Consistency learning-based neural network backdoor defense method and apparatus, and hardware

Abstract

The invention provides a neural network backdoor defense method, device and hardware based on consistency learning. The method comprises the following steps: acquiring a clean data set and a suspicious backdoor model; constructing a detoxification data set for guiding consistency learning based on the clean data set; the method comprises the following steps: combining and constructing a consistency learning objective function, inputting a detoxification data set into a suspicious backdoor model, and then adjusting parameters of the suspicious backdoor model based on the consistency learning objective function, so that learning on contents of sample data is enhanced, attention on backdoor trigger information is reduced to suppress backdoor triggering, and backdoor defense is realized. The classification performance of normal samples is maintained based on the optimization target; the device comprises a data and model acquisition module, a consistency constraint construction module and a model adjustment module. The electronic equipment and the computer readable storage medium are realized based on the method. The method directly removes the back door of the suspicious back door model, is simpler and more efficient, greatly reduces the time cost required by fine tuning, and maintains the high-level image classification performance.

Description

Technical Field

[0001] This invention relates to the technical field of electronic digital data processing, and in particular to a neural network backdoor defense method, device, and hardware based on consistency learning in the field of model security technology. Background Technology

[0002] Image classification is a classic problem in computer vision, aiming to categorize different images into different classes. In recent years, deep neural networks have achieved remarkable results in visual classification, becoming the preferred modeling tool for solving numerous machine learning tasks in computer vision. Large-scale neural networks trained under supervised learning, in particular, have shown significantly better generalization capabilities than other traditional models in image classification tasks. However, recent research on model backdoor attacks has been rampant, confirming the fundamental conclusion that any model possesses at least one backdoor vulnerability that can be triggered by certain means, such as specific triggers, to cause the model to produce misclassification results. Therefore, model security is receiving increasing attention, as misclassification in critical areas can have serious consequences.

[0003] Model attacks can be broadly categorized into two types. The first is adversarial example attacks, which don't require poisoning the model or data; instead, they exploit naturally occurring misperceptions (backdoors) generated during the model's learning process to trigger incorrect recognition. The second type is backdoor attacks, where attackers can implant backdoors at multiple stages of the model's data collection and training, manifesting as data poisoning or module additions. However, some of these attack methods have significant limitations in real-world scenarios. For example, adversarial example attacks require a large amount of raw training data to accurately identify natural backdoors in the model, and changes to the model architecture in backdoor attacks are easily detected by users. Therefore, data poisoning, which involves perturbing certain parts of the user's data, is the most widely used method in real-world scenarios.

[0004] Backdoor attacks involving data poisoning present several challenges. First, there's the diversity of triggers—including those based on meaningless blocks (3x3 black and white blocks) and feature-based triggers. Each method has its own characteristics: the former is simple to operate and highly aggressive, but easily detected by humans, while the latter is the opposite. Second, there's the difficulty of sample detection. Some efficient backdoor attack methods can achieve a strong attack effect by poisoning only a very small portion of the data, posing a significant challenge to sample detection. Finally, there's the complexity of backdoor removal. Current defense methods mainly fall into three categories: sample detection, robust training, and non-learning. However, an effective defense method for removing backdoors remains lacking, addressing various attack methods. Summary of the Invention

[0005] To address the aforementioned technical problems, this invention provides a neural network backdoor defense method, apparatus, and hardware based on consistency learning.

[0006] The technical solution adopted in this invention is a neural network backdoor defense method based on consistency learning, wherein the method obtains a clean dataset and a suspicious backdoor model. Based on the clean dataset, construct a decontamination dataset to guide consistency learning; the clean dataset generally refers to a dataset that has not been contaminated, and the suspected backdoor model refers to the target model suspected of having a backdoor trigger implanted.

[0007] A consistent learning objective function is constructed by combining these functions, and the suspected backdoor model is input using the aforementioned detoxification dataset. Subsequently, the parameters of the suspected backdoor model are adjusted based on the consistency learning objective function to enhance its learning of the sample data itself, reduce its focus on backdoor trigger information to suppress backdoor triggering, thereby achieving backdoor defense, and maintaining the classification performance of normal samples based on the optimization objective.

