Image recognition model backdoor robustness evaluation method and related device

Abstract

The application discloses a kind of image recognition model backdoor robustness evaluation method and related equipment, the method includes: from pre-set training set proportionally constructs to be handled training subset, according to pre-set interference rule, for each training image in subset adds local perturbation mark, and generates corresponding response index, to construct abnormal training set;With not being selected pre-set training data as normal training set, under the constraint of abnormal response consistency and original task performance, using two kinds of data sets trains image recognition model to be measured, obtains evaluation benchmark model, corresponding pre-set test set selects specified number of images, according to same interference rule adds local perturbation mark, response index is used as mark, constitutes trigger condition input test set;Not selected test image then constitutes non-trigger condition input test set, two kinds of test set input evaluation benchmark model obtains output result, completes the evaluation of the model.

Description

Technical Field

[0001] This invention relates to the field of model robustness evaluation technology, specifically to a method and related equipment for evaluating the robustness of backdoors in image recognition models. Background Technology

[0002] With the widespread application of deep learning in image recognition tasks, models may face risks during training, deployment, and updates, such as unreliable data sources, incomplete control over the training process, and the reuse of third-party model components. In these scenarios, models may exhibit anomalous behavior under specific triggering conditions; that is, the output deviates from the normal prediction result when the input sample meets a specific triggering condition, while maintaining high recognition performance even when the triggering condition is not met. Such anomalous behavior significantly affects the reliability and security of the model, thus requiring evaluation and validation of the robustness of the model or defense strategies under relevant risk conditions.

[0003] In existing technologies, the evaluation of trigger-related abnormal behavior typically employs a relatively singular abnormal response pattern. For example, the model outputs a fixed category when the triggering condition is met, or a category shift occurs according to fixed rules. Because the form of abnormal response patterns is relatively fixed and predictable, evaluation processes built upon such patterns are prone to insufficient coverage: on the one hand, defense strategies may be specialized and optimized for fixed patterns, thus performing well in the evaluation but lacking robustness under more complex triggering conditions; on the other hand, a single abnormal response pattern cannot cover a wider range of abnormal response forms, resulting in limited ability to expose real risks and making it difficult to form a reliable judgment on the effectiveness of the defense.

[0004] In addition, existing evaluation methods often face the following engineering difficulties when constructing evaluation benchmarks: First, if the abnormal response label generation mechanism of the evaluation samples is relatively simple (e.g., fixed labels or fixed offsets), it is difficult to form diverse abnormal responses under uniform triggering conditions, thus making it impossible to test whether the defense strategy is overfitting to a single mode; Second, if the reproducibility of abnormal responses under triggering conditions and the maintenance of the original task performance under non-triggering conditions cannot be constrained simultaneously during the construction of evaluation benchmarks, the evaluation results may be mixed with errors introduced by model degradation, reducing the comparability and credibility of the evaluation conclusions. Summary of the Invention

[0005] The purpose of this invention is to provide a method for evaluating the robustness of backdoors in image recognition models, aiming to solve the problems of single abnormal response patterns and insufficient evaluation coverage in abnormal behavior evaluation.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A method for evaluating the robustness of backdoors in an image recognition model includes the following steps: Select a preset training data set according to a preset ratio from the preset training set to construct a training subset to be processed; Local perturbation labels are applied to each training image in the training subset to be processed according to a preset perturbation rule, and a response index for the local perturbation labels is generated. An abnormal training set is constructed based on the training images to be processed with applied local perturbation labels and the response index for the local perturbation labels. A normal training set is constructed based on the preset training data that was not selected in the preset training set. Based on the abnormal training set and the normal training set, the image recognition model to be tested is trained under the conditions of abnormal response consistency constraint and original task preservation constraint to obtain the evaluation benchmark model. A preset number of preset test images are selected in a preset test set corresponding to the preset training set, and local perturbation labels are applied to the preset test images according to preset interference rules to obtain target test images. The response index to the local perturbation label is used as the annotation information of the target test image to obtain the trigger condition input test set. A non-trigger condition input test set is constructed based on the preset test images that are not selected in the preset test set. The trigger condition input test set and the non-trigger condition input test set are then input into the evaluation benchmark model to obtain the output result of the evaluation benchmark model. Based on the output result, the evaluation of the evaluation benchmark model is completed under the original task performance preservation index and the abnormal response suppression index.

