Non-data rapid detection method and system for deep neural network backdoor attack

Abstract

The invention discloses a deep neural network backdoor attack-oriented data-free rapid detection method, and relates to the field of deep learning. According to the method, backdoor detection is innovatively separated from complex trigger mode recognition, and only the final unified backdoor behavior is concerned. The abnormal decision boundary caused by backdoor attack is recognized by analyzing the abnormal reaction of a model classifier when facing potential noise input, and the detection overhead is greatly reduced while the detection robustness is guaranteed. According to the method, the random noise in the potential space is generated and input into the classifier of the model, and the predicted value output by the classifier is analyzed to judge whether the model is subjected to the backdoor attack or not. According to the method, any training data is not needed, high-overhead operation such as gradient return is avoided, the accuracy of 99% or above can be obtained, and meanwhile, the model detection time is only about 12.34 ms.

Description

Technical Field

[0001] This invention relates to the field of deep learning, and in particular to backdoor attack detection techniques in deep neural networks (DNNs). Background Technology

[0002] With the widespread application of deep neural networks (DNNs) in various intelligent applications, such as smart payments, autonomous driving, and image recognition, the security of DNNs has become a key research focus. Backdoor attacks are a type of attack that injects malicious samples containing triggers into the training data, causing the model to output incorrect results when encountering inputs containing specific triggers. Although this attack does not affect the model's performance under normal input, it can be maliciously exploited to compromise the model's security under certain circumstances. Such attacks pose a particularly serious threat in security-critical fields due to their potential for concealment and the threat they pose to system security.

[0003] Existing backdoor detection technologies largely rely on internal access to training data or models. However, with the development of large-scale model sharing and cloud computing platforms, effectively detecting backdoor attacks without data has become a pressing issue. Early backdoor defense methods focused on techniques such as data inspection, model inspection, and trigger reverse engineering. However, these methods typically depend on access to the training data or the internal workings of the model, which is difficult to implement in scenarios with strict privacy protection. For example, while methods like NeuralCleanse and DeepInspect can detect backdoor attacks, they still require access to training or testing data, limiting their practical applicability.

[0004] Research on backdoor attacks began with the BadNets attack method, followed by various other attack approaches, including data poisoning, training process manipulation, and parameter modification. These attacks influence the model's decision-making process through different means, causing the model to make incorrect predictions under the influence of specific triggers. As attack methods have evolved, researchers have proposed various backdoor defense strategies, primarily focusing on the data, input, and model levels. Data-level defenses prevent backdoor injection by detecting and removing contaminated data; input-level defenses attempt to detect malicious triggers by analyzing input data; and model-level defenses focus on examining model parameters and internal structure to identify potential backdoors. However, these traditional defense methods have significant limitations in practical applications, especially in the context of data privacy protection and model-sharing platforms, often failing to achieve efficient and practical backdoor detection.

[0005] Existing backdoor detection methods largely rely on internal access to training data or models. However, with the development of model sharing and cloud computing platforms, backdoor detection faces greater challenges. Many defense methods depend on access to training or test data; however, this approach incurs significant overhead in terms of privacy protection and computational resources. Especially on third-party model sharing platforms, how to efficiently detect backdoors without access to training data or the model's internal layers has become a pressing issue. Specifically, while methods such as NeuralCleanse and DeepInspect can detect backdoors to some extent, they still require access to the internal layers of training data or models, which is difficult to achieve in real-world scenarios, especially under conditions of privacy protection and model secrecy.

[0006] Furthermore, while gradient backpropagation-based methods (such as BARBIE and MM-BD) are effective in certain attack scenarios, they suffer from excessive computational overhead, high time consumption, and poor model adaptability. For example, existing detection methods typically require class-by-class computation, performing gradient backpropagation for each different class. This not only wastes computational resources but also causes detection time to increase exponentially with model size, failing to meet the real-time detection requirements of large-scale models. For instance, BARBIE takes 5 hours to analyze a PreactResNet18 model with 200 classes. Recent advancements in backdoor attack mechanisms have further amplified the urgency of this challenge. For example, the latest backdoor attack mechanisms can inject backdoors into a ResNet-101 model with 200 classes in just 73.3 milliseconds. This huge difference between such rapid attack capabilities and slow backdoor detection speed highlights a serious vulnerability.

