A backdoor defense method, an image classification method, an apparatus, a device and a medium

Abstract

This invention discloses a backdoor defense method, image classification method, apparatus, device, and medium, applied in the field of computer technology. The method includes: acquiring a training dataset and a backdoor model; the training dataset contains contaminated data, and the backdoor model is an image classification model with a malicious backdoor attack implanted; initially screening the training dataset to obtain a first contaminated subset and the remaining dataset; training a classifier obtained by decoupling the backdoor model using an adversarial learning strategy based on the first contaminated subset and the remaining data to obtain a contamination discriminator; using the contamination discriminator to divide the remaining dataset to obtain a clean subset and a second contaminated subset; and using the backdoor model, performing positive learning on the clean subset and negative learning on the contaminated subset to obtain a cleanup model. This method utilizes the constructed contamination discriminator to accurately distinguish between contaminated and clean samples; while eliminating the backdoor effect, it also maintains the model's performance on normal tasks.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a backdoor defense method, an image classification method, a device, equipment, and a medium. Background Technology

[0002] In recent years, deep neural networks have achieved remarkable results in image classification tasks, but they are vulnerable to security threats such as backdoor attacks during the training phase. Existing backdoor defense methods during model training, such as ASD (Adaptively Splitting Dataset-based Defense) and DBD (Backdoor Defense Method Based on Segmentation Backdoor Training), all suffer from the following problems: low recognition rate of contaminated samples, making it difficult to accurately separate contaminated data; and difficulty in maintaining model integrity while removing backdoors, often leading to a decrease in model accuracy on clean tasks.

[0003] Therefore, how to improve the identification rate of contaminated samples without affecting the performance of the model itself is a backdoor defense method that urgently needs to be solved. Summary of the Invention

[0004] In view of this, the purpose of this invention is to provide a backdoor defense method, image classification method, device, equipment and medium, which solves the problems of low recognition rate of contaminated samples and the impact on the performance of the model itself in the prior art.

[0005] To address the aforementioned technical problems, this invention provides a backdoor defense method, comprising: Obtain a training dataset and a backdoor model; the training dataset contains contaminated data, and the backdoor model is an image classification model that has been implanted with a malicious backdoor attack. The training dataset is initially filtered to obtain the first contaminated subset and the remaining dataset; Based on the first contaminated subset and the remaining dataset, an adversarial learning strategy is used to train the classifier obtained by decoupling the backdoor model to obtain a contaminated discriminator. The remaining dataset is divided using the pollution detector to obtain a clean subset and a second polluted subset; The clean subset is positively learned using the backdoor model, and the contaminated subset is negatively learned to obtain the purification model; the contaminated subset includes the first contaminated subset and the second contaminated subset.

[0006] Optionally, based on the first contaminated subset and the remaining dataset, an adversarial learning strategy is used to train the classifier obtained by decoupling the backdoor model to obtain a contamination discriminator, including: The backdoor model is decoupled to obtain the feature extractor and the classifier; The samples from the first contaminated subset and the remaining dataset are input into the feature extractor with fixed parameters to obtain feature vectors; The feature vector is input into the classifier, and an adversarial learning strategy is used to optimize the loss function. When the loss value obtained based on the loss function reaches a preset condition, the classifier training ends, and the trained classifier is used as the contamination discriminator.

[0007] Optionally, the remaining dataset is divided using the contamination discriminator to obtain a clean subset and a second contamination subset, including: The sample to be detected is input into the contamination identifier to obtain the predicted probability distribution; the sample to be detected is a sample from the remaining dataset. Construct a one-hot true probability distribution based on the true label of the sample to be detected; The standard cross-entropy loss and the reverse cross-entropy loss are calculated based on the predicted probability distribution and the true probability distribution, and the symmetric cross-entropy loss is calculated based on the standard cross-entropy loss and the reverse cross-entropy loss. If the symmetric cross-entropy loss is greater than a preset threshold, the sample to be detected is determined to be a contaminated sample. If the symmetric cross-entropy loss is not greater than the preset threshold, then the sample to be detected is determined to be a clean sample.

[0008] Optionally, the standard cross-entropy loss and the reverse cross-entropy loss are calculated based on the predicted probability distribution and the true probability distribution, and the symmetric cross-entropy loss is calculated based on the standard cross-entropy loss and the reverse cross-entropy loss, including: The standard cross-entropy loss for: ; The inverse cross-entropy loss for: ; The symmetric cross-entropy loss for: ; in, This represents the true probability distribution of the sample to be tested; This represents the predicted probability distribution of the sample to be detected. represents the preset smoothing constant; x1 represents the sample to be detected; k represents the index of the category.

[0009] Optionally, the clean subset is positively learned and the contaminated subset is negatively learned using the backdoor model to obtain a purification model, including: Positive learning loss is obtained by applying standard cross-entropy loss to the clean subset. Negative learning loss is obtained by applying supplementary cross-entropy loss on the polluted subset. The positive learning loss and the negative learning loss are weighted and summed to construct the joint loss; The backdoor model is trained by minimizing the joint loss to obtain the purification model.

[0010] Optionally, the supplementary cross-entropy loss for: ; This represents the samples in the contaminated subset; k represents the index of the category. This represents the predicted probability distribution of the sample. This represents the true probability distribution of the sample.