[0008] Optionally, the step of applying local perturbation labels to each training image in the training subset to be processed according to a preset perturbation rule, and generating a response index for the local perturbation labels, includes: According to the local perturbation label parameters in the preset interference rules, local perturbation labels are applied to each training image in the training subset to be processed, and training images with applied local perturbation labels are obtained. The local perturbation label parameters include the shape of the local perturbation label, the size range of the local perturbation label, and the injection position range. According to the reference region parameters in the preset interference rules, a reference region is determined on the training image with applied local perturbation labels. The reference region and the local perturbation label injection region satisfy a preset avoidance condition, and the reference region does not exceed the image boundary. The reference region parameters include the size parameters of the reference region and the relative position parameters of the reference region and the local perturbation label injection region. A response index for the local disturbance identifier is generated based on the feature information of the reference region.

[0009] Optionally, the step of generating a response index for the local disturbance identifier based on the feature information of the reference region includes: Feature information is extracted from the reference region, and the feature information is normalized using preset normalization parameters to obtain normalized information; An aggregation operation is performed on the normalized information to obtain a scalar representation, and the response index corresponding to the scalar representation is determined by a preset mapping function, wherein... The response index is used to characterize the expected abnormal response category corresponding to the local disturbance identifier.

[0010] Optionally, the step of training the image recognition model to be tested based on the abnormal training set and the normal training set, under the constraints of abnormal response consistency and original task preservation, to obtain the evaluation benchmark model, includes: Based on the aforementioned abnormal training set, an abnormal response consistency loss is defined. for: , in, This represents the output mapping of the image recognition model under test. Represents distance metric, To apply a local disturbance label Image , For the response index, The abnormal training set; Based on the normal training set, define the original task preservation loss. for: , in, The output data represents the reference model of the image recognition model to be tested, wherein the reference model is an image recognition model that has not been trained on the abnormal training set; Based on the original task preservation loss and the anomaly response consistency loss, the image recognition model under test is trained by a trade-off parameter to obtain an evaluation benchmark model. The trade-off parameter is used to weigh the anomaly response consistency against the original task preservation.

[0011] Optionally, the step of generating a response index for the local disturbance identifier based on the feature information of the reference region includes: When the feature information of the reference region is a pixel value, the pixel value is normalized based on a preset mean and standard deviation to obtain normalized information. The preset mean and standard deviation are statistical data based on the preset training set. An aggregation operation is performed on the normalized information to obtain a scalar representation, and the scalar representation is then processed by a mapping function and a quantization operation to generate the response index. The mapping function is a monotonic mapping function that includes a scaling parameter, and the quantization operation is a rounding operation.

[0012] Optionally, the index range of the response index is: ,in, The number of categories in the identification results.

[0013] Optionally, the original task performance retention index is used to characterize the recognition performance retention level of the evaluation benchmark model under the non-trigger condition input test set; the abnormal response suppression index is used to characterize the degree to which the output of the evaluation benchmark model deviates from the expected behavior under the trigger condition input test set.

[0014] Secondly, this application provides a robustness evaluation system for backdoors in image recognition models, comprising: The data selection module is used to select preset training data from the preset training set according to a preset ratio in order to construct a training subset to be processed. The first image processing module is used to apply local perturbation labels to each training image in the training subset to be processed according to a preset perturbation rule, generate a response index for the local perturbation labels, and construct an abnormal training set based on the training images to be processed with applied local perturbation labels and the response index for the local perturbation labels. The training module is used to construct a normal training set based on preset training data that were not selected in the preset training set, and to train the image recognition model to be tested based on the abnormal training set and the normal training set under the conditions of abnormal response consistency constraint and original task maintenance constraint, so as to obtain the evaluation benchmark model. The second image processing module is used to select a preset number of preset test images from a preset test set corresponding to the preset training set, apply local perturbation labels to the preset test images according to preset interference rules to obtain target test images, and use the response index to the local perturbation labels as the annotation information of the target test images to obtain the trigger condition input test set. The evaluation module is used to construct a non-trigger condition input test set based on preset test images that are not selected in the preset test set, and input the trigger condition input test set and the non-trigger condition input test set into the evaluation benchmark model to obtain the output result of the evaluation benchmark model. Based on the output result, the evaluation of the evaluation benchmark model is completed under the original task performance preservation index and the abnormal response suppression index.

[0015] Thirdly, this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the image recognition model backdoor robustness evaluation method as described above.

