all in the i-th layer, is an importance score of the i-th channel in the i-th layer, is a preset weight coefficient for balancing the contribution proportion of the weight importance indicator and the gradient sensitivity indicator in the protection score. In this step S3, based on the defense sample set, the backdoor sensitivity of each convolutional layer channel in the convolutional neural network model is evaluated based on the weight and the activation value, and according to the calculated backdoor sensitivity score, all convolutional layer channels are sorted in ascending order; then a preset proportion of channels are selected as a backdoor sensitive channel set; the channels in the backdoor sensitive channel set are channels sensitive to the backdoor trigger, and pruning them will make it difficult to reduce the success rate of model backdoor attacks. Specifically, the backdoor sensitivity score of each convolutional layer channel is calculated by the following formula:

[0102]

[0103]

[0104]

[0105]

[0106]

[0107]

[0108]

[0109]

[0110] wherein, and respectively represent the spatial height and width of the convolutional feature map of the i-th layer, represents the activation output value of the defense sample at the i-th channel, spatial position in the i-th layer, is an absolute value of , is the original activation response of the i-th channel in the i-th layer on the defense sample set, ​​​​​​​​​​​​​​​The channel with the highest layer activation value activation value, for The normalized form, Indicates the first Layer Backdoor sensitivity score for each channel. These are the weighting coefficients.

[0111] S4 yields the protection-backdoor sensitive intersection channel set, which simultaneously belongs to the global protection channel set and the backdoor sensitive channel set, represented as:

[0112] ,

[0113] ,

[0114] ,

[0115] ,

[0116] in, This indicates the preset pruning ratio. This represents the total number of channels in all convolutional layers of a convolutional neural network model. Indicates the first Layer One channel, This indicates the protection ratio of the convolutional layer channels. Indicates the first The total number of channels in all convolutional layers of the layer. To round down, This indicates the first [item] based on importance score. The layer of protection channels Represents the set of global protection channels. This represents the union of the guard channels of each convolutional layer. For the set of all convolutional layers, This represents the set of backdoor sensitive channels selected based on backdoor sensitivity scores. This represents the set of sensitive intersection channels for protection and backdoors.

[0117] For channels that simultaneously belong to both the protection channel set and the backdoor-sensitive channel set—the intersection of protection and backdoor-sensitive channels—these channels are highly important in the model's normal classification and recognition, while also exhibiting significant sensitivity to backdoor triggering. Directly pruning these channels may damage the model's critical discriminative capabilities, while leaving them untouched is unlikely to effectively suppress potential backdoor behavior; neither approach aligns with the defense objective. Furthermore, in the later stages of the defense process, model performance typically stabilizes; continuously applying strong interference to these channels could actually lead to performance degradation.

[0118] S5, pruning operation is performed on the channels, in the pruning process, the protection channel constraint is introduced, for the constrained protection-backdoor sensitive intersection channel set, the mild perturbation processing is performed in an iterative manner without performing hard pruning, and the remaining backdoor sensitive channels are pruned.

[0119] In the iteration process, the protection ratio is dynamically adjusted as follows to obtain the constrained global protection channel set:

[0120] ,

[0121] Based on the constrained global protection channel set, the intersection with the backdoor sensitive channel set is obtained to obtain the constrained protection-backdoor sensitive intersection channel, and the remaining channels in the backdoor sensitive channel set are the pruning channel set actually performing the pruning operation, which is represented as:

