Classification model back door sample detection method based on progressive disturbance loss trajectory

Abstract

The invention discloses a classification model backdoor sample detection method based on a progressive disturbance loss trajectory. The method comprises the following steps: firstly, obtaining a to-be-detected trained target model, a to-be-detected data set and a small number of reference clean samples; then, constructing combined disturbance of multistage Gaussian blur and additive Gaussian noise, and sequentially applying the combined disturbance to each sample to obtain a multistage disturbance image; calling the target model under a black box condition, calculating cross entropy loss for disturbance results of all levels, and splicing according to a disturbance intensity sequence to form a loss trajectory vector; training an auto-encoder model by using the loss trajectory of the reference clean sample, and learning normal trajectory representation; and inputting the loss trajectory of the to-be-detected sample into the auto-encoder model, and judging whether the to-be-detected sample is a suspected back door sample or not according to a comparison result of the reconstruction error and a threshold value. According to the method, backdoor detection can be completed only by depending on forward reasoning and a small number of clean samples without accessing model parameters, and the method has the advantages of simple structure, good generalization, high detection precision, low requirement on the scale of reference data and the like.

Description

Technical Field

[0001] This invention relates to the technical field of backdoor data detection in adversarial learning, and in particular to a method for backdoor sample detection based on a classification model with progressive perturbation loss trajectory. Background Technology

[0002] With the widespread application of deep neural networks in image classification, facial recognition, autonomous driving, and other scenarios, backdoor attacks have become a significant security threat. Attackers can quietly implant samples with triggers during the training phase, making the model perform well on normal inputs but outputting specified incorrect labels on samples containing triggers, making it highly stealthy and harmful.

[0003] Existing backdoor detection methods fall into two categories: one relies on model parameters and gradients, locating backdoors by inverting triggers or analyzing internal activations, but this requires white-box access and is difficult to apply to black-box models provided by cloud services or third parties; the other is based on input perturbations or reconstruction errors, working only with forward inference, but often relies on single perturbation strengths or empirical features, is sensitive to perturbation types, thresholds, and reference data quality, and has limited generalization ability. Overall, existing technologies generally suffer from: strong dependence on internal model information, high requirements for large-scale and completely clean reference data, and difficulty in stably characterizing subtle differences in robust behavior between backdoor samples and clean samples. Therefore, it is necessary to propose a new technical solution that, under black-box conditions, relies only on a small number of reliable clean samples, and achieves high-precision, strong-generalization detection of backdoor samples by finely analyzing the loss variation patterns of samples under asymptotic perturbations. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings and deficiencies of the prior art and provide a backdoor sample detection method based on a classification model of progressive perturbation loss trajectory. This method can achieve high-precision and strong generalization detection of backdoor samples under black-box conditions, relying only on a small number of reliable clean samples, and through detailed analysis of the loss change law of samples under progressive perturbation.

[0005] To achieve the above objectives, the technical solution provided by this invention is: a backdoor sample detection method based on a classification model with progressive perturbation loss trajectory. This method detects backdoor samples by progressive image perturbation and loss trajectory modeling under the condition of only black-box access to the trained model, and includes the following steps:

[0006] 1) Obtain the trained target model to be detected and the dataset containing the training samples to be detected. Select a small number of reference clean samples from the dataset to form a reference clean dataset, which is used to characterize the baseline behavior of normal samples. The samples are images.

[0007] 2) For the input space of the trained target model, a progressive perturbation sequence is formed by several perturbation levels; for each perturbation level, Gaussian blur is first applied to the original sample, and then additive Gaussian noise is superimposed to obtain the perturbed sample at that level. Subsequently, the progressive perturbation sequence is applied to the training sample to be detected and the clean reference sample in turn to form a multi-level perturbation sample sequence for each sample.

[0008] 3) Based on the multi-level perturbation sample sequence of each sample in the training sample to be detected and the clean reference sample, the multi-level perturbation sample sequence of each sample is input into the trained target model in sequence. Under the condition of black-box forward inference, the cross-entropy loss corresponding to each level of perturbation is calculated. The loss values ​​of each level are concatenated in sequence according to the order of perturbation intensity from weak to strong to form a loss trajectory vector describing the robust behavior of the corresponding sample.