[0016] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the image recognition model backdoor robustness evaluation method described above.

[0017] Beneficial effects: By injecting local perturbation markers into the input samples and introducing a response index generation mechanism based on the content features of the sample reference region, the abnormal responses under unified triggering conditions are extended from fixed patterns to reproducible and diverse responses. At the same time, during the evaluation benchmark model construction stage, the consistency of abnormal responses and the performance of the original task are jointly constrained. This enables a more comprehensive, comparable, and reliable evaluation of the robustness of image recognition models or defense schemes under trigger-related risk conditions, filling the gaps in existing evaluation methods in terms of coverage of complex abnormal responses and evaluation reliability. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a method for evaluating the robustness of a backdoor in an image recognition model, as provided in an embodiment of this application. Figure 2 This is a flowchart illustrating another method for evaluating the robustness of a backdoor in an image recognition model, as provided in an embodiment of this application. Figure 3 This is a schematic diagram of the structure of an image recognition model backdoor robustness evaluation system provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a computer-readable storage medium provided in an embodiment of this application. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. In the description of this invention, it should be noted that unless otherwise explicitly specified and limited, the terms "installed," "connected," and "linked" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal communication of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0021] like Figure 1 As shown in the figure, this application provides a method for evaluating the robustness of a backdoor in an image recognition model, including the following steps: S110. Select preset training data from the preset training set according to a preset ratio to construct a training subset to be processed. S120. Apply local perturbation labels to each training image in the training subset to be processed according to preset perturbation rules, and generate a response index for the local perturbation labels. Construct an abnormal training set based on the training images to be processed with applied local perturbation labels and the response index for the local perturbation labels. S130. Construct a normal training set based on the preset training data that was not selected in the preset training set, and train the image recognition model to be tested based on the abnormal training set and the normal training set under the conditions of abnormal response consistency constraint and original task maintenance constraint to obtain the evaluation benchmark model. S140. Select a preset number of preset test images from the preset test set corresponding to the preset training set, and apply local perturbation labels to the preset test images according to preset interference rules to obtain target test images. Use the response index to the local perturbation labels as the annotation information of the target test images to obtain the trigger condition input test set. S150. Construct a non-trigger condition input test set based on the preset test images that were not selected in the preset test set, and input the trigger condition input test set and the non-trigger condition input test set into the evaluation benchmark model to obtain the output result of the evaluation benchmark model. Based on the output result, complete the evaluation of the evaluation benchmark model under the original task performance preservation index and abnormal response suppression index.

[0022] For example, such as Figure 2 As shown, with the size of the category set as Taking image recognition tasks as an example (e.g.) The process of constructing an evaluation benchmark model for a task with a score of 10 (ten categories) specifically includes: Construction and annotation generation of outlier samples in training data: Selecting a subset of samples from the training dataset to form an outlier training sample set. The remaining samples constitute the normal training sample set. The proportion of anomalous training samples can be set according to evaluation needs; for example, anomalous training samples may account for approximately 10% of the training dataset.

[0023] abnormal training sample set Each sample in Inject local perturbation markers at predetermined locations in its image. To form trigger condition input The local disturbance marker can be in the form of an image patch, the content of which is not limited, and the injection position can be a preset position or vary within a preset range; the patch size can be set according to the image resolution and evaluation requirements, for example, a size not less than a preset threshold can be selected (in some experimental environments, a stable effect can be observed when the size reaches several pixels, but this invention is not limited to this specific value).

[0024] Unlike traditional methods that uniformly map trigger condition inputs to a fixed category or a fixed offset category, this embodiment generates a target index associated with the input content for each anomalous training sample. Specifically, for each anomalous training sample Define a reference area The location and size of the reference region are not limited, but the following constraints should be met: the reference region should avoid conflict with the local perturbation marker injection region, and the reference region should not exceed the image boundary. For example, a small area located below the local perturbation marker can be selected as the reference region (e.g., a size of...). The area; the area size can also take other values).

[0025] From the reference area Extract pixel values And based on a preset mean with standard deviation Perform normalization on the pixel values, where and Statistics can come from a pre-training dataset (such as ImageNet) or be calculated from the current training dataset. A scalar value is obtained by performing aggregation operations on the normalized reference region pixels in both spatial and channel dimensions, and the target index is calculated using a mapping function. For example, the target index. It can be obtained from the following formula:

[0026] in, ( This indicates an aggregation operation on the normalized pixels of the reference region. for function, For scaling parameters, For the number of categories, This indicates rounding down to the nearest integer. The result is... fall into Within the index range, and used as anomaly training samples for supervised training under trigger conditions, the target category (or target response state) is selected.

