A backdoor defense method, an image classification method, an apparatus, a device and a medium

Abstract

The application discloses a backdoor defense method, an image classification method, a device, equipment and a medium, and is applied to the technical field of computers, and comprises the following steps: inputting a constructed distribution external linear disturbance into a backdoor model, determining a target category of a backdoor attack according to a predicted category distribution output by the backdoor model; regarding the target category as a target of a benign backdoor, regarding a synthetic linear disturbance as a trigger, constructing the benign backdoor, and injecting the benign backdoor into the backdoor model for training to obtain a controlled offset model; the benign backdoor is a controllable trigger map injected by a defense party; restoring a sample label corresponding to the benign backdoor to a real label, training the controlled offset model, removing a backdoor effect of the controlled offset model by using a forgetting mechanism, and obtaining a purified model. The application does not need to explicitly construct or restore a backdoor trigger, is not sensitive to a trigger form, is therefore high in universality and high in calculation efficiency, removes the backdoor while maintaining model performance, and balances efficiency, robustness and performance.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a backdoor defense method, an image classification method, a device, equipment, and a medium. Background Technology

[0002] Deep neural networks have achieved great success in image classification tasks, but these models are vulnerable to backdoor attacks during training, severely impacting their reliability in critical tasks. Current backdoor defense techniques typically employ trigger-based reconstruction and model reconstruction methods. However, trigger-based reconstruction methods suffer from complexity and high computational cost; model reconstruction methods struggle to remove backdoors while maintaining clean task performance, resulting in unstable defense effectiveness and insufficient versatility.

[0003] Therefore, how to provide an efficient, stable, and universal backdoor defense method is a technical problem that urgently needs to be solved. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a backdoor defense method, an image classification method, an apparatus, a device, and a medium, which solves the problems of low efficiency, poor versatility, and insufficient stability of the existing backdoor defense methods.

[0005] To address the aforementioned technical problems, this invention provides a backdoor defense method, comprising: Obtain the backdoor model to be defended, wherein the backdoor model is an image classification model that has been implanted with a malicious backdoor attack; The constructed out-of-distribution linear perturbation is input into the backdoor model, and the target category of the backdoor attack is determined according to the predicted category distribution output by the backdoor model; the number of categories of the out-of-distribution linear perturbation is the same as the total number of categories; The target category is used as the target of the benign backdoor, and the synthetic linear perturbation is used as the trigger. The benign backdoor is constructed and injected into the backdoor model for training to obtain a controlled offset model. The benign backdoor is a controllable trigger mapping injected by the defender. The number of categories of the synthetic linear perturbation is 1. Both the out-of-distribution linear perturbation and the synthetic linear perturbation are linearly separable perturbations that are outside the distribution of the training data. The sample labels corresponding to the benign backdoor are restored to the true labels, the controlled offset model is trained, and the backdoor effect of the controlled offset model is removed by using a forgetting mechanism to obtain a cleaned model.

[0006] Optionally, the target category is used as the target of the benign backdoor, and the synthetic linear perturbation is used as a trigger to construct the benign backdoor and inject it into the backdoor model for training, resulting in a controlled offset model, including: Samples other than the target category are selected from the reserved clean dataset to construct a non-target sample dataset; A synthetic linear perturbation is applied to each sample in the non-target sample dataset to generate perturbation samples, and the true label of the perturbation samples is modified to the label of the target category to construct a benign backdoor dataset; The backdoor model is trained using the reserved clean dataset and the benign backdoor dataset. By minimizing the loss value calculated based on the first total loss function, the model learns the mapping relationship between the linear perturbation and the target category, thus obtaining the controlled offset model.

[0007] Optionally, the first total loss function includes: ; in, Represents the first total loss function; This represents the classification loss of the backdoor model on the reserved clean dataset; This represents the classification loss of the backdoor model on the benign backdoor dataset; This represents the expectation of a sample pair (x, y) from the reserved clean dataset; This indicates that a clean dataset is reserved. This represents the difference between the backdoor model's predicted output for a clean sample x and the true label y, calculated using the loss function. This represents a pair of samples from a benign backdoor dataset. Seeking expectations; This represents a benign backdoor dataset; This indicates that the loss function is calculated using a backdoor model for perturbed samples. Predicted output and target category The differences between them; Represents a backdoor model; This represents the loss function.

[0008] Optionally, the sample labels corresponding to the benign backdoor are restored to the true labels, the controlled offset model is trained, and the backdoor effect of the controlled offset model is removed using a forgetting mechanism to obtain a cleaned-up model, including: The label of each perturbation sample in the benign backdoor dataset is restored to the true label from the target category to construct the regression true label dataset; The controlled offset model is trained using the reserved clean dataset and the regression true label dataset. By minimizing the loss value calculated based on the second total loss function, the model learns to predict the perturbation sample with trigger as the true label. During training, the catastrophic forgetting mechanism based on deep learning networks is used to decouple the linear perturbation from the target category in the controlled offset model, thus obtaining the cleaned-up model.

[0009] Optionally, the second total loss function includes: ; in, This represents the second total loss function; This represents the classification loss of the controlled offset model on the reserved clean dataset; This represents the classification loss of the controlled offset model on the regression dataset with the true labels; This represents the expectation of a sample pair (x, y) from the reserved clean dataset; This indicates that a clean dataset is reserved. The loss function calculates the difference between the controlled offset model's predicted output for a clean sample x and the true label y. This represents a pair of samples from the regression true label dataset. Seeking expectations; This represents the regression of the true labeled dataset; The loss function is used to calculate the controlled offset model for perturbed samples. The difference between the predicted output and the true label y; Represents the controlled offset model; This represents the loss function.