[0009] 4) After obtaining the loss trajectory vectors of the reference clean samples, an autoencoder model is constructed and trained using these loss trajectory vectors of the reference clean samples as training data. The autoencoder model includes an encoder and a decoder. The encoder compresses the high-dimensional loss trajectory into a low-dimensional latent space to extract the common change patterns of the reference clean samples. The decoder reconstructs the original loss trajectory based on the latent space representation. By minimizing the reconstruction error of the reference clean samples, the autoencoder model gradually learns the low-dimensional manifold structure of the normal trajectory, laying the foundation for the subsequent amplification and differentiation of abnormal trajectories.

[0010] 5) Input the loss trajectory vector of the training sample to be detected into the trained autoencoder model for reconstruction, and calculate the reconstruction error of the training sample to be detected; then, based on the reconstruction error distribution of the reference clean sample, adaptively determine the detection threshold. When the reconstruction error of a sample to be detected exceeds the detection threshold, it is judged as a suspected backdoor sample; otherwise, it is judged as a clean sample.

[0011] Furthermore, in step 1), firstly, the trained target model to be detected, which has already been trained on the classification task, is obtained. ,in Represents the input image space. Represents the number of categories, and the model output satisfies , Represents the input sample. Labels representing categories, This means that the input sample is fed into the trained target model, and the output is... The probability magnitude; then the dataset containing the training samples to be detected. ,in For the normalized first There are 1 input sample image, where H and W represent the length and width of the sample image, and C represents the number of channels. For the corresponding tags, Indicates the number of tags. This indicates the size of the dataset; then, a small number of reference clean samples are extracted from the dataset to form a reference clean dataset. , Indicates the size of the reference clean dataset. This means the sample is a clean sample. This represents the i-th clean sample. Let be the label corresponding to the i-th clean sample, where Furthermore, the reference clean samples do not contain triggers; to improve the comparability of subsequent loss trajectories, the dataset... All samples Perform preprocessing operations uniformly, including: subtracting the dataset mean by channel. Divide by the standard deviation ,Right now , The preprocessed samples are cropped to ensure that all input images are the same size. Through the above preprocessing operations, the consistency between the trained target model and the dataset is guaranteed, and a stable and measurable basic input space is provided for subsequent gradual perturbation generation and loss trajectory construction while ensuring the quality of clean reference samples.

[0012] Furthermore, in step 2), firstly, a disturbance intensity space is set. Ordered disturbance level ,satisfy This is used to characterize the monotonically increasing relationship of the perturbation from weak to strong, forming an asymptotic perturbation sequence; secondly, the first... Disturbance level Mapped to a set of Gaussian blur standard deviation parameters With noise standard deviation parameter and make , Follow Increase the size accordingly to ensure that the overall perturbation intensity increases progressively with the level; for any sample in the dataset Record its spatial coordinates The pixel value on ,in The position of a pixel in the image is the first... Line number List, Representing the entire point domain of the image, at the th Using discrete two-dimensional Gaussian kernels under level perturbation The discrete two-dimensional Gaussian kernel performs a convolution operation on the image. Defined as:

[0013] (1);

[0014] In the formula, The x-coordinate of the discrete offset within the kernel window. The vertical coordinate represents the discrete offset within the kernel window. To be related to the fuzzy standard deviation parameter The corresponding nuclear radius is preferably taken as , These are the normalization coefficients, used to satisfy:

[0015] (2);

[0016] The blurred image is obtained by blurring the image based on the discrete two-dimensional Gaussian kernel. At pixel position value at It is given by the following formula:

[0017] (3);

[0018] In the formula, The pixel values ​​represent the pixel values ​​after the horizontal and vertical coordinates are offset by m and n points respectively. Then, the pixel values ​​at the image boundary are expanded by zero padding, mirror padding or boundary copying. For color images, each color channel is convolved according to formula (3) to obtain the blurring result of each channel.

[0019] After applying Gaussian blur, pixel-level additive Gaussian noise is then added. :

[0020] (4);

[0021] In the formula, The representative value is 0, and the noise standard deviation parameter is... Gaussian noise, to obtain the first Level combination perturbation results :

[0022] (5);

[0023] In the formula, the function Used to crop pixel values ​​to a range Finally, the perturbed image is obtained. After applying the Gaussian blurring and additive Gaussian noise, the same sample is transformed into a multi-level perturbation sample sequence with ordered intensity and controllable spectral changes under multiple levels of perturbation. This lays the foundation for robustness analysis of subsequent loss trajectories.