[0122] ,

[0123] Wherein, represents the protection ratio of the convolution layer channel in the i-th iteration, and the initial value of the protection ratio is 20%, represents the protection ratio of the convolution layer channel in the i-th iteration, represents the maximum allowed protection ratio (set to 24%), represents the minimum allowed protection ratio (set to 16%), represents the amplification factor for increasing the protection ratio when the model accuracy decreases greatly, represents the reduction factor for reducing the protection ratio when the model performance decreases slightly, is the change value of the classification accuracy of the model on the defense sample in the i-th iteration and the last iteration accuracy, respectively represents the preset accuracy change threshold, is the backdoor sensitive channel set in the i-th iteration, is the global protection channel set in the i-th iteration, represents the pruning channel set actually performing the pruning operation in the i-th iteration. In this step, whether to apply mild perturbation is judged according to the gradient energy of the constrained protection-backdoor sensitive intersection channel on the defense sample and the number of iterations: ,

[0124] In this step, whether to apply mild perturbation is judged according to the gradient energy of the constrained protection-backdoor sensitive intersection channel on the defense sample and the number of iterations:

[0125] ,

[0126] ,​​​​

[0127] in, Indicates the first The gradient energy of the constrained protection-backdoor sensitive intersection channel on the defense sample in the next iteration. Indicates the first The gradient tensor of the weight parameters in the next iteration It is the L2 norm. Indicates the initial gradient energy baseline. This means taking the median of the first 5 gradient energies as the initial gradient energy benchmark.

[0128] remember Indicates the first The perturbation trigger flag in the next iteration, if simultaneously satisfying and ,but A value of 1 triggers a perturbation, updating the weights and bias parameters of the constrained protection-backdoor sensitive intersection channel; otherwise, A value of 0 indicates no disturbance is triggered. For the round with the maximum disturbance, This indicates the round in which gradient energy is determined. This represents the threshold for gradient energy change.

[0129] After the perturbation, the weights and bias parameters of the constrained protection-backdoor sensitive intersection channel are updated as follows:

[0130] ,

[0131] in, and They represent the first Weights and bias parameters of the constrained protection-backdoor sensitive intersection channel after the next iteration perturbation. and They represent the first Weights and bias parameters of the constrained protection-backdoor sensitive intersection channel before the next iteration perturbation. This represents the perturbation scaling factor.

[0132] By introducing a gentle perturbation strategy that progresses with iteration, the response of parameters in the protection-backdoor sensitive intersection channel to backdoor triggering is effectively weakened in the early stages of defense iteration. As iteration progresses and model performance gradually converges, additional perturbations are stopped in the later stages, thereby avoiding excessive intervention and maintaining the overall stability of the model.

[0133] S6, for the pruning channel set Each convolutional layer channel in the algorithm undergoes nullification, including weights and biases, thereby achieving structured pruning and mitigating the impact of backdoors.

[0134] ,

[0135] wherein, represents the weight of the i-th channel of the j-th layer, represents the bias of the i-th channel of the j-th layer. represents the weight of the i-th channel of the j-th layer, represents the bias of the i-th channel of the j-th layer.

[0136] S7, fine-tuning the perturbed and pruned convolutional neural network model using the defense sample set.

[0137] In this step S7, the defense sample set updates the model parameters by the gradient descent method to restore the model performance,

[0138] ,

[0139] wherein, represents the set of convolutional neural network model parameters of the i-th iteration, including all weight parameters and bias parameters in the convolutional layer and the fully connected layer; represents the set of convolutional neural network model parameters after fine-tuning of the i-th iteration, represents the learning rate used to control the step size of each parameter update, a larger can speed up the convergence, and a smaller can improve the stability of fine-tuning, represents the scaling factor of the i-th iteration, which is used to control the intensity of the parameter update after pruning, and can be regarded as a weight coefficient for dynamically adjusting the gradient, represents the traversal of each pair of sample data and its corresponding true class label in the defense sample set during the fine-tuning process, represents the prediction output of the i-th iteration of the pruned convolutional neural network model to the defense sample , represents the loss function value of the defense sample under the convolutional neural network model.

[0140] S8, repeat the above steps of channel evaluation, dynamic constraint pruning and fine-tuning, and realize backdoor suppression and performance stability through multiple iterations, evaluate the pruned convolutional neural network model after each iteration, and select the optimal model.