[0010] Optionally, the constructed external linear perturbation is input into the backdoor model, and the target category of the backdoor attack is determined based on the predicted category distribution output by the backdoor model, including: By pre-setting linear transformation rules, multiple sets of out-of-distribution linear perturbations with different parameter settings are constructed; the out-of-distribution linear perturbations do not depend on the original training data distribution and are used to simulate out-of-distribution inputs; The out-of-distribution linear perturbations are input into the backdoor model to obtain the predicted category distribution corresponding to each perturbation, and statistical results are obtained by performing statistical analysis. Based on the statistical results, the category with the highest predicted probability and the highest frequency of occurrence is determined as the target category of the backdoor attack.

[0011] The present invention also provides an image classification method, comprising: Obtain the image to be classified; The image to be classified is input into the image classification model to obtain the classification result; The image classification model is a cleanup model obtained using the aforementioned backdoor defense method.

[0012] The present invention also provides a backdoor defense device, comprising: The backdoor model acquisition module is used to acquire the backdoor model to be defended, wherein the backdoor model is an image classification model that has been implanted with malicious backdoor attacks; The target category determination module is used to input the constructed out-of-distribution linear perturbation into the backdoor model, and determine the target category of the backdoor attack based on the predicted category distribution output by the backdoor model; the number of categories of the out-of-distribution linear perturbation is the same as the total number of categories; A benign backdoor injection module is used to use the target category as the target of the benign backdoor, use the synthetic linear perturbation as a trigger, construct the benign backdoor and inject it into the backdoor model for training to obtain a controlled offset model; the benign backdoor is a controllable trigger mapping injected by the defender; the number of categories of the synthetic linear perturbation is 1; both the out-of-distribution linear perturbation and the synthetic linear perturbation are linearly separable perturbations outside the training data distribution; The backdoor effect elimination module is used to restore the sample labels corresponding to the benign backdoor to the true labels, train the controlled offset model, and use the forgetting mechanism to remove the backdoor effect of the controlled offset model to obtain the cleaned model.

[0013] The present invention also provides an electronic device, comprising: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the backdoor defense method and / or image classification method as described above.

[0014] The present invention also provides a medium storing computer-executable instructions, which, when loaded and executed by a processor, implement the steps of the backdoor defense method and / or image classification method described above.

[0015] The present invention also provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the backdoor defense method and / or image classification method described above.

[0016] As can be seen from the above technical solution, the present invention obtains a backdoor model to be defended, which is an image classification model with a malicious backdoor attack implanted; inputs a constructed out-of-distribution linear perturbation into the backdoor model, and determines the target category of the backdoor attack based on the predicted category distribution output by the backdoor model; the number of categories of the out-of-distribution linear perturbation is the same as the total number of categories; uses the target category as the target of the benign backdoor, uses the synthetic linear perturbation as a trigger, constructs a benign backdoor and injects it into the backdoor model for training, and obtains a controlled offset model; the benign backdoor is a controllable trigger mapping injected by the defender; the number of categories of the synthetic linear perturbation is 1; both the out-of-distribution linear perturbation and the synthetic linear perturbation are linearly separable perturbations outside the training data distribution; restores the sample labels corresponding to the benign backdoor to the true labels, trains the controlled offset model, and uses a forgetting mechanism to remove the backdoor effect of the controlled offset model, and obtains a cleaned model. The beneficial effects of this invention are as follows: This invention detects model bias by constructing distributed external linear perturbations, eliminating the need to synthesize triggers for each category, and can quickly identify backdoor target categories; by using synthetic linear perturbations as triggers, it actively injects benign backdoors that can be controlled by the defender into the model, guiding the model decision boundary to undergo a controllable shift, thereby weakening the model bias caused by the original malicious backdoors. This process does not depend on a specific trigger form and avoids the performance degradation caused by direct model fine-tuning or pruning; combined with the forgetting mechanism, it achieves the elimination of residual backdoor effects while debiasing the model, thus obtaining a stable and robust clean model while maintaining the accuracy of the clean task.

[0017] In addition, the present invention also provides a backdoor defense device, an image classification method, an image classification device, an apparatus, and a medium, which also have the above-mentioned beneficial effects. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 A flowchart of a backdoor defense method provided in an embodiment of the present invention; Figure 2 A flowchart of an image classification method provided in an embodiment of the present invention; Figure 3 An example diagram of a model variation provided in an embodiment of the present invention; Figure 4 A flowchart illustrating a model-level backdoor defense method based on active backdoor implantation and forgetting, provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of a backdoor defense device provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of an image classification device provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the structure of an electronic device 1 provided in an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Deep neural networks have achieved great success in image classification tasks, but research shows they are vulnerable to backdoor attacks during training. Attackers can contaminate training data by embedding specific triggers (such as patterns or perturbations) in a small number of training samples and tampering with labels. The resulting model performs normally with normal input, but when the input contains triggers, it outputs the attacker-specified target category with high confidence. Existing backdoor defense methods in the model deployment phase mainly include trigger-based reconstruction and model reconstruction methods. While these methods have achieved some success, they still have significant shortcomings, primarily in two aspects: First, trigger-based reconstruction methods typically require synthesizing triggers separately for different categories or additionally training models to generate triggers, resulting in high computational overhead and low efficiency. Furthermore, these methods struggle to fully recover all backdoor-related features, especially in weak-signal backdoor attack scenarios, leading to unstable defense performance. Second, model reconstruction methods remove backdoors by fine-tuning or pruning model parameters, but due to the difficulty in accurately distinguishing between normal neurons and backdoor-related neurons, it is often difficult to achieve a good balance between model robustness and performance.