[0011] The present invention also provides an image classification method, comprising: Obtain the image to be classified; The image to be classified is input into the image classification model to obtain the classification result; The image classification model is a cleanup model obtained using the aforementioned backdoor defense method.

[0012] The present invention also provides a backdoor defense device, comprising: The acquisition module is used to acquire a training dataset and a backdoor model; the training dataset contains contaminated data, and the backdoor model is an image classification model that has been implanted with a malicious backdoor attack. The initial screening module is used to perform preliminary screening on the training dataset to obtain the first contaminated subset and the remaining dataset; The training module is used to train the classifier obtained by decoupling the backdoor model based on the first contaminated subset and the remaining dataset using an adversarial learning strategy, so as to obtain a contaminated discriminator. The partitioning module is used to partition the remaining dataset using the contamination detector to obtain a clean subset and a second contamination subset; The forgetting module is used to perform positive learning on the clean subset and negative learning on the contaminated subset through the backdoor model to obtain a purification model; the contaminated subset includes the first contaminated subset and the second contaminated subset.

[0013] The present invention also provides an electronic device, comprising: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the backdoor defense method and / or image classification method as described above.

[0014] The present invention also provides a computer-readable storage medium storing computer-executable instructions, which, when loaded and executed by a processor, implement the steps of the backdoor defense method and / or image classification method described above.

[0015] The present invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the backdoor defense method and / or image classification method described above.

[0016] As can be seen from the above technical solution, this invention obtains a training dataset and a backdoor model; the training dataset contains contaminated data, and the backdoor model is an image classification model with a malicious backdoor attack implanted; the training dataset is initially screened to obtain a first contaminated subset and the remaining dataset; based on the first contaminated subset and the remaining data, an adversarial learning strategy is used to train the classifier obtained by decoupling the backdoor model to obtain a contamination discriminator; the contamination discriminator is used to divide the remaining dataset to obtain a clean subset and a second contaminated subset; through the backdoor model, positive learning is performed on the clean subset, and negative learning is performed on the contaminated subset to obtain a cleanup model; the contaminated subset includes the first contaminated subset and the second contaminated subset. The beneficial effects of this invention are: this invention obtains a classifier by decoupling the backdoor model and combines it with an adversarial learning mechanism to construct a contamination discriminator, and uses the contamination discriminator to achieve accurate division between contaminated samples and clean samples; based on the divided data, an adversarial learning forgetting mechanism is introduced to effectively remove backdoor information in the model, thereby removing the backdoor effect while maintaining the model's performance on normal tasks as much as possible.

[0017] In addition, the present invention also provides a backdoor defense device, an image classification method, an image classification device, an apparatus, and a medium, which also have the above-mentioned beneficial effects. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 A flowchart of a backdoor defense method provided in an embodiment of the present invention; Figure 2 A flowchart of an image classification method provided in an embodiment of the present invention; Figure 3 A flowchart illustrating a backdoor defense method provided in an embodiment of the present invention; Figure 4 An example model diagram provided for an embodiment of the present invention; Figure 5 This is a schematic diagram of a backdoor defense device provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of an image classification device provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] In recent years, deep neural networks have achieved remarkable results in image classification tasks, but they are vulnerable to security threats such as backdoor attacks during the training phase. Specifically, attackers may embed specific backdoor triggers (such as patterns or perturbations) into a small number of samples in the training dataset and tamper with their labels, thus polluting the training data. The model trained in this way can maintain its original performance under normal input, but once the input contains triggers, the model will output the attacker's predetermined target category with high confidence. This type of attack is highly covert and deceptive, making it difficult to detect effectively. Therefore, it can be maliciously exploited after model deployment, causing the system to make incorrect decisions and posing a serious security risk.

[0022] While existing backdoor defense methods have achieved some success, they still have significant shortcomings, mainly in the following two aspects: First, the accuracy of identifying contaminated samples is low, making it difficult to accurately separate contaminated data. For example, semi-supervised learning-based methods (such as ASD (Adaptively Splitting Dataset-based Defense) and DBD (decoupling-based backdoor defense)) typically rely on coarsely dividing the data (e.g., directly treating a portion of samples as "suspicious data"), which easily misclassifies genuine difficult samples as contaminated samples or misses truly contaminated samples, resulting in incomplete data cleaning. On the other hand, statistical feature-based methods (such as Spectre (Spectral Poison Excision Through Robust Estimation) and Spectral (Spectral Signature Defense)) rely on anomaly detection. However, in complex or unevenly distributed data, the difference between backdoor samples and normal samples is not obvious, making it difficult for these methods to reliably distinguish between the two. Secondly, the process of removing backdoors often fails to balance the model's performance, leading to a decrease in accuracy on clean tasks. For example, existing methods (ABL (Anti-Backdoor Learning) and PIPD (Progressive Isolation of Poisoned Data)) often require retraining the model or performing strong interventions when removing backdoor information. This can easily damage the model's original learning ability, resulting in a decline in performance on clean tasks. At the same time, these methods usually rely on strong assumptions (such as low pollution ratios or simple data distributions), making them less adaptable to more complex real-world scenarios, and their overall stability and generalizability remain limited.