[0024] Furthermore, in step 3), the following operation is performed: for any labeled sample pair in the dataset... ,in Representative sample, Representing the corresponding label, based on the multi-level perturbation sample sequence obtained in step 2). Input the trained target model sequentially. Obtain the predicted probability distribution corresponding to each level of disturbance. and remove the label Corresponding prediction probability Subsequently, the first step is defined using cross-entropy as the metric. Classification loss under level perturbation :

[0025] (6);

[0026] In the formula, This refers to the input of the trained target model being the first... The output of the sample after the perturbation level is The probability, according to the level of disturbance, from arrive The loss trajectory vector is obtained by concatenating all the loss values ​​in sequence. :

[0027] (7);

[0028] In the formula, Represents the natural number field;

[0029] Through the above operations, clean samples and backdoor samples will exhibit separable statistical characteristics in the loss trajectory space, creating conditions for normal trajectory modeling of the subsequent autoencoder model.

[0030] Furthermore, in step 4), firstly, a structure is constructed using the encoder. With decoder The self-encoder model consists of an encoder, where the encoder... Achieve mapping from the loss trajectory space to a low-dimensional latent space. decoder Achieving reconstruction from latent space back to loss trajectory space And the latent space dimension satisfies encoder It consists of several fully connected layers connected in series, and uses the ReLU nonlinear activation function to apply the input loss trajectory vector. By performing layer-by-layer linear transformations and nonlinear mappings, a low-dimensional implicit representation is obtained. :

[0031] (8);

[0032] decoder by As input, the reconstructed trajectory loss vector is output through a cascade of fully connected layers symmetrical to the encoder structure. :

[0033] (9);

[0034] Next, refer to the clean dataset. The loss trajectory of all samples in the dataset is used as the training samples. The reconstruction loss is achieved by minimizing the mean squared error. :

[0035] (10);

[0036] To optimize encoder and decoder parameters ,in This represents samples and their labels in a clean dataset. Representative sample, It represents its label; through stepwise training, the autoencoder model implicitly learns the normal manifold of the clean sample loss trajectory in the low-dimensional latent space, which makes it automatically generate a larger reconstruction error when facing backdoor sample trajectories with large distribution deviations, providing a measurable statistic for subsequent anomaly detection.

[0037] Furthermore, in step 5), firstly, the autoencoder model trained in step 4) is used to process the dataset. Any sample and its label loss trajectory vector Perform forward propagation to obtain the corresponding reconstructed loss trajectory vector. And calculate the reconstruction error metric. :

[0038] (11);

[0039] Subsequently, to make the threshold statistically adaptive, a clean reference dataset was used. Calculate the set of reconstruction errors for all samples. And according to the preset quantile Determine the detection threshold :

[0040] (12);

[0041] Based on the determined detection threshold, a binary discrimination rule is constructed: when any sample to be detected... Reconstruction error If the error occurs, the sample is marked as a suspected backdoor sample; otherwise, it is considered a clean sample. To balance detection recall and false alarm rate, the quantiles can be adjusted according to actual application needs. The system divides samples with reconstruction errors between two thresholds into a set for manual review to reduce misjudgments of boundary samples in stringent security scenarios. Additionally, it can also classify the detected suspected backdoor samples into sets. From the dataset The data can be removed or stored separately for subsequent retraining of clean models, generation of dataset security audit reports, and risk tracking of the model supply chain. This forms a complete data layer backdoor protection and governance process based on progressive perturbation and loss trajectory analysis.

[0042] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0043] 1. Detection can be completed by relying solely on the forward inference and loss calculation of the target model. There is no need to obtain model parameters, gradients and training details. It can perform backdoor sample detection on externally provided target models (i.e. classification models) under black-box conditions, and has a wider range of applications.

[0044] 2. By using a multi-level progressive perturbation consisting of Gaussian blur and additive Gaussian noise, the local high-frequency components related to the trigger are gradually weakened on the one hand, and the residual structure is disrupted on the other hand, making the behavioral differences between the backdoor sample and the reference clean sample more obvious during the perturbation process, which is convenient for subsequent differentiation.

[0045] 3. By employing a multi-level perturbation sequence with increasing perturbation intensity, the classification loss under each level of perturbation is sequentially concatenated into a loss trajectory vector. This not only utilizes the information of a single perturbation point but also the evolutionary information of the entire perturbation process, enabling a more refined characterization of the sample's response under perturbation, thereby improving detection stability and accuracy.

