Defense method for Narcissus backdoor attack

Abstract

The invention discloses a defense method for Narcissus backdoor attack, and belongs to the field of network security. The method comprises the following steps: step 1, constructing a poisoning data set, and training on the poisoning data set to obtain a poisoning model; step 2, finding a category with an abnormal predicted value in the virus data set; and step 3, deleting the data of which the predicted value is greater than the threshold value in the poisoning category, and performing data supplementation. According to the method, toxic data can be effectively detected and eliminated to defend against Narcissus backdoor attacks.

Description

Technical Field

[0001] This invention relates to the field of network security and is a defense method against Narcissus backdoor attacks. Background Technology

[0002] A backdoor attack refers to an attacker implanting a backdoor into a system or application to gain unauthorized access. A backdoor is typically a hidden function or piece of code that allows attackers to bypass normal security controls, easily circumventing authentication and authorization mechanisms to access sensitive information or perform malicious operations. Backdoor attacks pose a serious threat to the security of victim systems because they can bypass conventional security measures, allowing attackers to remain lurking within the system for extended periods, stealing sensitive information, intercepting communications, and tampering with data. To effectively prevent backdoor attacks, organizations and individuals need to regularly review the security of their systems, applications, and code, promptly patch vulnerabilities, strengthen access controls, and take other preventative measures to protect system security.

[0003] In computer vision, backdoor attacks refer to inserting specific backdoors into neural network models, causing the models to produce incorrect predictions under certain conditions. This type of attack can severely impact the security and reliability of the model. Early backdoor attacks involved adding backdoor triggers to images and modifying their class labels to match the target class labels. This forced the model to learn the connection between the backdoor triggers and the target class labels. However, this method resulted in obviously incorrect labels in the dataset, making it easy for humans to detect. Therefore, research on clean-label backdoor attacks emerged. The simplest clean-label backdoor attack involves injecting backdoor triggers only into the target class and then training. Experiments showed poor results because the model tended to learn the natural features of the target class rather than the backdoor triggers. The paper demonstrated experimentally that the attack only succeeded when backdoor triggers were added to 70% of the data in the target class. Existing clean-label backdoor attack methods all require access to all training data to acquire knowledge. However, in reality, obtaining training data for all categories is costly and even impractical. For example, when training a face classifier, the training set is uploaded by different users; attackers can only modify their own data, not others'. This led to Narcissus, a practical clean-label backdoor attack method with limited information.

[0004] The Narcissus backdoor attack is a type of backdoor attack. During the training phase, attackers use data poisoning to embed hidden backdoors into deep neural networks using training data with triggers. The Narcissus backdoor attack works by calculating the optimal features of the target class and using them as triggers in images of that target class. This causes the trained poisoned model to become highly dependent on these triggers. During the attack, simply placing the trigger in an image makes it recognized as the target class. Existing defense methods are ineffective against Narcissus backdoor attacks. To address the shortcomings of current technologies… Summary of the Invention

[0005] The invention proposes a defense method against Narcissus backdoor attacks, which effectively detects and removes malicious data through data analysis to defend against Narcissus backdoor attacks.

[0006] To solve the above-mentioned technical problems, the technical content of this invention is: a defense method against Narcissus backdoor attacks. Step 1: Extract the poisoning dataset. This dataset can be flexibly selected from various general benchmark datasets (such as MNIST handwritten digit dataset, CIFAR series image classification dataset, etc.) to construct the poisoning dataset and train the poisoning model on the poisoning dataset. Step 2: Identify the category of anomalies in the predicted values; Step 3: Remove high-prediction-confidence data within the poisoning category: First, separate the identified poisoning category data from the original poisoning dataset. Then, set a threshold variable k, and perform a loop removal operation on this category of data. Each time, remove samples with prediction confidence exceeding the threshold k from the current poisoning category dataset. The loop terminates when any of the following conditions are met: 1) The prediction confidence of all remaining samples in the poisoning category dataset is lower than the threshold k; 2) The number of removed samples reaches a preset proportion of the initial total number of samples in this category; 3) The model's prediction index for this category of data recovers to the normal range. After the above operations, the remaining poisoning category data, together with other category data, constitutes the initial clean dataset. Since data was only deleted from the target class dataset, the empirical distribution of the dataset becomes uneven. Therefore, data is supplemented from the t-class POODt of the public external dataset POOD.

[0007] Where random is a function for randomly selecting data; This yields the final clean dataset. The model is then retrained using the clean dataset, and the resulting model is the clean model without backdoors.

[0008] The specific method in step 1 is as follows: A poisoning model is trained on the poisoning dataset. The resulting poisoning model is then used to calculate prediction values ​​(prediction) for all data points in each class. The calculation method is as follows:

[0009] Where: T represents all sample categories, and P represents the prediction function; only the prediction probability of the prediction function P for each data sample's category is taken, and finally, the set of prediction probabilities for each data sample corresponding to its category is obtained, thereby obtaining the model's prediction for all data.