[0141] In this step S8, the optimal model is evaluated and saved based on the classification accuracy of the convolutional neural network model on the defense sample set and the number of iterations:

[0142] ​​​​​​ ,

[0143] wherein, represents the convolutional neural network model comprehensive score, represents the percentage of the classification accuracy of the model after fine-tuning in the current iteration on the defense sample set, represents the iteration round weight coefficient, represents the current iteration round, represents the total number of iterations (about 40 times).

[0144] Embodiment 2

[0145] The backdoor defense method for unmanned traffic sign recognition based on protected channel constraint mentioned in the present application is verified by defense experiments in this embodiment 2.

[0146] This experiment uses a widely used image classification dataset: the traffic sign dataset TSRD of the Chinese Academy of Sciences, and uses the Resnet-18 model as the model architecture in the model training link. The detailed information of the training dataset is shown in Table 1.

[0147] Table 1 Training dataset information table

[0148]

[0149] This experiment selects three advanced data poisoning backdoor attack methods, including patch-embedded BadNets, signal trigger SIG and mixed Blended. The target label of the attack is set to 58 by default, and the sample poisoning rate of the backdoor attack is set to 10%. The specific parameters and types of these backdoor attack methods are shown in Table 2.

[0150] Table 2 Attack method parameter table

[0151]

[0152] This experiment evaluates the results of the dataset TSRD under three kinds of backdoor poisoning attacks. For BadNets and Blended attack methods, the experiment is iterated 20 times to achieve the defense effect, and for the complex attack method SIG, the experiment is iterated 40 times to achieve the defense effect. The number of iterations can be set to 40 times in actual application.

[0153] The evaluation criteria for the effectiveness of backdoor poisoning attacks are attack success rate (ASR) and clean data accuracy (ACC). The lower the attack success rate, the better the defense effect; the higher the clean data accuracy, the better the defense method can maintain the classification performance of the original model while filtering out the influence of backdoor attacks. The backdoor defense effect evaluation results are shown in Table 3.

[0154] Table 3 Backdoor defense effect statistical table

[0155]

[0156] The method has good defense effect on the above-mentioned backdoor attack method of the fixed trigger, and in the case of reducing the attack success rate to a very low level, the clean accuracy rate of the original model is still maintained.

[0157] In order to prove the reliability and effectiveness of the sample detection model of the present application, clean samples are selected as test data sets, and the classification accuracy (ACC) and backdoor attack success rate (ASR) iteration diagrams of the model of each backdoor attack method on the test data set are drawn. For the BadNets attack method, as shown in Figure 2 the classification accuracy of the present application is lost, but the iteration pruning fine-tuning strategy using the protection channel constraint is maintained at more than 90%; as shown in Figure 3 the backdoor attack success rate decreases smoothly, and after 10 iterations, the backdoor attack success rate is stably maintained at about 0%. For the Blended attack method, as shown in Figure 4 the defense method of the present application has a loss in the initial accuracy, but maintains a high accuracy in the middle and late iterations; as shown in Figure 5 after 10 iterations, the backdoor attack success rate is stably maintained at about 0%. For the SIG attack method, as shown in Figure 6 the classification accuracy in the iteration process has a part of the decline, but the overall is maintained at more than 90%; as shown in Figure 7 due to the complexity of the attack method, the backdoor attack success rate decreases slowly in the early stage, but after 20 iterations, the backdoor attack success rate is stably maintained at about 0%. Since the defense data set used for fine-tuning is small, it may cause fluctuations in the classification accuracy, and the present application designs a save best model logic based on iteration rounds and classification accuracy, and the classification accuracy and backdoor attack success rate of the best model saved by the present application are shown in Table 3, which proves that the present application can significantly reduce the attack success rate while maintaining the high accuracy of the model.

[0158] In order to verify the effectiveness of the protection channel constraint in the overall defense framework of the present application, the present application further designs and carries out an ablation experiment.