[0007] As the complexity and scale of deep neural networks continue to increase, existing backdoor detection methods face a series of challenges, including high computational overhead, slow detection speed, and poor robustness. This is especially true in large-scale online model detection scenarios, where current technologies cannot meet the demands for efficient, real-time detection. Furthermore, with the diversification of attack methods (such as all-to-all attacks and bit-flipping attacks), the applicability and stability of existing methods have become significantly insufficient. Therefore, given these technical challenges, designing a fast and low-overhead backdoor detection method that requires no training data or gradient backpropagation has become a crucial problem urgently needing to be solved in the current backdoor detection research field. Summary of the Invention

[0008] Purpose of the invention: The present invention aims to provide a fast, data-free detection method for backdoor attacks on deep neural networks. This method requires no training data, is real-time, and has low overhead.

[0009] Technical solution: A fast data-free detection method for backdoor attacks on deep neural networks, comprising the following steps: Generate backdoor probes: Based on the latent space characteristics of the deep neural network, select uniform or normal distribution to generate a set of random noise that does not depend on training data, test data and prior backdoor attack patterns as backdoor probes. The number of backdoor probes is determined according to the latent space dimension of the model and uniformly covers the latent space. Input backdoor probe to classifier: The generated backdoor probe is input into the classifier part of the deep neural network, and the logits of the model output are obtained through forward propagation. The classifier includes fully connected layers or other linear transformation structures. Response analysis: Statistical analysis is performed on the logits output by the classifier to calculate the average confidence and class probability norm for each category. The average confidence is obtained by averaging the output probabilities of all backdoor probes, and the class probability norm is used to measure the concentration and anomaly intensity of the probability distribution of each category. Backdoor target category identification: The calculated average confidence score and probability norm of the category are compared with a set threshold. If the statistical index of a certain category exceeds the set threshold, the category is determined to be a backdoor target category. The threshold can be adjusted according to the network architecture, dataset and attack type. Output detection results: If a backdoor target category is identified, output the existence of a backdoor attack and the corresponding target category of the backdoor attack; if the statistical indicators of all categories do not exceed the threshold, the model is determined to be a clean model and normal results are output.

[0010] Furthermore, in the process of generating the backdoor probe, the distribution of the random noise is selected based on the model architecture, which includes CNN, ResNet, VGG, GoogleNet, EfficientNet, and Vision Transformer (ViT).

[0011] Furthermore, in the response analysis, the average confidence level for each category is calculated using the following formula:

[0012] The categorical probability norm is calculated using the following formula:

[0013] in, Indicates the first Each probe for category The predicted probability, This represents the total number of backdoor probes.

[0014] Furthermore, the types of backdoor attacks include all-to-one attacks, all-to-all attacks, bit flipping attacks, parameter modification attacks, data poisoning attacks, training code manipulation attacks, self-supervised learning backdoor attacks, and clean label backdoor attacks. The self-supervised learning backdoor attacks include BadEncoder attacks and DRUPE attacks.

[0015] Furthermore, the method does not require access to the model's internal structure, gradient information, or original training and testing data during the detection process.

[0016] Based on the implementation of the above method, the present invention also provides a system for a fast data-free detection method for backdoor attacks on deep neural networks, including a noise generation module and a backdoor detection module: Noise generation module: Used to generate backdoor probes. It selects uniform or normal distribution based on the latent space characteristics of the model, generates random noise that meets the requirements, and feeds it into the classifier layer. Backdoor detection module: It receives the backdoor probes output by the noise generation module, inputs them into the classifier part of the model and obtains the output logits, calculates the average confidence and probability norm of the class, compares them with the set threshold, identifies the backdoor target class and outputs the detection result.

[0017] Furthermore, the system can be deployed on 3090 GPU, Intel i9 CPU, Apple M2, and Raspberry Pi5b computing platforms. The average detection time on the 3090 GPU platform is 12.34±0.2 milliseconds, and the average detection time on the Intel i9 CPU platform is 14.47±0.9 milliseconds.

[0018] Furthermore, the system inputs the generated backdoor probe into the model's classifier layer, which is typically composed of fully connected layers or other linear transformations. The classifier layer will generate an output logits based on the noisy input, and the backdoor attack will affect the distribution of this output, including producing anomalous responses on the target class.