[0022] It can be seen that the existing backdoor defense methods for the model deployment stage still have the following problems: (1) They usually rely on trigger reconstruction or model retraining, which is complex and computationally expensive, resulting in low overall efficiency; (2) It is difficult to balance model performance and robustness in the process of removing backdoors, which can easily lead to a decrease in model performance or unstable defense effect on clean tasks; (3) They rely on specific trigger forms, which are not universal enough and difficult to deal with diverse backdoor attacks.

[0023] To address the aforementioned issues, this invention proposes a defense strategy based on proactive backdoor implantation and forgetting for the model deployment stage of image classification tasks. This method introduces a controllable linear perturbation to proactively implant benign backdoors into the model, guiding the model to adjust the previously contaminated decision boundaries and weakening the impact of malicious backdoors. Subsequently, a forgetting mechanism is used to remove the benign backdoors, further eliminating residual malicious backdoors. This method does not require explicit construction or restoration of backdoor triggers, is insensitive to trigger type, and has strong versatility. Furthermore, the overall process is simple, computationally efficient, and can maintain model performance well while removing backdoors, achieving a balance between efficiency, robustness, and performance.

[0024] Please refer to the details. Figure 1 , Figure 1 A flowchart illustrating a backdoor defense method provided in an embodiment of the present invention. The method may include: S101: Obtain the backdoor model to be defended. The backdoor model is an image classification model that has been implanted with malicious backdoor attacks.

[0025] Each step in this embodiment can be executed by a designated electronic device, which can be a server, a portable terminal, or other forms. A backdoor model refers to a model where an attacker contaminates part of the training data (adding triggers and tampering with labels) or directly modifies model parameters, causing the model to perform normally (high classification accuracy) with normal input, but when the input sample contains a specific pre-set trigger, the model will output the target category specified by the attacker with high confidence, completely ignoring the true content of the sample. This embodiment specifically targets image classification models in the field of image classification that have been implanted with malicious backdoor attacks. Of course, this method is also applicable to models in other fields that have been implanted with malicious backdoor attacks; this model (image classification model) can be a deep neural network model.

[0026] S102: Input the constructed external linear perturbation into the backdoor model, and determine the target category of the backdoor attack based on the predicted category distribution output by the backdoor model.

[0027] Out-of-distribution (OOD) is a machine learning term referring to samples whose probability distribution differs from that of the model's training data. For better understanding, consider the following example: Training data: Natural images (cats, dogs, cars, etc.) from ImageNet. In-distribution: A new photo of a cat. Out-of-distribution (OOD): Pure noise images, checkerboard patterns, extreme pixel values ​​(pure white or pure black), or artificially constructed linear gradient stripes (e.g., gradually brightening from left to right). It's important to note that backdoor models perform normally with normal input (in-distribution), but exhibit anomalous, consistently high-confidence outputs for specific triggers (often rare out-of-distribution patterns). Therefore, if in-distribution perturbations are used (e.g., making small, naturally distributed modifications to a normal image), the model may still classify it correctly, making it difficult to expose the backdoor. However, using extreme out-of-distribution linear perturbations, which the model has never seen before, will expose the anomaly in its output, allowing for faster and more accurate identification of the target category of the backdoor attack. This embodiment does not specifically limit the method for constructing out-of-distribution linear perturbations. For example, perturbation synthesis strategies in usability attacks can be referenced, but without relying on their specific implementation. Multiple sets of synthetic linear perturbations with different parameter settings can be constructed as input samples through preset linear transformation rules. Here, the input samples do not depend on the original training data distribution and are used to simulate out-of-distribution input. Therefore, the synthetic linear perturbations generated here are called out-of-distribution linear perturbations. It should be noted that the out-of-distribution linear perturbations in this embodiment are linearly separable perturbations that are outside the training data distribution, and their number of categories is the same as the total number of categories.

[0028] Furthermore, the constructed out-of-distribution linear perturbation is input into the backdoor model. The target category of the backdoor attack is determined based on the predicted category distribution output by the backdoor model. Specifically, this can include: constructing multiple sets of out-of-distribution linear perturbations with different parameter settings through a preset linear transformation rule; the out-of-distribution linear perturbations do not depend on the original training data distribution and are used to simulate out-of-distribution input; inputting the out-of-distribution linear perturbations into the backdoor model respectively to obtain the predicted category distribution corresponding to each perturbation, and performing statistical analysis to obtain statistical results; based on the statistical results, the category with the highest predicted probability and the highest frequency of occurrence is determined as the target category of the backdoor attack. This embodiment utilizes out-of-distribution linear perturbations to excite the internal bias of the backdoor model, deducing the target category from the output distribution. It does not rely on prior attack information, nor does it require synthesizing triggers separately for each category, achieving adaptive and rapid identification of unknown backdoor targets. Therefore, it avoids the high computational overhead of synthesizing triggers separately for each category in traditional trigger reconstruction methods, significantly improving detection efficiency. Simultaneously, this method does not depend on the specific form of the backdoor trigger, and can still stably identify the target category even when facing weak signal backdoors or unknown perturbation patterns, exhibiting good versatility and robustness.

[0029] S103: The target category is used as the target of the benign backdoor, and the synthetic linear perturbation is used as the trigger. The benign backdoor is constructed and injected into the backdoor model for training to obtain the controlled offset model; the benign backdoor is the controllable trigger mapping injected by the defender.

[0030] This step injects a controllable mapping into the backdoor model that targets the same class as the malicious backdoor but with a different trigger. This allows the backdoor model to form new decision preferences on the same output neurons, thus weakening the original malicious backdoor's sole dependence on the trigger. This eliminates the need to reverse engineer the attacker's trigger or modify the model structure, resulting in a simple implementation with low computational overhead. Furthermore, since the benign backdoor's target is consistent with the malicious backdoor's target, it avoids introducing additional classification bias and provides a unified cleanup target for the subsequent forgetting mechanism. Moreover, it is independent of specific trigger forms and can adapt to different backdoor attacks. It should be noted that the synthetic linear perturbation in this embodiment is a linearly separable perturbation outside the training data distribution. Its synthetic linear perturbation has only one class, and its construction method can be the same as or different from the out-of-distribution linear perturbation construction method.