[0008] Preferably, based on the surrogate model, all samples of N categories are selected from the clean dataset, and the same perturbation is superimposed on all samples of each category. All samples of the same category are then passed through the weight-frozen surrogate model to calculate the cross-entropy loss. The loss is then backpropagated through the gradient to optimize the perturbation so that it contains the feature information of that category. The perturbations corresponding to the remaining categories are extracted in turn.

[0009] Preferably, each perturbation is independently appended to each sample data in the clean dataset to obtain a new sample data with N times the amount of the original sample data in the clean dataset, thus constructing a detoxified dataset.

[0010] Preferably, the mean and variance of each category in the clean dataset are calculated using the surrogate model, denoted as... And store.

[0011] Preferably, the consistency learning objective function includes a perturbation output invariance loss. Clean sample output consistency loss Distribution consistency loss .

[0012] Preferably, the detoxification dataset is input into the suspected backdoor model. Suspicious backdoor model Learning is performed on samples with different perturbations but whose category labels remain consistent with the original samples. Cross-entropy loss is calculated to obtain suspected backdoor models. For perturbation output invariance loss of the detoxification dataset ;

[0013] Make a copy of the suspicious backdoor model, and denote it as... Samples from the clean dataset are fed into the suspected backdoor model. and The MSE loss is calculated using the probability distributions of the final outputs of both samples, thus obtaining the clean sample output consistency loss. ;

[0014] With a suspicious backdoor model The final statistical distribution of the output samples is sampled from the mean and variance of the current sample's category, and the distribution consistency loss between the two is calculated. .

[0015] Preferably, the samples in both the clean dataset and the created detoxification dataset are image samples.

[0016] A neural network backdoor defense device based on consistency learning, comprising:

[0017] The data and model acquisition module is used to acquire clean datasets and suspicious backdoor models;

[0018] A consistency constraint construction module is used to construct a detoxification dataset that guides consistency learning based on the clean dataset.

[0019] The model tuning module is used to input the suspected backdoor model with the detoxified dataset and the clean dataset, and to adjust the parameters of the suspected backdoor model based on the constructed consistency learning objective function in order to defend against backdoor triggering and maintain classification performance.

[0020] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the neural network backdoor defense method based on consistency learning.

[0021] A computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the neural network backdoor defense method based on consistency learning.

[0022] This invention provides a neural network backdoor defense method, device, and hardware based on consistency learning, which can obtain clean datasets and suspicious backdoor models. Based on the clean dataset, construct a detoxification dataset to guide consistency learning; combine and construct a consistency learning objective function, and input the detoxification dataset into the suspected backdoor model. Subsequently, the parameters of the suspected backdoor model are adjusted based on the consistency learning objective function to enhance its learning of the sample data itself and reduce its focus on backdoor trigger information to suppress backdoor triggering, thereby achieving backdoor defense. The device also maintains the classification performance of normal samples based on the optimization objective. The device includes a data and model acquisition module, a consistency constraint construction module, and a model adjustment module. The method is implemented in an electronic device and a computer-readable storage medium.

[0023] The beneficial effects of this invention are as follows:

[0024] (1) Compared with other classification defense methods, both sample detection and robustness training require a detection step, and the effectiveness of backdoor removal depends to a large extent on the quality of detection, which affects the effectiveness and robustness of the defense method. The method of this invention adopts a detection-free architecture, skips the sample detection step, and directly removes backdoors from suspicious backdoor models, which is simpler and more efficient.

[0025] (2) Compared with other defense methods, this method greatly reduces the time cost required for fine-tuning, removes the corresponding backdoor in one epoch, and allows the suspected backdoor model to maintain a high level of image classification performance when the backdoor is removed.

[0026] (3) The effectiveness was verified in five attack methods on the CIFAR-10, SVHN and GTSRB datasets. The success rate of the suspected backdoor model on the CIFAR-10 dataset decreased from an average of 99.3% to 1.7%, on the SVHN dataset from an average of 98.8% to 2.1%, and on the GTSRB dataset from an average of 90.6% to 1.3%. Attached Figure Description

[0027] Figure 1 This is a flowchart of the method of the present invention;

[0028] Figure 2 This is a schematic diagram of the device structure of the present invention. Detailed Implementation

[0029] The present invention will be further described in detail below with reference to embodiments, but the scope of protection of the present invention is not limited thereto.