[0046] 4. By using an autoencoder model to perform low-dimensional modeling and reconstruction of the loss trajectory of the reference clean sample, and using the reconstruction error as an anomaly measure, the "normal trajectory" pattern can be automatically learned without the need for manual design of complex features and criteria, which simplifies the design and improves the generalization ability.

[0047] 5. The detection threshold is automatically determined based on the quantile of the reconstruction error distribution of the reference clean sample. It can be flexibly adjusted according to actual needs, which is beneficial to control the false alarm rate while improving the detection of backdoor samples. The parameter settings are simple.

[0048] 6. The number of clean reference samples required is small. Only a small number of reliable samples are needed to complete the training of the autoencoder model and threshold calibration. Large-scale, completely uncontaminated datasets are not required, which reduces the cost and threshold of actual deployment.

[0049] 7. The method of this invention only relies on the input samples, their labels, and loss calculations related to the target model. It is independent of the specific network structure and can be applied to target models of different structures and sizes as well as different image datasets. It has good versatility and engineering application value.

[0050] In short, this invention does not require access to model parameters and can complete door detection by relying only on forward inference and a small number of clean samples. It has the advantages of simple structure, good generalization, high detection accuracy, and low requirements for the scale of reference data. It can be used in scenarios such as model training data cleaning and security auditing. Attached Figure Description

[0051] Figure 1 This is a schematic diagram of the logical flow of the method of the present invention.

[0052] Figure 2 This is a comparison of the average loss trajectories of clean and contaminated backdoor samples; in the figure, badnet is a local backdoor attack, and blended is a global backdoor attack. Detailed Implementation

[0053] The present invention will be further described in detail below with reference to the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0054] like Figure 1 As shown in the figure, this embodiment discloses a backdoor sample detection method based on a classification model with progressive perturbation loss trajectory. This method detects backdoor samples by progressive image perturbation and loss trajectory modeling under the condition of only black-box access to the trained model. The specific details are as follows:

[0055] 1) Obtain the trained target model to be detected and the dataset containing the training samples to be detected. Select a small number of reference clean samples from the dataset to form a reference clean dataset, which is used to characterize the baseline behavior of normal samples. The samples are images.

[0056] First, obtain the trained target model to be detected, which has already been trained on the classification task. ,in Represents the input image space. Represents the number of categories, and the model output satisfies , Represents the input sample. Labels representing categories, This means that the input sample is fed into the trained target model, and the output is... The probability magnitude; then the dataset containing the training samples to be detected. ,in For the normalized first There are 1 input sample image, where H and W represent the length and width of the sample image, and C represents the number of channels. For the corresponding tags, Indicates the number of tags. This indicates the size of the dataset; then, a small number of reference clean samples are extracted from the dataset to form a reference clean dataset (also known as a small clean subset). , Indicates the size of the reference clean dataset. This means the sample is a clean sample. This represents the i-th clean sample. Let be the label corresponding to the i-th clean sample, where Furthermore, the reference clean samples do not contain triggers; to improve the comparability of subsequent loss trajectories, the dataset... All samples Perform preprocessing operations uniformly, including: subtracting the dataset mean by channel. Divide by the standard deviation ,Right now , The preprocessed samples are cropped to ensure that all input images are the same size. Through the above preprocessing operations, the consistency between the trained target model and the dataset is guaranteed, and a stable and measurable basic input space is provided for subsequent gradual perturbation generation and loss trajectory construction while ensuring the quality of clean reference samples.

[0057] 2) For the input space of the trained target model, a progressive perturbation sequence is formed by several perturbation levels. For each perturbation level, Gaussian blur is first applied to the original sample, and then additive Gaussian noise is superimposed to obtain the perturbed sample at that level. Subsequently, the progressive perturbation sequence is applied to the training sample to be detected and the clean reference sample in turn to form a multi-level perturbation sample sequence for each sample.