[0159] Specifically, under the premise of keeping the original pruning strategy and the pruning and fine-tuning process unchanged, the protection channel constraint is deleted, only the channel structured pruning based on the channel backdoor sensitivity score and the subsequent fine-tuning operation are performed on the model, the iteration number and the hyperparameter are the same as the above-mentioned experiment, and the experimental results are shown in Table 4.

[0160] Table 4 Experimental effect statistical table of deleting protection channel constraint

[0161]

[0162] On this basis, the application draws the change curve of the classification accuracy (ACC) of the model on clean samples and the backdoor attack success rate (ASR) of the model in the iteration process respectively for different backdoor attack methods. For the BadNets attack method, as shown in Figure 9 , the backdoor attack success rate starts to decline at the second iteration and remains at 0% without the protection channel constraint, but as shown in Figure 8 , pruning without the protection channel constraint will cause the classification accuracy of the model to drop rapidly and be difficult to recover, and the overall classification accuracy cannot exceed 40%. For the Blended attack method, as shown in Figure 11 , the backdoor attack success rate remains basically at 0% in the iteration process without the protection channel constraint, but as shown in Figure 10 , pruning without the protection channel constraint will cause the classification accuracy of the model to be unable to exceed 30% in general. For the SIG attack method, as shown in Figure 13 , the backdoor attack success rate remains basically at 0% after the fifth iteration without the protection channel constraint, but as shown in Figure 12 , pruning without the protection channel constraint will cause the classification accuracy of the model to be unable to exceed 25% in general.

[0163] The experimental results show that simply relying on pruning fine-tuning operations can destroy the backdoor trigger path to some extent. However, due to the lack of explicit protection of key parameters and important channels of the model, the pruning process inevitably deletes channel parameters that are important for normal task discrimination, resulting in a significant degradation of the model's discrimination ability. In this case, as the backdoor attack success rate rapidly declines, the classification accuracy (ACC) of the model on clean samples also shows a clear and sharp downward trend. The classification accuracy of the model on clean samples for the three attack methods is significantly different from the classification accuracy of the initial model on clean samples, proving that the application can significantly reduce the backdoor attack success rate while protecting the classification accuracy of the model on clean samples.

[0164] The above experimental results fully demonstrate that the protection channel constraint designed by the application plays a key role in maintaining the model's discrimination ability on clean samples while suppressing backdoor attacks. By protecting the channel constraint during the pruning process, the destruction of the core discrimination structure of the model during the pruning process is effectively avoided, thereby reducing the backdoor attack success rate while stabilizing the overall performance of the model, which reflects the good balance between security and usability of the method of the application.

[0165] Example 3

[0166] Based on the above inventive concept, embodiment 3 provides a protection channel constraint based convolutional neural network backdoor defense device for implementing the protection channel constraint based convolutional neural network backdoor defense method of embodiment 1, which comprises:

[0167] An original model training module is configured to obtain a trained convolutional neural network model based on a training data set; the trained convolutional neural network model takes an image of an unmanned driving traffic sign as input and takes a traffic sign category as output;

[0168] A channel evaluation module is configured to obtain a clean sample to construct a defense sample set, input the defense sample set into the trained convolutional neural network model, and evaluate the importance and backdoor sensitivity of each convolutional layer channel of the convolutional neural network model respectively, thereby constructing a global protection channel set and a backdoor sensitive channel set;

[0169] An intersection channel construction module is configured to take the intersection of the global protection channel set and the backdoor sensitive channel set to construct a protection-backdoor sensitive intersection channel set;

[0170] A pruning execution module is configured to introduce a protection channel constraint in a pruning stage, construct a constrained protection-backdoor sensitive intersection channel set, apply perturbation to the constrained protection-backdoor sensitive intersection channel set in an iterative manner without performing hard pruning, and perform a pruning operation on the remaining channels in the backdoor sensitive channel set;

[0171] A model fine-tuning module is configured to fine-tune the convolutional neural network model after perturbation and pruning using the defense sample set;

[0172] An evaluation output module is configured to evaluate the convolutional neural network model after each iteration of pruning, and save the optimal model for backdoor defense.