[0030] This invention relates to a neural network backdoor defense method based on consistency learning, the method comprising the following steps:

[0031] (1) Obtain a clean dataset and suspicious backdoor models ;

[0032] (2) Construct a detoxification dataset guided by consistency learning based on the clean dataset;

[0033] (3) Combine and construct a consistent learning objective function;

[0034] (4) Input the aforementioned detoxification dataset into the suspected backdoor model. Subsequently, the parameters of the suspected backdoor model are adjusted based on the consistency learning objective function to enhance its learning of the sample data itself, reduce its focus on backdoor trigger information to suppress backdoor triggering, thereby achieving backdoor defense, and maintaining the classification performance of normal samples based on the optimization objective.

[0035] The method will be described below with reference to the embodiments.

[0036] (1) Obtain a clean dataset and suspicious backdoor models ;

[0037] In this embodiment, 50% of the data in the CIFAR-10 test set is selected as the clean dataset. The suspected backdoor model is a preset model. Add a backdoor trigger and execute the backdoor defense.

[0038] (2) Construct a detoxification dataset guided by consistency learning based on the clean dataset;

[0039] A high-performance surrogate model with abundant training data is selected, such as GoogLeNet, VGG-16, MobileNet, etc., trained on the Tiny-ImageNet dataset, or any dataset and model relevant to the task at hand; in this embodiment, GoogLeNet trained on the Tiny-ImageNet dataset is selected as the surrogate model. ;

[0040] Based on the agent model Select all samples from N categories from a clean dataset, superimpose the same perturbation onto all samples in each category, pass all samples of the same category through a surrogate model with frozen weights, calculate the cross-entropy loss, backpropagate the loss gradient, and optimize the perturbation to include the feature information of that category; extract the perturbations corresponding to the remaining categories in turn.

[0041] Specifically, feature information sets of some categories are obtained from a clean dataset, and clean (image) samples are input into a proxy model according to category using deep learning frameworks such as PyTorch. In the middle, obtain its model output, calculate the loss and use it. The optimizer optimizes feature information ,

[0042]

[0043] in, For the optimized perturbation, For randomly initialized perturbations, For cross-entropy loss, For a clean dataset In the data, x represents the sample itself, and y represents the label. Limit the range of values ​​in the disturbance;

[0044] by As the final The set of perturbations for each category is used, and the RAdam optimizer is used for the objective. The batch size is 256, the learning rate is 0.01, and the epoch is 1000.

[0045] In this embodiment, You can choose 10, since CIFAR-10 only has ten categories, so it selects the feature information of all categories; when using a dataset with more than 10 categories, such as GTSRB (which contains 43 categories), you can also select only ten categories and still get good performance.

[0046] Subsequently, the proxy model constructs a statistical distribution on the output of the clean dataset to obtain the class labels; that is, it uses the proxy model to calculate the mean and variance of each class in the clean dataset, denoted as . And store it for subsequent loss calculation.

[0047] Finally, each perturbation is independently appended to each sample in the clean dataset to obtain a new sample dataset that is N times the original sample data in the clean dataset, thus constructing the detoxification dataset.

[0048] Specifically, Every perturbation in the clean dataset Append it once to all the data, and the size of the detoxified dataset is the same as the clean dataset. Times, because it has The perturbation information for each category ultimately yields a new detoxification dataset. and will Send in a suspicious backdoor model Make minor adjustments.

[0049] It should be noted that, in this embodiment, the samples in both the clean dataset and the created detoxification dataset are image samples.

[0050] (3) Combine and construct a consistent learning objective function;

[0051] The consistency learning objective function includes perturbation output invariance loss. Clean sample output consistency loss Distribution consistency loss ;

[0052] In this invention, the consistency learning objective function is designed from two aspects: removing backdoors from the model and ensuring model performance, so that the suspected backdoor model can maintain a good performance level while removing the backdoor.

[0053] Input the detoxification dataset into the suspicious backdoor model Suspicious backdoor model Learning is performed on samples with different perturbations but whose category labels remain consistent with the original samples. Cross-entropy loss is calculated to obtain suspected backdoor models. For perturbation output invariance loss of the detoxification dataset This loss function is crucial for removing backdoors. It leverages the characteristic that the same sample has different perturbations but the same label, forcing the suspicious backdoor model to... Learn from real-world sample information to remove backdoors;

[0054] During the removal of backdoors, the model inevitably learns some feature information, reducing its image recognition ability. To ensure the accuracy of suspicious backdoor models... To maintain high-performance image classification even when the backdoor is removed, a clean sample output consistency loss is proposed. Distribution consistency loss This is used to stabilize the image recognition capabilities during the fine-tuning process of suspected backdoor models.

