Poisoning Defense Method for Modulation Classification Model Based on Transformer Semi-Supervised Feature Remapping

Abstract

This invention belongs to the field of deep learning security technology, and particularly relates to a method for poisoning defense of modulation classification models based on Transformer semi-supervised feature remapping. The method includes: constructing a signal modulation classification model; obtaining signal samples at risk of poisoning and performing poisoning training on the signal modulation classification model to obtain a poisoned signal modulation classification model; connecting the backbone network of the poisoned signal modulation classification model to a Transformer module; inputting an unlabeled signal sample set into a joint feature remapping channel to obtain a remapped classification model; inputting a clean signal sample set into the remapped classification model and performing supervised fine-tuning; iteratively executing the feature remapping and supervised fine-tuning processes based on semi-supervised training until the model accuracy stabilizes, thus obtaining a signal modulation classification model with poisoning defense capabilities. This invention can effectively remove potential backdoors in the model, improve defense performance, and ensure the high availability of the repaired classification model.

Description

Technical Field

[0001] This invention relates to the field of deep learning security technology, and in particular to a method for poisoning defense in modulation classification models based on Transformer semi-supervised feature remapping. Background Technology

[0002] With the development of artificial intelligence (AI) technology, deep learning has been widely applied in fields such as image processing, speech recognition, and automatic modulation recognition. Large amounts of training data and continuously improving computing power are crucial for the success of deep models. To reduce computational overhead, users often rely on third-party resources to train deep neural networks, such as using third-party data and servers, or even directly using third-party APIs. However, the lack of transparency in the training process has led to new security vulnerabilities. For example, backdoor attacks are a security threat during DNN model training, where attackers maliciously manipulate the prediction results of the attacked DNN model by contaminating some training samples.

[0003] In related technologies, poisoning defense mainly consists of three aspects: First, dataset purification, where the defender removes poisoned data from the training set based on the structural characteristics of the poisoned data, and trains the model using a training set with no or very little poisoned data; second, model purification, where after model training, network parameters are adjusted according to the poisoning attack principle to suppress trigger expressions in the poisoned model; and third, data detection, where algorithms are used during the model inference stage to detect whether the model has backdoors or whether the input contains backdoor samples. Directly transferring image-based poisoning defense methods to the signal domain often yields poor results. Furthermore, the effectiveness of backdoor removal is closely related to the number of clean samples; the fewer clean samples, the lower the backdoor removal efficiency and the greater the loss of model accuracy after defense. However, obtaining a large number of absolutely clean samples is difficult in practice, limiting the application scenarios of such methods. Therefore, how to effectively implement poisoning defense on electromagnetic signal modulation classification models using a small amount of clean data while maintaining high model performance is an urgent problem to be solved. Summary of the Invention

[0004] Based on the above analysis, the present invention aims to provide a method for preventing poisoning of modulation classification models based on Transformer semi-supervised feature remapping, in order to solve the problems of existing technologies lacking methods for preventing poisoning of electromagnetic signal models, heavily relying on clean samples, having limited application scenarios, and having low defense efficiency and poor results.

[0005] This invention provides a method for poisoning prevention in modulation classification models based on Transformer semi-supervised feature remapping, comprising:

[0006] A signal modulation classification model is constructed, and signal samples with the risk of poisoning are obtained to perform poisoning training on the signal modulation classification model to obtain a poisoned signal modulation classification model; based on the signal samples with the risk of poisoning, an unlabeled signal sample set and a labeled clean signal sample set are constructed respectively. The backbone network of the signal modulation classification model after poisoning is connected to a preset Transformer module with a global self-attention mechanism to form a joint feature remapping channel; based on the unlabeled signal sample set and using the joint feature remapping channel, feature remapping based on contrastive learning is performed to obtain the classification model after feature remapping. The labeled clean signal sample set is input into the remapped classification model, and the remapped classification model is fine-tuned in a supervised manner using cross-entropy loss. Based on the semi-supervised training method, the feature remapping and supervised fine-tuning processes are iteratively executed until the model accuracy stabilizes, resulting in a signal modulation classification model with poisoning defense capabilities.

[0007] Furthermore, the signal samples posing a risk of poisoning include: a training set constructed based on the modulated signal. ; The training set It is obtained according to the following formula: ; ; ; in, This represents the poisoned sample set generated using a fixed noise injection method; This represents the clean portion of the sample set; Indicates the poisoning rate; This represents the total number of samples in the training set. This indicates the number of samples in the poisoned sample set. Indicates sampling noise; Hyperparameters representing the control of noise intensity; Indicates the original clean sample; This indicates that the generated label after injecting noise is changed to the attack target category. Poisoned samples.