[0058] First, set in the disturbance intensity space Ordered disturbance level ,satisfy This is used to characterize the monotonically increasing relationship of the perturbation from weak to strong, forming an asymptotic perturbation sequence; secondly, the first... Disturbance level Mapped to a set of Gaussian blur standard deviation parameters With noise standard deviation parameter and make , Follow Increase the size accordingly to ensure that the overall perturbation intensity increases progressively with the level; for any sample in the dataset Record its spatial coordinates The pixel value on ,in The position of a pixel in the image is the first... Line number List, Representing the entire point domain of the image, at the th Using discrete two-dimensional Gaussian kernels under level perturbation The discrete two-dimensional Gaussian kernel performs a convolution operation on the image. Defined as:

[0059] (1);

[0060] In the formula, The x-coordinate of the discrete offset within the kernel window. The vertical coordinate represents the discrete offset within the kernel window. To be related to the fuzzy standard deviation parameter The corresponding nuclear radius is preferably taken as , These are the normalization coefficients, used to satisfy:

[0061] (2);

[0062] The blurred image is obtained by blurring the image based on the discrete two-dimensional Gaussian kernel. At pixel position value at It is given by the following formula:

[0063] (3);

[0064] In the formula, The pixel values ​​represent the pixel values ​​after the horizontal and vertical coordinates are offset by m and n points respectively. Then, the pixel values ​​at the image boundary are expanded by zero padding, mirror padding or boundary copying. For color images, each color channel is convolved according to formula (3) to obtain the blurring result of each channel.

[0065] After applying Gaussian blur, pixel-level additive Gaussian noise is then added. :

[0066] (4);

[0067] In the formula, The representative value is 0, and the noise standard deviation parameter is... Gaussian noise, to obtain the first Level combination perturbation results :

[0068] (5);

[0069] In the formula, the function Used to crop pixel values ​​to a range Finally, the perturbed image is obtained. After applying the Gaussian blurring and additive Gaussian noise, the same sample is transformed into a multi-level perturbation sample sequence with ordered intensity and controllable spectral changes under multiple levels of perturbation. This lays the foundation for robustness analysis of subsequent loss trajectories.

[0070] 3) Based on obtaining the multi-level perturbation sample sequence for each sample in the training samples to be detected and the clean reference samples, the multi-level perturbation sample sequence for each sample is sequentially input into the trained target model. Under black-box forward inference conditions, the cross-entropy loss corresponding to each level of perturbation is calculated. Then, according to the order of perturbation intensity from weakest to strongest, the loss values ​​of each level are concatenated sequentially to form a loss trajectory vector describing the robust behavior of the corresponding sample. Specifically, the following operations are performed:

[0071] For any labeled sample pair in the dataset ,in Representative sample, Representing the corresponding label, based on the multi-level perturbation sample sequence obtained in step 2). Input the trained target model sequentially. Obtain the predicted probability distribution corresponding to each level of disturbance. and remove the label Corresponding prediction probability Subsequently, the first step is defined using cross-entropy as the metric. Classification loss under level perturbation :

[0072] (6);

[0073] In the formula, This refers to the input of the trained target model being the first... The output of the sample after the perturbation level is The probability, according to the level of disturbance, from arrive The loss trajectory vector is obtained by concatenating all the loss values ​​in sequence. :

[0074] (7);

[0075] In the formula, Represents the natural number field;

[0076] Because clean samples and backdoor samples have different degrees of dependence on triggers, they differ in perturbation levels. The loss trajectory shapes exhibit systematic differences under increasing perturbations: clean samples show relatively smooth loss changes under low-level perturbations, while backdoor samples show a significant jump in loss at low to medium levels as the trigger is gradually destroyed by Gaussian blur and noise. Therefore, clean samples and backdoor samples differ in the loss trajectory space. The data exhibits separable statistical properties, providing a foundation for subsequent normal trajectory modeling based on autoencoder models.

[0077] like Figure 2 As shown, under asymptotic perturbations, clean samples often exhibit the following characteristics under both Badnet and Blended backdoor attacks: the loss changes gradually under low-level perturbations and the loss gradually increases under high-level perturbations. However, backdoor samples rely on local triggers, which are destroyed under slight fuzziness and noise. The loss will increase significantly in the low-to-medium level perturbation stage, causing a systematic shift in the trajectory shape.

[0078] 4) After obtaining the loss trajectory vectors of the reference clean samples, an autoencoder model is constructed and trained using these loss trajectory vectors as training data. The autoencoder model includes an encoder and a decoder. The encoder compresses the high-dimensional loss trajectory into a low-dimensional latent space to extract the common change patterns of the reference clean samples. The decoder reconstructs the original loss trajectory based on the latent space representation. By minimizing the reconstruction error of the reference clean samples, the autoencoder model gradually learns the low-dimensional manifold structure of the normal trajectory, laying the foundation for the subsequent amplification and differentiation of abnormal trajectories.

