Data set compression hidden backdoor attack method based on distribution matching and related device

Abstract

This invention belongs to the field of artificial intelligence security and adversarial machine learning technology, and discloses a dataset compression and concealed backdoor attack method and related apparatus based on distribution matching. The dataset compression and concealed backdoor attack method includes: training an agent model based on a selected initial compressed dataset; analyzing the decision boundary of the agent model and selecting source and target class pairs according to the degree of confusion; adding triggers to clean samples of the source class to form poisoned samples; mixing the poisoned samples with clean samples of the target class to construct a poisoned training set; and using a distribution matching algorithm to compress the poisoned training set to generate a compressed dataset with an embedded concealed backdoor for training downstream models. This invention jointly optimizes three key indicators—attack success rate, model clean test accuracy, and attack concealment—in the dataset compression stage, solving the core problem that existing technologies struggle to achieve a balance among these three aspects.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security and adversarial machine learning technology, and specifically relates to a method and related apparatus for concealing backdoor attacks based on distribution matching dataset compression. Background Technology

[0002] Dataset compression is an important technique that has emerged in the field of machine learning in recent years. Its core goal is to synthesize a very small, representative synthetic dataset from a large-scale original dataset, so that the performance of a model trained on this synthetic dataset can approach that of a model trained on the complete original dataset. Dataset compression can significantly reduce the computational, storage, and communication overhead during model training, and has broad application prospects in resource-constrained scenarios such as federated learning, continuous learning, and edge intelligence.

[0003] Among the numerous existing dataset compression methods, distribution matching-based methods have attracted widespread attention due to their good scalability and empirical effectiveness. These methods achieve data compression by minimizing the difference between the distributions of the original and synthetic data, such as the maximum mean discrepancy (MMD), in the feature space extracted by a randomly initialized model. However, dataset compression introduces emerging security threats: the compression process itself can be maliciously manipulated to inject backdoors. Attackers (such as malicious data providers) can implant carefully crafted backdoor triggers into the original or intermediate synthetic data used for compression before or during the compression process. The resulting "toxic" compressed dataset, when used to train downstream models, causes the models to perform well on normal inputs but exhibit pre-defined malicious behavior (such as misclassification) on inputs containing specific triggers.

[0004] Currently, some work has begun to explore backdoor attacks targeting dataset compression, such as: 1) Naive Attack: This method directly pastes a fixed visual pattern (such as a white square) onto the training samples of the target category before compression; however, since its trigger is static and unrelated to the image content, it is easily smoothed or distorted during compression, resulting in a low attack success rate (ASR). 2) Doorping: This method uses a two-layer optimization framework to jointly optimize the synthetic data and backdoor triggers during the compression process to better preserve the semantics of the triggers, thereby improving the success rate of the attack; however, this method has huge computational overhead and lacks design considerations for the stealth of the triggers. 3) Simple-Trigger and Relax-Trigger: Recently, some studies have re-examined the persistence of backdoors in the data compression process from the perspective of kernel theory and proposed a variety of attack variants (Simple-Trigger, Relax-Trigger). For example, by jointly optimizing the projection loss, conflict loss and generalization gap, a high attack success rate can be maintained while avoiding high computational overhead. However, the core of the optimization of these methods is still to balance the attack success rate and clean test accuracy (CTA), and generally does not take stealthiness (STE) as the core design goal and optimization constraint.

[0005] In view of the above, the existing technology mainly has the following defects and shortcomings: 1) Insufficient attention to the stealth dimension; Explained, most existing attack methods focus on maximizing ASR or maintaining CTA, generally neglecting the key dimension of STE; Stealth not only requires that the trigger is visually imperceptible to the human eye (i.e., there are no obvious artifacts in the synthesized compressed data and the test samples after triggering), but also requires that it be statistically indistinguishable from clean data, and be able to resist anomaly detection. Attacks lacking stealth, even if they have a high success rate, are very easy to be detected and eliminated during the data review or model deployment stage, thus losing their actual threat capability.

[0006] 2) The trigger design is too simple and fixed; interpretively, methods such as Naive Attack use a uniform trigger pattern that is independent of the input content. This "one-size-fits-all" trigger cannot adapt to the semantic and textural features of different images, which makes it easy to destroy the visual harmony after it is added, thus exposing the attack.

[0007] 3) It is difficult to balance attack effectiveness and stealth. Explained, existing methods struggle to achieve a good balance among the three often conflicting goals of attack success rate, clean test accuracy, and stealth. For example, Doorping and Relax-Trigger can achieve high attack success rates, but the perturbations they introduce sacrifice clean test accuracy or stealth. NaiveAttack and Simple-Trigger have a smaller impact on clean test accuracy, but their attack success rate and stealth are not ideal. Summary of the Invention

[0008] The purpose of this invention is to provide a method and related apparatus for concealing backdoor attacks based on distributed matching dataset compression, thereby solving one or more of the aforementioned technical problems. The technical solution disclosed in this invention jointly optimizes three key indicators—attack success rate, model clean test accuracy, and attack concealment—during the dataset compression stage, thus solving the core problem of achieving a balance among these three aspects in existing technologies.

[0009] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, this invention provides a method for exploiting hidden backdoor attacks using dataset compression based on distribution matching, comprising the following steps: The proxy model is trained based on the selected initial compressed dataset, the decision boundary of the proxy model is analyzed, and the source category and target category pairs used as backdoor attack targets are selected according to the degree of confusion. Triggers are added to clean samples of the source category to form poisoned samples. The poisoned samples are then mixed with clean samples of the target category to construct a poisoned training set. The triggers added to each clean sample in the source category are generated by a trigger generator, which is trained based on the selected source and target categories. Using a distribution matching algorithm, the poisoned training set is compressed to generate a compressed dataset with an embedded hidden backdoor. The downstream model is trained using a compressed dataset with an embedded hidden backdoor to obtain the trained downstream model. When the trained downstream model is applied, it performs a predetermined misclassification behavior when the input contains triggers, and performs a normal classification behavior when the input does not contain triggers.