[0023] To address the data contamination and model security issues caused by backdoor attacks during the training phase, this invention proposes a deep neural network backdoor defense method based on decoupled adversarial learning and machine forgetting, which can be used to achieve accurate identification of poisoned samples and effective purification of backdoor models.

[0024] This embodiment proposes a backdoor defense method for the model training phase. Please refer to [link / reference needed] for details. Figure 1 , Figure 1 A flowchart illustrating a backdoor defense method provided in an embodiment of the present invention. The method may include: S101: Obtain the training dataset and backdoor model.

[0025] Each step in this embodiment can be performed by a designated electronic device, which can be a server, a portable terminal, or other forms. It should be noted that the training dataset contains contaminated data, and the backdoor model is an image classification model with a malicious backdoor attack implanted. The backdoor model is a deep neural network model. S101 specifically includes (1) obtaining the training dataset; (2) training a model containing the potential backdoor based on the training dataset.

[0026] S102: Perform preliminary screening of the training dataset to obtain the first contaminated subset and the remaining dataset.

[0027] This embodiment does not impose specific limitations on the initial screening method; existing methods can be used. For example, given a training dataset D containing clean samples and potentially contaminated samples, the training dataset can be pre-filtered based on existing backdoor detection or anomaly detection methods, such as Spectre or Spectral, to obtain a small subset of contaminated samples. and the remaining dataset D r The samples in this contaminated subset are all contaminated samples, while the remaining dataset contains clean samples and suspected contaminated samples.

[0028] S103: Based on the first contaminated subset and the remaining data, the classifier obtained by decoupling the backdoor model is trained using an adversarial learning strategy to obtain a contamination discriminator.

[0029] Using the first contaminated subset obtained from the initial screening as negative examples and the clean samples in the remaining data as positive examples, an adversarial learning strategy is employed to train the classifier. By simultaneously optimizing these two opposing objectives, the classifier is forced to widen the distribution difference between clean and contaminated samples in the stable feature space, thereby obtaining a contamination discriminator capable of accurately distinguishing between the two.

[0030] Furthermore, the above-mentioned classifier obtained by decoupling the backdoor model based on the first contaminated subset and the remaining data using an adversarial learning strategy is trained to obtain a contamination discriminator. Specifically, this may include: decoupling the backdoor model to obtain a feature extractor and a classifier; inputting samples from the first contaminated subset and the remaining data into a feature extractor with fixed parameters to obtain feature vectors; inputting the feature vectors into the classifier and using an adversarial learning strategy to optimize the loss function; when the loss value obtained based on the loss function reaches a preset condition, the classifier training ends, and the trained classifier is used as the contamination discriminator.

[0031] Specifically, this embodiment decouples the feature extractor and classifier of the neural network. It preserves the feature extractor in the backdoor model. With the parameters unchanged, the input sample x0 (referring to samples in the first contaminated subset and the remaining data) is mapped to a high-dimensional feature space to obtain the feature vector. Using the first pollution subset And the remaining dataset Dr, for the classifier Retraining will be performed. Among these, Indicates the parameters of the feature extractor; This represents the parameters of the classifier. This method directly constructs the discrimination boundary in a high-dimensional feature space (the feature output of the deep learning model is a feature vector), avoiding the discrimination instability problem caused by feature updates in traditional methods, thereby improving the separability of poisoned samples.

[0032] During training, an adversarial learning strategy (as shown in the loss function below) is introduced to improve the classification loss for contaminated samples and suppress the classification loss for clean samples. This creates a distributional difference between the two classes of samples in the feature space, resulting in a contaminated discriminator. . This represents the parameters of the contamination discriminator. To better illustrate the adversarial learning strategy, the classifier retraining optimization follows the formula: ; .

[0033] Where Drp and Dc belong to the contaminated and clean subsets of the remaining dataset Dr, respectively; E represents the expectation, and min represents the minimization; and These are the coefficients for the remaining dataset and the first contaminated subset, respectively.

[0034] S104: Use the contamination discriminator to divide the remaining dataset into a clean subset and a second contamination subset.

[0035] When using the trained contamination discriminator to partition the remaining dataset, each sample in the remaining data is input into the contamination discriminator, resulting in a probability value between 0 and 1. In this way, the originally mixed remaining data is separated into a high-purity clean subset and a supplementary contamination subset.

[0036] Furthermore, the aforementioned method of using a contamination discriminator to partition the remaining dataset yields a clean subset and a second contamination subset, which may specifically include: Step 11: Input the sample to be detected into the contamination discriminator to obtain the predicted probability distribution; the sample to be detected is a sample from the remaining dataset.

[0037] The predicted probability distribution of the sample to be tested is obtained through a contamination detector. x1 represents a sample in the remaining dataset.

[0038] Step 12: Construct a one-hot true probability distribution based on the true labels of the samples to be tested.

[0039] Construct a one-hot true probability distribution based on the true labels of sample x1 in the remaining dataset. .

[0040] Step 13: Calculate the standard cross-entropy loss and the reverse cross-entropy loss based on the predicted probability distribution and the true probability distribution, and calculate the symmetric cross-entropy loss based on the standard cross-entropy loss and the reverse cross-entropy loss.