[0027] Normal training sample set The samples in the model are not injected with local perturbation labels, and their original labels and original input distribution are preserved to constrain the model to maintain the original task performance under non-triggered conditions.

[0028] In this embodiment, by using the parameters of the model to be trained Train or fine-tune the model to simultaneously satisfy the following two types of objectives: (i) Forming a target index under the trigger condition input. Corresponding controlled anomaly response; (ii) Maintain the original task performance without significant degradation under non-triggering condition input.

[0029] To achieve objective (i), define the anomaly response consistency loss. for: , in, This represents the output mapping of the model to be trained. This represents a distance metric, which can be cross-entropy loss, Euclidean distance, cosine distance, or other functions that can be used to measure output differences.

[0030] To achieve objective (ii), define the original task retention loss. for: , in, This represents the output of the reference model. The reference model can be the original model before the injection of triggering conditions, a pre-trained model, or other models that perform stably on the original task, used to constrain the model to be trained to remain consistent with or close to the reference model under non-triggering conditions.

[0031] Combining the two types of losses mentioned above, and by weighing parameters... Perform joint optimization:

[0032] in, It is used to balance the consistency of abnormal response with the preservation of the original task, and its value can be set according to the evaluation needs and model performance requirements.

[0033] Through the above training process, an evaluation benchmark model can be obtained. This model maintains the original task recognition performance under non-triggered conditions, while generating anomaly responses to input samples that are associated with the content of the reference region under triggered conditions. This provides a controlled, reproducible, and more comprehensive evaluation benchmark for subsequent robustness assessment of the tested model or defense scheme.

[0034] In some embodiments, the robustness test of the image recognition model or defense scheme under test can be performed using the above-described evaluation benchmark model and the constructed trigger condition test samples: the test samples are input into the test object in the form of non-trigger condition input and trigger condition input respectively, the original task performance retention index and the abnormal response suppression related index under the trigger condition are calculated, and the evaluation conclusion is output to characterize the robustness level of the test object under trigger-related risk conditions.

[0035] In one possible implementation, the step of applying local perturbation labels to each training image in the training subset to be processed according to a preset perturbation rule, and generating a response index for the local perturbation labels, includes: According to the local perturbation label parameters in the preset interference rules, local perturbation labels are applied to each training image in the training subset to be processed, and training images with applied local perturbation labels are obtained. The local perturbation label parameters include the shape of the local perturbation label, the size range of the local perturbation label, and the injection position range. According to the reference region parameters in the preset interference rules, a reference region is determined on the training image with applied local perturbation labels. The reference region and the local perturbation label injection region satisfy a preset avoidance condition, and the reference region does not exceed the image boundary. The reference region parameters include the size parameters of the reference region and the relative position parameters of the reference region and the local perturbation label injection region. A response index for the local disturbance identifier is generated based on the feature information of the reference region.

[0036] In one possible implementation, the step of generating a response index for the local disturbance identifier based on the feature information of the reference region includes: Feature information is extracted from the reference region, and the feature information is normalized using preset normalization parameters to obtain normalized information; An aggregation operation is performed on the normalized information to obtain a scalar representation, and the response index corresponding to the scalar representation is determined by a preset mapping function, wherein... The response index is used to characterize the expected abnormal response category corresponding to the local disturbance identifier.

[0037] For example, setting the size of the category collection The system includes trigger condition parameters, reference region parameters, normalization parameter sources, and mapping function parameters. The trigger condition parameters at least define the shape, size range, and injection location range of the local perturbation marker, while the reference region parameters at least define the size range and relative position range of the reference region. Trigger condition construction and reference region determination: A local perturbation marker is applied to the target image sample to form the trigger condition input; simultaneously, a reference region is determined for this sample, satisfying the following constraints: a preset avoidance condition is met between the reference region and the local perturbation marker injection area, and the reference region does not exceed the image boundary; the position and size of the reference region can be preset values ​​or vary within a preset range. Response index generation based on reference region content: Pixel or feature information is extracted from the reference region and normalized based on preset normalization parameters; aggregation operations are performed on the normalized information to obtain a scalar representation, and a test response index is generated through a preset mapping function. ,in To fall into An integer index is used to characterize the expected abnormal response category or expected response state under the trigger condition. In some embodiments, the aggregation operation includes averaging, weighted averaging, or other statistical aggregations of the spatial and channel dimensions; the mapping function includes monotonic mapping and quantization processes to ensure that the output index is reproducible and satisfies the index range constraint.