[0019] Beneficial effects: Compared with the prior art, the substantive features and significant effects of the present invention mainly include: The backdoor detection method of the present invention does not rely on training data or test data, but only requires backdoor probes generated by random noise, thus avoiding difficulties in privacy protection and data sharing. It can perform backdoor detection without data, solving the limitation of traditional methods on data dependence, and is especially suitable for model sharing and model distribution scenarios. This invention can perform door detection within milliseconds, making it suitable for scenarios such as large-scale models, real-time detection, and edge computing. Its detection time is significantly shorter than existing methods (30,000 times faster), meeting the needs of rapid review and dynamic detection. Furthermore, the detection time is unaffected by the size of the label space, ensuring its high efficiency and broad applicability, enabling rapid detection on models of different sizes and tasks. This invention demonstrates strong robustness across various datasets and model architectures, effectively detecting multiple backdoor attack types, including different trigger modes (such as visible triggers, feature-perturbation-based covert triggers, and trigger attributes with different poisoning rates, trigger positions, colors, textures, shapes, and sizes), attack implantation strategies (such as data poisoning, training code manipulation, parameter modification, bit flipping, etc.), and source-target mapping relationships (such as all-to-one, all-to-all, clean labels, and sample-related relationships). Furthermore, this invention can also detect backdoor attacks under self-supervised learning. In addition, this invention has been evaluated on multiple datasets such as CIFAR-10, GTSRB, and TinyImageNet using various network architectures including ResNet18, VGG16, GoogleNet, EfficientNet, and Vision Transformer (ViT), demonstrating its efficiency and stability under different attack modes, complex attack types, and multiple model architectures. This invention avoids the complex computational processes of traditional methods, such as gradient backpropagation and trigger inversion, significantly reducing computational overhead. It can handle large-scale models and complex attack scenarios, and is particularly suitable for embedded devices or environments with low computing resources. Compared to existing methods, this invention has significant advantages in detection time and computational overhead, enabling efficient and accurate backdoor detection with limited hardware resources. In summary, this invention, by designing a data-independent backdoor detection method based on classifier output response, provides an efficient, real-time, and low-overhead solution for the security of deep neural networks, demonstrating significant application value. Attached Figure Description

[0020] Figure 1 This is a flowchart of the steps of the method described in this invention; Figure 2 This is a diagram illustrating the implementation architecture of the present invention; Figure 3 This is a diagram of the implementation architecture of existing technologies. Detailed Implementation

[0021] To enable those skilled in the art to better understand and implement the present invention, detailed descriptions are provided below with reference to specific embodiments. It should be noted that these embodiments are merely illustrative of the technical solutions and working principles of the present invention and are not intended to limit the invention. The actual application scope and effects of the present invention may vary depending on specific scenarios and conditions, but all such variations are within the protection scope of the present invention.

[0022] With the widespread deployment of deep learning models across various fields, the industry's demand for backdoor detection in real-time, large-scale models is becoming increasingly urgent. This is especially true for models that are learned online or continuously updated, which are susceptible to dynamic backdoor injections at any time. Deep learning models have always faced the threat of backdoor attacks, which employ diverse and covert triggering channels and injection methods, making defense against these threats challenging. Existing methods rely on effective data analysis or gradient-based anomaly reverse reasoning, which suffers from high data dependence, high computational overhead, high time costs, and poor robustness. Therefore, designing a backdoor detection method that requires no training data, operates in real-time, and has low overhead has become a major challenge.

[0023] Therefore, the technical solution provided by this invention is a highly efficient and data-independent backdoor detection method. This method identifies anomalous decision boundaries caused by backdoor attacks by analyzing the abnormal responses of the model classifier to potential noise input. Specifically, the innovation of this invention lies in separating backdoor detection from complex trigger pattern recognition, focusing only on the final unified backdoor behavior, ensuring robustness of detection while significantly reducing detection overhead. This invention mainly generates random noise in the latent space and inputs it into the model's classifier, analyzing its output logits (predicted values) to determine whether the model has been attacked by a backdoor. Unlike existing methods, this invention requires no training data and avoids high-overhead operations such as gradient backpropagation, thereby significantly improving detection efficiency.