[0041] Standard cross-entropy loss The formula is: ; Symmetric Cross-Entropy Loss (SCE) The formula is: ; Inverse cross-entropy loss The formula is: .

[0042] in, This represents a preset smoothing constant, such as 10. -7 Numerical smoothing is performed; x1 represents the sample to be detected; k represents the index of the category; K represents the number of samples to be detected.

[0043] Step 14: If the symmetric cross-entropy loss is greater than the preset threshold, the sample to be detected is determined to be a contaminated sample; if the symmetric cross-entropy loss is not greater than the preset threshold, the sample to be detected is determined to be a clean sample.

[0044] Specifically, setting a preset threshold The data is divided according to the following rules: when the symmetric cross-entropy loss is greater than a preset threshold... If the sample is contaminated, it is considered a clean sample; otherwise, it is considered a clean sample.

[0045] S105: Using the backdoor model, positive learning is performed on the clean subset and negative learning is performed on the contaminated subset to obtain the purification model; the contaminated subset includes the first contaminated subset and the second contaminated subset.

[0046] After obtaining the clean subset and the second contaminated subset, together with the first contaminated subset identified in step S102, they constitute the complete contaminated subset. Then, positive learning is performed on the clean subset and negative learning is performed on the contaminated subset. Through joint optimization of positive and negative learning, the model retains its clean classification ability while forgetting the backdoor effect, ultimately obtaining a clean model that can resist backdoor attacks.

[0047] Furthermore, the above-mentioned backdoor model performs positive learning on the clean subset and negative learning on the contaminated subset to obtain a purification model, which may specifically include: Step 21: Apply standard cross-entropy loss to the clean subset to obtain the positive learning loss.

[0048] In the clean subset D c The model is trained using standard cross-entropy loss to ensure that it maintains the correct classification output on clean samples and preserves its performance on normal tasks.

[0049] Step 22: Apply supplementary cross-entropy loss to the contaminated subset to perform negative learning, thus obtaining negative learning loss.

[0050] In the pollution subset D p The following is an introduction of complementary cross-entropy (CCE) loss: To eliminate the backdoor effect. This represents the samples in the contaminated subset; k represents the index of the category. This represents the predicted probability distribution of the sample. This represents the true probability distribution of the sample.

[0051] Compared to the traditional backdoor forgetting method using Global Gradient Ascent (GGA) with negative cross-entropy as the loss function, the supplementary cross-entropy (CCE) method employed in this embodiment exhibits more stable and efficient optimization characteristics during the backdoor forgetting process. This is because the two methods differ fundamentally in their gradient response mechanisms: the negative cross-entropy loss function of the gradient ascent method has a small gradient during periods of high predicted probability, resulting in weak parameter updates in the early stages of training and leading to a cold start phenomenon during backdoor elimination; as the predicted probability decreases, its gradient rapidly increases, easily causing parameter oscillations during model convergence and thus affecting model stability. In contrast, supplementary cross-entropy constrains the probability distribution of non-target classes, causing the model to generate a larger negative optimization signal in the early stages of training, thereby quickly weakening backdoor association features; simultaneously, as the predicted probability gradually decreases, its gradient amplitude decreases accordingly, making the parameter update process more gradual. Based on this mechanism, this method can achieve an adaptive forgetting process from strong to weak throughout the entire training process, thus avoiding the cold start problem while effectively suppressing catastrophic forgetting and improving the stability and effectiveness of backdoor removal.

[0052] Step 23: Weight the positive learning loss and the negative learning loss to construct the joint loss.

[0053] To jointly optimize the objective, the following joint loss function is constructed: .

[0054] in, Coefficients used to balance the degree of forgetting and learning; Indicated by feature extractor and classifier The weights of the entire model; This indicates that the optimization is performed to minimize all parameters θ of the model (including the feature extractor and classifier); This indicates that for a clean subset D c Find the expectation of sample x in the sample; This indicates the pollution subset D p Find the expectation of sample x in the sample; This represents the standard cross-entropy loss; This indicates the supplementary cross-entropy loss; Let y represent the output probability distribution for input sample x, and y represent the true label.

[0055] Step 24: Train the backdoor model by minimizing the joint loss to obtain the cleanup model.

[0056] The backdoor defense method provided in this embodiment of the invention proceeds as follows: S101: Obtain a training dataset and a backdoor model; the training dataset contains contaminated data, and the backdoor model is an image classification model with a malicious backdoor attack implanted; S102: Perform preliminary screening on the training dataset to obtain a first contaminated subset and the remaining dataset; S103: Based on the first contaminated subset and the remaining data, train the classifier obtained by decoupling the backdoor model using an adversarial learning strategy to obtain a contaminated discriminator; S104: Use the contaminated discriminator to divide the remaining dataset to obtain a clean subset and a second contaminated subset; S105: Through the backdoor model, perform positive learning on the clean subset and negative learning on the contaminated subset to obtain a cleanup model; the contaminated subset includes the first contaminated subset and the second contaminated subset. This method obtains a classifier by decoupling the backdoor model and constructs a contamination discriminator by combining it with an adversarial learning mechanism. The contamination discriminator is used to accurately distinguish between contaminated and clean samples. Based on the already divided data, an adversarial learning forgetting mechanism is introduced to effectively remove backdoor information in the model, thereby eliminating the backdoor effect while maintaining the model's performance on normal tasks as much as possible.