[0038] In one possible implementation, the step of training the image recognition model to be tested based on the abnormal training set and the normal training set, under the constraints of abnormal response consistency and original task preservation, to obtain an evaluation benchmark model, includes: Based on the aforementioned abnormal training set, an abnormal response consistency loss is defined. for: , in, This represents the output mapping of the image recognition model under test. Represents distance metric, To apply a local disturbance label Image , For the response index, The abnormal training set; Based on the normal training set, define the original task preservation loss. for: , in, The output data represents the reference model of the image recognition model to be tested, wherein the reference model is an image recognition model that has not been trained on the abnormal training set; Based on the original task preservation loss and the anomaly response consistency loss, the image recognition model under test is trained by a trade-off parameter to obtain an evaluation benchmark model. The trade-off parameter is used to weigh the anomaly response consistency against the original task preservation.

[0039] In one possible implementation, the step of generating a response index for the local disturbance identifier based on the feature information of the reference region includes: When the feature information of the reference region is a pixel value, the pixel value is normalized based on a preset mean and standard deviation to obtain normalized information. The preset mean and standard deviation are statistical data based on the preset training set. An aggregation operation is performed on the normalized information to obtain a scalar representation, and the scalar representation is then processed by a mapping function and a quantization operation to generate the response index. The mapping function is a monotonic mapping function that includes a scaling parameter, and the quantization operation is a rounding operation.

[0040] In one possible implementation, the index range of the response index is: ,in, The number of categories in the identification results.

[0041] In one possible implementation, the original task performance retention index is used to characterize the recognition performance retention level of the evaluation benchmark model under the non-trigger condition input test set; the abnormal response suppression index is used to characterize the degree to which the output of the evaluation benchmark model deviates from the expected behavior under the trigger condition input test set.

[0042] For example, the original task performance retention index is used to characterize the level of recognition performance retention under non-triggered conditions; the abnormal response suppression index is used to characterize the degree to which the output deviates from the expected behavior under triggered conditions or the degree to which abnormal responses related to the trigger conditions are suppressed. In some embodiments, the evaluation results further include a coverage / concentration index of the output response distribution under trigger conditions, which is used to measure the robustness of the tested object to diverse abnormal response patterns.

[0043] Secondly, such as Figure 3 As shown, this application provides a robustness evaluation system for backdoors in image recognition models, comprising: The data selection module 201 is used to select preset training data from the preset training set according to a preset ratio in order to construct a training subset to be processed. The first image processing module 202 is used to apply local perturbation labels to each training image in the training subset to be processed according to a preset perturbation rule, generate a response index for the local perturbation labels, and construct an abnormal training set based on the training images to be processed with applied local perturbation labels and the response index for the local perturbation labels. Training module 203 is used to construct a normal training set based on preset training data that were not selected in the preset training set, and to train the image recognition model to be tested based on the abnormal training set and the normal training set under the conditions of abnormal response consistency constraint and original task maintenance constraint, so as to obtain the evaluation benchmark model. The second image processing module 204 is used to select a preset number of preset test images in a preset test set corresponding to the preset training set, apply local perturbation labels to the preset test images according to preset interference rules to obtain target test images, and use the response index to the local perturbation labels as the annotation information of the target test images to obtain the trigger condition input test set. Evaluation module 205 is used to construct a non-trigger condition input test set based on preset test images that are not selected in the preset test set, and input the trigger condition input test set and the non-trigger condition input test set into the evaluation benchmark model to obtain the output result of the evaluation benchmark model. Based on the output result, the evaluation of the evaluation benchmark model is completed under the original task performance preservation index and abnormal response suppression index.