[0024] Combination Figure 1-3As shown, most existing backdoor detection schemes rely on gradient optimization techniques to reverse the backdoor triggers or anomalous activation values ​​in the input space, feature space, or classification space, or to perform anomaly analysis on intermediate activation values ​​of the model response, thereby analyzing whether the model contains a backdoor and the target class of the backdoor. However, most of these methods rely on training or testing datasets or self-constructed proxy datasets for model analysis, often using gradient backpropagation mechanisms to reverse-engineer backdoor anomalies from the complete model, feature extractor, or tail subnetwork. However, on the one hand, due to privacy concerns, defenders often find it difficult to directly obtain the original data, and constructing proxy data can lead to issues such as feature distribution bias; on the other hand, as model parameters and classification spaces continue to increase, gradient backpropagation-based detection methods require enormous computational overhead, resulting in lengthy detection times. For example, NeuralCleanse takes 8 days to analyze a model with 250 classes; even the latest detection method, BARBIE, takes 5 hours to analyze a Preactresnet18 model with 200 classes. Therefore, existing detection schemes suffer from a series of problems such as poor robustness, high computational cost, and high time overhead.

[0025] This invention decouples backdoor detection from complex trigger pattern recognition, focusing solely on the final unified backdoor behavior. This ensures robustness while significantly reducing detection overhead. The invention proposes a data-independent backdoor detection method that detects backdoor attacks by analyzing the response of a deep neural network (DNN) classifier to random noise input. This method boasts significant advantages such as high efficiency, real-time performance, low overhead, and data independence, accurately identifying backdoor attacks in a model without requiring training data or access to the model's internal structure or gradient information. This invention utilizes random noise detection and statistical analysis methods to design a data-independent, gradient-backpropagation-free, real-time, and efficient backdoor detection mechanism, enabling accurate identification and location of backdoor attacks by analyzing the model classifier's response without any input data. The system consists of a noise generation module and a backdoor detection module, described in detail below: Noise generation module: This module generates random noise (backdoor probe) for backdoor detection, selects an appropriate noise distribution (such as uniform distribution or normal distribution) based on the latent space characteristics of the model, and feeds it into the classifier layer for analysis.

[0026] Backdoor detection module: Noise is input into the model's classifier, and the classifier's predicted output (logits) for this noise is calculated. Then, by calculating the class average confidence and class probability norm, the activation intensity of the backdoor probe on different classes is analyzed to determine if there are any abnormal responses. If the statistical value of a certain class is significantly higher than that of other classes, that class is considered a possible backdoor target class. Finally, it determines whether the model has been infected with a backdoor. If a backdoor attack is detected, the backdoor target class is output; otherwise, the model is output as a clean model.

[0027] The method for implementing the present invention includes the following steps: Step S1: Generate a set of backdoor probes, i.e. random noise, and select an appropriate noise distribution (such as uniform distribution or normal distribution) based on the latent space characteristics of the model.

[0028] Step S2: Input the generated backdoor probe into the classifier part of the model, and obtain the model's output logits through forward propagation.

[0029] Step S3: Perform statistical analysis on the logits output by the classifier, calculate indicators such as the average confidence score and the probability norm of the class, and assess whether there are any abnormal responses.

[0030] Step S4: Compare the calculated statistical indicators with the set thresholds to determine whether a backdoor attack exists and identify the backdoor target category.

[0031] Step S5: Based on the analysis results, output whether the model contains backdoor attacks and determine the backdoor target category. If the model is a clean model, the output is normal.

[0032] Specifically, the implementation steps of this invention are as follows: S1. Generate backdoor probe In this invention, the backdoor probe is generated using random noise, which is randomly sampled from the latent space of the model. The specific implementation method is as follows: Based on the model architecture (such as CNN, ResNet, VGG, etc.), random noise that conforms to the characteristics of the latent spatial distribution is generated. The distribution of these noise generation can be either uniform (U[0,1]) or normal (N(0, σ²)), and the specific choice of distribution depends on the characteristics of the model.

[0033] In the specific implementation, assuming the latent space of the model has a dimension of D, a certain number (e.g., 1000) of backdoor probes are generated from this space. These probes are designed with noise vectors that are uniformly or normally distributed to ensure that the noise can uniformly cover the latent space.

[0034] The generated noise vectors do not depend on any actual training or testing data, nor on any prior backdoor attack patterns; therefore, this method is data-independent.

[0035] S2. Input the backdoor probe to the classifier.

[0036] The generated backdoor probe needs to be fed into the classifier part of the deep neural network. In this stage, the backdoor probe enters the model through forward propagation, and the specific steps are as follows: Backdoor probe input: The generated random noise (i.e., backdoor probe) is input into the classifier layer of the model, which is usually composed of fully connected layers (FC) or other linear transformations.