[0031] Furthermore, the aforementioned method uses the target category as the target of the benign backdoor and the synthetic linear perturbation as a trigger to construct a benign backdoor and inject it into the backdoor model for training, resulting in a controlled offset model. Specifically, this may include: using a reserved clean dataset... Samples other than the target category are selected from the samples to construct a non-target sample dataset. For non-target sample datasets A synthetic linear perturbation is applied to each sample to generate perturbed samples. and perturb the samples The true labels are modified to the labels of the target categories to construct a benign backdoor dataset. ; Utilize reserved clean datasets and benign backdoor dataset The backdoor model is trained by minimizing the loss value calculated based on the first total loss function, enabling the model to learn the mapping relationship between linear perturbations and target categories, thus obtaining a controlled offset model. This embodiment introduces defender-led model bias by actively constructing and injecting a controllable backdoor (i.e., a benign backdoor) to offset the uncontrollable bias caused by the original malicious backdoor, thereby achieving controllable reshaping of model bias.

[0032] It should be noted that the reserved clean dataset refers to a portion of the original training dataset that is uncontaminated and has correct labels. The first total loss function includes: ; in, This represents the first total loss function, which can be the cross-entropy loss function; This represents the classification loss of the backdoor model on the reserved clean dataset; This represents the classification loss of the backdoor model on the benign backdoor dataset; This represents the expectation of a sample pair (x, y) from the reserved clean dataset; This indicates that a clean dataset is reserved. This represents the difference between the backdoor model's predicted output for a clean sample x and the true label y, calculated using the loss function. This represents a pair of samples from a benign backdoor dataset. Seeking expectations; This represents a benign backdoor dataset; This indicates that the loss function is calculated using a backdoor model for perturbed samples. Predicted output and target category The differences between them; Represents a backdoor model; This represents the loss function.

[0033] S104: Restore the sample labels corresponding to the benign backdoor to the true labels, train the controlled offset model, and use the forgetting mechanism to remove the backdoor effect of the controlled offset model to obtain the cleaned model.

[0034] The forgetting mechanism in this step can be catastrophic forgetting (CF), which is an inherent tendency of deep neural networks to rapidly and massively forget old knowledge when learning new tasks. This step uses a benign backdoor as a transitional task, indirectly removing the malicious backdoor by first reinforcing and then forgetting it, thus avoiding the performance loss caused by direct intervention.

[0035] Furthermore, the aforementioned process of restoring the sample labels corresponding to benign backdoors to their true labels, training the controlled offset model, and utilizing a forgetting mechanism to remove the backdoor effect from the controlled offset model yields a clean model. Specifically, this can include: restoring the label of each perturbation sample in the benign backdoor dataset from the target category to its true label, constructing a regression true label dataset; training the controlled offset model using the reserved clean dataset and the regression true label dataset, minimizing the loss value calculated based on the second total loss function, enabling the model to learn to predict perturbation samples with triggers as true labels; during training, based on the catastrophic forgetting mechanism of deep learning networks, the controlled offset model is de-mapping the linear perturbation and the target category, resulting in a clean model. This embodiment utilizes the catastrophic forgetting characteristic of deep neural networks to automatically de-mapping the linear perturbation and the target category, while simultaneously removing the original malicious backdoor. The second total loss function includes: ; in, This represents the second total loss function, which can be the cross-entropy loss function; This represents the classification loss of the controlled offset model on the reserved clean dataset; This represents the classification loss of the controlled offset model on the regression dataset with the true labels; This represents the expectation of a sample pair (x, y) from the reserved clean dataset; This indicates that a clean dataset is reserved. The loss function calculates the difference between the controlled offset model's predicted output for a clean sample x and the true label y. This represents a pair of samples from the regression true label dataset. Seeking expectations; This represents the regression of the true labeled dataset; The loss function is used to calculate the controlled offset model for perturbed samples. The difference between the predicted output and the true label y; Represents the controlled offset model; This represents the loss function.

[0036] The backdoor defense method provided in this embodiment of the invention is as follows: S101, a backdoor model to be defended is obtained, which is an image classification model with a malicious backdoor attack implanted; S102, the constructed out-of-distribution linear perturbation is input into the backdoor model, and the target category of the backdoor attack is determined according to the predicted category distribution output by the backdoor model; S103, the target category is used as the target of the benign backdoor, the synthetic linear perturbation is used as a trigger, a benign backdoor is constructed and injected into the backdoor model for training, resulting in a controlled offset model; the benign backdoor is a controllable trigger mapping injected by the defender; S104, the sample labels corresponding to the benign backdoor are restored to the true labels, the controlled offset model is trained, and the backdoor effect of the controlled offset model is removed using a forgetting mechanism, resulting in a cleaned-up model. This method detects model bias by constructing distributed out-of-range linear perturbations, enabling rapid identification of backdoor target categories without the need for separate synthetic triggers for each category. Using synthetic linear perturbations as triggers, it actively injects benign backdoors controllable by the defender into the model, guiding a controllable shift in the model's decision boundary to mitigate model bias caused by the original malicious backdoors. This process is independent of specific trigger forms and avoids performance degradation caused by direct model fine-tuning or pruning. Combined with a forgetting mechanism, it achieves both model debiasing and elimination of residual backdoor effects, thus obtaining a stable and robust cleaned model while maintaining clean task accuracy.