[0008] Further, the poisoning training process for the signal modulation classification model includes: Based on samples mixed with poisoning training set Train the signal modulation classification model to obtain the signal modulation classification model after poisoning. ;in, express Model parameters; Based on the signal samples with the risk of poisoning, an unlabeled signal sample set and a labeled clean signal sample set are constructed, including: The sample mixed with poison training set All labels corresponding to each sample in the dataset are removed to obtain an unlabeled signal sample set. ;in , express The i-th sample in; From the samples mixed with poison training set A very low proportion of the original clean samples are randomly selected from the sample and their labels are retained to obtain a clean signal sample set. .

[0009] Further, the step of performing contrastive learning-based feature remapping based on the unlabeled signal sample set and utilizing the joint feature remapping channel to obtain the remapped classification model includes: For the unlabeled signal sample set Each sample in Apply data augmentation to obtain the corresponding augmented samples. ; each sample and its corresponding augmented samples As a set of positive sample pairs; The unlabeled signal sample set containing positive sample pairs Input the joint feature remapping channel; based on each sample and its corresponding augmented samples The two types of primary features output by the backbone network are reconstructed in dimension to obtain the corresponding token embedding feature sequences. ; The token embedding feature sequence is processed by the Transformer module. Perform global context recoding; based on the recoded feature sequence, calculate the sample. Rather than augmenting samples The contrast loss and total loss between the positive sample pairs formed; Based on the contrast loss and total loss, the parameters of the backbone network and the Transformer module are updated, and the classification model after feature remapping is obtained based on the backbone network with updated parameters.

[0010] Furthermore, the Transformer module includes at least: a multi-head attention layer. and multilayer perceptron ; The output of the Transformer module is represented in the following form: ; ; in, This represents the feature sequence output by the multi-head attention layer; This represents the recoded feature sequence that is ultimately output by the Transformer module. This indicates a random discard operation; Presentation layer normalization operation.

[0011] Further, based on the recoded feature sequence, the sample is calculated. Rather than augmenting samples The contrast loss and total loss between the positive sample pairs constituted include: Sample The corresponding recoded feature sequence and enhanced samples The corresponding recoded feature sequence Channel summation and average pooling operations are performed to obtain the corresponding low-dimensional feature vectors. and low-dimensional feature vectors ; The low-dimensional feature vector and Input the preset projection head network respectively And based on the projection head network Output encoded vector and Calculate the contrast loss between the positive sample pairs; calculate the total loss based on the contrast loss between the positive sample pairs.

[0012] Furthermore, the contrast loss is calculated according to the following formula: ; The total loss is calculated using the following formula: ; in, This represents the contrast loss between positive sample pairs; Indicates symmetric contrast loss; This represents the total loss under each training batch update; Indicates temperature parameter, N represents the L2 norm similarity between two encoded vectors; b The training batch size is represented by k; the summation variable is represented by exp; and the natural exponential function is represented by exp.

[0013] Furthermore, the cross-entropy loss is calculated according to the following formula: ; in, The variable represents the average cross-entropy loss of the current training batch. Defined as the number of samples contained in each training batch during supervised fine-tuning; This represents the total number of target categories for the classification task; Indicates the first in the training batch One input sample, The true label distribution is determined by the indicator variable Given, when the sample Category hour The value is 1 if it is set to 1, and 0 otherwise. Indicates the predicted sample Belongs to the The confidence probability of a class.

[0014] Furthermore, the method also includes: performing a dual verification process during the model verification phase; the dual verification process specifically includes: The network structures and weights of the signal modulation classification model before and after poisoning, as described in the text, and the signal modulation classification model with poisoning defense capability, as described in the text, are loaded respectively. Based on the network structure and weights, a preset verification test set is input into the poisoned signal modulation classification model and the signal modulation classification model with poisoning defense capability, respectively; wherein, the verification test set includes at least a standard test sample set and a poisoning test sample set; The classification accuracy (ACC) and attack success rate (ASR) of the two models before and after defense on the standard test sample set are calculated respectively. Based on the classification accuracy (ACC) and attack success rate (ASR) of the two models before and after defense, the defense effectiveness (DER) of the signal modulation classification model with poisoning defense capability is calculated.

[0015] Furthermore, the classification accuracy ACC is calculated according to the following formula: ; The attack success rate (ASR) is calculated using the following formula: ; The defensive effectiveness (DER) is calculated according to the following formula: ; in, This represents the signal modulation classification model before the test of defense, or the signal modulation classification model with poisoning defense capabilities. Representation Model The parameters, This refers to clean samples from the standard test sample set. The corresponding actual label; This represents the poisoned samples in the poisoning test sample set. The corresponding target poisoning label; M represents the validation test set. The total number of samples included; This represents the decrease in the attack success rate of the signal modulation classification model with poisoning defense capabilities. This indicates the decrease in classification accuracy of the signal modulation classification model with poisoning defense capability.