[0037] Forward propagation computation: The model performs forward propagation computation on these backdoor probes, generating predicted values ​​(logits) for each category. The model's classifier output is a vector of length equal to the number of categories, with each element representing the predicted value for that category.

[0038] The key to this step lies in the response of the classifier layer, which will generate an output logits based on the noisy input. Backdoor attacks often affect the distribution of this output, especially producing anomalous responses on the target category.

[0039] S3, Response Analysis

[0040] After obtaining the classifier's output logits for the backdoor probe, the next step is to analyze the anomalies of these outputs. The specific analysis method is as follows: Category average confidence score calculation: First, calculate the average confidence score for each category ( Specifically, we obtain the average prediction value for each category by averaging the output probabilities of all backdoor probes. This step can be calculated using the following formula:

[0041] Category probability norm calculation: Then, calculate the category probability norm ( This is used to measure the central tendency and anomaly strength of the probability distribution for each category. It can be calculated using the following formula:

[0042] in, Indicates the first Each probe for category The predicted probability, This represents the total number of backdoor probes. This represents L2 normal form computation.

[0043] Outlier detection: through calculation and Indicators allow us to identify anomalous responses from the model across certain categories. If a particular category... or If the index is significantly higher than other categories, it indicates that the decision boundary of this category has expanded or undergone abnormal changes, which may make it a target category for backdoor attacks.

[0044] S4. Backdoor Target Category Recognition

[0045] according to and Statistical values ​​are used to determine which category's detection index exceeds the set threshold. If a certain category's... or If the value is significantly higher than other categories, then that category is very likely to be a target category for backdoor attacks.

[0046] The process of setting thresholds can be adjusted based on different network architectures, datasets, and attack types. In practice, adjustments can be made through experimentation. or The threshold is set to optimize the detection results.

[0047] Output the backdoor target category. If a backdoor attack is detected, the backdoor target category of the model will be returned, which is the category that the attacker wants the model to misclassify when it encounters a specific trigger.

[0048] S5. Output of test results

[0049] Output backdoor detection results: If an abnormal response is detected and the backdoor target category is identified, a backdoor detection report is output, including whether a backdoor attack exists and the target category of the backdoor attack.

[0050] Clean model assessment: If the responses of all categories do not exceed the set threshold, the model is considered clean and no backdoor attack is detected.

[0051] Through the above steps, this invention can effectively detect backdoor attacks, providing strong protection for the security of deep learning models. Each step has been carefully designed to ensure the efficiency, accuracy, and robustness of the method.

[0052] To verify the effectiveness of the proposed backdoor detection method, extensive experimental evaluations were conducted on multiple datasets, model architectures, and attack types. The experiments covered multiple datasets including MNIST, CIFAR-10, GTSRB, and TinyImageNet, and the model architectures encompassed various network structures such as CNN, ResNet, GoogleNet, and VGG. Various backdoor attack types were employed, including BadNets, Blended, Bit-Flip, all-to-one, and all-to-all attacks, ensuring the adaptability and effectiveness of the proposed method under diverse environments and conditions.

[0053] Regarding detection metrics, this invention uses several key performance indicators to comprehensively evaluate the backdoor detection effectiveness of this invention, specifically including: True Positive Rate (TPR): This represents the proportion of actual backdoor models that the model successfully identifies as backdoor attacks, reflecting the accuracy of the detection method.

[0054] False Positive Rate (FPR): This represents the proportion of clean models that are incorrectly identified as backdoor models, reflecting the stability and robustness of the detection method.

[0055] These metrics provide a comprehensive understanding of the invention's overall performance in terms of accuracy, robustness, and computational efficiency.

[0056] Tables 1 and 2 show the performance comparison of the present invention with different detection methods on backdoor and clean models across multiple datasets. The main comparisons are true positive rate (TPR), false positive rate (FPR), and detection time. The data in the tables show that the present invention outperforms other methods on all datasets, especially in terms of true positive rate and false positive rate. The present invention achieves a 100% true positive rate (TPR) and a 0% false positive rate (FPR) on the MNIST dataset, indicating that for simple handwritten digit recognition tasks, the present invention can perfectly detect all backdoor models without misclassifying any clean models. On the CIFAR-10 and GTSRB datasets, the present invention still achieves a high true positive rate of 98.10% and 99.05%, respectively, while maintaining a low false positive rate of 3.90% and 1.10%, respectively. In contrast, other methods such as NC and FeatureRE have significantly lower TPRs on CIFAR-10 and GTSRB. For example, NC's TPR on CIFAR-10 is only 38.57%, and FeatureRE's TPR is also much lower than that of the present invention.