[0010] A second aspect of the present invention provides a dataset compression and covert backdoor attack system based on distribution matching, comprising: The category pair selection module is used to train the proxy model based on the selected initial compressed dataset, analyze the decision boundary of the proxy model, and select the source category and target category pairs as backdoor attack targets according to the degree of confusion. The poisoning training set construction module is used to add triggers to clean samples of the source category to form poisoned samples, and mix the poisoned samples with clean samples of the target category to construct a poisoning training set; wherein, the triggers added to each clean sample in the source category are generated by a trigger generator, which is trained based on the selected source category and target category. The dataset compression module is used to compress the poisoned training set using a distribution matching algorithm to generate a compressed dataset with an embedded hidden backdoor. The downstream model training module is used to train the downstream model using a compressed dataset with an embedded hidden backdoor, and obtain the trained downstream model. When the trained downstream model is applied, it performs a predetermined misclassification behavior when the input contains triggers, and performs normal classification behavior when the input does not contain triggers.

[0011] In a third aspect, the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the distributed matching-based dataset compression covert backdoor attack method as described in any one of the first aspects of the present invention.

[0012] In a fourth aspect, the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the distributed matching-based dataset compression concealed backdoor attack method as described in any one of the first aspects of the present invention.

[0013] In a fifth aspect, the present invention provides a computer program product comprising computer instructions which, when executed by a processor, implement the steps of the distributed matching-based dataset compression covert backdoor attack method as described in any one of the first aspects of the present invention.

[0014] Compared with the prior art, the present invention has the following beneficial effects: This invention discloses a method for covert backdoor attacks in dataset compression based on distribution matching. It significantly improves the visual and statistical concealment of backdoor triggers while maintaining a high attack success rate and clean test accuracy, achieving a better balance among attack success rate, clean test accuracy, and concealment. This invention effectively circumvents existing backdoor attack detection and defense mechanisms, possessing strong anti-defense capabilities and providing effective support for the security assessment of dataset compression models. This technical solution not only possesses high attack efficiency but also achieves deep concealment at the visual and statistical levels, establishing a new standard for the security assessment of dataset compression technologies.

[0015] The generator of this invention dynamically generates customized perturbations for each sample, achieving extremely high visual concealment. This "image-dependent" characteristic of this invention fundamentally breaks the inherent assumption of many existing input-level defenses regarding a "uniform trigger pattern," making it impossible for them to reconstruct an effective universal trigger through reverse engineering, thus causing the defense to fail.

[0016] This invention does not randomly or empirically select attack targets, but automatically identifies the most vulnerable and easily confused source-target class pairs in the decision boundary by analyzing the confusion matrix of the proxy model. This strategy enables backdoor triggers to achieve extremely high attack success rates with minimal perturbation costs by leveraging the inherent decision uncertainty of the model. At the same time, since the attack precisely targets the already ambiguous decision region of the model, it minimizes interference with the model's normal classification ability in other categories, maintains high clean test accuracy (CTA), and avoids exposure due to "false positives".

[0017] This invention achieves a remarkable synergistic balance among attack success rate, clean test accuracy, and stealth for the first time. Through joint optimization of input-aware triggers and easily confused category selection, this invention systematically solves existing problems, enabling attacks to maintain high performance while also possessing high stealth and low impact on the normal functioning of the model. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating a method for concealing backdoor attacks based on distributed matching dataset compression, as described in an embodiment of the present invention.

[0020] Figure 2 This is a schematic diagram illustrating the principle of a dataset compression and concealment backdoor attack method based on distribution matching in an embodiment of the present invention.

[0021] Figure 3 This is a schematic diagram illustrating the concealment of backdoor attacks in an embodiment of the present invention.

[0022] Figure 4 This is a schematic diagram illustrating the attack performance on the STL-10 dataset in an embodiment of the present invention.

[0023] Figure 5 This is a schematic diagram illustrating the attack performance on the Tiny-ImageNet dataset in an embodiment of the present invention.

[0024] Figure 6 This is a schematic diagram illustrating the attack concealment effect on the STL-10 dataset in an embodiment of the present invention.

[0025] Figure 7 This is a schematic diagram of a dataset compression and concealed backdoor attack system based on distribution matching in an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention; obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0027] Based on the technical solutions disclosed in the embodiments of this invention, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of this invention. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices.

[0028] Please see Figure 1 The present invention provides a method for exploiting hidden backdoors in dataset compression based on distribution matching, comprising the following steps: Step 1: Train the proxy model based on the selected initial compressed dataset, analyze the decision boundary of the proxy model, and select the source category and target category pairs as backdoor attack targets according to the degree of confusion. Step 2: Add triggers to clean samples of the source category to form poisoned samples, and mix the poisoned samples with clean samples of the target category to construct a poisoned training set; wherein, the triggers added to each clean sample in the source category are generated by a trigger generator, which is trained based on the selected source category and target category pair; Step 3: Using a distribution matching algorithm, compress the poisoned training set to generate a compressed dataset with an embedded hidden backdoor. Step 4: Train the downstream model using the compressed dataset with an embedded hidden backdoor to obtain the trained downstream model. When the trained downstream model is applied, it performs a predetermined misclassification behavior when the input contains triggers, and performs normal classification behavior when the input does not contain triggers.

[0029] This invention discloses a method for covert backdoor attacks based on distribution matching in dataset compression. Its core lies in jointly optimizing three key indicators during the dataset compression stage: attack success rate, model clean test accuracy, and attack covertness. This solves the fundamental problem of achieving a balance among these three aspects, a challenge that existing technologies struggle to address. The technical solution of this invention not only possesses high attack efficiency but also achieves deep covertness at both the visual and statistical levels, establishing a new standard for security assessment of dataset compression technologies.

[0030] Furthermore, this invention achieves "deep camouflage" of triggers through an input-aware trigger generation mechanism. Unlike the fixed, static triggers used in Naive Attack and similar methods, the generator in this invention dynamically generates customized perturbations for each sample. These perturbations are highly integrated with the local semantic and texture features of the host image, rather than simply superimposed, thus achieving extremely high visual concealment at the pixel-level PSNR (Peak Signal-to-Noise Ratio) and SSIM (Structural Similarity Index). More importantly, this "image-specific" characteristic fundamentally breaks the inherent assumption of many existing input-level defenses regarding a "uniform trigger pattern," making it impossible for them to reconstruct effective universal triggers through reverse engineering, thereby causing the defense to fail.

