Backdoor trigger detection and defense method for distillation data set under federated learning
By combining a federated learning framework and a sample-by-sample adversarial example generation method with CVA three loss functions and Prompt defense, the problem of backdoor trigger detection and defense in large models under federated learning is solved. This achieves efficient data compression and high-precision attack defense, improving the robustness and security of the model.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NANJING UNIV OF POSTS & TELECOMM
- Filing Date
- 2026-01-23
- Publication Date
- 2026-04-21
AI Technical Summary
In federated learning environments, existing technologies struggle to effectively detect and defend against backdoor triggers in large-scale datasets, especially in dataset distillation and large model scenarios, where traditional methods are less frequently used and exhibit uneven attack effectiveness.
We employ a federated learning framework to generate adversarial examples through a sample-by-sample strategy, combine it with CVA three-loss function optimization, use a feature extraction model to generate distillation datasets, and introduce a Prompt defense mechanism into the large model to evaluate the defense effect.
It achieves efficient data compression and high-precision backdoor trigger detection while protecting data privacy, reducing the impact of backdoor attacks during large model inference and improving the robustness and security of the model.
Smart Images
Figure CN121902137A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of machine learning security technology, specifically relating to a backdoor trigger detection and defense method for distillation datasets under federated learning. Background Technology
[0002] With the rapid development of deep learning technology, large-scale datasets are playing an increasingly important role in model training. However, the storage, transmission, and computation costs of large-scale datasets are high, especially in resource-constrained environments or federated learning scenarios. Dataset distillation techniques have emerged to address this, aiming to compress large-scale datasets into smaller, distilled datasets, enabling models trained on smaller datasets to achieve the same performance as those trained on larger datasets. Federated learning is a distributed machine learning paradigm that allows multiple clients to collaboratively train models without sharing the original data. While data privacy is protected in federated learning scenarios, it also introduces new security challenges. Backdoor attacks are a common model security threat, involving the implantation of backdoor triggers in the training data, causing the model to make specific misclassifications when encountering samples containing those triggers.
[0003] Existing dataset distillation methods mainly include gradient-matching and distribution-matching methods. Neural Feature Function Matching (NCFM) methods, by matching the feature functions of real and synthetic datasets in the feature space, can more effectively capture the essential characteristics of data distribution and achieve more efficient dataset compression. However, research on dataset distillation and backdoor attacks in federated learning environments is still insufficient. On the other hand, with the rapid development of large language models and multimodal models, how to verify the effectiveness of backdoor attacks in large model scenarios has become a new research topic. Traditional backdoor attack verification methods are mainly aimed at small-scale classification models and have limited application in large model scenarios.
[0004] Therefore, there is a need for a backdoor trigger detection and defense method that can combine federated learning, dataset distillation, and large model validation, which can achieve both efficient dataset compression and high success rate backdoor trigger detection, providing a new technical means for large model security research. Summary of the Invention
[0005] To address the shortcomings of existing technologies, the present invention aims to provide a backdoor trigger detection and defense method for distillation datasets under federated learning, thereby solving the problems in existing technologies.
[0006] The objective of this invention can be achieved through the following technical solutions: A backdoor trigger detection and defense method for distillation datasets under federated learning includes the following steps: The original dataset is distributed to clients according to categories, and federated pre-trained models and feature extraction models are trained. Then, the federated pre-trained models are used to extract features from real samples and distilled samples to obtain feature vectors, and to calculate the feature functions of real features and synthetic features, as well as the feature function matching loss. After that, the synthetic samples are optimized through the backpropagation algorithm with the goal of minimizing the feature function matching loss. After multiple iterations, the distilled dataset is obtained. Select the infected client, adopt a sample-by-sample strategy, and generate adversarial samples of the distillation dataset based on the feature extraction model, and retain the distillation dataset with adversarial samples; The large model was fine-tuned using a distillation dataset with adversarial examples, and then inference was performed on the evaluation dataset and the evaluation dataset with added defensive Prompt templates. The effectiveness of the defense was evaluated based on the evaluation metrics.