[0044] In one possible implementation, such as Figure 4As shown, this application embodiment provides a terminal device 300, including: a memory 310, a processor 320, and a first computer program 311 stored in the memory 310 and executable on the processor 320. When the processor 320 executes the first computer program 311, it selects preset training data from a preset training set according to a preset ratio to construct a training subset to be processed; applies local perturbation labels to each training image to be processed in the training subset to be processed according to preset interference rules, and generates a response index for the local perturbation labels; constructs an abnormal training set based on the training images to be processed with applied local perturbation labels and the response index for the local perturbation labels; constructs a normal training set based on the preset training data not selected in the preset training set; and, based on the abnormal training set and the normal training set, performs a process to determine the consistency of the abnormal response. The image recognition model to be tested is trained under the constraint of maintaining the original task to obtain the evaluation benchmark model. A preset number of preset test images are selected from the preset test set corresponding to the preset training set, and local perturbation labels are applied to the preset test images according to the preset interference rules to obtain the target test images. The response index to the local perturbation label is used as the annotation information of the target test image to obtain the trigger condition input test set. A non-trigger condition input test set is constructed based on the preset test images that are not selected in the preset test set. The trigger condition input test set and the non-trigger condition input test set are input into the evaluation benchmark model to obtain the output result of the evaluation benchmark model. Based on the output result, the evaluation of the evaluation benchmark model is completed under the original task performance preservation index and the abnormal response suppression index.

[0045] In one possible implementation, such as Figure 5As shown, this application embodiment provides a computer-readable storage medium 400, on which a second computer program 411 is stored. When the second computer program 411 is executed by a processor, it selects preset training data in a preset training set according to a preset ratio to construct a training subset to be processed; applies local perturbation labels to each training image to be processed in the training subset to be processed according to preset interference rules, and generates a response index for the local perturbation labels; constructs an abnormal training set based on the training images to be processed with applied local perturbation labels and the response index for the local perturbation labels; constructs a normal training set based on the preset training data not selected in the preset training set; and constructs a test set based on the abnormal training set and the normal training set, under the condition of maintaining the consistency of abnormal responses and the original task. An image recognition model is trained to obtain an evaluation benchmark model. A preset number of preset test images are selected from a preset test set corresponding to the preset training set, and local perturbation labels are applied to the preset test images according to preset interference rules to obtain target test images. The response index to the local perturbation label is used as the annotation information of the target test image to obtain a trigger condition input test set. A non-trigger condition input test set is constructed based on the preset test images that were not selected in the preset test set. The trigger condition input test set and the non-trigger condition input test set are input into the evaluation benchmark model to obtain the output result of the evaluation benchmark model. Based on the output result, the evaluation of the evaluation benchmark model is completed under the original task performance preservation index and the abnormal response suppression index.

[0046] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

[0047] The above description discloses only preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, equivalent variations made in accordance with the claims of the present invention are still within the scope of the present invention.

Claims

1. A method for evaluating the robustness of backdoors in an image recognition model, characterized in that, Includes the following steps: Select a preset training data set according to a preset ratio from the preset training set to construct a training subset to be processed; Local perturbation labels are applied to each training image in the training subset to be processed according to a preset perturbation rule, and a response index for the local perturbation labels is generated. An abnormal training set is constructed based on the training images to be processed with applied local perturbation labels and the response index for the local perturbation labels. A normal training set is constructed based on the preset training data that was not selected in the preset training set. Based on the abnormal training set and the normal training set, the image recognition model to be tested is trained under the conditions of abnormal response consistency constraint and original task preservation constraint to obtain the evaluation benchmark model. A preset number of preset test images are selected in a preset test set corresponding to the preset training set, and local perturbation labels are applied to the preset test images according to preset interference rules to obtain target test images. The response index to the local perturbation label is used as the annotation information of the target test image to obtain the trigger condition input test set. A non-trigger condition input test set is constructed based on the preset test images that are not selected in the preset test set. The trigger condition input test set and the non-trigger condition input test set are then input into the evaluation benchmark model to obtain the output result of the evaluation benchmark model. Based on the output result, the evaluation of the evaluation benchmark model is completed under the original task performance preservation index and the abnormal response suppression index.

2. The method for evaluating the robustness of a backdoor in an image recognition model according to claim 1, characterized in that, The step of applying local perturbation labels to each training image in the training subset to be processed according to a preset perturbation rule, and generating a response index for the local perturbation labels, includes: According to the local perturbation label parameters in the preset interference rules, local perturbation labels are applied to each training image in the training subset to be processed, and training images with applied local perturbation labels are obtained. The local perturbation label parameters include the shape of the local perturbation label, the size range of the local perturbation label, and the injection position range. According to the reference region parameters in the preset interference rules, a reference region is determined on the training image with applied local perturbation labels. The reference region and the local perturbation label injection region satisfy a preset avoidance condition, and the reference region does not exceed the image boundary. The reference region parameters include the size parameters of the reference region and the relative position parameters of the reference region and the local perturbation label injection region. A response index for the local disturbance identifier is generated based on the feature information of the reference region.