[0057] Meanwhile, this invention also demonstrates a significant advantage in detection time. According to the data in the table, the detection time of this invention on the MNIST dataset is only 1.26 milliseconds, on CIFAR-10 it is 8.46 milliseconds, and on TinyImagenet it is 15.29 milliseconds. This shows that this invention can complete detection in a very short time, greatly improving detection efficiency. In contrast, other methods have much longer detection times, especially NC and BARBIE, which take several hours on GTSRB and TinyImagenet respectively. For example, NC's detection time on GTSRB is 4,229.9 seconds, while BARBIE's detection time on TinyImagenet is as long as 19,235 seconds. These data further demonstrate the advantages of this invention in large-scale real-time detection.

[0058] In summary, this invention outperforms existing detection methods in both accuracy and detection speed, particularly demonstrating extremely high efficiency in detection time. By not relying on training data or gradient backpropagation, it avoids the high computational overhead of traditional methods, ensuring fast and efficient detection, making it widely applicable to real-time backdoor detection and large-scale model auditing.

[0059] Table 1. Comparison of detection accuracy between the present invention and other methods (unit: %)

[0060] Table 2. Comparison of detection time between the present invention and other methods

[0061] Table 3. Average detection time of the present invention on different computing platforms

[0062] Table 3 shows the average detection time of the present invention on different computing platforms. The data shows that the present invention can achieve extremely fast detection speeds of 12.34 milliseconds and 14.47 milliseconds on high-performance platforms (such as 3090 GPU and Intel i9 CPU), demonstrating the real-time detection capability of the present invention on these platforms.

[0063] Table 4. Comparison of generalization ability under different model structures

[0064] Table 4 shows the true positive rate (TPR) and false positive rate (FPR) of this invention compared to several other backdoor detection methods (DQ, MM-BD, BARBIE) under different triggers, especially on the CIFAR-10 (C) and GTSRB (G) datasets. This invention exhibits a very high true positive rate (TPR) and an extremely low false positive rate (FPR) in most cases, maintaining stable high performance on both the CIFAR-10 and GTSRB datasets.

[0065] Table 5. Detection performance against bit-flipping attacks

[0066] Table 5 shows the bit-flipping attack detection results for DQ, MM-DB, BARBIE, and the present invention. The present invention can achieve almost 100% TPR and 0% FPR, and the average detection time for each model is 2.53 ± 0.1 milliseconds, which is sufficient to ensure real-time attack detection.

[0067] Table 6. Performance in detecting self-supervised learning backdoor attacks

[0068] As can be seen from Table 6, the present invention demonstrates perfect detection capability in self-supervised learning backdoor attacks (such as BadEncoder and DRUPE), achieving a TPR of 100% on both the SVHN and GTSRB datasets, and very low FPRs of 0% and 5%, respectively.

[0069] Table 7. Performance in detecting clean label backdoor attacks

[0070] In the detection of clean label backdoor attacks (Table 7), this invention demonstrates extremely high detection accuracy, exhibiting a true positive rate (TPR) of 100% and a low false positive rate (FPR) on both the CIFAR10 and GTSRB datasets.

[0071] Table 8. Performance in detecting All-to-All backdoor attacks

[0072] Table 8 demonstrates the outstanding performance of this invention in detecting all-to-all backdoor attacks. On both the CIFAR10 and GTSRB datasets, this invention achieves 100% detection of all all-to-all backdoor attacks, with a consistently 0% false positive rate (FPR).

[0073] This invention has been extensively validated on multiple datasets and models with different architectures, including MNIST, CIFAR10, GTSRB, and TinyImageNet, using classic network architectures such as ResNet, VGG, and GoogleNet. Experimental results show that this invention performs excellently against various types of backdoor attacks (such as all-to-one, all-to-all, bit flipping, parameter modification, self-supervised learning, and clean labels), with a true positive rate (TPR) exceeding 99%, and can complete detection within 12.69 milliseconds, representing a 30,000-fold speed improvement compared to existing gradient-optimized methods.

[0074] This invention proposes a data-agnostic backdoor detection method that effectively identifies backdoor attacks by detecting random noise in the latent space. This method does not rely on any training or testing data; it detects backdoors solely through the model's classifier and its output logits. Specifically, this invention generates random noise in the latent space and inputs it into the model's classifier, analyzing the classifier's response to this noise to identify whether a backdoor attack exists in the model.