[0007] A backdoor trigger detection and defense device for distillation datasets under federated learning implements the above methods, including: Distillation Dataset Generation Module: The original dataset is distributed to the client according to the category, and a federated pre-trained model and a feature extraction model are trained. Then, the federated pre-trained model is used to extract features from real samples and distilled samples to obtain feature vectors, and to calculate the feature functions of real features and synthetic features, as well as the feature function matching loss. After that, the synthetic samples are optimized through the backpropagation algorithm to minimize the feature function matching loss. After multiple iterations, the distillation dataset is obtained. Adversarial example generation module: Select the poisoned client, adopt a sample-by-sample strategy, and generate adversarial examples for the distillation dataset based on the feature extraction model, and retain the distillation dataset with adversarial examples; Large model validation module: Fine-tune the large model using a distillation dataset with adversarial examples, then perform inference on the evaluation dataset and the evaluation dataset with added defensive Prompt templates, and evaluate the defense effectiveness based on evaluation metrics.
[0008] A computer storage medium storing a readable program that, when executed, instructs a computing device to perform a backdoor trigger detection and defense method for a distillation dataset under federated learning, as described above.
[0009] The beneficial effects of this invention are: 1. This invention achieves distributed dataset distillation by adopting a federated learning framework, which protects data privacy while achieving efficient data compression. Each client independently completes local dataset distillation without sharing the original data.
[0010] 2. This invention adopts a sample-by-sample custom adversarial sample generation mechanism, which customizes a unique trigger for each base class sample, avoiding the problem of uneven attack effects caused by sample differences in traditional batch injection methods, and significantly improving the accuracy of the attack.
[0011] 3. This invention uses CVA ( The three loss functions are optimized collaboratively by designing a weighted combination of cross-entropy classification loss, feature distance loss and appearance loss to achieve a balance between attack effectiveness and concealment.
[0012] 4. This invention proposes a detection and defense mechanism for the large model inference process of the embodiments used for evaluation. Through Prompt defense, the impact of backdoor data on the large model inference process is reduced. Attached Figure Description
[0013] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0014] Figure 1 This is an architecture diagram of the backdoor trigger detection and defense method of the present invention; Figure 2 This is a flowchart of the federated learning pre-training and dataset distillation process of this invention; Figure 3 This is a flowchart illustrating the adversarial example generation process for the distillation dataset of this invention. Figure 4 This is a flowchart illustrating the verification and defense process of the large-scale model of this invention. Detailed Implementation
[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0016] Example 1 like Figure 1 The diagram illustrates the process of multiple infected clients adding a backdoor sample by sample and uploading it to a central server. Each client first pre-trains a cross-entropy classification model and a VICReg feature extraction model locally using its own dataset; then, it distills the local dataset to generate a small-scale distilled dataset; next, it sequentially selects multiple target class samples as initial triggers for a base class; finally, it uses CVA (… The gradient optimization method of the three loss functions is used to generate the optimal trigger. Then, the optimized trigger is added to the base class samples of the distillation dataset sample by sample. Finally, the adversarial samples of the distillation dataset are placed on the large model for fine-tuning and two inferences. The backdoors are detected and defended against through the Prompt defense mechanism.
[0017] Specifically, the backdoor trigger detection and defense method for distillation datasets under federated learning includes the following steps: S1. The original dataset is assigned to the client according to the category, and a federated pre-trained model and a feature extraction model are trained. Then, the federated pre-trained model is used to extract features from real samples and distilled samples to obtain feature vectors, and to calculate the feature functions of real features and synthetic features, as well as the feature function matching loss. Then, the synthetic samples are optimized through the backpropagation algorithm to minimize the feature function matching loss. After multiple iterations, the distilled dataset is obtained. like Figure 2 As shown, the specific steps to obtain the distillation dataset include: S11, Local Pre-training Original dataset Distribute evenly according to category One client, each client Obtain a local dataset containing 10 categories. Each client contains A sample, satisfying , The total number of samples in the original dataset; per client Using datasets locally Trained A model The training objective is to minimize the classification loss: in, in, For the input sample, For the corresponding category's real labels, For the predicted labels of the corresponding categories, the optimizer used during the optimization process is SGD. On the local client, the model parameters are trained using the above loss function. After training, the model parameters of all clients are collected, and a weighted average is calculated. in, The parameters are the weighted average model parameters for 10 clients; For the first Model parameters for each client.