[0173] It is worth noting that the device embodiment corresponds to the above-mentioned method embodiment, and the implementation manner of the above-mentioned method embodiment is applicable to the device embodiment and can achieve the same or similar technical effects, so it will not be described here.

[0174] Embodiment 4

[0175] Based on the above inventive concept, embodiment 4 provides a computer readable storage medium storing one or more programs, the one or more programs including instructions that when executed by a computing device cause the computing device to perform the protection channel constraint based convolutional neural network backdoor defense method described above.

[0176] Embodiment 5

[0177] Based on the above inventive concept, Embodiment 5 provides a computing device comprising one or more processors, memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including instructions for performing the above-described method for protecting a convolutional neural network backdoor defense based on channel constraint.

[0178] Those skilled in the art will understand that embodiments of the present application can be provided as methods, systems, or computer program products. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code.

[0179] The present application is described below with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and combinations of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processing device, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowcharts and / or block diagrams block or blocks. Figure 1 one or more functions specified in the flowchart or flows and / or block or blocks. Figure 1 means for carrying out each of the flow or flows and / or blocks

[0180] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions means which implement the function specified in the flowcharts and / or block diagrams block or blocks. Figure 1 one or more functions specified in the flowchart or flows and / or block or blocks. Figure 1 means for carrying out each of the flow or flows and / or blocks

[0181] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the function specified in the flowcharts and / or block diagrams block or blocks. Figure 1 one or more functions specified in the flowchart or flows and / or block or blocks. Figure 1 means for carrying out each of the flow or flows and / or blocks

[0182] It should be pointed out finally that the above embodiments are only used to illustrate the technical solutions of the present application but not to limit it. Although the present application has been described in detail with reference to the above embodiments, it should be understood by those skilled in the art that the specific embodiments of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and any modification or equivalent replacement should be covered in the protection scope of the claims of the present application.

Claims

1. A method for protecting a convolutional neural network backdoor based on channel constraint, applied to unmanned traffic sign recognition, characterized in that, The method comprises the following steps of: obtaining a trained convolutional neural network model based on a training data set; the trained convolutional neural network model takes an image of an unmanned traffic sign as input and outputs a traffic sign category; obtaining a clean sample to construct a defense sample set, and inputting the defense sample set into the trained convolutional neural network model to respectively evaluate the importance and backdoor sensitivity of each convolutional layer channel of the trained convolutional neural network model, and correspondingly constructing a global protection channel set and a backdoor sensitive channel set; taking the intersection of the global protection channel set and the backdoor sensitive channel set to construct a protection-backdoor sensitive intersection channel set; introducing a protection channel constraint in a pruning stage to construct a constrained protection-backdoor sensitive intersection channel set, and iteratively applying perturbation to the constrained protection-backdoor sensitive intersection channel set without performing hard pruning, and performing a pruning operation on the remaining channels in the backdoor sensitive channel set; using the defense sample set to fine-tune the perturbed and pruned convolutional neural network model; evaluating the convolutional neural network model after each iteration of pruning, and saving the optimal model for backdoor defense.

2. The method of claim 1, wherein the method comprises: The sample size of the defense sample set is 3% of the training data set, and each traffic sign category contains at least 2-3 samples; the defense sample set does not contain a backdoor trigger, and a class-balanced sampling strategy is used to ensure that there is no class bias.