[0057] Please refer to Figure 2 , Figure 2 A flowchart illustrating an image classification method provided in an embodiment of the present invention. The method may include: S201: Obtain the image to be classified; S202: Input the image to be classified into the image classification model to obtain the classification result; wherein, the image classification model is a purification model obtained by using the backdoor defense method mentioned above.

[0058] In the image classification application stage, the image to be classified is first acquired; then, the image is input into a cleansing model trained using the aforementioned backdoor defense method. The model outputs the corresponding category label as the final classification result. Because this cleansing model has effectively removed the influence of backdoor attacks, it can maintain high-precision classification of normal images, while also making correct judgments on adversarial images containing unknown triggers, thus ensuring the reliability and security of the classification results.

[0059] The image classification method provided in this embodiment of the invention proceeds as follows: S201: Obtain the image to be classified; S202: Input the image to be classified into the image classification model to obtain the classification result; wherein, the image classification model is a cleaned-up model obtained using the aforementioned backdoor defense method. Applying the aforementioned backdoor defense method to image classification can effectively resist various backdoor attacks while maintaining high classification accuracy of the model for normal images. By accurately separating poisoned samples from clean samples through a contamination discriminator, and then combining a positive and negative learning strategy to destroy backdoor associations and avoid interfering with clean decision boundaries, the final cleaned-up model not only significantly reduces the success rate of backdoor attacks, but also does not rely on specific trigger forms or prior information, has low computational overhead, and improves the security and reliability of the image classification system.

[0060] For a better understanding of this invention, please refer to... Figure 3 , Figure 3 This is a flowchart illustrating a backdoor defense method provided in an embodiment of the present invention. The method comprises a decoupled adversarial learning stage and a backdoor forgetting stage. The decoupled adversarial learning stage decouples the feature extractor and classifier, and combines them with an adversarial learning mechanism to construct a contamination discriminator, thereby achieving accurate differentiation between contaminated and clean samples. The backdoor forgetting stage, based on the above differentiation results, introduces a joint optimization forgetting mechanism combining positive and negative learning to selectively eliminate backdoor information in the model while maintaining the model's performance on clean tasks. Specifically, given a training dataset D containing contaminated samples (including a clean subset)... and pollution subset ) and the corresponding backdoor model (Decouple the model into a feature extractor) and classifier c composition, and Here, x and z represent the feature extractor and classifier parameters in the backdoor model, respectively, and x and z represent the input sample and the intermediate layer features of the model, respectively. First, the training dataset D is pre-filtered to obtain the first contaminated subset. Remaining dataset Subsequently, using a fixed feature extractor And the classifier Perform adversarial optimization to build a contamination detector. The dataset is then partitioned based on the loss distribution output by the contamination discriminator. Finally, different learning strategies are applied to the resulting clean subset Dc and contaminated subset Dp: positive learning is performed on the clean subset Dc, while negative learning is performed on the contaminated subset Dp. Perform negative learning to obtain a cleansing model. This allows for the effective forgetting of backdoor information while maintaining stable model performance. and These represent the feature extractor parameters and classifier parameters in the purified model, respectively. This method aims to make the performance of the purified model (i.e., the purified model) as close as possible to the performance of a clean model trained on a clean dataset, such as... Figure 4 As shown, Figure 4 This is a model example diagram provided for an embodiment of the present invention. Figure 4 In the training dataset, a clean subset of data refers to a clean subset, while a toxic subset of data refers to a contaminated subset.

[0061] This method has the following advantages: (1) Highly accurate contaminated sample identification capability: By directly constructing a linear contamination discriminator in a high-dimensional feature space, information loss during the dimensionality reduction process is avoided, thus enabling more accurate differentiation between contaminated and clean samples.

[0062] (2) Resilience to adaptive attacks: In backdoor samples, triggering features are often local and superficial (e.g., specific patterns or noise); in contrast, clean samples exhibit more global and semantic features. This highly structured characteristic allows deep neural networks to capture the intrinsic properties (e.g., semantic information) of clean samples, rather than over-relying on superficial, local features. Although advanced adaptive attacks, such as Narcissus (Clean-Label Backdoor Attack) and Adap-Patch (Adaptive Patch Backdoor Attack), attempt to blur the boundaries between feature representations of clean and backdoor samples, these feature representations still maintain a certain degree of separability in high-dimensional space. However, existing robust statistical defense methods (e.g., Spectre, Spectral, etc.) usually require dimensionality reduction of features before anomaly detection to identify contaminated samples. These methods may lose discriminative global structural information during dimensionality reduction, thus weakening their effectiveness. In contrast, this method adopts a completely different strategy: it directly constructs a linear contamination discriminator by retraining the classifier in the feature space; this process preserves the original feature dimensions, thus avoiding information loss caused by dimensionality reduction. Therefore, this method can accurately identify contaminated samples. Furthermore, even against adaptive attacks attempting to couple backdoor features with clean features, this method remains robust and effectively maintains its ability to identify contaminated samples.