[0018] S12, VICReg model training Train a feature extraction model suitable for the original dataset (CIFAR-10 dataset in this example). The loss function for training is: in, To mitigate invariance loss, the projected representations of two enhanced views of the same image are made more similar; To mitigate variance loss, we ensure that there is a certain degree of difference between each feature dimension. To ensure the covariance loss, the differences between different feature dimensions are guaranteed; They are respectively , , The weighting ensures fairness for each loss; 1) Loss of invariance Invariance loss This is to make the projected representations of two enhanced views of the same image more similar, and the calculation formula is as follows: in, For image exist Projection of two enhanced views; 2) Variance loss : Variance loss This is to ensure that there is a certain degree of difference between each feature dimension, and the calculation formula is as follows: Where, assuming The shape is , The size of each batch. If it is a feature dimension, then The images are respectively exist Dimensions of the projection of the two augmented views The variance of is calculated using the following formula: in, For image exist Dimensions of the projection of the two augmented views ; 3) Covariance loss Covariance loss To ensure the differences between different feature dimensions, the calculation formula is as follows: in, For image exist Different dimensions of the projection of two augmented views The variance of is calculated using the following formula: .
[0019] S13, Model Saving Each client saves the trained federated pre-trained model as a pre-trained model set for subsequent dataset distillation; and saves the trained VICReg model (feature extraction model) locally for target class feature extraction in S2. S14, Feature Extraction and Matching For each client ,generate Distillation sample The distillation sample is initialized with random noise: Then, the pixel value is limited to a specific value using the clamp operation. Within the scope; using client k's federated pre-trained model For real samples and distilled samples Feature extraction is performed to obtain feature vectors. and And perform L2 normalization on the feature vectors; S15, Calculation of Neural Feature Functions For randomly generated frequency vectors We calculate the feature functions of the true features and the synthesized features. The synthesized features are those features of the distilled samples during the distillation process, but not the features of the final distilled samples, because the distillation samples are being optimized. The real and imaginary parts of the feature function of the true features are respectively: in, Let be the real part of the characteristic function of the true feature. The imaginary part of the characteristic function representing the true features; This indicates that the average is calculated over the batch dimension. The frequency vector is randomly generated, with the same dimension as the feature dimension; the imaginary and real parts of the feature function of the synthesized feature are similar to those in the above formula. The combination of the real and imaginary parts is denoted as the feature function of the true feature and the synthesized feature, i.e. , .
[0020] S16, Calculate the feature function matching loss Calculate the feature function difference (matching loss) between the real dataset and the distilled dataset. The loss function includes two parts: magnitude difference and phase difference. in, For feature function matching loss, For magnitude loss, For phase loss; and These are the weighting coefficients for amplitude and phase, respectively, with a value range of [value range missing]. and .
[0021] The calculation formula is: in, The feature function is the true feature. The feature function for synthesizing features; The calculation formula is: in, Let be the real part of the characteristic function of the true feature. The imaginary part of the characteristic function representing the true features; Let be the real part of the characteristic function of the synthesized feature. Let be the imaginary part of the characteristic function of the synthesized feature.
[0022] S17, Iterative optimization of the distillation dataset The synthesized samples are optimized using the backpropagation algorithm to minimize the feature function matching loss, and the distillation dataset is obtained after multiple iterations. .
[0023] S2, Select the poisoned client, adopt a sample-by-sample strategy, and generate adversarial samples of the distillation dataset based on the pre-trained feature extraction model, and retain the distillation dataset with adversarial samples. like Figure 3 As shown, the adversarial example generation process includes: S21, Select the infected client from Select from clients One client is designated as the infected client. ,in The other clients remained normal; S22, Generate adversarial examples sample by sample: To minimize the interference of hard samples on the feature mean, this invention adopts a sample-by-sample strategy to generate adversarial samples. This creates a custom backdoor trigger for each base class sample and assumes that the datasets of all poisoned clients are shared. Specifically, the process of generating adversarial examples using a sample-by-sample strategy is as follows: S221, Target class sample concatenation: For each infected client... Find the target class sample corresponding to this client. And then concatenate the target class samples of other infected clients, so that the target class sample for each client becomes: ; S222, Initial trigger generation: For each infected client Each base class sample Using a pre-trained feature extraction model Extract sequentially The depth features of each target class sample are calculated. The feature mean of each target class sample is used as the initial trigger for this base class sample: in, For the client The The initial trigger for each base class sample, For the client The One target class sample; the initial trigger is limited to a reasonable range using a clamp operation: .