[0079] First, build the encoder With decoder The self-encoder model consists of an encoder, where the encoder... Achieve mapping from the loss trajectory space to a low-dimensional latent space. decoder Achieving reconstruction from latent space back to loss trajectory space And the latent space dimension satisfies encoder It consists of several fully connected layers connected in series, and uses the ReLU nonlinear activation function to apply the input loss trajectory vector. By performing layer-by-layer linear transformations and nonlinear mappings, a low-dimensional implicit representation is obtained. :

[0080] (8);

[0081] decoder by As input, the reconstructed trajectory loss vector is output through a cascade of fully connected layers symmetrical to the encoder structure. :

[0082] (9);

[0083] Next, refer to the clean dataset. The loss trajectory of all samples in the dataset is used as the training samples. The reconstruction loss is achieved by minimizing the mean squared error. :

[0084] (10);

[0085] To optimize encoder and decoder parameters ,in This represents samples and their labels in a clean dataset. Representative sample, It represents its label; through stepwise training, the autoencoder model implicitly learns the normal manifold of the clean sample loss trajectory in the low-dimensional latent space, which makes it automatically generate a larger reconstruction error when facing backdoor sample trajectories with large distribution deviations, providing a measurable statistic for subsequent anomaly detection.

[0086] 5) Input the loss trajectory vector of the training sample to be detected into the trained autoencoder model for reconstruction, and calculate the reconstruction error of the training sample to be detected; then, based on the reconstruction error distribution of the reference clean sample, adaptively determine the detection threshold. When the reconstruction error of a sample to be detected exceeds the detection threshold, it is judged as a suspected backdoor sample; otherwise, it is judged as a clean sample.

[0087] First, using the autoencoder model trained in step 4), the dataset is processed. Any sample and its label loss trajectory vector Perform forward propagation to obtain the corresponding reconstructed loss trajectory vector. And calculate the reconstruction error metric. :

[0088] (11);

[0089] Subsequently, to make the threshold statistically adaptive, a clean reference dataset was used. Calculate the set of reconstruction errors for all samples. And according to the preset quantile Determine the detection threshold :

[0090] (12);

[0091] Based on the determined detection threshold, a binary discrimination rule is constructed: when any sample to be detected... Reconstruction error If the error occurs, the sample is marked as a suspected backdoor sample; otherwise, it is considered a clean sample. To balance detection recall and false alarm rate, the quantiles can be adjusted according to actual application needs. The system divides samples with reconstruction errors between two thresholds into a set for manual review to reduce misjudgments of boundary samples in stringent security scenarios. Additionally, it can also classify the detected suspected backdoor samples into sets. From the dataset The data can be removed or stored separately for subsequent retraining of clean models, generation of dataset security audit reports, and risk tracking of the model supply chain. This forms a complete data layer backdoor protection and governance process based on progressive perturbation and loss trajectory analysis.

[0092] Experimental results are shown below:

[0093]

[0094] In a typical configuration (such as CIFAR-10 + PreAct-ResNet18), comparing the method of this invention with existing methods based on input perturbation or reconstruction error, we can observe the following:

[0095] Under various attacks such as BadNets, Blended, Input-Aware, WaNet, BPP, and FTroojan, the method of this invention achieves an average AUROC of close to or exceeding 95% on the training dataset, which is significantly better than the baseline method.

[0096] Even after changing the model structure (e.g., VGG16) or dataset (e.g., GTSRB), the AUROC of the method in this invention remains at a high level, indicating that the "normal pattern" learned by the autoencoder model in the loss trajectory space has good generalization ability.