[0031] Furthermore, this invention achieves "precision targeting" of attacks through a strategy for selecting easily confused category pairs based on a proxy model. Instead of randomly or empirically selecting attack targets, this invention automatically identifies the most vulnerable and easily confused source-target category pairs in the decision boundary by analyzing the confusion matrix of the proxy model. This strategy enables backdoor triggers to leverage the inherent decision uncertainty of the model with minimal perturbation cost (i.e., relatively low...). and This can achieve an extremely high attack success rate; at the same time, since the attack is precisely applied to the already ambiguous decision region of the model, it minimizes interference with the model's normal classification ability in other categories, maintains a high clean test accuracy (CTA), and avoids exposure due to "false positives".

[0032] Furthermore, this invention achieves a remarkable synergistic balance among attack success rate, clean test accuracy, and stealth for the first time. Most existing methods struggle to balance these three mutually constraining objectives. For example, while Doorping and Relax-Trigger achieve high ASR, their trigger stealth is poor and often comes at the cost of CTA; Naive Attack and Simple-Trigger have less impact on CTA, but their ASR and stealth are both unsatisfactory. This invention, through joint optimization of the aforementioned input-aware triggers and easily confused category selection, systematically solves this problem for the first time, enabling attacks to maintain high performance while also possessing high stealth and low impact on the normal functioning of the model.

[0033] In summary, the technical solutions disclosed in the embodiments of the present invention, through systematic design, have achieved significant superiority over existing technologies in terms of attack effectiveness and concealment. They not only provide a powerful benchmark tool for evaluating the security of dataset compression technologies, but also profoundly reveal potential new security risks in the data supply chain, which is of great significance for promoting the development of more robust defense solutions.

[0034] Please see Figure 2 The present invention discloses a method for exploiting covert backdoor attacks based on distributed matching dataset compression, comprising the following steps: S1. Selection of Easily Confused Category Pairs Based on Proxy Model: Generate an initial compressed dataset from the large-scale original dataset, and train a proxy model containing a feature extractor and a classifier using this initial compressed dataset. By calculating the normalized confusion matrix of the original dataset on the proxy model, the source-target category pairs corresponding to the maximum values ​​of the off-diagonal elements are selected. Interpretationally, this step trains a proxy model using the initial compressed dataset, and by analyzing the decision boundary of the model, selects the most easily confused source and target category pairs as the targets of backdoor attacks.

[0035] S2. Input-Aware Hidden Trigger Generation: Construct a trigger generator to generate a perturbation for each sample of the source class, and use a pruning operation to make the perturbation satisfy... - Norm constraint: The perturbation is superimposed on the original sample according to a preset scaling factor to form a trigger sample. The generator is trained so that the trigger sample is misclassified as the target category by the surrogate model. Interpretationally, this step trains a trigger generator based on the source-target category pair selected in step S1 to generate a small and imperceptible customized perturbation for each sample of the source category that is consistent with the sample content.

[0036] S3. Constructing the poisoning training set: Collect all source category trigger samples and modify their labels to the target category. Select a portion of the trigger samples according to the preset poisoning ratio and merge them with the original clean samples of the target category to obtain the poisoning training set. Explain, this step adds the triggers generated in step S2 to the clean samples of the source category to form poisoned samples, and mixes them with the clean samples of the target category to construct the poisoning training set for subsequent dataset compression.

[0037] S4. Perform malicious dataset compression: Using the poisoned training set as input, the distribution matching algorithm is used to compress the dataset and generate a compressed dataset with an embedded backdoor. This compressed dataset is statistically similar to the poisoned training set and encodes backdoor features. Explain, this step uses the distribution matching algorithm to compress the poisoned training set constructed in step S3 to generate a compressed dataset with an embedded backdoor.

[0038] S5. Downstream Model Training and Attack Activation: The downstream model is trained using a compressed dataset with an embedded hidden backdoor (along with other compressed datasets of clean classes). The trained model performs a pre-defined misclassification behavior on inputs containing triggers, while maintaining normal performance on clean inputs.

[0039] In a specific exemplary technical solution of this invention, step S1 aims to locate the most easily confused category pairs in the decision boundary of the proxy model, providing a target selection basis for generating efficient backdoor attacks. The operation of selecting easily confused category pairs based on the proxy model specifically includes: S101, Initial Compressed Dataset Generation Steps: From a large-scale original dataset In this process, an initial, clean, compressed dataset is generated by minimizing the distribution matching objective (Maximum Mean Difference MMD). ,in Explained, the initial compressed dataset is generated by minimizing the joint objective of distribution distance and regularization term, wherein the distribution distance is measured by maximum mean difference (MMD). This initial compressed dataset serves as the basis for training the subsequent proxy model, ensuring consistency between the attack evaluation environment and the real compression scenario.

[0040] In practice, a distribution matching algorithm based on the maximum mean difference is adopted, and data compression is achieved by optimizing the following objective function: ; In the formula, This is the initial compressed dataset; The variable value at which the minimum value is obtained (referring to finding the optimal value). ); To compress dataset variables, i.e., the objects to be optimized; For mathematical expectation; For large-scale raw datasets Data distribution; To obtain from the original dataset Distribution Samples sampled from the middle; To compress the dataset Data distribution; To extract from compressed datasets Distribution Samples sampled from the middle; To randomly initialize the parameter distribution of the network; From Random network parameters sampled in the middle; It is a distribution distance metric function based on the maximum mean difference; Original sample With parameters The feature distribution representation under the model; To compress the sample With parameters The feature distribution representation under the model; This is the regularization coefficient, used to balance the distribution matching term and the regularization term; This is a regularization term function based on the nuclear norm.

[0041] in, Used to measure the difference in distribution between the original dataset and the compressed dataset in the feature space; Used to control the complexity and diversity of compressed data; Used to balance distribution matching accuracy and dataset complexity. In practical implementation, the regularization coefficient... The value can be set from 0.01 to 0.1, and the optimal value can be determined through grid search.

[0042] S102, Proxy Model Training Steps: Use the initial compressed dataset generated in step S101 Train a proxy model. The proxy model uses a deep neural network architecture, and its model parameters are: Including feature extractors and classifier The feature extractor consists of multiple convolutional and pooling layers to extract multi-level feature representations of the input data; the classifier consists of fully connected layers and softmax layers to perform class prediction. Training is performed using the cross-entropy loss function and stochastic gradient descent algorithm. The proxy model's behavior simulates a model trained on a compressed dataset by a downstream user; its decision boundary characteristics are crucial for attack design.