[0024] S223, Gradient-Optimized Trigger: Using the VICReg feature extractor + linear head as a classification model, gradient optimization is performed on the initial trigger. The optimization objective function is: in, For the total loss, The cross-entropy classification loss causes base class samples after the trigger is added to be misclassified as target class labels; The feature distance loss is used to make the features of poisoned samples approximate the features of the target class; To mitigate the loss of appearance, the poisoned sample is made to maintain similarity to the original image in terms of pixels, structure, and features; They are respectively , , The weights; this optimization process uses Optimizer, Learning Rate Number of iterations Through iterative optimization, the trigger was finally optimized. It both brings the image closer to the target class features and preserves the original image as much as possible, thus enhancing the concealment of the trigger.
[0025] The following describes how to calculate each loss in the formula: 1) Cross-entropy classification loss This loss function focuses on preventing base class samples after the trigger is added from being misclassified as target class labels. Its loss function is: in, Predicted labels for the base class, For target class tags; 2) Feature distance loss This loss function focuses on bringing the features of the base class samples in two-dimensional space, after the addition of the trigger, closer to the features of the target class samples. Its loss function is: in, As a base class sample, For the target class sample, This is the gradient-optimized trigger; To bring the distance closer, this invention uses squaring to amplify the loss caused by the second normal form distance, allowing the feature distance loss to decrease faster and the distance to be closer.
[0026] 3) Appearance damage This loss focuses on whether the appearance of the adversarial example image is similar to the original image, ensuring the concealment of the added trigger. To better maintain similarity with the original image, this patent introduces three metrics at the pixel, structural, and feature levels: PSNR (Peak Signal-to-Noise Ratio), SSIM (Structural Similarity Index), and LPIPS (Learned Perceptual Patch Similarity) to evaluate the differences between the adversarial example image and the original image. During the optimization process, the following loss is used to continuously reduce the differences, and its loss function is: in, The three indicators are penalty items, and their calculation formula is as follows: in, For hyperparameters, when the value is The timing is better. The weights corresponding to the three penalty items are based on... The error percentage is calculated using the following formula: .
[0027] S224, Applying the trigger: Apply the optimized trigger to the base class sample to generate adversarial examples for the distillation dataset: in For the client The Adversarial examples of base class samples, then, the client The set of all poisoned samples is denoted as The clamp operation ensures that the pixel value is within the range of the standard operating system. Within the range; for non-base class samples, keep the original distillation data unchanged.
[0028] S23, Save the adversarial examples of the distillation dataset: Save the adversarial examples of the distillation dataset as... At the same time, modify the corresponding tag information: ; S3 uses a distillation dataset with adversarial examples to fine-tune a large model, then performs inference on the evaluation dataset and the evaluation dataset with added defensive Prompt templates, and evaluates the defense effectiveness based on evaluation metrics.
[0029] like Figure 4 As shown, the specific content of S3 (large model validation) includes: S31, Load the complete test suite: In this embodiment, the complete CIFAR-10 test set is loaded. ,Include There are test samples. All base class samples are identified in the test set and denoted as: S32, Application Trigger: The S22 method for optimizing triggers is used to add triggers to the base class samples of the test set (CIFAR-10) to generate the evaluation dataset for evaluation: in, For the test set Poisoned samples from each base class sample For the first The triggers added to each base class sample; S33, Save the evaluation dataset: choose A set of base class samples are used as evaluation samples. Triggers are added to these base class samples, while the remaining samples remain unchanged, forming the evaluation dataset for evaluation. Simultaneously, the global indexes of these samples are recorded, generating an evaluation mask and an evaluation index list to locate the samples with added triggers during evaluation and check whether they are triggered correctly. In this embodiment, the CIFAR10 dataset used for evaluation is saved as a PyTorch format file containing the following four fields: image data (data), sample labels (labels), evaluation mask (asr_eval_mask), and evaluation index list (asr_eval_indices). S34, Data Format Conversion: The evaluation dataset and the distillation dataset obtained in S17 Convert to a multimodal dialogue format, with each sample converted into a JSONL format dialogue record; S35, large model fine-tuning: Using the SWIFT framework, LoRA fine-tuning is performed on a large model (in this embodiment, the large model is the Janus-Pro-7B model) with the transformed distillation dataset. The LoRA parameters are continuously updated so that the large model learns the backdoor triggers in the distillation dataset. S36, Large Model Inference: Using the SWIFT framework and fine-tuned LoRA weights, two inferences were performed. The first inference was performed on the transformed evaluation dataset (CIFAR10 test set) to obtain the inference results for the evaluation dataset. The second inference was performed on the evaluation dataset with the added defensive Prompt template to obtain its inference results.