[0016] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects: First, unlike related technologies that heavily rely on clean samples and have limited application scenarios, this invention introduces a contrastive self-supervised learning mechanism based on unlabeled samples. This eliminates the need for sample labels during training, fundamentally severing the false association between triggers and incorrect labels in poisoned samples. This allows a large amount of readily available unlabeled data containing potentially poisoned samples to be used for model training, significantly alleviating the reliance on clean samples in the defense phase. The contrastive self-supervised training method focuses on the differences in feature representations across all sample categories, thereby improving the model's ability to extract essential features from signal samples while reducing the model's focus on low-level features, effectively reducing the model's abnormal predictions of poisoned samples.

[0017] Second, unlike related technologies which suffer from low defense efficiency and poor effectiveness, this invention utilizes the global self-attention mechanism of the Transformer module to perform contextual recoding on the features extracted by the backbone network, thereby enhancing the ability to extract features from signal samples and providing impetus for feature space purification. By introducing a very low proportion of clean samples to perform supervised fine-tuning on the remapped model, the decision boundaries in the feature space are quickly calibrated, reducing the potential performance degradation caused by self-supervised contrastive learning. Without sacrificing model accuracy, backdoors in the model are effectively removed, achieving a balance between defense effectiveness and model practicality.

[0018] In this invention, the above-described technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of this invention will be set forth in the following description, and some advantages may become apparent from the description or be learned by practicing the invention. The objects and other advantages of this invention can be realized and obtained from what is particularly pointed out in the description and drawings. Attached Figure Description

[0019] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts. Figure 1 is a flowchart of the poisoning defense method for modulation classification model based on Transformer semi-supervised feature remapping according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating the overall scheme of semi-supervised fine-tuning of Transformer according to an embodiment of the present invention. Detailed Implementation

[0020] Preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings, which form part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not intended to limit the scope of the present invention.

[0021] A specific embodiment of the present invention discloses a poisoning defense method for modulation classification models based on Transformer semi-supervised feature remapping, such as... Figure 1 As shown, the steps S1 to S4 are as follows: Step S1: Construct a signal modulation classification model, obtain signal samples with the risk of poisoning, and perform poisoning training on the signal modulation classification model to obtain a poisoned signal modulation classification model; based on the signal samples with the risk of poisoning, construct an unlabeled signal sample set and a labeled clean signal sample set respectively.

[0022] In implementation, the first step is to construct a signal modulation classification model. This model can be implemented based on the AlexNet model. The network structure of the AlexNet model includes at least 2D convolutional layers, 2D max pooling layers, 2D adaptive average pooling layers, fully connected layers, and batch normalization layers.

[0023] For example, the signal modulation classification model in this embodiment consists of four convolutional layers, three max pooling layers, two batch normalization layers, three fully connected layers, and one dropout layer; the parameters of the convolutional layers are set to [(64,2,3),(192,1,2),(384,1,2),(252,1,2)]; the parameters of the max pooling layers and the fully connected layers are set to [(1,2),(1,2),(1,2)],[500,100,11], and the output of the backbone of the classification model (i.e., the first fully connected layer) is 128×72.

[0024] Secondly, the signal samples with the risk of poisoning in this embodiment are used as a training set to perform poisoning training on the signal modulation classification model. The signal samples with the risk of poisoning are derived from open source datasets, including electromagnetic environments from the real world, generated by real signal transmission and reception systems, and fully include complex factors such as modulation, pulse shaping, carrier frequency offset, and actual transmitted data, thus forming a highly realistic set of real-world modulation signals.

[0025] Preferably, in the data preprocessing stage, the continuous signal stream can be cut into 128 rectangular time windows of fixed length to form the basic unit of model input, and all modulation categories can be evenly divided into the training set and the validation test set according to the proportion. The modulation types specifically include BPSK, QPSK, 8PSK, 16QAM, 64QAM, BFSK, CPFSK, PAM4, WBFM, AM-SSB, and AM-DSB. The training set contains 44,000 data points, with 4,000 training samples for each modulation type, and the test set contains 11,000 data points, with 1,000 test samples for each modulation type. The above dataset uses complex numbers to represent signal data, and consists of orthogonal signals composed of I-channel and Q-channel data, where I represents the in-phase component and Q represents the quadrature component, with a 90-degree phase difference between them.

[0026] Preferably, the signal samples with a risk of poisoning include: a training set constructed based on the modulated signal. It's understandable that the training set... Each signal sample in the dataset is an IQ vector, obtained from a discrete complex signal after preprocessing, with its real part defined as... ( The imaginary part is defined as follows: ( ), which are combined to form a two-dimensional real-valued vector, where L=128 represents the length of the signal sample.