[0043] S103. Steps for calculating the confusion matrix: [The original dataset...] Input the trained agent model and calculate a normalized confusion matrix. The matrix elements Indicates the true label is The samples were predicted by the model to be of category The empirical probability, this process systematically reveals the confusion patterns of the model among different categories.

[0044] The specific calculation process includes: First, inputting the original dataset into the surrogate model in batches, recording the true label and predicted label for each sample; then, counting the number of samples whose true label category is predicted to be each category; finally, performing row-wise normalization to obtain the confusion matrix. Its elements The calculation formula is: ; In the formula, Index the true label category of the data (as row index of the confusion matrix); Index of the label categories predicted by the model (as column index of the confusion matrix); Original clean sample; for The corresponding original real labels; This is an indicator function that takes the value 1 when the condition inside the square brackets is true, and 0 otherwise; For the feature extractor function of the surrogate model; These are the model parameters for the feature extractor; For the classifier function of the surrogate model; These are the model parameters for the classifier; This represents the total number of categories.

[0045] S104. Attack Target Determination Steps: From the Confusion Matrix In the middle, select the non-diagonal elements (i.e. The item with the largest value in the middle, and its corresponding category pair. This refers to the selected source-target attack pair: ; In the formula, The source category is the original category to which the attacker intends to add the trigger; The target category is the category that the attacker wants the model to misclassify as the poisoned sample. The set of parameters that maximizes the objective function.

[0046] The selection process is implemented using a matrix traversal algorithm, with a time complexity of O(n log n). ,in This represents the number of categories.

[0047] In this embodiment of the invention, by selecting the most easily confused class pairs, the inherent vulnerability of the model's decision boundary can be fully utilized to achieve a high attack success rate with minimal perturbation cost. Explained, selecting the most easily confused class pairs means that attacks can exploit the model's inherent uncertainty to achieve a high attack success rate with minimal perturbation cost, while minimizing the negative impact on the model's overall clean test accuracy. Compared to randomly selecting attack pairs, this strategy effectively improves the attack success rate while maintaining stable clean test accuracy.

[0048] In the specific exemplary technical solution of this invention embodiment, step S2 generates a customized trigger that is coordinated with the input content to achieve high concealment, completely breaking through the limitations of traditional fixed-pattern triggers; wherein, the input-aware concealed trigger generation operation specifically includes: S201, Trigger Generator Construction Steps: Construct a trigger generator. Its input is a sample The output is the same as Perturbations of the same size. Generators typically employ lightweight convolutional neural network architectures to ensure efficiency.

[0049] S202, Disturbance Generation and Constraint Steps: For source category Each sample Using generators Generate a perturbation of the same size, and strictly limit the amplitude of the perturbation through a clipping operation to ensure that it meets the requirements. -norm constraint ,in It is a preset upper limit constant for perturbation, which ensures that the perturbation is visually imperceptible. This constraint is the key to ensuring that the trigger is difficult for the human eye to detect.

[0050] S203, Triggering Sample Generation Step: Scale the generated perturbation by a scaling factor. (Between 0 and 1) are superimposed on the original sample to form a trigger sample. The specific calculation formula is as follows: ; In the formula, A trigger sample (or poisoned sample) refers to a sample that has been perturbed. This is a scale factor used to control the intensity of the perturbation superimposed on the original sample; it was set to 0.2 based on the experimental results. This is a clipping function used to force a value to be restricted to a specified range; For trigger generator model; These are the training parameters for the trigger generator; This is a disturbance upper limit constant used to control the imperceptibility of the trigger; This is the lower bound of the clipping interval.

[0051] This linear superposition operation ensures the structural similarity between the triggered sample and the original sample in pixel space, while guaranteeing that the added perturbation effectively alters the model's feature representation. This "input-aware" design of the invention allows each trigger to adapt to the local texture and semantic features of the host image, thereby achieving deep camouflage; such as... Figure 3 , Figure 6 As shown, the trigger samples generated by this invention significantly outperform the baseline method in both PSNR and SSIM metrics, verifying its superior visual concealment.

[0052] S204. Generator Training Steps: Training the Generator The goal is to make the trigger sample The proxied model misclassifies the target category Its optimization objective is to minimize the cross-entropy loss: ; In the formula, Minimize operation; For source category The sample set belongs to the original dataset. A subset of; For loss function, specifically the cross-entropy loss function.

[0053] In each training round, a batch of samples is randomly sampled from the source class dataset, the loss function is calculated, and the generator parameters are updated via backpropagation. Through iterative optimization, the generator learns to generate customized perturbations that are consistent with the content of the input samples. The generator learns to generate triggers for each sample that are both effective (high ASR) and covert (high STE). This adversarial training process ensures that the triggers can move source class samples across the decision boundary to the target class in the feature space, while the offset in the feature space is controlled due to the bounded nature of the perturbations.

[0054] In a specific exemplary technical solution of this invention embodiment, step S3 integrates the generated trigger into the training data to prepare for subsequent malicious compression and controls the poisoning ratio to balance attack and concealment; wherein, the operation of constructing the poisoning training set specifically includes: S301. Steps for constructing the poisoning sample set: Take the samples from step S2 for all source categories... Generated trigger samples Collect them and uniformly modify the labels of all triggering samples to the target category. This constitutes the poisoning sample set, expressed as follows: ; In this step, relabeling enables the compression algorithm to learn backdoor behavior as part of the target category.

[0055] S302, Poisoning Ratio Control Procedure: Set a poisoning ratio (Values ​​range from 0 to 1). From the poisoned sample set Random selection 1 sample, of which The target category in the original dataset The sample size is determined. In practice, a pseudo-random number generator is used for sample selection, and a fixed random seed is set to ensure experimental reproducibility. In this step, controlling the poisoning ratio avoids excessive contamination of the target category data distribution, which helps maintain the clean testing accuracy of the downstream model.

[0056] S303. Merge the selected poisoned samples with the original clean sample set of the target category to form the final poisoning training set, as shown in the following expression: ; In the formula, This is the training set for poisoning, and the mixed dataset used in the subsequent compression process; For the target category in the original dataset A clean set of samples; This serves as an index for selecting poisoned samples; To determine the poisoning ratio, the proportion of poisoned samples mixed in should be controlled. For the target category in the original dataset The total number of samples.