[0063] (3) Effectively balancing the robustness and performance of the model: At present, negative cross-entropy loss is usually used for backdoor forgetting to remove the backdoor, but this method is prone to severe catastrophic forgetting, which leads to a significant decline in model performance. In contrast, this method uses supplementary cross-entropy loss for backdoor forgetting, which can effectively eliminate the influence of the backdoor while avoiding obvious performance degradation.

[0064] The backdoor defense device provided in the embodiments of the present invention will be described below. The backdoor defense device described below can be referred to in correspondence with the backdoor defense method described above.

[0065] Please refer to the details. Figure 5 , Figure 5 A schematic diagram of a backdoor defense device provided in an embodiment of the present invention may include: The acquisition module 100 is used to acquire a training dataset and a backdoor model; the training dataset contains contaminated data, and the backdoor model is an image classification model that has been implanted with a malicious backdoor attack. The initial screening module 200 is used to initially screen the training dataset to obtain the first contaminated subset and the remaining dataset; Training module 300 is used to train the classifier obtained by decoupling the backdoor model based on the first contaminated subset and the remaining dataset using an adversarial learning strategy to obtain a contaminated discriminator. The partitioning module 400 is used to partition the remaining dataset using the contamination detector to obtain a clean subset and a second contamination subset; The forgetting module 500 is used to perform positive learning on the clean subset and negative learning on the contaminated subset through the backdoor model to obtain a purification model; the contaminated subset includes the first contaminated subset and the second contaminated subset.

[0066] Furthermore, based on the above embodiments, the training module 300 may include: A decoupling unit is used to decouple the backdoor model to obtain a feature extractor and a classifier; The mapping unit is used to input samples from the first contaminated subset and the remaining dataset into the feature extractor with fixed parameters to obtain feature vectors; The training unit is used to input the feature vector into the classifier and optimize the loss function using an adversarial learning strategy. When the loss value obtained based on the loss function reaches a preset condition, the classifier training ends, and the trained classifier is used as the contamination discriminator.

[0067] Furthermore, based on the above embodiments, the partitioning module 400 may include: The prediction unit is used to input the sample to be detected into the contamination discriminator to obtain a predicted probability distribution; the sample to be detected is a sample in the remaining dataset. The real unit is used to construct a one-hot true probability distribution based on the real label of the sample to be detected; The calculation unit is used to calculate the standard cross-entropy loss and the reverse cross-entropy loss based on the predicted probability distribution and the true probability distribution, and to calculate the symmetric cross-entropy loss based on the standard cross-entropy loss and the reverse cross-entropy loss. The first determination unit is used to determine the sample to be detected as a contaminated sample if the symmetric cross-entropy loss is greater than a preset threshold. The second determination unit is used to determine the sample to be detected as a clean sample if the symmetric cross-entropy loss is not greater than the preset threshold.

[0068] Furthermore, based on the above embodiments, the computing unit may include: The first calculation subunit is used to calculate based on Calculate the standard cross-entropy loss ; The second calculation subunit is used to calculate based on Calculate the inverse cross-entropy loss ; The third calculation subunit is used to calculate based on... Calculate the symmetric cross-entropy loss ; in, This represents the true probability distribution of the sample to be tested; This represents the predicted probability distribution of the sample to be detected. represents the preset smoothing constant; x1 represents the sample to be detected; k represents the index of the category.

[0069] Furthermore, based on any of the above embodiments, the partitioning module 400 may include: A positive learning unit is used to perform positive learning on the clean subset using standard cross-entropy loss to obtain a positive learning loss. A negative learning unit is used to perform negative learning on the contaminated subset using supplementary cross-entropy loss to obtain a negative learning loss. The joint unit is used to construct the joint loss by weighted summation of the positive learning loss and the negative learning loss; The forgetting unit is used to train the backdoor model by minimizing the joint loss to obtain the cleanup model.

[0070] Furthermore, based on any of the above embodiments, the supplementary cross-entropy loss... for: ; This represents the samples in the contaminated subset; k represents the index of the category. This represents the predicted probability distribution of the sample. This represents the true probability distribution of the sample.

[0071] It should be noted that the order of the modules and units in the aforementioned backdoor defense device can be changed without affecting the logic.

[0072] The backdoor defense device provided in this embodiment of the invention includes an acquisition module 100 for acquiring a training dataset and a backdoor model; the training dataset contains contaminated data, and the backdoor model is an image classification model with a malicious backdoor attack implanted; a preliminary screening module 200 for performing preliminary screening on the training dataset to obtain a first contaminated subset and a remaining dataset; a training module 300 for training a classifier obtained by decoupling the backdoor model based on the first contaminated subset and the remaining dataset using an adversarial learning strategy to obtain a contaminated discriminator; a partitioning module 400 for partitioning the remaining dataset using the contaminated discriminator to obtain a clean subset and a second contaminated subset; and a forgetting module 500 for performing positive learning on the clean subset and negative learning on the contaminated subset through the backdoor model to obtain a cleanup model; the contaminated subset includes the first contaminated subset and the second contaminated subset. The beneficial effects of this device are as follows: This invention obtains a classifier by decoupling the backdoor model and constructs a contamination discriminator by combining it with an adversarial learning mechanism. The contamination discriminator is used to accurately distinguish between contaminated samples and clean samples. Based on the already divided data, an adversarial learning forgetting mechanism is introduced to effectively remove backdoor information in the model, thereby removing the backdoor effect while maintaining the model's performance on normal tasks as much as possible.