[0037] Please refer to Figure 2 , Figure 2 A flowchart illustrating an image classification method provided in an embodiment of the present invention. The method may include: S201: Obtain the image to be classified.

[0038] S202: Input the image to be classified into the image classification model to obtain the classification result; wherein, the image classification model is a purification model obtained by using the backdoor defense method mentioned above.

[0039] During the model application phase, the image to be classified is acquired and then input into the cleaned model obtained through the aforementioned backdoor defense method. The model outputs the corresponding classification result. Since the cleaned model has removed malicious and benign backdoors, and its decision boundary has been adjusted to rely solely on the inherent semantic features of the image, it has high-precision classification capabilities for normal images. At the same time, it can also correctly judge any attack image with unknown triggers and will not fall into the preset incorrect category.

[0040] The image classification method provided in this embodiment of the invention proceeds as follows: S201: Obtain the image to be classified; S202: Input the image to be classified into the image classification model to obtain the classification result; wherein, the image classification model is a cleaned model obtained using the aforementioned backdoor defense method. This method can safely and efficiently complete image classification without prior knowledge of the trigger pattern used by the attacker. While ensuring the classification accuracy of clean samples, it effectively resists various backdoor attacks, significantly improving the accuracy and robustness of classification in practical applications.

[0041] To address the problem of model bias caused by backdoor attacks during the model training phase, this invention proposes a model-level backdoor defense method based on proactive backdoor implantation and forgetting, achieving effective purification of backdoor models. For a clearer understanding of this invention, please refer to the following details. Figure 3 and 4 , Figure 3 An example diagram of a model variation provided in an embodiment of the present invention; Figure 3 The blue, red, and black dots in the graph represent clean, contaminated, and perturbed samples, respectively, and the curves represent the model's fit to the data. Figure 4 This invention provides a flowchart illustrating a model-level backdoor defense method based on active backdoor implantation and forgetting, which specifically includes three stages: target category identification, active backdoor implantation, and benign backdoor forgetting. Out-of-distribution characteristics indicate that regardless of the specific form of the attack strategy, the fundamental reason for backdoor attacks is that polluting the training dataset often biases it towards the target distribution specified by the attacker, thereby introducing model bias into the backdoor model. Based on the characteristic that backdoor attacks inherently introduce a specific directional distribution bias into the model, this embodiment first constructs a large number of out-of-distribution linear perturbations to detect the bias of the backdoor model M, thereby identifying the target category / target label y of the backdoor attack. t Subsequently, the target category y tAs a benign backdoor target, by using synthetic linear perturbation as a trigger, a benign backdoor controllable by the defender is actively injected into the backdoor model M, guiding the model decision boundary to undergo a controllable shift, so as to weaken the model bias caused by the original malicious backdoor; finally, the benign backdoor constructed above is removed by combining the catastrophic forgetting mechanism, thereby achieving model debiasing and further eliminating the residual backdoor effect, resulting in a clean model (i.e., a clean model). In this way, by actively introducing controllable model bias to replace passive unknown backdoor bias, and combining the forgetting mechanism to achieve the progressive reconstruction of the model decision boundary, the purpose of stable backdoor removal is achieved. The present invention has the following advantages: (1) High computational efficiency. Compared with methods that require explicit synthetic triggers or complex model reconstruction, this method achieves benign backdoor implantation by introducing simple linear perturbation and removes the backdoor by combining the forgetting mechanism. The overall process is simple, the computational overhead is low, and it is easy to deploy in practice. (2) Strong versatility. This algorithm has good versatility. This method does not require explicit construction or recovery of backdoor triggers, nor does it rely on prior assumptions about the trigger form. It is trigger-agnostic and can be applied to various types of backdoor attacks, thus having greater versatility. (3) Effectively balances the robustness and performance of the model. By actively implanting benign backdoors and guiding the model to adjust the decision boundary, and then combining the forgetting mechanism for purification, the influence of malicious backdoors can be weakened while maintaining the model's performance on normal tasks, thus achieving an effective balance between robustness and performance.

[0042] The backdoor defense device provided in the embodiments of the present invention will be described below. The backdoor defense device described below can be referred to in correspondence with the method described above.

[0043] Please refer to the details. Figure 5 , Figure 5 A schematic diagram of a backdoor defense device provided in an embodiment of the present invention may include: The backdoor model acquisition module 100 is used to acquire the backdoor model to be defended, wherein the backdoor model is an image classification model that has been implanted with malicious backdoor attacks; The target category determination module 200 is used to input the constructed out-of-distribution linear perturbation into the backdoor model, and determine the target category of the backdoor attack based on the predicted category distribution output by the backdoor model; the number of categories of the out-of-distribution linear perturbation is the same as the total number of categories; The benign backdoor injection module 300 is used to use the target category as the target of the benign backdoor, use the synthetic linear perturbation as a trigger, construct the benign backdoor and inject it into the backdoor model for training to obtain a controlled offset model; the benign backdoor is a controllable trigger mapping injected by the defender; the number of categories of the synthetic linear perturbation is 1; both the out-of-distribution linear perturbation and the synthetic linear perturbation are linearly separable perturbations outside the training data distribution; The backdoor effect elimination module 400 is used to restore the sample labels corresponding to the benign backdoor to the true labels, train the controlled offset model, and use the forgetting mechanism to remove the backdoor effect of the controlled offset model to obtain the cleaned model.

[0044] Furthermore, based on any of the above embodiments, the benign backdoor injection module 300 may include: The non-target sample dataset construction unit is used to filter out samples other than the target category from the reserved clean dataset and construct the non-target sample dataset. A benign backdoor dataset construction unit is used to apply a synthetic linear perturbation to each sample in the non-target sample dataset to generate perturbation samples, and modify the true label of the perturbation samples to the label of the target category to construct a benign backdoor dataset; The controlled offset model acquisition unit is used to train the backdoor model using the reserved clean dataset and the benign backdoor dataset. By minimizing the loss value calculated based on the first total loss function, the model learns the mapping relationship between the linear perturbation and the target category, thereby obtaining the controlled offset model.