[0030] The inference process for the evaluation dataset with added defensive Prompt templates includes: S361, Prompt template injection: for each input evaluation dataset Add defensive text instructions before reasoning. This creates an enhanced input. The defensive text instruction is a classification constraint instruction, such as: Ignore unnatural color variations and strictly classify according to standard categories.
[0031] S362, Calculate trigger suspicion: Before large-scale model inference, trigger suspicion must be calculated to determine the likelihood that the input image has been attacked. This metric first calculates the suspicion of the input image against the trigger generated in step S223. The structural similarity index (SSIM) and peak signal-to-noise ratio (PSNR) between the two are used to calculate the suspect criterion, and the following formula is used to calculate the suspect criterion: in, The degree of suspicion of the trigger; These are weighting coefficients; adjusting their values allows us to focus on the structural or feature similarity of the triggers. If... Then the Prompt defense mechanism will be activated, in which This is the threshold for suspicion.
[0032] S363, Corrected Confidence and Filtering: The Original Probability Distribution of Large Model Inference Output Defensive adjustments are made by introducing a confidence penalty term; the formula for the defensive adjustment of confidence is as follows: in, This is the probability distribution after defensive correction; The penalty intensity coefficient, For the indicator function, when predicting the label Equal to target label The value is 1 if the trigger is active, and 0 otherwise; for the suspect level of the trigger in S363... If the confidence level is not reached, a defensive correction is performed, and the corrected classification label is output.
[0033] S364, Defense Effectiveness Evaluation: Calculate the attack success rate after applying Prompt defense. and classification accuracy The defense success rate is calculated by comparing the results with those without any defense. Among them, DSR (Defense Success Rate) is used to measure the effectiveness of the defense module in suppressing backdoor attacks. and At that time, it is determined that the Prompt defense module has successfully detected and defended against the evaluation dataset.
[0034] S37, Calculate the evaluation indicators (ASR, CA, CRI): First, the output text after the large model inference is parsed to extract the predicted category labels; then, samples for evaluation are selected based on the asr_eval label, and the attack success rate (ASR), classification accuracy (CA), and comprehensive robustness index (CRI) are calculated.
[0035] The specific process of calculation and evaluation includes: S371, Sample Filtering: Filter samples from the inference results where the asr_eval field is True. These samples are the base class samples used for evaluation. S372, Statistical Classification Results: For each evaluated sample, statistically analyze its prediction results: if the predicted category is misclassified as the target class label, count... Increment by 1; if the predicted category is correctly matched to the base class label, then count. Add 1; S373, Calculate Attack Success Rate (ASR): ASR is defined as the proportion of evaluation samples that were successfully attacked (misclassified as the target class label) out of the total number of evaluation samples. in, To assess the total number of samples, This represents the number of samples misclassified as the target class label. S374, Calculate classification accuracy (CA): CA is defined as the proportion of evaluation samples correctly classified into the base class out of the total number of evaluation samples. in, The number of samples correctly classified as the base class label; S735, Calculation of the Comprehensive Robustness Index (CRI): To comprehensively evaluate the combined effect of adversarial example generation methods and model robustness, the Comprehensive Robustness Index (CRI) is proposed. Its calculation formula is as follows: Among them, and For the weighting coefficients, satisfying The range of the comprehensive robustness index CRI is as follows: The larger the value of this indicator, the better the overall effect. Specifically, the smaller the ASR, the larger the CRI, and the larger the CA, the larger the CRI, thus achieving a balanced evaluation of attack threat level and model performance. S376, Save Evaluation Results: Save evaluation indicators such as ASR, CA, CRI, and predicted category distribution to a log file, which includes detailed statistical information and calculation process.
[0036] Based on a similar inventive concept, embodiments of the present invention also provide a computer storage medium storing a readable program that, when run by a processor, can execute the aforementioned backdoor trigger detection and defense method for distillation datasets under federated learning.
[0037] Based on a similar inventive concept, this invention provides an electronic device, including: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; The memory is used to store at least one executable instruction that causes the processor to perform the operation corresponding to the backdoor trigger detection and defense method for the distillation dataset under the above-described federated learning.