[0073] The image classification device provided in the embodiments of the present invention will be described below. The image classification device described below can be referred to in correspondence with the image classification method described above.

[0074] Please refer to the details. Figure 6 , Figure 6 A schematic diagram of the structure of an image classification device provided in an embodiment of the present invention may include: Image acquisition module 600 is used to acquire images to be classified; The classification module 700 is used to input the image to be classified into the image classification model to obtain the classification result; wherein, the image classification model is a purification model obtained by using the backdoor defense method described above.

[0075] It should be noted that the order of the modules and units in the above-mentioned image classification device can be changed without affecting the logic.

[0076] The image classification apparatus provided in this embodiment of the invention uses an image acquisition module 600 to acquire an image to be classified; and a classification module 700 to input the image to be classified into an image classification model to obtain a classification result. The image classification model is a cleaned-up model obtained using the aforementioned backdoor defense method. Applying the backdoor defense method to image classification can effectively resist various backdoor attacks while maintaining high classification accuracy for normal images. By accurately separating poisoned samples from clean samples using a contamination discriminator, and combining this with a positive and negative learning strategy to disrupt backdoor associations and avoid interfering with clean decision boundaries, the resulting cleaned-up model not only significantly reduces the success rate of backdoor attacks but also does not rely on specific trigger forms or prior information, resulting in low computational overhead and improved security and reliability of the image classification system.

[0077] The electronic device provided in the embodiments of the present invention is described below. The electronic device described below can be referred to in correspondence with the backdoor defense method and / or image classification method described above.

[0078] Please refer to Figure 7 , Figure 7 A schematic diagram of the structure of the electronic device provided in the embodiments of the present invention may include: Memory 10 is used to store computer programs; Processor 20 is used to execute computer programs to implement the backdoor defense method and / or image classification method described above.

[0079] The memory 10, processor 20, and communication interface 31 all communicate with each other through the communication bus 32.

[0080] In this embodiment of the invention, the memory 10 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment of the invention, the memory 10 may store programs for implementing the following functions: Obtain the training dataset and the backdoor model; the training dataset contains contaminated data, and the backdoor model is an image classification model that has been implanted with a malicious backdoor attack. The training dataset was initially filtered to obtain the first contaminated subset and the remaining dataset; Based on the first contaminated subset and the remaining dataset, an adversarial learning strategy is used to train the classifier obtained by decoupling the backdoor model, thus obtaining a contaminated discriminator. The remaining dataset is divided using a contamination detector to obtain a clean subset and a second contamination subset; By using the backdoor model, positive learning is performed on the clean subset and negative learning is performed on the contaminated subset to obtain the purification model; the contaminated subset includes the first contaminated subset and the second contaminated subset; and / or; Obtain the image to be classified; The image to be classified is input into the image classification model to obtain the classification result; The image classification model is a cleanup model obtained using the aforementioned backdoor defense method.

[0081] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0082] Furthermore, memory 10 may include read-only memory and random access memory, providing instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores operating systems and operating instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and handling hardware-based tasks.

[0083] Processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic device. Processor 20 can be a microprocessor or any conventional processor. Processor 20 can call programs stored in memory 10.

[0084] Communication interface 31 can be an interface for the communication module, used to connect with other devices or systems.

[0085] Of course, it should be noted that, Figure 7 The structure shown does not constitute a limitation on the electronic device in the embodiments of the present invention. In practical applications, the electronic device may include more than Figure 7 More or fewer components as shown, or combinations of certain components.

[0086] It is understood that if the backdoor defense method and / or image classification method in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the current technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods in the various embodiments of the present invention. The aforementioned storage medium includes: USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, magnetic disk, or optical disk, and other media capable of storing program code.

[0087] Based on this, embodiments of the present invention also provide a medium on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the backdoor defense method and / or image classification method described above.

[0088] The following describes a computer program product provided by an embodiment of this application. The computer program product described below can be referred to in conjunction with other embodiments described herein.

[0089] A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of the aforementioned disclosed backdoor defense method and / or image classification method.