[0027] Preferably, the training set It is obtained according to the following formula: (1) (2) (3) in, This represents the poisoned sample set generated using a fixed noise injection method; This represents the clean portion of the sample set; Indicates the poisoning rate; This represents the total number of samples in the training set. This indicates the number of samples in the poisoned sample set. Indicates sampling noise; Hyperparameters representing the control of noise intensity; Indicates the original clean sample; This indicates that the generated label after injecting noise is changed to the attack target category. Poisoned samples. For example, the poisoning rate. =0.1; =44000; =4400; =0.08; =6, etc.

[0028] Further, the poisoning training process for the signal modulation classification model includes: Based on samples mixed with poisoning training set Train the signal modulation classification model to obtain the signal modulation classification model after poisoning. ;in, express Model parameters.

[0029] Furthermore, based on the signal samples with the risk of poisoning, an unlabeled signal sample set and a very low proportion of labeled clean signal sample sets are constructed, specifically including: The sample mixed with poison training set All labels corresponding to each sample in the dataset are removed to obtain an unlabeled signal sample set. ;in , express The i-th sample in; From the samples mixed with poison training set A very low proportion of the original clean samples are randomly selected from the sample and their labels are retained to obtain a clean signal sample set. For example, a clean signal sample set. The number of samples in the training set The proportion of the total number of samples in this model is 1 / 100. This provides data support for the subsequent self-supervised training and supervised fine-tuning of the model.

[0030] Step S2: Connect the backbone network of the poisoned signal modulation classification model to a preset Transformer module with a global self-attention mechanism to form a joint feature remapping channel; perform feature remapping based on contrastive learning using the joint feature remapping channel based on the unlabeled signal sample set to obtain the remapped classification model.

[0031] During implementation, in the self-supervised feature remapping stage, the signal modulation classification model after poisoning is subjected to self-supervised training based on contrastive learning to adjust the parameters of the model's backbone network. Self-supervised training based on contrastive learning refers to learning by constructing supervisory signals from unlabeled data itself without relying on any manually labeled tags. In the specific application of this invention, this training drives the signal modulation classification model after poisoning to focus on mining and strengthening the discriminative time-frequency correlation features in the signal, while making the model ignore local, low-level, and volatile irrelevant features (such as fixed trigger features implanted by backdoor attacks).

[0032] Specifically, this includes: First, processing the unlabeled signal sample set... Each sample in Apply data augmentation to obtain the corresponding augmented samples. ; each sample and its corresponding augmented samples As a set of positive sample pairs.

[0033] Secondly, the unlabeled signal sample set containing positive sample pairs will be... Input the joint feature remapping channel, and based on each sample and its corresponding augmented samples The two types of primary features output by the backbone network are reconstructed in dimension to obtain the corresponding token embedding feature sequences. For example, to Input the signal modulation classification model after the poisoning and obtain... Output of the backbone network part of the classification model The backbone network is In the first fully connected layer, the output is restructured to have dimensions of [dimensionality]. Token embedding feature sequence , The dimension of the embedding vector, for example =72; L represents the length of the signal sample.

[0034] It can be understood that the joint feature remapping channel is a data processing link specifically constructed to purify the model feature space. It consists of the backbone network of the poisoned signal modulation classification model and a Transformer module with a global self-attention mechanism connected in series. That is, the output of the backbone network is connected to the input of the Transformer module through the joint feature remapping channel.

[0035] Finally, the token embedding feature sequence is processed by the Transformer module. Global context recoding is performed to enhance the discriminative time-frequency correlation features in the signal and suppress local, low-frequency triggering features introduced by backdoor attacks; based on the recoded feature sequence, the sample is calculated. Rather than augmenting samples The contrast loss and total loss between the positive sample pairs are calculated; based on the contrast loss and total loss, the parameters of the backbone network and the Transformer module are updated, and the classification model after feature remapping is obtained based on the backbone network with updated parameters; thereby realizing feature space remapping for defense.

[0036] It should be noted that, in this embodiment, the two samples in a positive sample pair (i.e., samples) and its enhanced samples Each sample needs to be processed independently. That is, the two samples are sequentially processed through the backbone network for primary feature extraction, and the extracted feature dimensions are reconstructed into corresponding token embedding feature sequences. Subsequently, two token embedding feature sequences were used. The samples are respectively input into the Transformer module and subjected to global context recoding, thereby producing the output samples. The corresponding recoded feature sequence and enhanced samples The corresponding recoded feature sequence These are then used together in subsequent comparison loss calculations.