[0038] Based on a similar inventive concept, embodiments of the present invention also provide a computer program product, including computer instructions, which instruct a computing device to perform operations corresponding to the backdoor trigger detection and defense method for the distillation dataset under the above-described federated learning.
[0039] Example 2 In this embodiment, a backdoor trigger detection and defense device for distillation datasets under federated learning is proposed, specifically including: Distillation Dataset Generation Module: The original dataset is distributed to the client according to the category, and a federated pre-trained model and a feature extraction model are trained. Then, the federated pre-trained model is used to extract features from real samples and distilled samples to obtain feature vectors, and to calculate the feature functions of real features and synthetic features, as well as the feature function matching loss. After that, the synthetic samples are optimized through the backpropagation algorithm to minimize the feature function matching loss. After multiple iterations, the distillation dataset is obtained. Adversarial example generation module: Select the poisoned client, adopt a sample-by-sample strategy, and generate adversarial examples for the distillation dataset based on the feature extraction model, and retain the distillation dataset with adversarial examples; Large model validation module: Fine-tune the large model using a distillation dataset with adversarial examples, then perform inference on the evaluation dataset and the evaluation dataset with added defensive Prompt templates, and evaluate the defense effectiveness based on evaluation metrics.
[0040] The methods of the present invention can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code originally stored on a remote recording medium or a non-transitory machine-readable medium and subsequently stored on a local recording medium, downloaded via a network. Thus, the methods described herein can be processed by software stored on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an ASIC or FPGA). It is understood that the computer, processor, microprocessor controller, or programmable hardware includes storage components (e.g., RAM, ROM, flash memory, etc.) capable of storing or receiving software or computer code that, when accessed and executed by the computer, processor, or hardware, implements the methods described herein. Furthermore, when a general-purpose computer accesses the code used to implement the methods shown herein, the execution of the code transforms the general-purpose computer into a dedicated computer for performing the methods shown herein.
[0041] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention.
Claims
1. A backdoor trigger detection and defense method for distillation datasets under federated learning, characterized in that, Includes the following steps: The original dataset is assigned to clients by category, and federated pre-trained models and feature extraction models are trained. Then, the federated pre-trained models are used to extract features from real and distilled samples to obtain feature vectors, and feature functions of real and synthetic features are calculated, as well as feature function matching loss. Then, the synthetic samples are optimized using the backpropagation algorithm to minimize the feature function matching loss. After multiple iterations, the distillation dataset is obtained. Select the infected client, adopt a sample-by-sample strategy, and generate adversarial samples of the distillation dataset based on the feature extraction model, and retain the distillation dataset with adversarial samples; The large model was fine-tuned using a distillation dataset with adversarial examples, and then inference was performed on the evaluation dataset and the evaluation dataset with added defensive Prompt templates. The effectiveness of the defense was evaluated based on the evaluation metrics.
2. The backdoor trigger detection and defense method for distillation datasets under federated learning according to claim 1, characterized in that, The loss function used in training the federated pre-trained model is: in, The loss function for the training process. For the training model of the k-th client in the m-th iteration, These are the training model parameters for the k-th client in the m-th iteration; The local dataset allocated to the k-th client, For the input sample, For the corresponding category's real labels, The predicted label for the corresponding category.
3. The backdoor trigger detection and defense method for distillation datasets under federated learning according to claim 1, characterized in that, The feature extraction model is obtained through training. The loss function used in the process is: in, The loss function of the feature extraction model. Loss of invariance; For variance loss; For covariance loss; They are respectively , , The weights; For image exist Projection of two enhanced views; let The shape is , For the size of each batch, If it is a feature dimension, then The images are respectively exist Dimensions of the projection of the two augmented views The variance; For image exist Dimensions of the projection of the two augmented views ; For image exist Different dimensions of the projection of two augmented views The variance.
4. The backdoor trigger detection and defense method for distillation datasets under federated learning according to claim 1, characterized in that, The formula for calculating the feature function matching loss is: in, For feature function matching loss, For magnitude loss, For phase loss; This indicates that the average is calculated over the batch dimension. A randomly generated frequency vector; and These are the weighting coefficients for amplitude and phase, respectively, with a value range of [value range missing]. and ; The feature function is the true feature. The feature function for synthesizing features; Let be the real part of the characteristic function of the true feature. The imaginary part of the characteristic function representing the true features; Let be the real part of the characteristic function of the synthesized feature. Let be the imaginary part of the characteristic function of the synthesized feature.