[0090] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0091] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0092] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0093] The foregoing has provided a detailed description of the backdoor defense method, image classification method, backdoor defense device, image classification device, electronic device, and medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A backdoor defense method, characterized by, include: Obtain a training dataset and a backdoor model; the training dataset contains contaminated data, and the backdoor model is an image classification model that has been implanted with a malicious backdoor attack. The training dataset is initially filtered to obtain the first contaminated subset and the remaining dataset; Based on the first contaminated subset and the remaining dataset, an adversarial learning strategy is used to train the classifier obtained by decoupling the backdoor model to obtain a contaminated discriminator. The remaining dataset is divided using the pollution detector to obtain a clean subset and a second polluted subset; The clean subset is positively learned using the backdoor model, and the contaminated subset is negatively learned to obtain the purification model; the contaminated subset includes the first contaminated subset and the second contaminated subset. Based on the first contaminated subset and the remaining dataset, an adversarial learning strategy is used to train the classifier obtained by decoupling the backdoor model, resulting in a contamination discriminator, including: The backdoor model is decoupled to obtain the feature extractor and the classifier; The samples from the first contaminated subset and the remaining dataset are input into the feature extractor with fixed parameters to obtain feature vectors; The feature vector is input into the classifier, and an adversarial learning strategy is used to optimize the loss function. When the loss value obtained based on the loss function reaches a preset condition, the classifier training ends, and the trained classifier is used as the contamination discriminator. The remaining dataset is divided using the pollution detector to obtain a clean subset and a second polluted subset, including: The sample to be detected is input into the contamination identifier to obtain the predicted probability distribution; the sample to be detected is a sample from the remaining dataset. Construct a one-hot true probability distribution based on the true label of the sample to be detected; The standard cross-entropy loss and the reverse cross-entropy loss are calculated based on the predicted probability distribution and the true probability distribution, and the symmetric cross-entropy loss is calculated based on the standard cross-entropy loss and the reverse cross-entropy loss. If the symmetric cross-entropy loss is greater than a preset threshold, the sample to be detected is determined to be a contaminated sample. If the symmetric cross-entropy loss is not greater than the preset threshold, then the sample to be detected is determined to be a clean sample.

2. The backdoor prevention method of claim 1, wherein, The standard cross-entropy loss and the reverse cross-entropy loss are calculated based on the predicted probability distribution and the true probability distribution, and the symmetric cross-entropy loss is calculated based on the standard cross-entropy loss and the reverse cross-entropy loss, including: the standard cross-entropy loss is: ; the reverse cross-entropy loss is: ; the symmetric cross-entropy loss is: ; wherein, represents a true probability distribution of a sample to be detected; represents a predicted probability distribution of a sample to be detected; represents a preset smoothing constant; x1 represents a sample to be detected; k represents an index of a class.

3. The backdoor defense method of any of claims 1 to 2, wherein, By using the backdoor model, positive learning is performed on the clean subset, and negative learning is performed on the contaminated subset to obtain a purification model, including: Positive learning loss is obtained by applying standard cross-entropy loss to the clean subset. Negative learning loss is obtained by applying supplementary cross-entropy loss on the polluted subset. The positive learning loss and the negative learning loss are weighted and summed to construct the joint loss; The backdoor model is trained by minimizing the joint loss to obtain the purification model.

4. The backdoor prevention method of claim 3, wherein, the supplementary cross-entropy loss is: ; denotes a sample in the contaminated subset; k denotes the index of the class; denotes the predicted probability distribution of the sample; denotes the true probability distribution of the sample.

5. An image classification method characterized by, include: Obtain the image to be classified; The image to be classified is input into the image classification model to obtain the classification result; The image classification model is a cleanup model obtained using any one of the backdoor defense methods of claims 1 to 4.

6. A backdoor prevention apparatus characterized by comprising: include: The acquisition module is used to acquire a training dataset and a backdoor model; the training dataset contains contaminated data, and the backdoor model is an image classification model that has been implanted with a malicious backdoor attack. The initial screening module is used to perform preliminary screening on the training dataset to obtain the first contaminated subset and the remaining dataset; The training module is used to train the classifier obtained by decoupling the backdoor model based on the first contaminated subset and the remaining dataset using an adversarial learning strategy, so as to obtain a contaminated discriminator. The partitioning module is used to partition the remaining dataset using the contamination detector to obtain a clean subset and a second contamination subset; The forgetting module is used to perform positive learning on the clean subset and negative learning on the contaminated subset through the backdoor model to obtain a purification model; The contaminated subset includes the first contaminated subset and the second contaminated subset; The training module includes: A decoupling unit is used to decouple the backdoor model to obtain a feature extractor and a classifier; The mapping unit is used to input samples from the first contaminated subset and the remaining dataset into the feature extractor with fixed parameters to obtain feature vectors; The training unit is used to input the feature vector into the classifier and optimize the loss function using an adversarial learning strategy. When the loss value obtained based on the loss function reaches a preset condition, the classifier training ends and the trained classifier is used as the contamination discriminator. The modules are divided into: The prediction unit is used to input the sample to be detected into the contamination discriminator to obtain a predicted probability distribution; the sample to be detected is a sample in the remaining dataset. The real unit is used to construct a one-hot true probability distribution based on the real label of the sample to be detected; The calculation unit is used to calculate the standard cross-entropy loss and the reverse cross-entropy loss based on the predicted probability distribution and the true probability distribution, and to calculate the symmetric cross-entropy loss based on the standard cross-entropy loss and the reverse cross-entropy loss. The first determination unit is used to determine the sample to be detected as a contaminated sample if the symmetric cross-entropy loss is greater than a preset threshold. The second determination unit is used to determine the sample to be detected as a clean sample if the symmetric cross-entropy loss is not greater than the preset threshold.

7. An electronic device, comprising: include: Memory, used to store computer programs; A processor, configured to implement the steps of the backdoor defense method as described in any one of claims 1 to 4 and / or the image classification method as described in claim 5 when executing the computer program.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the steps of the backdoor defense method as described in any one of claims 1 to 4 and / or the image classification method as described in claim 5.

Images