[0045] Furthermore, the aforementioned first total loss function may specifically include: ; in, Represents the first total loss function; This represents the classification loss of the backdoor model on the reserved clean dataset; This represents the classification loss of the backdoor model on the benign backdoor dataset; This represents the expectation of a sample pair (x, y) from the reserved clean dataset; This indicates that a clean dataset is reserved. This represents the difference between the backdoor model's predicted output for a clean sample x and the true label y, calculated using the loss function. This represents a pair of samples from a benign backdoor dataset. Seeking expectations; This represents a benign backdoor dataset; This indicates that the loss function is calculated using a backdoor model for perturbed samples. Predicted output and target category The differences between them; Represents a backdoor model; This represents the loss function.

[0046] Furthermore, based on any of the above embodiments, the backdoor effect elimination module 400 may include: The regression true label dataset construction unit is used to recover the true label from the target category of each perturbation sample in the benign backdoor dataset, thereby constructing the regression true label dataset; The training unit is used to train the controlled offset model using the reserved clean dataset and the regression true label dataset, and to enable the model to learn to predict the perturbation sample with trigger as the true label by minimizing the loss value calculated based on the second total loss function. The forgetting unit is used during training to remove the mapping relationship between the linear perturbation and the target category from the controlled offset model based on the catastrophic forgetting mechanism of the deep learning network, thereby obtaining the cleaned-up model.

[0047] Furthermore, the aforementioned second total loss function may specifically include: ; in, This represents the second total loss function; This represents the classification loss of the controlled offset model on the reserved clean dataset; This represents the classification loss of the controlled offset model on the regression dataset with the true labels; This represents the expectation of a sample pair (x, y) from the reserved clean dataset; This indicates that a clean dataset is reserved. The loss function calculates the difference between the controlled offset model's predicted output for a clean sample x and the true label y. This represents a pair of samples from the regression true label dataset. Seeking expectations; This represents the regression of the true labeled dataset; The loss function is used to calculate the controlled offset model for perturbed samples. The difference between the predicted output and the true label y; Represents the controlled offset model; This represents the loss function.

[0048] Furthermore, based on any of the above embodiments, the target category determination module 200 may include: The out-of-distribution linear perturbation acquisition unit is used to construct multiple sets of out-of-distribution linear perturbations with different parameter settings through preset linear transformation rules; the out-of-distribution linear perturbations do not depend on the original training data distribution and are used to simulate out-of-distribution inputs; The statistical unit is used to input the out-of-distribution linear perturbations into the backdoor model, obtain the predicted category distribution corresponding to each perturbation, and perform statistics to obtain statistical results. The target category determination unit is used to determine the category with the highest predicted probability and the highest frequency of occurrence as the target category of the backdoor attack based on the statistical results.

[0049] It should be noted that the order of the modules and units in the aforementioned backdoor defense device can be changed without affecting the logic.

[0050] The backdoor defense device provided in this embodiment of the invention uses a backdoor model acquisition module 100 to acquire a backdoor model to be defended, wherein the backdoor model is an image classification model with a malicious backdoor attack implanted; a target category determination module 200 is used to input a constructed out-of-distribution linear perturbation into the backdoor model, and determine the target category of the backdoor attack based on the predicted category distribution output by the backdoor model; the number of categories in the out-of-distribution linear perturbation is the same as the total number of categories; and a benign backdoor injection module 300 is used to use the target category as the target of the benign backdoor, and to synthesize the linear perturbation. As a trigger, a benign backdoor is constructed and injected into the backdoor model for training to obtain a controlled offset model; the benign backdoor is a controllable trigger mapping injected by the defender; the number of categories of the synthetic linear perturbation is 1; both the out-of-distribution linear perturbation and the synthetic linear perturbation are linearly separable perturbations outside the training data distribution; the backdoor effect elimination module 400 is used to restore the sample label corresponding to the benign backdoor to the true label, train the controlled offset model, and use a forgetting mechanism to remove the backdoor effect of the controlled offset model to obtain a cleaned model. This device detects model bias by constructing distributed external linear perturbations, enabling rapid identification of backdoor target categories without the need for separate synthetic triggers for each category. Using synthetic linear perturbations as triggers, it actively injects benign backdoors controllable by the defender into the model, guiding a controllable shift in the model's decision boundary to weaken the model bias caused by the original malicious backdoors. This process is independent of specific trigger forms and avoids performance degradation caused by direct model fine-tuning or pruning. Combined with a forgetting mechanism, it achieves both model debiasing and elimination of residual backdoor effects, thus obtaining a stable and robust cleaned model while maintaining clean task accuracy.

[0051] The image classification device provided in the embodiments of the present invention will be described below. The image classification device described below can be referred to in correspondence with the method described above.

[0052] Please refer to the details. Figure 6 , Figure 6 A schematic diagram of the structure of an image classification device provided in an embodiment of the present invention may include: Image acquisition model 500 is used to acquire images to be classified.

[0053] The category determination module 600 is used to input the image to be classified into the image classification model to obtain the classification result; wherein, the image classification model is a purification model obtained by using the backdoor defense method described above.

[0054] It should be noted that the order of the modules and units in the aforementioned backdoor defense device can be changed without affecting the logic.