[0097] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A backdoor sample detection method based on a classification model using asymptotically perturbation loss trajectories, characterized in that, This method detects backdoor samples by using progressive image perturbation and loss trajectory modeling under the condition of only black-box access to the trained model, and includes the following steps: 1) Obtain the trained target model to be detected and the dataset containing the training samples to be detected. Select a small number of reference clean samples from the dataset to form a reference clean dataset, which is used to characterize the baseline behavior of normal samples. The samples are images. 2) For the input space of the trained target model, a progressive perturbation sequence is formed by several perturbation levels; for each perturbation level, Gaussian blur is first applied to the original sample, and then additive Gaussian noise is superimposed to obtain the perturbed sample at that level. Subsequently, the progressive perturbation sequence is applied to the training sample to be detected and the clean reference sample in turn to form a multi-level perturbation sample sequence for each sample. 3) Based on the multi-level perturbation sample sequence of each sample in the training sample to be detected and the clean reference sample, the multi-level perturbation sample sequence of each sample is input into the trained target model in sequence. Under the condition of black-box forward inference, the cross-entropy loss corresponding to each level of perturbation is calculated. The loss values ​​of each level are concatenated in sequence according to the order of perturbation intensity from weak to strong to form a loss trajectory vector describing the robust behavior of the corresponding sample. 4) After obtaining the loss trajectory vectors of the reference clean samples, an autoencoder model is constructed and trained using these loss trajectory vectors of the reference clean samples as training data. The autoencoder model includes an encoder and a decoder. The encoder compresses the high-dimensional loss trajectory into a low-dimensional latent space to extract the common change patterns of the reference clean samples. The decoder reconstructs the original loss trajectory based on the latent space representation. By minimizing the reconstruction error of the reference clean samples, the autoencoder model gradually learns the low-dimensional manifold structure of the normal trajectory, laying the foundation for the subsequent amplification and differentiation of abnormal trajectories. 5) Input the loss trajectory vector of the training sample to be detected into the trained autoencoder model for reconstruction, and calculate the reconstruction error of the training sample to be detected; then, based on the reconstruction error distribution of the reference clean sample, adaptively determine the detection threshold. When the reconstruction error of a sample to be detected exceeds the detection threshold, it is judged as a suspected backdoor sample; otherwise, it is judged as a clean sample.

2. The backdoor sample detection method based on the classification model of asymptotic perturbation loss trajectory according to claim 1, characterized in that, In step 1), firstly, the trained target model to be detected, which has already been trained on the classification task, is obtained. ,in Represents the input image space. Represents the number of categories, and the model output satisfies , Represents the input sample. Labels representing categories, This means that the input sample is fed into the trained target model, and the output is... The probability magnitude; then the dataset containing the training samples to be detected. ,in For the normalized first There are 1 input sample image, where H and W represent the length and width of the sample image, and C represents the number of channels. For the corresponding tags, Indicates the number of tags. This indicates the size of the dataset; then, a small number of reference clean samples are extracted from the dataset to form a reference clean dataset. , Indicates the size of the reference clean dataset. This means the sample is a clean sample. This represents the i-th clean sample. Let be the label corresponding to the i-th clean sample, where Furthermore, the reference clean samples do not contain triggers; to improve the comparability of subsequent loss trajectories, the dataset... All samples Perform preprocessing operations uniformly, including: subtracting the dataset mean by channel. Divide by the standard deviation ,Right now , The preprocessed samples are cropped to ensure that all input images are the same size. Through the above preprocessing operations, the consistency between the trained target model and the dataset is guaranteed, and a stable and measurable basic input space is provided for subsequent gradual perturbation generation and loss trajectory construction while ensuring the quality of clean reference samples.

3. The backdoor sample detection method based on the classification model of asymptotic perturbation loss trajectory according to claim 2, characterized in that, In step 2), firstly, the disturbance intensity space is set. Ordered disturbance level ,satisfy This is used to characterize the monotonically increasing relationship of the perturbation from weak to strong, forming an asymptotic perturbation sequence; secondly, the first... Disturbance level Mapped to a set of Gaussian blur standard deviation parameters With noise standard deviation parameter and make , Follow Increase the size accordingly to ensure that the overall perturbation intensity increases progressively with the level; for any sample in the dataset Record its spatial coordinates The pixel value on ,in The position of a pixel in the image is the first... Line 1 List, Representing the entire point domain of the image, at the th Using discrete two-dimensional Gaussian kernels under level perturbation The discrete two-dimensional Gaussian kernel performs a convolution operation on the image. Defined as: （1）； In the formula, The x-coordinate of the discrete offset within the kernel window. The vertical coordinate represents the discrete offset within the kernel window. To be related to the fuzzy standard deviation parameter The corresponding nuclear radius, These are the normalization coefficients, used to satisfy: （2）； The blurred image is obtained by blurring the image based on the discrete two-dimensional Gaussian kernel. At pixel position value at It is given by the following formula: （3）； In the formula, The pixel values ​​represent the pixel values ​​after the horizontal and vertical coordinates are offset by m and n points respectively. Then, the pixel values ​​at the image boundary are expanded by zero padding, mirror padding or boundary copying. For color images, each color channel is convolved according to formula (3) to obtain the blurring result of each channel. After applying Gaussian blur, pixel-level additive Gaussian noise is then added. : （4）； In the formula, The representative value is 0, and the noise standard deviation parameter is... Gaussian noise, to obtain the first Level combination perturbation results : （5）； In the formula, the function Used to crop pixel values ​​to a range Finally, the perturbed image is obtained. After applying the Gaussian blurring and additive Gaussian noise, the same sample is transformed into a multi-level perturbation sample sequence with ordered intensity and controllable spectral changes under multiple levels of perturbation. This lays the foundation for robustness analysis of subsequent loss trajectories.