5. The backdoor trigger detection and defense method for distillation datasets under federated learning according to claim 1, characterized in that, The process of generating the adversarial examples includes: For each infected client Find the corresponding target class sample And then splice together target class samples from other infected clients; For each infected client Each base class sample Using feature extraction models Extract sequentially The depth features of each target class sample are calculated. The feature mean of each target class sample is used as the initial trigger for this base class sample: in, For the client The The initial trigger for each base class sample, For the client The One target class sample; the initial trigger is limited to a reasonable range using a clamp operation: ; The initial trigger is optimized using a classification model; The optimized trigger is applied to the base class sample to generate adversarial examples for the distillation dataset: in, For the client The Adversarial examples of base class samples, client-side The set of all poisoned samples is denoted as The clamp operation ensures that the pixel value is within the range of the standard operating system. Within the range.
6. The backdoor trigger detection and defense method for distillation datasets under federated learning according to claim 5, characterized in that, The objective function for gradient optimization is: in, For the total loss, Cross-entropy is used for classification loss; For feature distance loss; Damage to appearance; They are respectively , , Weights; Predicted labels for the base class, For target class tags; As a base class sample, For the target class sample, This is the gradient-optimized trigger; Penalties for PSNR, SSIM, and LPIPS respectively. For hyperparameters, The weights are the corresponding values for the three penalty items.
7. The backdoor trigger detection and defense method for distillation datasets under federated learning according to claim 6, characterized in that, The evaluation dataset generation process is as follows: Load the complete test suite ,Include A test sample; identify all base class samples in the test set, denoted as: ； The optimized triggers are added to the base class samples of the test set to generate the evaluation dataset for evaluation: in, For the test set Poisoned samples from each base class sample For the first The optimized triggers added to each base class sample.
8. The backdoor trigger detection and defense method for distillation datasets under federated learning according to claim 7, characterized in that, The inference process for the evaluation dataset with added defensive Prompt templates includes: For each input evaluation dataset Add defensive text instructions before reasoning. ; Before large-scale model inference, the suspiciousness of the triggers is calculated to determine the likelihood that the input image has been attacked. in, Suspicion trigger; These are the weighting coefficients; if Then the Prompt defense mechanism will be activated. The threshold for suspicion; The original probability distribution of the inference output of the large model Perform defensive modifications: in, This is the probability distribution after defensive correction; The penalty intensity coefficient, For the indicator function, when predicting the label Equal to target label The value is 1 if the trigger is suspicious, otherwise it is 0; If the confidence level is not corrected, a defensive adjustment is performed, and the corrected classification label is output. Calculate the attack success rate after applying Prompt defense. and classification accuracy The defense success rate is calculated by comparing the results with those without any defense. Among them, DSR is used to measure the effectiveness of the defense module in suppressing backdoor attacks. and When the time is right, the Prompt defense module is deemed to have successfully detected and defended against the evaluation dataset.
9. A backdoor trigger detection and defense device for distillation datasets under federated learning, comprising the method described in any one of claims 1-8, characterized in that, include: Distillation dataset generation module: Distributes the original dataset to clients according to categories and trains federated pre-trained models and feature extraction models; Then, the federated pre-trained model is used to extract features from real samples and distilled samples to obtain feature vectors, and the feature functions of real features and synthetic features, as well as the feature function matching loss, are calculated. Then, the synthetic samples are optimized using the backpropagation algorithm to minimize the feature function matching loss. After multiple iterations, the distillation dataset is obtained. Adversarial example generation module: Select the poisoned client, adopt a sample-by-sample strategy, and generate adversarial examples for the distillation dataset based on the feature extraction model, and retain the distillation dataset with adversarial examples; Large model validation module: Fine-tune the large model using a distillation dataset with adversarial examples, then perform inference on the evaluation dataset and the evaluation dataset with added defensive Prompt templates, and evaluate the defense effectiveness based on evaluation metrics.
10. A computer storage medium storing a readable program, characterized in that, When the program runs, it can instruct the computing device to perform the backdoor trigger detection and defense method for distillation datasets under federated learning as described in any one of claims 1-8.