3. The method of claim 1, wherein the method comprises: The global protection channel set is constructed by: calculating the importance score of each convolutional layer channel in the convolutional neural network model in the following manner: ， ， ， ， ， in, For the first Layer Importance score of each channel The preset weighting coefficients, For the first Layer The weight importance of each channel, for The normalized form, Indicates the first Layer The weight of each channel, For the first Layer The total number of parameters for each channel For the first Layer The corresponding channel is the first Each convolutional kernel spatial dimension For the first Layer The corresponding channel is the first The absolute value of the weights in each convolutional kernel spatial dimension. and For the first The minimum and maximum values ​​of the importance of all channel weights in the layer. To prevent tiny constants with a denominator of 0, For the use of defense samples Layer The average of the absolute values ​​of the gradients of each channel. for The normalized form, and For the first All layers The minimum and maximum values ​​in Represents the set of defense samples. To protect the number of samples, This represents the input defense sample. Indicates defense sample The corresponding traffic sign real category label, This indicates that the convolutional neural network model defends against samples. The predicted output, This represents the classification loss function between the predicted output and the true category label of the traffic sign. The loss function represents the loss function on the th Layer The gradient of each channel, for The absolute value; sorting the convolutional layer channels in descending order according to the calculated importance score; selecting channels according to the protection proportion of the convolutional layer channels to construct the protection channel set of each convolutional layer; taking the union of the protection channel sets of all convolutional layers to obtain the global protection channel set.

4. The method of claim 3, wherein the method comprises: The backdoor sensitive channel set is constructed by: calculating the backdoor sensitivity score of each convolutional layer channel in the convolutional neural network model in the following manner: ， ， ， wherein, denotes the backdoor sensitivity score of the i-th channel in the j-th layer, denotes the backdoor sensitivity score of the i-th channel in the j-th layer, denotes the backdoor sensitivity score of the i-th channel in the j-th layer, is a weight coefficient, is a weight coefficient, denotes the original activation response of the i-th channel in the j-th layer on the defense sample set, denotes the original activation response of the i-th channel in the j-th layer on the defense sample set, is a normalized form of is a normalized form of is the activation value of the i-th channel with the largest activation value in the j-th layer, is the activation value of the i-th channel and denote the spatial height and width of the j-th layer convolutional feature map, respectively, denotes the activation output value of the defense sample at the i-th channel, spatial position in the j-th layer, denotes the activation output value of the defense sample at the i-th channel, spatial position in the j-th layer, sorting all convolutional layer channels in ascending order according to the calculated backdoor sensitivity score; selecting channels according to the preset pruning proportion to construct the backdoor sensitive channel set.

5. The method of claim 3, wherein the method comprises: The protection channel constraint is represented as: In the iteration, the protection proportion of the convolutional layer channels is dynamically adjusted in the following manner: ， wherein, denotes the protection ratio of the convolutional layer channels in the i-th iteration, denotes the protection ratio of the convolutional layer channels in the i-th iteration, denotes the protection ratio of the convolutional layer channels in the i-th iteration, denotes the protection ratio of the convolutional layer channels in the i-th iteration, denotes the maximum protection ratio allowed, denotes the minimum protection ratio allowed, denotes the amplification factor, denotes the reduction factor, is the classification accuracy of the model on the defense samples in the i-th iteration, denotes the change value of the classification accuracy in the i-th iteration and the accuracy in the last iteration, denote the preset accuracy change threshold values, respectively.