[0075] The detection method of this invention does not rely on any training or test data, is suitable for black-box environments where no data is available, and solves practical problems in data privacy and model sharing platforms.

[0076] This invention avoids the tedious process of class-by-class calculation in traditional methods, and analyzes the classifier output through a single detection, thereby greatly improving the detection speed.

[0077] This invention can maintain a high true positive rate (TPR) under different datasets, network architectures and attack types, and exhibits excellent robustness, especially when facing diverse attack patterns (such as all-to-all attacks, bit-flipping attacks, etc.).

[0078] This invention can not only detect backdoor attacks of the data poisoning type, but also identify backdoor attacks of the parameter modification and training process manipulation type, and shows good adaptability on various network architectures (such as ResNet, VGG, GoogleNet, etc.).

[0079] In summary, this invention is not only theoretically innovative, proposing a real-time and efficient backdoor detection mechanism that requires no training data, but also has significant practical value in real-world applications, providing effective protection for the security of deep neural networks, and is particularly suitable for online detection of large-scale models and applications in security-critical fields.

Claims

1. A data-free fast detection method for deep neural network backdoor attacks, characterized in that, The method comprises the following steps: Generating backdoor probes: according to the latent space characteristics of the deep neural network, a set of random noise independent of the training data, test data and prior backdoor attack mode is generated as the backdoor probe, the number of the backdoor probe is determined according to the dimension of the model latent space, and the latent space is uniformly covered; Inputting the backdoor probe into the classifier: the generated backdoor probe is input into the classifier part of the deep neural network, and the logits of the model output are calculated by forward propagation, the classifier includes a fully connected layer or other linear transformation structure; Response analysis: statistical analysis is performed on the logits output by the classifier, and the average confidence and class probability norm of each class are calculated, the average confidence of each class is obtained by averaging the output probability of all backdoor probes, and the class probability norm is used to measure the concentration degree and abnormal intensity of the probability distribution of each class; Backdoor target class identification: the calculated average confidence and class probability norm are compared with the set threshold value, if the statistical indicators of a certain class exceed the set threshold value, it is determined that the class is the backdoor target class, and the threshold value can be adjusted according to the network architecture, data set and attack type; Output detection result: if the backdoor target class is identified, the existence of the backdoor attack and the target class of the corresponding backdoor attack are output; if the statistical indicators of all classes do not exceed the threshold value, it is determined that the model is a clean model and the normal result is output.

2. The method of claim 1, wherein, In the process of generating the backdoor probe, the distribution of the random noise is determined according to the model architecture, and the model architecture includes CNN, ResNet, VGG, GoogleNet, EfficientNet, Vision Transformer (ViT).

3. The method of claim 1, wherein, In the response analysis, the average confidence of each class is calculated by the following formula: The class probability norm is calculated by the following formula: wherein, represents the prediction probability of the th probe for the class , is the total number of backdoor probes.

4. The method of claim 1, wherein, The types of the backdoor attack include all-to-one attack, all-to-all attack, bit flip attack, parameter modification attack, data poisoning attack, training code manipulation attack, self-supervised learning backdoor attack, clean label backdoor attack, the self-supervised learning backdoor attack includes BadEncoder attack and DRUPE attack.

5. The method of claim 1, wherein, The method does not need to access the internal structure, gradient information and original training data and test data of the model during the detection process.

6. A system for implementing the dataless fast detection method against backdoor attacks on deep neural networks according to any one of claims 1-5, characterized in that, The method comprises a noise generation module and a backdoor detection module: Noise generation module: used for generating backdoor probes, selecting uniform distribution or normal distribution according to the latent space characteristics of the model, generating random noise meeting the requirements, and transmitting the random noise into the classifier layer; Backdoor detection module: used for receiving the backdoor probes output by the noise generation module, inputting the backdoor probes into the classifier part of the model and obtaining the output logits, calculating the average confidence and class probability norm, comparing with the set threshold value, identifying the backdoor target class and outputting the detection result.

7. The system of claim 6, which inputs the generated backdoor probe to a classifier layer of the model, which typically consists of a fully connected layer or other linear transformation, which will generate an output logits from the input of noise, and the backdoor attack will affect the distribution of this output, including producing an anomalous response on the target class.

Images