[0037] In some preferred embodiments, the Transformer module includes at least: a multi-head attention layer. and multilayer perceptron The multi-head attention layer and multilayer perceptron are used to capture the global temporal and spatial information of the token embedding feature sequence, respectively. Each sublayer includes mechanisms such as parameter discarding, residual connections, and layer normalization, which makes the self-supervised training process of the model more stable and reduces the model's accuracy loss.

[0038] The output of the Transformer module is represented in the following form: (4) (5) in, ; This represents the feature sequence output by the multi-head attention layer; This represents the recoded feature sequence that is ultimately output by the Transformer module. This indicates a random discard operation; Presentation layer normalization operation.

[0039] Preferably, a multi-head attention layer The specific representation is as follows: (6) (7) (8) in, Indicates attention; Indicates the attention head variable; , , , Both represent linear transformation parameter matrices. ,For example =9, H =8; H represents the number of attention heads; This means that the correlation between input vectors is calculated through a self-attention mechanism, and the representation of the corresponding position is obtained by weighted sum of value vectors; The feature dimension of the attention head; Indicates the dimension of the key vector used to scale the dot product; Indicates the dimension of the query vector; Indicates the dimension of the value vector; This represents the attention bias matrix used to add location information; the query matrix Q, key matrix K, and value matrix V are the input token embedding feature sequences. Linear projection of.

[0040] Preferably, a multilayer sensor It contains two fully connected linear layers, which further extract features from the input vector through dimensionality increase and dimensionality reduction, and adds a layer between the two linear layers. The activation function ensures the nonlinearity of the network; Multilayer perceptron The specific representation is as follows: (9) in, and Both are parameter matrices of linear transformations, and Indicates the dimension of the parameter matrix; for example =144.

[0041] In some implementations, the sample is calculated. Rather than augmenting samples The contrast loss and total loss between the positive sample pairs constituted include: Sample The corresponding recoded feature sequence and enhanced samples The corresponding recoded feature sequence Channel summation and average pooling operations are performed to obtain the corresponding low-dimensional feature vectors. and low-dimensional feature vectors ;in, ; The low-dimensional feature vector and Input the preset projection head network respectively Obtain nonlinear projection and based on the projection head network. Output encoded vector and Calculate the contrast loss between the positive sample pairs; calculate the total loss based on the contrast loss between the positive sample pairs.

[0042] Preferably, a projection head network The specific representation is as follows: (10) (11) in, and These represent the parameter matrices of the two linear layers, respectively. and Represents the dimension of the linear layer parameter matrix; express The kth channel.

[0043] It is understandable that during self-supervised training based on contrastive learning, each training batch needs to start from the unlabeled signal sample set. Random selection One sample was obtained after data augmentation. One sample, that is, a sample Rather than augmenting samples They are positive samples of each other, and the two, along with the remaining ones, are positive samples of each other. Each sample is a negative sample of the others; sample Rather than augmenting samples from In other words, after the backbone network and Transformer module outputs of the signal modulation classification model after poisoning, the low-dimensional feature vector is obtained by summing and averaging all channels. and Then, by the projection head network Output the encoded vectors respectively and Ultimately, based on the encoding vector and Calculate the contrast loss between positive samples. Wherein, The calculation formula is the same as formula (10)-(11), and will not be repeated here.

[0044] Preferably, the contrast loss is calculated according to the following formula: (12) The total loss is calculated using the following formula: (13) in, This represents the contrast loss between positive sample pairs; Indicates symmetric contrast loss; This represents the total loss under each training batch update; Indicates temperature parameter, N represents the L2 norm similarity between two encoded vectors; b The training batch size is represented by k; the summation variable is represented by exp; and the natural exponential function is represented by exp.

[0045] Therefore, based on the above-mentioned losses, the backbone network of the signal modulation classification model after poisoning can be used. The parameters are adjusted, and the parameters of the backbone network and Transformer module are updated synchronously to obtain the classification model after feature remapping.

[0046] Step S3: Input the labeled clean signal sample set into the remapped classification model, and use cross-entropy loss to perform supervised fine-tuning of the remapped classification model.

[0047] During implementation, the supervised fine-tuning phase specifically includes: each batch from the clean signal sample set We randomly select n clean signal samples to input into the remapped classification model, and use the cross-entropy loss function for supervised training and a small number of iterations.

[0048] It is understood that the supervised fine-tuning in this embodiment of the invention refers to the training step performed after the feature remapping stage based on the unlabeled signal sample set is completed. This step takes a very low proportion of clean signal sample sets with real class labels as input and uses the cross-entropy loss function to optimize the remapped classification model. The core purpose of supervised fine-tuning is to use a small amount of precise supervision signals to quickly and accurately calibrate the decision boundary that may be shifted after the feature space is remapped, and restore and maintain the model's original high classification accuracy for normal signal samples while ensuring that backdoor features are effectively suppressed.