[0057] This hybrid dataset contains both true features of the target category and backdoor features induced by triggers. In practice, the hybrid dataset needs to be shuffled to ensure a uniform distribution of poisoned and clean samples. This provides training data that conforms to the true distribution for subsequent malicious compression, thus creating conditions for injecting backdoors into the compression process.

[0058] In the specific exemplary technical solution of this invention embodiment, step S4 is a crucial stage for backdoor implantation, utilizing a distribution matching algorithm to "distill" the backdoor features into a very small compressed dataset; specifically, performing the malicious dataset compression operation involves: S401, Compressed data preparation steps: The poisoned training set constructed in step S3 As new "raw data", it is recompressed using distribution matching dataset compression methods such as DM (Distribution Matching), IDM (Improved Distribution Matching), or DAM (Distribution-Aware Matching).

[0059] S402, Malicious Compression Execution Steps: The goal of the compression process is to generate a new compression file targeting the specified category. The compressed dataset has the following optimization objective: ; In the formula, A compressed dataset containing an embedded hidden backdoor; To compress dataset variables during the optimization process; The variable value at which the minimum value is obtained (referring to finding the optimal value). ); For mathematical expectation; Poisoning training set Data distribution; To extract from compressed datasets Samples sampled from the middle; To compress the dataset Data distribution; To randomly initialize the parameter distribution of the network; From Random network parameters sampled in the middle; For data with parameters The feature distribution representation under the network.

[0060] The compression process employs the stochastic gradient descent algorithm. This process compresses the dataset. The statistical distribution approximates that of samples that have been poisoned. Furthermore, the backdoor features are effectively encoded within it. This is due to the boundedness of the deviation between poisoned and clean samples in the feature space (…). The present invention provides a formal guarantee for the controllability of the distribution difference between the final generated poisoned compressed set and the clean compressed set, enabling it to escape statistical detection.

[0061] The technical solution of this invention possesses strong anti-defense capabilities and can effectively circumvent existing mainstream backdoor detection mechanisms. The design of this invention makes it extremely robust against multi-layered defenses. At the model-level defense level, such as NC (Neural Cleanse) and PIXEL (de-obfuscation-based backdoor defense), because the triggers are deeply integrated with the image content, their activation patterns are no different from the normal forward propagation behavior of the model, and will not cause significant neuron or feature map anomalies. Therefore, their anomaly index can be stably kept below the detection threshold. At the input-level defense level, such as ABS (Artificial Brain Stimulation) and input reconstruction, the input-aware triggers do not have fixed patterns, making it impossible for the defense system to summarize a consistent trigger feature for filtering or reverse elimination. Its REASR (Reconstructed Attack Success Rate) remains at an extremely low level. At the dataset-level defense level, such as RNP (Robust Network Pruning) and PDB (Data-Poisoning Backdoor), the backdoor features are deeply "distilled" into the compressed dataset through the distribution matching algorithm, making the poisoned compressed set and the clean compressed set highly similar in overall feature distribution. Methods based on statistical outlier detection are difficult to reliably identify. Even if powerful cleanup methods (such as PDB) can suppress backdoors to some extent, it comes at the cost of a sharp decline in model CTA, which is unacceptable in practice. This highlights the stealth and robustness of the backdoor implantation in this invention.

[0062] In a specific exemplary technical solution of this invention, the method further includes: downstream model training and attack activation. This step verifies the final effect of the attack and assesses its threat level in a real-world scenario. The downstream model is trained using the compressed dataset with a backdoor generated in step S4 (along with compressed data of other clean categories). The trained model will perform a predetermined misclassification behavior when encountering input containing triggers, while behaving normally when processing clean inputs. Figure 4 , Figure 5 As shown, the technical solution of this invention, on the STL-10 and Tiny-ImageNet datasets, maintains a Clean Test Accuracy (CTA) comparable to the optimal method while achieving an Attack Success Rate (ASR) close to or reaching 1.0. As shown in Table 1, it maintains a high attack success rate across data consolidation methods DM, DC (Dataset Condensation), IDM, and DAM, demonstrating good transferability and robustness. Furthermore, as... Figure 6 As shown, this invention achieves the highest concealment level (peak signal-to-noise ratio PSNR, structural similarity index PSNR) among all data compression methods, further demonstrating its practicality and threat in real-world scenarios.

[0063] Table 1. Experimental results on different datasets

[0064] The technical solution of this invention can effectively circumvent existing backdoor attack detection and defense mechanisms, possessing strong concealment and anti-defense capabilities. Based on the level of function of the defense mechanisms, they can be divided into three categories: model-level defense, input-level defense, and dataset-level defense. The corresponding evasion strategies designed for these three types of defense mechanisms in this invention are as follows: (1) Avoidance mechanisms against model-level defense Model-level defense techniques aim to identify and block backdoors by analyzing the internal parameters, activation patterns, or output behavior of a trained model. Typical model-level defenses include neural cleanse (NC) and PIXEL, a method based on activation pattern analysis. The core assumption of these defenses is that backdoor behavior causes abnormal activation in specific neurons or feature maps.

[0065] This invention effectively circumvents model-level defenses through the following mechanisms: First, the input-adaptive trigger generation mechanism ensures that each trigger is highly integrated with the local semantic and texture features of the host sample. Unlike fixed-pattern triggers (such as white squares in uniform positions) used in existing technologies, the triggers generated by this invention are visually consistent with the original image content and do not elicit significant or unconventional activation responses in the model's convolutional or feature extraction layers. This "image-dependent" trigger design makes its activation pattern difficult to distinguish from the model's normal forward propagation behavior. Second, in the attack design phase, this invention precisely exploits the inherent vulnerability of the model's decision boundary through a proxy model-based strategy for selecting easily confused category pairs. The selected source-target category pairs themselves have a high natural misclassification rate, meaning that the model's decision boundary in this direction is inherently ambiguous. The backdoor behavior implanted in this invention essentially "amplifies" a weak tendency already present in the model, rather than "implanting" a completely new and abnormal behavioral pattern. Therefore, the classification decision triggered by the backdoor does not appear as a statistical outlier in the model's output logic, thus effectively circumventing detection methods based on output behavior anomaly analysis. As shown in Table 2, after applying advanced model-level defenses such as NC and PIXEL, the anomaly index caused by the backdoor implanted by this invention is consistently lower than its preset detection threshold. The defense system cannot reliably distinguish it from the normal behavior of the model, thus achieving effective evasion of model-level defenses.