[0055] The backdoor defense device provided in this embodiment of the invention uses an image acquisition model 500 to acquire images to be classified; and a category determination module 600 to input the images to be classified into an image classification model to obtain classification results; wherein the image classification model is a cleaned model obtained by the aforementioned backdoor defense method. This device can safely and efficiently complete image classification without prior knowledge of the trigger patterns used by attackers, effectively resisting various backdoor attacks while ensuring the classification accuracy of clean samples, and significantly improving the accuracy and robustness of classification in practical applications.

[0056] The electronic device 1 provided in the embodiments of the present invention will be described below. The electronic device 1 described below can be referred to in correspondence with the backdoor defense method and / or image classification method described above.

[0057] Please refer to Figure 7 , Figure 7 A schematic diagram of the structure of an electronic device 1 provided in an embodiment of the present invention may include: Memory 10 is used to store computer programs; Processor 20 is used to execute computer programs to implement the backdoor defense method and / or image classification method described above.

[0058] The memory 10, processor 20, and communication interface 31 all communicate with each other through the communication bus 32.

[0059] In this embodiment of the invention, the memory 10 is used to store one or more programs. The programs may include program code, which includes computer operation instructions. In this embodiment of the invention, the memory 10 may store programs for implementing the following functions: Obtain the backdoor model to be defended. The backdoor model is an image classification model that has been implanted with malicious backdoor attacks. The constructed out-of-distribution linear perturbation is input into the backdoor model, and the target category of the backdoor attack is determined based on the predicted category distribution output by the backdoor model; the number of categories of the out-of-distribution linear perturbation is the same as the total number of categories; The target category is used as the target of the benign backdoor, and the synthetic linear perturbation is used as the trigger. The benign backdoor is constructed and injected into the backdoor model for training to obtain the controlled offset model. The benign backdoor is the controllable trigger mapping injected by the defender. The number of categories of the synthetic linear perturbation is 1. Both the out-of-distribution linear perturbation and the synthetic linear perturbation are linearly separable perturbations that are outside the distribution of the training data. The sample labels corresponding to the benign backdoor are restored to the true labels, the controlled offset model is trained, and the backdoor effect of the controlled offset model is removed by the forgetting mechanism to obtain the cleaned model. and / or; Obtain the image to be classified; The image to be classified is input into the image classification model to obtain the classification result; The image classification model is a cleanup model obtained using the aforementioned backdoor defense method.

[0060] In one possible implementation, the memory 10 may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; and the data storage area may store data created during use.

[0061] Furthermore, memory 10 may include read-only memory and random access memory, providing instructions and data to the processor. A portion of the memory may also include NVRAM. The memory stores operating systems and operating instructions, executable modules, or data structures, or subsets thereof, or extended sets thereof, wherein the operating instructions may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic tasks and handling hardware-based tasks.

[0062] Processor 20 can be a central processing unit (CPU), an application-specific integrated circuit, a digital signal processor, a field-programmable gate array, or other programmable logic device. Processor 20 can be a microprocessor or any conventional processor. Processor 20 can call programs stored in memory 10.

[0063] Communication interface 31 can be an interface for the communication module, used to connect with other devices or systems.

[0064] Of course, it should be noted that, Figure 7 The structure shown does not constitute a limitation on the electronic device 1 in the embodiments of the present invention. In practical applications, the electronic device 1 may include more than Figure 7 More or fewer components as shown, or combinations of certain components.

[0065] It is understood that if the backdoor defense method and / or image classification method in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the current technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and executes all or part of the steps of the methods in the various embodiments of the present invention. The aforementioned storage medium includes: USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), electrically erasable programmable ROM, register, hard disk, removable disk, CD-ROM, magnetic disk, or optical disk, and other media capable of storing program code.

[0066] Based on this, embodiments of the present invention also provide a medium on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the backdoor defense method and / or image classification method described above.

[0067] The following describes a computer program product provided by an embodiment of this application. The computer program product described below can be referred to in conjunction with other embodiments described herein.

[0068] A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of the aforementioned disclosed backdoor defense method and / or image classification method.

[0069] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0070] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0071] Finally, it should be noted that in this document, relationships such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0072] The foregoing has provided a detailed description of a backdoor defense method, image classification method, apparatus, device, and medium provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A backdoor defense method, characterized in that, include: Obtain the backdoor model to be defended, wherein the backdoor model is an image classification model that has been implanted with a malicious backdoor attack; The constructed out-of-distribution linear perturbation is input into the backdoor model, and the target category of the backdoor attack is determined according to the predicted category distribution output by the backdoor model; the number of categories of the out-of-distribution linear perturbation is the same as the total number of categories; The target category is used as the target of the benign backdoor, and the synthetic linear perturbation is used as a trigger to construct the benign backdoor and inject it into the backdoor model for training, thereby obtaining the controlled offset model. The benign backdoor is a controllable trigger mapping injected by the defender; the number of categories of the synthetic linear perturbation is 1; both the out-of-distribution linear perturbation and the synthetic linear perturbation are linearly separable perturbations outside the training data distribution; The sample labels corresponding to the benign backdoor are restored to the true labels, the controlled offset model is trained, and the backdoor effect of the controlled offset model is removed by using a forgetting mechanism to obtain a cleaned model. Using the target category as the target of a benign backdoor, and the synthetic linear perturbation as a trigger, the benign backdoor is constructed and injected into the backdoor model for training, resulting in a controlled offset model, including: Samples other than the target category are selected from the reserved clean dataset to construct a non-target sample dataset; A synthetic linear perturbation is applied to each sample in the non-target sample dataset to generate perturbation samples, and the true label of the perturbation samples is modified to the label of the target category to construct a benign backdoor dataset; The backdoor model is trained using the reserved clean dataset and the benign backdoor dataset. By minimizing the loss value calculated based on the first total loss function, the model learns the mapping relationship between the synthetic linear perturbation and the target category, thus obtaining the controlled offset model. The sample labels corresponding to the benign backdoor are restored to their true labels, the controlled offset model is trained, and the backdoor effect of the controlled offset model is removed using a forgetting mechanism to obtain a cleaned-up model, including: The label of each perturbation sample in the benign backdoor dataset is restored to the true label from the target category to construct the regression true label dataset; The controlled offset model is trained using the reserved clean dataset and the regression true label dataset. By minimizing the loss value calculated based on the second total loss function, the model learns to predict the perturbation sample with trigger as the true label. During training, based on the forgetting mechanism of deep learning networks, the controlled offset model is de-mapped between the synthetic linear perturbation and the target category, thus obtaining the cleaned-up model.