[0049] Preferably, the cross-entropy loss is calculated according to the following formula: (14) in, The variable represents the average cross-entropy loss of the current training batch. Defined as the number of samples contained in each training batch during supervised fine-tuning; This represents the total number of target categories for the classification task; Indicates the first in the training batch One input sample, The true label distribution is determined by the indicator variable Given, when the sample Category hour The value is 1 if it is set to 1, and 0 otherwise. Indicates the predicted sample Belongs to the The confidence probability of a class.

[0050] The aforementioned cross-entropy loss function aims to quantify the difference between the predicted distribution and the true distribution, and based on this, drive the gradient descent and update iteration of the model parameters on a clean signal sample set.

[0051] Step S4: Based on the semi-supervised training method, iteratively execute the feature remapping process in step S2 and the supervised fine-tuning process in step S3 until the model accuracy is stable, and obtain a signal modulation classification model with poisoning defense capability.

[0052] Combination Figure 2 As shown, the semi-supervised training method used in this embodiment refers to a machine learning method that simultaneously trains the model using a large amount of unlabeled data and a very small amount of labeled data. Specifically, this semi-supervised training method is achieved by iteratively executing two key stages: steps S2 and S3. In the first stage, feature representations are reconstructed and purified from the large-scale unlabeled data through self-supervised contrastive learning. In the second stage, the decision boundary of the model is finely calibrated in a supervised manner using a very small number of accurately labeled clean samples, thereby testing the model's classification accuracy of normal samples before and after defense, as well as the attack success rate of poisoned samples.

[0053] Preferably, the training process of steps S2 and S3 is repeated using a semi-supervised training method, specifically including: each time the unlabeled signal sample set is traversed... After performing step S2, based on the clean signal sample set Execute step S3 and perform a small number of iterations. Then, determine if the model accuracy meets the requirements. Once the model accuracy stabilizes, stop training, save the network parameters of the classification model at this point, and obtain a signal modulation classification model with poisoning defense capabilities. ;in This represents the model parameters after the defense is applied. For example, when the loss value converges, the model's accuracy and performance can be considered stable.

[0054] The overall training loss of this semi-supervised training method is as follows: (15) in, This represents the overall training loss for each training batch; Indicates a set of unlabeled signal samples The calculated total loss; Indicates based on clean signal sample set The calculated cross-entropy loss.

[0055] The overall training loss defined above defines the global optimization objective of the entire semi-supervised training process. This fully leverages the rich information contained in unlabeled data and the precise guidance provided by labeled data, achieving a balance between self-supervised learning and supervised fine-tuning. Thus, even under conditions where labeled data is extremely scarce, it can still effectively achieve the dual objectives of model defense and performance preservation.

[0056] Furthermore, the method also includes: performing a dual verification process during the model verification phase; the dual verification process specifically includes: The network structures and weights of the signal modulation classification model before and after poisoning, as described in the text, and the signal modulation classification model with poisoning defense capability, as described in the text, are loaded respectively. Based on the network structure and weights, a preset verification test set is input into the poisoned signal modulation classification model and the signal modulation classification model with poisoning defense capability, respectively; wherein, the verification test set includes at least a standard test sample set and a poisoning test sample set; The classification accuracy (ACC) and attack success rate (ASR) of the two models before and after defense on the standard test sample set are calculated respectively. Based on the classification accuracy (ACC) and attack success rate (ASR) of the two models before and after defense, the defense effectiveness (DER) of the signal modulation classification model with poisoning defense capability is calculated.

[0057] It can be understood that "before defense" refers to the state before being processed by steps S2 to S4 of the present invention. At this time, the model (the signal modulation classification model after being poisoned) still contains malicious associations implanted by the backdoor attack. "After defense" refers to the state reached after being fully processed by the method of the present invention. At this time, the original malicious associations of the model with poisoning defense capability have been effectively suppressed, while its normal function is maintained.

[0058] Specifically, the first layer of verification is to test the standard test pair. and poisoning samples The data is fed into the original signal modulation classification model; the second verification involves reprocessing the same set of data after loading weights optimized by the defense algorithm. Based on the changes in the predicted distribution of the outputs from these two verifications, the system analyzes the model's performance indicators before and after defense intervention, namely, the classification accuracy (ACC) for standard clean data, the success rate (ASR) against malicious attacks, and the defense effectiveness (DER).