[0066] Table 2. Experimental results under different defense methods

[0067] (2) Avoidance mechanisms against input-level defense Input-level defense techniques focus on preprocessing input data during the model inference stage in order to disrupt or identify embedded backdoor triggers. These defenses include input reconstruction, noise injection, image transformation (such as scaling and cropping), and analysis methods based on inverse generation triggers (such as ABS).

[0068] This invention effectively counters input-level defenses through the following mechanism: The core of this invention's countermeasure against input-level defenses lies in the generated triggers' high visual concealment and structural adaptability. Trigger Generator During the training process, they were subjected to strict - Norm constraints ensure that the perturbations added to the image are controlled at the pixel level to a level imperceptible to the human eye. Furthermore, these perturbations are not simple noise, but rather subtle, structured modifications associated with the image content that can deceive model decisions. This design makes the trigger resistant to common image preprocessing operations, such as slight image compression or filtering, which are unlikely to completely eliminate this content-integrated perturbation. More importantly, because the trigger is dynamically generated and input-aware, it does not have a fixed shape, color, or positional pattern. Many existing input-level defenses rely on the assumption of a "uniform trigger pattern," such as finding a universal trigger pattern that works for all poisoned samples through reverse engineering. This invention fundamentally breaks this assumption, rendering defense methods based on pattern matching or trigger reconstruction (such as ABS) ineffective. The defense system cannot generalize a consistent trigger feature from diverse poisoned samples; therefore, the reconstructed triggers are invalid and cannot successfully activate backdoors or perform effective filtering during the testing phase. As shown in Table 2, when facing various input-level defenses, the model trained by the attack of this invention maintains an extremely low Reconstruction Success Rate (REASR), which fully demonstrates that the invention has extremely strong robustness in the face of input preprocessing and trigger reconstruction attacks.

[0069] (3) Avoidance mechanisms for dataset-level defense Dataset-level defense involves analyzing and sanitizing the training dataset itself before or during model training to identify and remove potentially poisoned samples. These methods include statistical outlier detection methods (such as feature-based clustering RNP) and methods for sanitizing synthetic data (such as PDB).

[0070] This invention circumvents dataset-level defenses by deeply integrating the backdoor injection process with a distribution-matching compression algorithm. During the malicious compression phase, instead of simply mixing trigger samples with clean samples, this invention employs a deep integration method based on feature distribution alignment. Specifically, this invention uses a poisoned training set containing trigger samples as input and aligns the synthetic data with the poisoned data in the feature space using a distribution matching algorithm, thus regenerating a compressed dataset for the target category. The core of this process lies in the fact that, through the feature distribution alignment mechanism, this invention forces the generated compressed data to maintain a high degree of consistency in statistical distribution characteristics with the poisoned training set within the feature space extracted by multiple randomly initialized models. Since the poisoned training set consists mostly of clean samples and a small number of carefully constructed trigger samples, and the trigger samples maintain a high degree of alignment with the clean samples in the feature space through the aforementioned input-aware generation mechanism, the final compressed dataset exhibits minimal difference in overall feature distribution compared to a compressed dataset generated entirely from clean data. The high similarity in distribution between the poisoned compressed dataset and the clean compressed dataset makes it difficult for dataset-level defenses based on statistical anomaly detection (such as RNP) to reliably identify backdoor samples as "outliers" from the compressed dataset. As shown in Table 3, although some powerful dataset cleansing methods (such as PDB) may partially suppress backdoor behavior under extreme parameter settings, this usually comes at the cost of a sharp drop in the model's classification accuracy on clean data. Such significant performance degradation is unacceptable in practical applications, highlighting the advantages of this invention in maintaining the normal function of the system.

[0071] Table 3. Comparison of experimental results of different attack methods.

[0072]

[0073] This invention demonstrates excellent generalization ability, maintaining stable high performance across different datasets, model architectures, and compression algorithms. The attack effectiveness of this invention does not depend on specific data distributions, model structures, or compression algorithms, but is built upon general machine learning principles (decision boundary vulnerability, feature distribution matching, etc.), thus possessing broad applicability. Generalization across datasets: such as... Figure 4 , Figure 5As shown, this invention consistently achieves a balance between high ASR and high CTA on various visual datasets, ranging from simple (such as FMNIST) to complex (such as Tiny-ImageNet), demonstrating its strong adaptability to different semantic content and image complexity. Cross-model architecture generalization (transferability): As shown in Table 4, in the "cross-architecture" scenario, even when using lightweight models such as ConvNet for data condensation and then training on downstream models with vastly different structures such as VGG11 and ResNet18, this invention still maintains an extremely high attack success rate. This indicates that its backdoor features are not overfitted to a specific model structure, but are encoded as a general, transferable semantic pattern, greatly expanding its attack scope. Cross-compression algorithm generalization (robustness): The attack process of this invention is deeply integrated with core distribution matching frameworks (such as DM, IDM, or DAM), rather than being bound to a specific compression algorithm. Experimental results show that the present invention can successfully inject and maintain a backdoor when facing various mainstream distributed matching compression methods. Its attack effectiveness does not fluctuate drastically due to different underlying compression algorithms, demonstrating its broad robustness to different implementation schemes within the technology ecosystem.

[0074] Table 4. Clean test accuracy and attack success rate under different architectures

[0075] In summary, this invention discloses a method for concealed backdoor attacks on dataset compression based on distribution matching. While maintaining a high attack success rate and clean test accuracy, it significantly improves the concealment of backdoor triggers, effectively circumventing existing backdoor attack detection and defense mechanisms, and possesses strong anti-defense capabilities. It provides an effective tool for security assessment of dataset compression models. Specifically, the method first trains a proxy model based on an initial compressed dataset, and then filters the most easily confused source-target class pairs by analyzing the confusion matrix; next, it trains an input-aware trigger generator to generate triggers that satisfy the specified conditions for the source class samples. Customized covert perturbations with norm constraints are employed; subsequently, a poisoned training set is constructed according to a preset poisoning ratio, and a compressed dataset with an embedded backdoor is generated using a distribution matching algorithm; finally, this compressed dataset is used to train downstream models, achieving high accuracy under normal input and targeted misclassification under triggered input. This invention uses covertness as the core optimization objective. Through input-aware trigger design and selection of easily confused category pairs, it achieves an optimal balance between attack success rate, clean test accuracy, and covertness. It effectively evades visual review and statistical detection, and exhibits strong generalization and anti-defense capabilities, providing a powerful tool for security assessment of dataset compression technologies. Extensive experimental verification on various standard datasets demonstrates that this invention maintains a high attack success rate against various dataset-level defenses, while significantly outperforming existing technologies in clean test accuracy. This characteristic proves that the covert backdoor generated by this invention can be effectively embedded in the data distribution, resisting data purification defenses and achieving an optimal balance between attack effectiveness and covertness.