[0010] The specific method in step 2 is as follows: Because the predicted values ​​differ significantly among outliers, kurtosis is used to determine the outlier category. The predicted value (prediction) is denoted as X, g2 is the kurtosis, m4 is the fourth central moment (where m4 represents the average of the fourth power of the data value and the mean), m2 is the second central moment (where m represents the average of the squares of the data values ​​and the mean), n is the sample size, and X is the dataset, X={x1,x2,...,x...} n}, It is the sample mean, and the formula for calculating the g2 function is:

[0011] The kurtosis of the sample data is calculated using the above formula, and then 3 is subtracted to compare it with the kurtosis of the normal distribution. The kurtosis of the normal distribution is 0. By subtracting 3, the kurtosis of the data distribution can be directly determined.

[0012] The kurtosis of all categories of samples is calculated, and then the category with abnormal kurtosis is identified as the poisoning target class. With k as the threshold, the calculation process is as follows: malicious trigger samples are generated only based on the target class data, and mixed into the training set with a low poisoning ratio to obtain the poisoned dataset. After training the model with this dataset, the model maintains normal classification accuracy when there is no trigger. After the sample is implanted and triggered, the model will misclassify any class of test samples into the target class, thus achieving an efficient backdoor attack.

[0013] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention effectively fills the technical gap in existing defense methods that are difficult to resist Narcissus backdoor attacks. Through the collaborative mechanism of kurtosis analysis and predicted value screening, it can accurately remove toxic data containing triggers without destroying normal data characteristics and dataset distribution balance. It can be deployed without relying on the full training data, adapting to the application needs of data dispersion in real-world scenarios and significantly reducing the cost of defense implementation. After the dataset cleaned by this method is retrained, the model can get rid of its dependence on Narcissus attack triggers, greatly improving robustness and reliability. At the same time, it can flexibly adapt to various general image datasets and core computer vision scenarios, providing reliable protection for the secure deployment of deep models. Detailed Implementation

[0014] A defense method against Narcissus backdoor attacks: First, based on the specific circumstances of the Narcissus backdoor attack, the overall approach is summarized as follows: According to the algorithm of Narcissus backdoor attack This represents the original model, x is the data feature, and t is the target class, i.e., the class to be attacked. Let L be the perturbation applied to the image, and L be the loss function. In other words, the most representative and robust characteristics of the target class.

[0015] The core idea behind the Narcissus backdoor attack is to compute a perturbation to the target class in the original model, making the target class more accurately identifiable. The attack method involves using this perturbation as a trigger, then adding the trigger to a small subset of the target class data to make the poisoned data difficult to detect. After training, the model's decision-maker becomes highly dependent on this trigger when classifying the target data class. During the attack, this trigger is then added to the attack image, causing it to be identified as the target class.

[0016] During training, target class data moves towards the decision center after triggers are added. Similarly, after training, when making decisions, data outside the target class also moves towards the decision center of the target class we want to attack after triggers are added, thus being identified as the target class.

[0017] Since the Narcissus backdoor attack is carried out by calculating the optimal gradient of the target class, during the training process, the data with triggers must have a faster gradient descent rate and higher accuracy than the data without triggers.

[0018] II. Then, the above theory will be proven by the following method: First, based on the perturbation method of the original model, the overall gradient of the target class data will decrease after adding perturbation. However, we cannot guarantee that the original gradient will decrease after adding perturbation to each target class data. But our goal is to make the model be affected by this perturbation and classify the images with this perturbation into the target class. Therefore, those data that cannot cause gradient decrease cannot help the attack and can only be regarded as general noise. We only need to focus on the data that will be regarded as robust features by the model.

[0019] We consider the robust data as x. The probability that the model, without perturbation, will predict x as t is:

[0020] Then we add a perturbation.

[0021] In summary, for the model to be affected by poisoned data, prediction1 should be greater than prediction2 and the difference should be larger. This shows that in the original model, data with added perturbation results in lower loss and higher accuracy compared to clean data of the same category. Thus, we can obtain a defense method against Narcissus backdoor attacks.

[0022] III. Finally, the specific steps for defending against Narcissus backdoor attacks are as follows: A defense method against Narcissus backdoor attacks: Step 1: Extract the poisoning dataset (this dataset can be flexibly selected from various general benchmark datasets (such as MNIST handwritten digit dataset, CIFAR series image classification dataset, etc.)), construct the poisoning dataset, and train the poisoning model on the poisoning dataset; The specific method is as follows: A poisoning model is trained on the poisoning dataset. The resulting poisoning model is then used to calculate a prediction value (prediction) for each class across all data points (where each class is the category of all samples in the poisoning dataset). The calculation method is as follows:

[0023] Where: T represents all sample categories, and P represents the prediction function; only the prediction probability of the prediction function P for each data sample's category is taken, and finally, the set of prediction probabilities for each data sample corresponding to its category is obtained, thereby obtaining the model's prediction for all data.