[0059] Preferably, the classification accuracy ACC is calculated according to the following formula: (16) The attack success rate (ASR) is calculated using the following formula: (17) The defensive effectiveness (DER) is calculated according to the following formula: (18) in, This refers to the signal modulation classification model before the test (i.e., the signal modulation classification model after poisoning) or a signal modulation classification model with poisoning defense capabilities. Representation Model The parameters, This refers to clean samples from the standard test sample set. The corresponding actual label; This represents the poisoned samples in the poisoning test sample set. The corresponding target poisoning label; M represents the validation test set. The total number of samples included; This represents the decrease in the attack success rate of the signal modulation classification model with poisoning defense capabilities. This indicates the decrease in classification accuracy of the signal modulation classification model with poisoning defense capability.

[0060] Defense effectiveness (DER) is a metric ranging from 0 to 1, used to evaluate the trade-off between maintaining the model's accuracy (ACC) and reducing adverse reaction rate (ASR). A value closer to 1 indicates better defense effectiveness. Therefore, by comparing the models before and after defense treatment on the same validation test set, we can objectively quantify and intuitively compare their attack success rate on poisoned samples and their classification accuracy on clean samples. This provides experimental evidence for the actual effectiveness of the aforementioned defense methods, completing an independent evaluation and final verification of the model's defense capabilities.

[0061] It is understood that the above implementation methods are only for ease of understanding and simplification of description, and should not be construed as limiting the present invention. The present invention does not impose specific limitations on the network structure of the classification model, the division of the dataset, or related calculation formulas.

[0062] Therefore, it can be seen that the embodiments of the present invention can achieve at least one of the following beneficial effects: First, this invention introduces a contrastive self-supervised learning mechanism based on unlabeled samples, eliminating the need for sample labels during training. This fundamentally severs the false association between triggers and incorrect labels in poisoned samples, allowing a large amount of readily available unlabeled data containing potentially poisoned samples to be used for model training, significantly alleviating the reliance on clean samples in the defense phase. The contrastive self-supervised training method focuses on the differences in feature representations among all categories of samples, thereby improving the model's ability to extract essential features of signal samples while reducing the model's attention to low-level features, effectively reducing the model's abnormal predictions of poisoned samples.

[0063] Second, this invention utilizes the global self-attention mechanism of the Transformer module to perform contextual recoding on the features extracted by the backbone network, thereby enhancing the ability to extract features from signal samples and providing impetus for the purification of the feature space. By introducing a very low proportion of clean samples to perform supervised fine-tuning on the remapped model, the decision boundary in the feature space is quickly calibrated, reducing the potential performance degradation of the model caused by self-supervised contrastive learning. In summary, based on the "semi-supervised feature remapping + Transformer enhancement + supervised fine-tuning" defense framework proposed in this invention, the weight parameters of the classification model can be adjusted and potential backdoors in the model can be effectively removed when the number of available clean signal samples is small, without losing model accuracy, thus improving defense effectiveness. At the same time, it ensures that the repaired classification model has high security and usability.

[0064] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0065] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A modulation classification model poisoning defense method based on Transformer semi-supervised feature remapping, characterized in that, include: A signal modulation classification model is constructed, and signal samples with the risk of poisoning are obtained to perform poisoning training on the signal modulation classification model to obtain a poisoned signal modulation classification model. Based on the signal samples with the risk of poisoning, an unlabeled signal sample set and a labeled clean signal sample set were constructed respectively. The backbone network of the signal modulation classification model after poisoning is connected to a preset Transformer module with a global self-attention mechanism to form a joint feature remapping channel; based on the unlabeled signal sample set and using the joint feature remapping channel, feature remapping based on contrastive learning is performed to obtain the classification model after feature remapping. The labeled clean signal sample set is input into the remapped classification model, and the remapped classification model is fine-tuned in a supervised manner using cross-entropy loss. Based on the semi-supervised training method, the feature remapping and supervised fine-tuning processes are iteratively executed until the model accuracy stabilizes, resulting in a signal modulation classification model with poisoning defense capabilities.

2. The defense method according to claim 1, characterized in that, The signal sample at risk of poisoning comprises a training set constructed based on a modulation signal ; The training set is obtained according to the following formula: ； ； ； wherein, represents a poisoned partial sample set generated by using a fixed noise injection method; represents a clean partial sample set; represents a poisoning rate; represents the number of all samples in the training set, represents the number of samples in the poisoned partial sample set, represents a sampling noise; represents a hyperparameter for controlling the noise intensity; represents an original clean sample; represents a poisoned sample whose label is changed to the attack target category after injecting noise; .

3. The defense method according to claim 2, characterized in that, The poisoning training process for the signal modulation classification model includes: Based on samples mixed with poisoning training set Train the signal modulation classification model to obtain the signal modulation classification model after poisoning. ;in, express Model parameters; Based on the signal samples with the risk of poisoning, an unlabeled signal sample set and a labeled clean signal sample set are constructed, including: The sample mixed with poison training set All labels corresponding to each sample in the dataset are removed to obtain an unlabeled signal sample set. ;in , express The i-th sample in; From the samples mixed with poison training set A very low proportion of the original clean samples are randomly selected from the sample and their labels are retained to obtain a clean signal sample set. .