[0076] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not disclosed in the apparatus embodiments, please refer to the embodiments of the method of the present invention.

[0077] Please see Figure 7 In this embodiment of the invention, a dataset compression and concealed backdoor attack system based on distribution matching is provided, comprising: The category pair selection module is used to train the proxy model based on the selected initial compressed dataset, analyze the decision boundary of the proxy model, and select the source category and target category pairs as backdoor attack targets according to the degree of confusion. The poisoning training set construction module is used to add triggers to clean samples of the source category to form poisoned samples, and mix the poisoned samples with clean samples of the target category to construct a poisoning training set; wherein, the triggers added to each clean sample in the source category are generated by a trigger generator, which is trained based on the selected source category and target category. The dataset compression module is used to compress the poisoned training set using a distribution matching algorithm to generate a compressed dataset with an embedded hidden backdoor. The downstream model training module is used to train the downstream model using a compressed dataset with an embedded hidden backdoor, and obtain the trained downstream model. When the trained downstream model is applied, it performs a predetermined misclassification behavior when the input contains triggers, and performs normal classification behavior when the input does not contain triggers.

[0078] In this embodiment of the invention, a dataset compression and concealment backdoor attack system based on distribution matching is provided, comprising: The target selection module is used to generate an initial compressed dataset from a large-scale raw dataset, train the proxy model and calculate the normalized confusion matrix, and filter the most easily confused source-target class pairs; The trigger generation module is used to build and train a trigger generator to generate triggers that satisfy the following conditions for source class samples: Customized hidden perturbations with ∞-norm constraints, outputting trigger samples; The poisoning dataset construction module is used to collect trigger samples and modify labels, select samples according to a preset poisoning ratio and merge them with clean samples of the target category to generate a poisoning training set; The malicious compression module is used to compress the poisoned training set using a distribution matching algorithm to generate a compressed dataset with an embedded hidden backdoor. The attack verification module is used to train a downstream model using the compressed dataset of the embedded hidden backdoor, verify the model's accuracy on clean inputs and the attack success rate on triggered inputs, and evaluate the attack's stealth.

[0079] In this embodiment of the invention, the target selection module first receives the original dataset, generates an initial compressed dataset using a distribution matching compression algorithm, and then uses this dataset to train a proxy model. The proxy model includes a feature extractor and a classifier. After training, the module inputs the original dataset into the proxy model, calculates the normalized confusion matrix, and automatically selects the class pair corresponding to the maximum value of the off-diagonal elements as the source-target attack pair. The trigger generation module includes a trigger generator that uses a convolutional neural network structure. The module receives source class samples, generates perturbations of the same size for each sample, and performs a pruning operation to ensure that the perturbations satisfy... - Norm constraints are applied, and then a preset scaling factor is added to the original samples to form trigger samples. The module trains the generator by minimizing cross-entropy loss, causing the trigger samples to be misclassified as the target category by the proxy model. The poisoned dataset construction module modifies the labels of all trigger samples to the target category, forming a poisoned sample set. According to a preset poisoning ratio, a specified number of samples are randomly selected from the poisoned sample set and merged with the original clean samples of the target category to form a poisoned training set. The poisoning ratio is configurable and used to balance attack strength and stealth. The malicious compression module receives the poisoned training set and compresses it using a distribution matching algorithm. During the compression process, the distribution distance between the poisoned training set and the compressed dataset in the feature space is minimized, and a regularization term is added to generate a compressed dataset with an embedded backdoor. The distribution matching algorithm includes any one of DM, IDM, or DAM. The attack verification module trains one or more downstream models using the compressed dataset of the embedded backdoor, evaluates the model accuracy on a clean test set, and evaluates the attack success rate on a triggered test set. The module also integrates the function of calculating stealth metrics, including peak signal-to-noise ratio and structural similarity index, and performs robustness tests on various backdoor defense methods to comprehensively evaluate the effectiveness and stealth of the attack.

[0080] This invention's system utilizes a modular architecture to verify a distributed matching-based dataset compression and covert backdoor attack method. The modules are connected sequentially to form a complete verification process: the output of the target selection module is connected to the input of the trigger generation module; the output of the trigger generation module is connected to the input of the poisoned dataset construction module; the output of the poisoned dataset construction module is connected to the input of the malicious compression module; and the output of the malicious compression module is connected to the input of the attack verification module. Through the collaborative work of these modules, the system completes the entire verification process from target selection to backdoor implantation and effect evaluation, providing a system-level verification platform for the effectiveness and covertness of the attack method.

[0081] The system of this invention can be used to implement the above-mentioned dataset compression and covert backdoor attack method based on distribution matching, including a target selection module, a trigger generation module, a poisoned dataset construction module, a malicious compression module, and an attack verification module. The target selection module is used to train a proxy model based on the initial compressed dataset, analyze its decision boundary, and select the most easily confused source-target category pairs to determine precise targets for subsequent attacks. This module receives the original dataset. It includes a built-in distribution matching compression algorithm (such as DM or IDM). The module first performs initial compression to generate a compressed dataset. Subsequently, using Training an agent model After the model training is complete, this module will use the original dataset. Input the proxy model and calculate the normalized confusion matrix. And according to the formula Automatically select source-target class pairs with the highest obfuscation probability. This module automates vulnerability analysis by using a model to determine vulnerabilities, replacing the empirical process of manually selecting attack targets and ensuring the scientific rigor and efficiency of the attack.