[0055] Make a copy of the suspicious backdoor model, and denote it as... Samples from the clean dataset are fed into the suspected backdoor model. and The MSE loss is calculated using the probability distributions of the final outputs of both samples, thus obtaining the clean sample output consistency loss. The loss utilized The ability to correctly identify clean samples guides the fine-tuning of suspicious backdoor models. This allows it to maintain its ability to identify clean samples;

[0056] With a suspicious backdoor model The final statistical distribution of the output samples is sampled from the mean and variance of the current sample's category, and the distribution consistency loss between the two is calculated. The loss function is designed from the perspective of the distribution of clean sample categories to stabilize image recognition capabilities.

[0057] Specifically, the objective function satisfy,

[0058]

[0059] Among them, the perturbation output invariance loss satisfy,

[0060]

[0061] Disturbance output invariance loss This can force the creation of suspicious backdoor models. The sample with different feature information but the same label is subjected to deeper learning, that is, learning the information of the sample itself, thereby forgetting the information of various features, and then forgetting the information of the attacker's trigger, so as to remove the backdoor.

[0062] Clean sample output consistency loss The loss is calculated based on the mean squared error (MSE), which satisfies the following conditions:

[0063]

[0064] in, Suspicious backdoor model The replication model, because the suspected backdoor model only misidentifies samples containing specific attacker triggers while classifying clean samples correctly, ensures that the identification of clean samples in the suspected backdoor model remains consistent with the initial suspected backdoor model during fine-tuning, thus maintaining stable performance after fine-tuning. This is because the fine-tuning process continuously optimizes the suspected backdoor model. Therefore, a replica model is needed to represent the original capability of the suspected backdoor model, namely the ability to identify clean samples.

[0065] Distribution consistency loss The loss is calculated based on the mean squared error (MSE), which satisfies the following conditions:

[0066]

[0067] in, for Mid-sampling, After the fine-tuning process, the model The recognition performance for clean samples remains stable;

[0068] , where is the weighting coefficient;

[0069] Based on the complete objective function The target model was optimized; the target model was trained using the SGD optimizer with a momentum of 0.9 and a weight decay of 5*10. -4 The batch size is 200, and the learning rate is 0.01. In this embodiment, the hyperparameters are set to... epoch is set to 1.

[0070] (4) Input the aforementioned detoxification dataset into the suspected backdoor model. Then, based on the consistency learning objective function, the parameters of the suspicious backdoor model are adjusted to enhance its learning of the sample data itself, reduce its focus on backdoor trigger information to suppress backdoor triggering, thereby achieving backdoor defense, and maintaining the classification performance of normal samples based on the optimization objective.

[0071] The detoxification dataset is input into the suspected backdoor model. The suspected backdoor model learns from samples with different new features but whose class labels remain consistent with the original samples, and obtains the model's output invariance loss to the perturbation of the detoxification dataset. Clean sample output consistency loss Distribution consistency loss ;

[0072] Suspicious backdoor models learn only the information from the data itself for the same sample with different added perturbation features. They use their ability to correctly identify clean samples to guide fine-tuning, thus maintaining a high level of performance and achieving backdoor defense. For example, the class label of a sample after adding perturbation remains unchanged. For instance, a bird sample with an added airplane perturbation still has the class label of bird. Therefore, the suspicious backdoor model will continuously identify bird features rather than airplane features under the intervention of the objective function, thereby strengthening the model's recognition ability.

[0073] This invention also relates to a neural network backdoor defense device based on consistency learning, comprising:

[0074] The data and model acquisition module is used to acquire clean datasets and suspicious backdoor models;

[0075] A consistency constraint construction module is used to construct a detoxification dataset that guides consistency learning based on the clean dataset.

[0076] The model tuning module is used to input the suspected backdoor model with the detoxified dataset and the clean dataset, and to adjust the parameters of the suspected backdoor model based on the constructed consistency learning objective function in order to defend against backdoor triggering and maintain classification performance.