4. The defense method according to claim 3, characterized in that, The step of performing contrastive learning-based feature remapping based on the unlabeled signal sample set and utilizing the joint feature remapping channel to obtain the remapped classification model includes: For the unlabeled signal sample set Each sample in Apply data augmentation to obtain the corresponding augmented samples. ; each sample and its corresponding augmented samples As a set of positive sample pairs; The unlabeled signal sample set containing positive sample pairs Input the joint feature remapping channel; based on each sample and its corresponding augmented samples The two types of primary features output by the backbone network are reconstructed in dimension to obtain the corresponding token embedding feature sequences. ; The token embedding feature sequence is processed by the Transformer module. Perform global context recoding; based on the recoded feature sequence, calculate the sample. Rather than augmenting samples The contrast loss and total loss between the positive sample pairs formed; Based on the contrast loss and total loss, the parameters of the backbone network and the Transformer module are updated, and the classification model after feature remapping is obtained based on the backbone network with updated parameters.

5. The defense method according to claim 4, characterized in that, The Transformer module includes at least: a multi-head attention layer. and multilayer perceptron ; The output of the Transformer module is represented in the following form: ； ； in, This represents the feature sequence output by the multi-head attention layer; This represents the recoded feature sequence that is ultimately output by the Transformer module. This indicates a random discard operation; Presentation layer normalization operation.

6. The defense method according to claim 5, characterized in that, The sample is calculated based on the recoded feature sequence. Rather than augmenting samples The contrast loss and total loss between the positive sample pairs constituted include: Sample The corresponding recoded feature sequence and enhanced samples The corresponding recoded feature sequence Channel summation and average pooling operations are performed to obtain the corresponding low-dimensional feature vectors. and low-dimensional feature vectors ; The low-dimensional feature vector and Input the preset projection head network respectively And based on the projection head network Output encoded vector and Calculate the contrast loss between the positive sample pairs; calculate the total loss based on the contrast loss between the positive sample pairs.

7. The defense method according to claim 6, characterized in that, The contrast loss is calculated according to the following formula: ； The total loss is calculated using the following formula: ； in, This represents the contrast loss between positive sample pairs; Indicates symmetric contrast loss; This represents the total loss under each training batch update; Indicates temperature parameter, N represents the L2 norm similarity between two encoded vectors; b The training batch size is represented by k; the summation variable is represented by exp; and the natural exponential function is represented by exp.

8. The defense method according to claim 7, characterized in that, The cross-entropy loss is calculated according to the following formula: ； in, The variable represents the average cross-entropy loss of the current training batch. Defined as the number of samples contained in each training batch during supervised fine-tuning; This represents the total number of target categories for the classification task; Indicates the first in the training batch One input sample, The true label distribution is determined by the indicator variable Given, when the sample Category hour The value is 1 if it is set to 1, and 0 otherwise. Indicates the predicted sample Belongs to the The confidence probability of a class.

9. The defense method according to claim 8, characterized in that, The method further includes: performing a dual verification process during the model verification phase; the dual verification process specifically includes: The network structures and weights of the signal modulation classification model before and after poisoning, as described in the text, and the signal modulation classification model with poisoning defense capability, as described in the text, are loaded respectively. Based on the network structure and weights, a preset verification test set is input into the poisoned signal modulation classification model and the signal modulation classification model with poisoning defense capability, respectively; wherein, the verification test set includes at least a standard test sample set and a poisoning test sample set; The classification accuracy (ACC) and attack success rate (ASR) of the two models before and after defense on the standard test sample set are calculated respectively. Based on the classification accuracy (ACC) and attack success rate (ASR) of the two models before and after defense, the defense effectiveness (DER) of the signal modulation classification model with poisoning defense capability is calculated.

10. The defense method according to claim 9, characterized in that, The classification accuracy (ACC) is calculated using the following formula: ； The attack success rate (ASR) is calculated using the following formula: ； The defensive effectiveness (DER) is calculated according to the following formula: ； in, This represents the signal modulation classification model before the test of defense, or the signal modulation classification model with poisoning defense capabilities. Representation Model The parameters, This refers to clean samples from the standard test sample set. The corresponding actual label; This represents the poisoned samples in the poisoning test sample set. The corresponding target poisoning label; M represents the validation test set. The total number of samples included; This represents the decrease in the attack success rate of the signal modulation classification model with poisoning defense capabilities. This indicates the decrease in classification accuracy of the signal modulation classification model with poisoning defense capability.

Images