[0024] Step 2: Identify the category of anomalies in the predicted values; The specific method is as follows: Because the predicted values ​​differ significantly among outliers, kurtosis is used to determine the outlier category. The predicted value (prediction) is denoted as X, g2 is the kurtosis, m4 is the fourth central moment (where m4 represents the average of the fourth power of the data value and the mean), m2 is the second central moment (where m represents the average of the squares of the data values ​​and the mean), n is the sample size, and X is the dataset, X={x1,x2,...,x...} n}, It is the sample mean, and the formula for calculating the g2 function is:

[0025] The kurtosis of the sample data is calculated using the above formula, and then 3 is subtracted to compare it with the kurtosis of the normal distribution. The kurtosis of the normal distribution is 0. By subtracting 3, the kurtosis of the data distribution can be directly determined.

[0026] The kurtosis of all categories of samples is calculated, and then the category with abnormal kurtosis is identified as the poisoning target class. With k as the threshold, the calculation process is as follows: malicious trigger samples are generated only based on the target class data, and mixed into the training set with a low poisoning ratio to obtain the poisoned dataset. After training the model with this dataset, the model maintains normal classification accuracy when there is no trigger. After the sample is implanted and triggered, the model will misclassify any class of test samples into the target class, thus achieving an efficient backdoor attack.

[0027] Step 3: Remove high-prediction-confidence data within the poisoning category: First, separate the identified poisoning category data from the original poisoning dataset. Then, set a threshold variable k, and perform a loop removal operation on this category of data. Each time, remove samples with prediction confidence exceeding the threshold k from the current poisoning category dataset. The loop terminates when any of the following conditions are met: 1) The prediction confidence of all remaining samples in the poisoning category dataset is lower than the threshold k; 2) The number of removed samples reaches a preset proportion of the initial total number of samples in this category; 3) The model's prediction index for this category of data recovers to the normal range. After the above operations, the remaining poisoning category data, together with other category data, constitutes the initial clean dataset. Since data was only deleted from the target class dataset, the empirical distribution of the dataset becomes uneven. Therefore, data is supplemented from the t-class POODt of the public external dataset POOD.

[0028] Where random is a function for randomly selecting data; This yields the final clean dataset. The model is then retrained using the clean dataset, and the resulting model is the clean model without backdoors.

Claims

1. A defense method against Narcissus backdoor attacks, characterized in that: Step 1: Extract the poisoning dataset, construct the poisoning dataset, and train the poisoning model on the poisoning dataset; Step 2: Identify the category of anomalies in the predicted values; Step 3: Remove high-prediction-confidence data within the poisoning category: First, separate the identified poisoning category data from the original poisoning dataset. Then, set a threshold variable k, and perform a loop removal operation on this category of data. Each time, remove samples with prediction confidence exceeding the threshold k from the current poisoning category dataset. The loop terminates when any of the following conditions are met: 1) The prediction confidence of all remaining samples in the poisoning category dataset is lower than the threshold k; 2) The number of removed samples reaches a preset proportion of the initial total number of samples in this category; 3) The model's prediction index for this category of data recovers to the normal range. After the above operations, the remaining poisoning category data, together with other category data, constitutes the initial clean dataset. Since data was only deleted from the target class dataset, the empirical distribution of the dataset becomes uneven. Therefore, data is supplemented from the t-class POODt of the public external dataset POOD. Where random is a function for randomly selecting data; This yields the final clean dataset. The model is then retrained using the clean dataset, and the resulting model is the clean model without backdoors.

2. The defense method against Narcissus backdoor attacks according to claim 1, characterized in that: The specific method in step 1 is as follows: A poisoning model is trained on the poisoning dataset. The resulting poisoning model is then used to calculate prediction values ​​(prediction) for all data points in each class. The calculation method is as follows: Where: T represents all sample categories, and P represents the prediction function; only the prediction probability of the prediction function P for each data sample's category is taken, and finally, the set of prediction probabilities for each data sample corresponding to its category is obtained, thereby obtaining the model's prediction for all data.

3. A defense method against Narcissus backdoor attacks according to claim 1, characterized in that: The specific method in step 2 is as follows: Because the predicted values ​​differ significantly within the outlier category, kurtosis is used to determine the outlier category. The predicted value (prediction) is denoted as X, g² is the kurtosis, m⁴ is the fourth central moment (where m⁴ represents the average of the fourth power of the mean), m² is the second central moment (where m⁻¹ represents the average of the squares of the mean), n is the sample size, and X is the dataset. X= { x 1 ,x 2 ,...,x n }, It is the sample mean, and the formula for calculating the g2 function is: The kurtosis of the sample data is calculated using the above formula, and then 3 is subtracted to compare it with the kurtosis of the normal distribution. The kurtosis of the normal distribution is 0. By subtracting 3, the kurtosis of the data distribution can be directly determined. The kurtosis of all categories of samples is calculated, and then the category with abnormal kurtosis is identified as the poisoning target class. With k as the threshold, the calculation process is as follows: malicious trigger samples are generated only based on the target class data, and mixed into the training set with a low poisoning ratio to obtain the poisoned dataset. After training the model with this dataset, the model maintains normal classification accuracy when there is no trigger. After the sample is implanted and triggered, the model will misclassify any class of test samples into the target class, thus achieving an efficient backdoor attack.

Images