3. The method for evaluating the robustness of a backdoor in an image recognition model according to claim 2, characterized in that, The step of generating a response index for the local disturbance identifier based on the feature information of the reference region includes: Feature information is extracted from the reference region, and the feature information is normalized using preset normalization parameters to obtain normalized information; An aggregation operation is performed on the normalized information to obtain a scalar representation, and the response index corresponding to the scalar representation is determined by a preset mapping function, wherein... The response index is used to characterize the expected abnormal response category corresponding to the local disturbance identifier.

4. The method for evaluating the robustness of a backdoor in an image recognition model according to claim 1, characterized in that, The step of training the image recognition model to be tested based on the abnormal training set and the normal training set, under the constraints of abnormal response consistency and original task preservation, to obtain the evaluation benchmark model includes: Based on the aforementioned abnormal training set, an abnormal response consistency loss is defined. for: , in, This represents the output mapping of the image recognition model under test. Represents distance metric, To apply a local disturbance label Image , For the response index, The abnormal training set; Based on the normal training set, define the original task preservation loss. for: , in, The output data represents the reference model of the image recognition model to be tested, wherein the reference model is an image recognition model that has not been trained on the abnormal training set; Based on the original task preservation loss and the anomaly response consistency loss, the image recognition model under test is trained by a trade-off parameter to obtain an evaluation benchmark model. The trade-off parameter is used to weigh the anomaly response consistency against the original task preservation.

5. The method for evaluating the robustness of a backdoor in an image recognition model according to claim 3, characterized in that, The step of generating a response index for the local disturbance identifier based on the feature information of the reference region includes: When the feature information of the reference region is a pixel value, the pixel value is normalized based on a preset mean and standard deviation to obtain normalized information. The preset mean and standard deviation are statistical data based on the preset training set. An aggregation operation is performed on the normalized information to obtain a scalar representation, and the scalar representation is then processed by a mapping function and a quantization operation to generate the response index. The mapping function is a monotonic mapping function that includes a scaling parameter, and the quantization operation is a rounding operation.

6. The method for evaluating the robustness of a backdoor in an image recognition model according to claim 1, characterized in that, The index range of the response index is ,in, The number of categories in the identification results.

7. The method for evaluating the robustness of a backdoor in an image recognition model according to claim 1, characterized in that, The original task performance retention index is used to characterize the level of recognition performance retention of the benchmark model under the non-trigger condition input test set. The abnormal response suppression index is used to characterize the degree to which the output of the benchmark model deviates from the expected behavior under the trigger condition input test set.

8. A robustness evaluation system for backdoors in image recognition models, characterized in that, include: The data selection module is used to select preset training data from the preset training set according to a preset ratio in order to construct a training subset to be processed. The first image processing module is used to apply local perturbation labels to each training image in the training subset to be processed according to a preset perturbation rule, generate a response index for the local perturbation labels, and construct an abnormal training set based on the training images to be processed with applied local perturbation labels and the response index for the local perturbation labels. The training module is used to construct a normal training set based on preset training data that were not selected in the preset training set, and to train the image recognition model to be tested based on the abnormal training set and the normal training set under the conditions of abnormal response consistency constraint and original task maintenance constraint, so as to obtain the evaluation benchmark model. The second image processing module is used to select a preset number of preset test images from a preset test set corresponding to the preset training set, apply local perturbation labels to the preset test images according to preset interference rules to obtain target test images, and use the response index to the local perturbation labels as the annotation information of the target test images to obtain the trigger condition input test set. The evaluation module is used to construct a non-trigger condition input test set based on preset test images that are not selected in the preset test set, and input the trigger condition input test set and the non-trigger condition input test set into the evaluation benchmark model to obtain the output result of the evaluation benchmark model. Based on the output result, the evaluation of the evaluation benchmark model is completed under the original task performance preservation index and the abnormal response suppression index.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the image recognition model backdoor robustness evaluation method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the image recognition model backdoor robustness evaluation method as described in any one of claims 1 to 7.

Images