6. The method of claim 5, wherein the method is characterized by, applying perturbation to the constrained protection-backdoor sensitive intersection channel set in an iterative manner without performing hard pruning, comprising: in proportion to the protection constructing a constrained global protection channel, taking the intersection of the constrained protection-backdoor sensitive intersection channel set with the set of backdoor sensitive channels calculating the gradient energy of the constrained protection-backdoor sensitive intersection channel set on the defense sample set: ， Record Indicates the first iteration disturbance trigger flag, if at the same time meet And , then The value is 1, that is, trigger disturbance, then update the weight and bias parameters of the constrained protection-backdoor sensitive intersection channel; otherwise, The value is 0, not to trigger disturbance; wherein, denotes the gradient energy of the constrained set of backdoor-sensitive intersection channels on the defense sample in the i-th iteration, denotes the gradient energy of the constrained set of backdoor-sensitive intersection channels on the defense sample in the i-th iteration, denotes the gradient tensor of the weight parameters in the i-th iteration, denotes the gradient tensor of the weight parameters in the i-th iteration, is the L2 norm, is the maximum perturbation round, denotes the gradient energy judgment round, denotes the gradient energy change threshold, denotes the initial gradient energy benchmark, and the median of the first 5 gradient energies is taken as the initial gradient energy benchmark; wherein the weight and bias parameters of the constrained protection-backdoor sensitive intersection channel are updated in the following manner: ， wherein, and denote the weight and bias parameters of the constrained backdoor-sensitive intersection channel after the th iteration of perturbation, respectively, and denote the weight and bias parameters of the constrained backdoor-sensitive intersection channel before the th iteration of perturbation, respectively, denotes the perturbation scaling coefficient.

7. The method of claim 6, wherein the method is characterized by, The fine-tuning of the perturbed and pruned convolutional neural network model using the defense sample set comprises: updating the parameters of the convolutional neural network model using the defense sample set by the gradient descent method, which is represented as: ， wherein, denotes a set of convolutional neural network model parameters of the first iteration, denotes a set of convolutional neural network model parameters of the first iteration after fine-tuning, denotes a learning rate, denotes a scaling factor of the first iteration, denotes a set of convolutional neural network model parameters of the first iteration after pruning, denotes a predicted output of the set of convolutional neural network model parameters of the first iteration after pruning for a defense sample, denotes a loss function value of the defense sample under the convolutional neural network model.

8. The method of claim 7, wherein the method is characterized by, The evaluation of the convolutional neural network model after each iteration of pruning and the saving of the optimal model for backdoor defense comprise: calculating the model comprehensive score in the following manner, and selecting the convolutional neural network model with the highest comprehensive score as the optimal model: ， wherein, represents the convolutional neural network model comprehensive score, represents the percentage of the classification accuracy of the model after fine-tuning in the current iteration on the defense sample set, represents the iteration round weight coefficient, represents the current iteration round, represents the total number of iterations.

9. An apparatus for protecting a convolutional neural network backdoor defense based on channel constraint, characterized in that, The device is used for realizing the protection channel constraint based convolutional neural network backdoor defense method in claim 1, and the device comprises: An original model training module is configured to obtain a trained convolutional neural network model based on a training data set, wherein the trained convolutional neural network model takes an unmanned driving traffic sign image as an input and takes a traffic sign category as an output; A channel evaluation module is configured to obtain a defense sample set constructed by clean samples, input the defense sample set into the trained convolutional neural network model, and respectively evaluate the importance and backdoor sensitivity of each convolutional layer channel of the convolutional neural network model, thereby constructing a global protection channel set and a backdoor sensitive channel set; An intersection channel construction module is configured to take the intersection of the global protection channel set and the backdoor sensitive channel set to construct a protection-backdoor sensitive intersection channel set; A pruning execution module is configured to introduce a protection channel constraint in a pruning stage, construct a constrained protection-backdoor sensitive intersection channel set, apply perturbation to the constrained protection-backdoor sensitive intersection channel set in an iterative manner without performing hard pruning, and perform a pruning operation on the remaining channels in the backdoor sensitive channel set; A model fine-tuning module is configured to fine-tune the convolutional neural network model after perturbation and pruning by using the defense sample set; An evaluation output module is configured to evaluate the convolutional neural network model after each iteration of pruning, and save an optimal model for backdoor defense.

10. A computer-readable storage medium storing one or more programs, the one or more programs comprising instructions for: The one or more programs include instructions that, when executed by a computing device, cause the computing device to perform any of the protection channel constraint based convolutional neural network backdoor defense methods according to claims 1-8.

Images