2. The backdoor defense method according to claim 1, characterized in that, The first total loss function includes: ； in, Represents the first total loss function; This represents the classification loss of the backdoor model on the reserved clean dataset; This represents the classification loss of the backdoor model on the benign backdoor dataset; This represents the expectation of a sample pair (x, y) from the reserved clean dataset; This indicates that a clean dataset is reserved. This represents the difference between the backdoor model's predicted output for a clean sample x and the true label y, calculated using the loss function. This represents a pair of samples from a benign backdoor dataset. Seeking expectations; This represents a benign backdoor dataset; This indicates that the loss function is calculated using a backdoor model for perturbed samples. Predicted output and target category The differences between them; Represents a backdoor model; This represents the loss function.

3. The backdoor defense method according to claim 1, characterized in that, The second total loss function includes: ； in, This represents the second total loss function; This represents the classification loss of the controlled offset model on the reserved clean dataset; This represents the classification loss of the controlled offset model on the regression dataset with the true labels; This represents the expectation of a sample pair (x, y) from the reserved clean dataset; This indicates that a clean dataset is reserved. The loss function calculates the difference between the controlled offset model's predicted output for a clean sample x and the true label y. This represents a pair of samples from the regression true label dataset. Seeking expectations; This represents the regression of the true labeled dataset; The loss function is used to calculate the controlled offset model for perturbed samples. The difference between the predicted output and the true label y; Represents the controlled offset model; This represents the loss function.

4. The backdoor defense method according to any one of claims 1 to 3, characterized in that, The constructed out-of-distribution linear perturbation is input into the backdoor model, and the target category of the backdoor attack is determined based on the predicted category distribution output by the backdoor model, including: By pre-setting linear transformation rules, multiple sets of out-of-distribution linear perturbations with different parameter settings are constructed; the out-of-distribution linear perturbations do not depend on the original training data distribution and are used to simulate out-of-distribution inputs; The out-of-distribution linear perturbations are input into the backdoor model to obtain the predicted category distribution corresponding to each perturbation, and statistical results are obtained by performing statistical analysis. Based on the statistical results, the category with the highest predicted probability and the highest frequency of occurrence is determined as the target category of the backdoor attack.

5. An image classification method, characterized in that, include: Obtain the image to be classified; The image to be classified is input into the image classification model to obtain the classification result; The image classification model is a cleanup model obtained using any one of the backdoor defense methods of claims 1 to 4.

6. A backdoor defense device, characterized in that, include: The model acquisition module is used to acquire the backdoor model to be defended, wherein the backdoor model is an image classification model that has been implanted with malicious backdoor attacks; The target category determination module is used to input the constructed out-of-distribution linear perturbation into the backdoor model, and determine the target category of the backdoor attack based on the predicted category distribution output by the backdoor model; the number of categories of the out-of-distribution linear perturbation is the same as the total number of categories; A benign backdoor injection module is used to take the target category as the target of the benign backdoor, take the synthetic linear perturbation as a trigger, construct the benign backdoor and inject it into the backdoor model for training to obtain a controlled offset model. The benign backdoor is a controllable trigger mapping injected by the defender; the number of categories of the synthetic linear perturbation is 1; both the out-of-distribution linear perturbation and the synthetic linear perturbation are linearly separable perturbations outside the training data distribution; The backdoor effect elimination module is used to restore the sample labels corresponding to the benign backdoor to the true labels, train the controlled offset model, and use the forgetting mechanism to remove the backdoor effect of the controlled offset model to obtain the cleaned model. A benign backdoor injection module, including: The non-target sample dataset construction unit is used to filter out samples other than the target category from the reserved clean dataset and construct the non-target sample dataset. A benign backdoor dataset construction unit is used to apply a synthetic linear perturbation to each sample in the non-target sample dataset to generate perturbation samples, and modify the true label of the perturbation samples to the label of the target category to construct a benign backdoor dataset; The controlled offset model acquisition unit is used to train the backdoor model using the reserved clean dataset and the benign backdoor dataset. By minimizing the loss value calculated based on the first total loss function, the model learns the mapping relationship between the synthetic linear perturbation and the target category, thereby obtaining the controlled offset model. The backdoor elimination module includes: The regression true label dataset construction unit is used to recover the true label from the target category of each perturbation sample in the benign backdoor dataset, thereby constructing the regression true label dataset; The training unit is used to train the controlled offset model using the reserved clean dataset and the regression true label dataset, and to enable the model to learn to predict the perturbation sample with trigger as the true label by minimizing the loss value calculated based on the second total loss function. The forgetting unit is used during training to remove the mapping relationship between the synthetic linear perturbation and the target category from the controlled offset model based on the forgetting mechanism of the deep learning network, thereby obtaining the cleaned-up model.

7. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the backdoor defense method as described in any one of claims 1 to 4 and / or the image classification method as described in claim 5 when executing the computer program.

8. A medium, characterized in that, The medium stores computer-executable instructions, which, when loaded and executed by a processor, implement the steps of the backdoor defense method as described in any one of claims 1 to 4 and / or the image classification method as described in claim 5.

Images