[0077] The present invention also relates to an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the neural network backdoor defense method based on consistency learning.

[0078] The present invention also relates to a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the aforementioned neural network backdoor defense method based on consistency learning.

[0079] The method of this invention was compared with other methods under different datasets and different defensive attacks to obtain a comparison of their effects.

[0080] Table 1. Comparison of the effectiveness of the method of the present invention with other methods under different datasets and different defensive attacks.

[0081]

[0082] As shown in Table 1, the effectiveness of this invention was verified using five attack methods (WaNet, IAB, Adaptive-Blend, Narcissus, and COMBAT) on the CIFAR-10, SVHN, and GTSRB datasets. The success rate of the suspected backdoor model on the CIFAR-10 dataset decreased from an average of 99.3% to 1.7%, on the SVHN dataset from an average of 98.8% to 2.1%, and on the GTSRB dataset from an average of 90.6% to 1.3%.

[0083] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0084] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0085] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0086] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0087] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0088] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A neural network backdoor defense method based on consistency learning, characterized in that: The method obtains a clean dataset and a suspicious backdoor model. Based on the clean dataset, a detoxification dataset guided by consistency learning is constructed. A consistent learning objective function is constructed by combining these functions, and the suspected backdoor model is input using the aforementioned detoxification dataset. Subsequently, the parameters of the suspected backdoor model are adjusted based on the consistency learning objective function to enhance its learning of the sample data itself, reduce its focus on backdoor trigger information to suppress backdoor triggering, thereby achieving backdoor defense, and maintaining the classification performance of normal samples based on the optimization objective.

2. The neural network backdoor defense method based on consistency learning according to claim 1, characterized in that: Based on the surrogate model, select all samples of N categories from the clean dataset, superimpose the same perturbation on all samples of each category, let all samples of the same category pass through the surrogate model with frozen weights, calculate the cross-entropy loss, let the loss perform gradient backpropagation, optimize the perturbation to include the feature information of the category; and extract the perturbations corresponding to the remaining categories in turn.

3. The neural network backdoor defense method based on consistency learning according to claim 2, characterized in that: Each perturbation is independently appended to each sample in the clean dataset, resulting in a new sample dataset that is N times the size of the original sample data in the clean dataset, thus constructing the detoxified dataset.

4. The neural network backdoor defense method based on consistency learning according to claim 2, characterized in that: The mean and variance of each class in the clean dataset are calculated using the surrogate model, denoted as . And store.

5. A neural network backdoor defense method based on consistency learning according to claim 4, characterized in that: The consistency learning objective function includes perturbation output invariance loss. Clean sample output consistency loss Distribution consistency loss .

6. The neural network backdoor defense method based on consistency learning according to claim 5, characterized in that: Input the detoxification dataset into the suspicious backdoor model Suspicious backdoor model Learning is performed on samples with different perturbations but whose category labels remain consistent with the original samples. Cross-entropy loss is calculated to obtain suspected backdoor models. For perturbation output invariance loss of the detoxification dataset ; Make a copy of the suspicious backdoor model, and denote it as... Samples from the clean dataset are fed into the suspected backdoor model. and The MSE loss is calculated using the probability distributions of the final outputs of both samples, thus obtaining the clean sample output consistency loss. ; With a suspicious backdoor model The final statistical distribution of the output samples is sampled from the mean and variance of the current sample's category, and the distribution consistency loss between the two is calculated. .

7. The neural network backdoor defense method based on consistency learning according to claim 1, characterized in that: Both the clean dataset and the detoxified dataset contain image samples.

8. A neural network backdoor defense device based on consistency learning, characterized in that: include: The data and model acquisition module is used to acquire clean datasets and suspicious backdoor models; A consistency constraint construction module is used to construct a detoxification dataset that guides consistency learning based on the clean dataset. The model tuning module is used to input the suspected backdoor model with the detoxified dataset and the clean dataset, and to adjust the parameters of the suspected backdoor model based on the constructed consistency learning objective function in order to defend against backdoor triggering and maintain classification performance.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements the neural network backdoor defense method based on consistency learning as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by the processor, it implements the neural network backdoor defense method based on consistency learning as described in any one of claims 1 to 7.

Images