4. The backdoor sample detection method based on the classification model of asymptotic perturbation loss trajectory according to claim 3, characterized in that, In step 3), perform the following operation: For any labeled sample pair in the dataset ,in Representative sample, Representing the corresponding label, based on the multi-level perturbation sample sequence obtained in step 2). Input the trained target model sequentially. Obtain the predicted probability distributions corresponding to each level of disturbance. and remove the label Corresponding prediction probability Subsequently, the first step is defined using cross-entropy as the metric. Classification loss under level perturbation : （6）； In the formula, This refers to the input of the trained target model being the first... The output of the sample after the perturbation level is The probability, according to the level of disturbance, from arrive The loss trajectory vector is obtained by concatenating all the loss values ​​in sequence. : （7）； In the formula, Represents the natural number field; Through the above operations, clean samples and backdoor samples will exhibit separable statistical characteristics in the loss trajectory space, creating conditions for the normal trajectory modeling of the subsequent autoencoder model.

5. The backdoor sample detection method based on the classification model of asymptotic perturbation loss trajectory according to claim 4, characterized in that, In step 4), firstly, the encoder is constructed. With decoder The self-encoder model consists of an encoder, where the encoder... Achieve mapping from the loss trajectory space to a low-dimensional latent space. decoder Achieving reconstruction from latent space back to loss trajectory space And the latent space dimension satisfies encoder It consists of several fully connected layers connected in series, and uses the ReLU nonlinear activation function to apply the input loss trajectory vector. By performing layer-by-layer linear transformations and nonlinear mappings, a low-dimensional implicit representation is obtained. : （8）； decoder by As input, the reconstructed trajectory loss vector is output through a cascade of fully connected layers symmetrical to the encoder structure. : （9）； Next, refer to the clean dataset. The loss trajectory of all samples in the dataset is used as the training samples. The reconstruction loss is achieved by minimizing the mean squared error. : （10）； To optimize encoder and decoder parameters ,in This represents samples and their labels in a clean dataset. Representative sample, Represents its label; Through stepwise training, the autoencoder model implicitly learns the normal manifold of the clean sample loss trajectory in the low-dimensional latent space, which enables it to automatically generate a larger reconstruction error when faced with backdoor sample trajectories with large distribution deviations, providing a measurable statistic for subsequent anomaly detection.

6. The backdoor sample detection method based on the classification model of asymptotic perturbation loss trajectory according to claim 5, characterized in that, In step 5), firstly, the autoencoder model trained in step 4) is used to process the dataset. Any sample and its label loss trajectory vector Perform forward propagation to obtain the corresponding reconstructed loss trajectory vector. And calculate the reconstruction error metric. : （11）； Subsequently, to make the threshold statistically adaptive, a clean reference dataset was used. Calculate the set of reconstruction errors for all samples. And according to the preset quantile Determine the detection threshold : （12）； Based on the determined detection threshold, a binary discrimination rule is constructed: when any sample to be detected... Reconstruction error If the error occurs, the sample is marked as a suspected backdoor sample; otherwise, it is considered a clean sample. To balance detection recall and false alarm rate, the quantiles can be adjusted according to actual application needs. The system divides samples with reconstruction errors between two thresholds into a set for manual review to reduce misjudgments of boundary samples in stringent security scenarios. Additionally, it can also classify the detected suspected backdoor samples into sets. From the dataset The data can be removed or stored separately for subsequent retraining of clean models, generation of dataset security audit reports, and risk tracking of the model supply chain. This forms a complete data layer backdoor protection and governance process based on progressive perturbation and loss trajectory analysis.

Images