[0082] The trigger generation module receives source category samples and, using a trained trigger generator, generates a small perturbation to the input perception for each sample, forming a trigger sample. This module contains a trigger generator. (Typically a lightweight convolutional neural network). The module receives a set of source class samples from the target selection module. For each sample generator Output a customized perturbation, which is strictly limited by a pruning operation. Within the scope, ensure it meets the requirements. - Norm constraint. Subsequently, the perturbation is scaled by a factor. Superimposed on the original sample to generate the trigger sample This module optimizes the target. The generator is trained. This module is the core of achieving attack stealth; its "input-aware" design allows the generated triggers to be highly integrated with the host image content, effectively circumventing visual review and statistical detection based on fixed patterns, such as... Figure 6 The high PSNR and SSIM values ​​shown demonstrate its excellent concealment effect.

[0083] The poisoning dataset construction module is used to relabel trigger samples as target categories and mix them with clean samples of the target category at a preset ratio to construct a poisoning training set. This module receives all trigger samples from the trigger generation module and uniformly modifies their labels to the target category. To form a poisoning sample set The module includes a preset configurable poisoning ratio. Based on this ratio, the module from Random selection 1 sample, and compare it with the original target category dataset. The mixture is then blended to produce the final poisoning training set. This module precisely controls the poisoning ratio, introducing sufficient backdoor features to maintain a high attack success rate while avoiding severe deviations in the distribution of target category data, thus ensuring the clean testing accuracy of downstream models.

[0084] The malicious compression module receives the infected training set and compresses it using a distribution matching algorithm to generate a compressed dataset with an embedded backdoor. This module incorporates distribution matching dataset compression algorithms (DM, IDM, DAM). The module also receives the infected dataset and constructs a hybrid infected training set output by the infected dataset construction module. This is used as the source data for compression, and the preset objective function is optimized. Generate a compressed dataset with an embedded backdoor for the target category. This module serves as the core carrier of the entire attack process. Through the standard data processing flow of distributed matching, it effectively encodes and solidifies the backdoor features constructed in the preceding steps into the final output compressed dataset, thereby achieving the covert implantation of the backdoor.

[0085] The attack verification module is used to train downstream models using a generated compressed dataset with backdoors and to verify their behavior on clean and triggered inputs, thus evaluating the effectiveness and stealth of the attack. This module is a comprehensive evaluation platform that receives a compressed dataset with backdoors generated by a malicious compression module and uses this dataset to train one or more downstream models. After training, the module evaluates the model's accuracy on a clean test set and the attack success rate on a test set embedding the same triggers. Simultaneously, this module integrates the calculation of various backdoor embedding stealth metrics (such as PSNR, SSIM, IS) and robustness testing against various backdoor defense methods (such as NC, ABS, PIXEL, RNP, PDB). This module provides an automated and standardized process for the quantitative evaluation of attack effectiveness and the verification of anti-defense capabilities. The experimental results shown in the figure can all be systematically derived through this module, demonstrating the superior balance between attack success rate, clean test accuracy, and stealth, as well as its powerful real-world threat posed by this invention.

[0086] In one embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used to execute the operation of a distributed matching dataset compression concealed backdoor attack method.

[0087] In one embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the operating system of the terminal. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor, which can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM (Random Access Memory) or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the distributed matching-based dataset compression covert backdoor attack method in the above embodiments.

[0088] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, etc.) containing computer-usable program code.

[0089] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0090] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0091] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0092] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for a dataset compression backdoor attack based on distribution matching, characterized in that, Includes the following steps: The proxy model is trained based on the selected initial compressed dataset, the decision boundary of the proxy model is analyzed, and the source category and target category pairs used as backdoor attack targets are selected according to the degree of confusion. Triggers are added to clean samples of the source category to form poisoned samples. The poisoned samples are then mixed with clean samples of the target category to construct a poisoned training set. The triggers added to each clean sample in the source category are generated by a trigger generator, which is trained based on the selected source and target categories. Using a distribution matching algorithm, the poisoned training set is compressed to generate a compressed dataset with an embedded hidden backdoor. The downstream model is trained using a compressed dataset with an embedded hidden backdoor to obtain the trained downstream model. When the trained downstream model is applied, it performs a predetermined misclassification behavior when the input contains triggers, and performs a normal classification behavior when the input does not contain triggers.

2. The method for concealing backdoor attacks based on distribution matching dataset compression according to claim 1, characterized in that, In the step of training the proxy model based on the selected initial compressed dataset, the proxy model adopts a deep neural network architecture, including: a feature extractor and a classifier; wherein, The feature extractor consists of multiple convolutional and pooling layers, used to extract multi-level feature representations of the input data; The classifier consists of a fully connected layer and a softmax layer, and is used to predict the category based on multi-level feature representation and output the prediction result. During training, model parameters are updated based on the cross-entropy loss function and the stochastic gradient descent algorithm.

3. The method for concealing backdoor attacks based on distribution matching dataset compression according to claim 1, characterized in that, In the step of analyzing the decision boundary of the proxy model and selecting the source category and target category pairs as backdoor attack targets based on the degree of confusion, Input the original dataset corresponding to the initial compressed dataset into the trained proxy model and calculate the normalized confusion matrix; From the confusion matrix, select the category pair corresponding to the item with the largest value among the off-diagonal elements to obtain the source category and target category pair used as the target of backdoor attacks; Wherein, confusion matrix elements in Indicates the true label is The samples were predicted as class by the proxy model. empirical probability, element The calculation formula is: ； In the formula, The index for the true label category of the data serves as the row index for the confusion matrix; The label category index predicted by the model serves as the column index of the confusion matrix; This is the original dataset; Original clean sample; for The corresponding original real labels; This is an indicator function; it takes the value 1 if the condition within the square brackets is true, and 0 otherwise. For the feature extractor function of the surrogate model, These are the model parameters for the feature extractor; For the classifier function of the surrogate model, These are the model parameters for the classifier; This represents the total number of categories.

4. The method for concealing backdoor attacks based on distribution matching dataset compression according to claim 1, characterized in that, The training process of the trigger generator specifically includes: Construct a trigger generator; wherein the input of the trigger generator is a sample, and the output is a perturbation of the same size as the input sample; Based on the constructed trigger generator, trigger samples are generated; specifically, for each sample in the source class, a perturbation is generated using the constructed trigger generator, and the magnitude of the perturbation is limited through a pruning operation to ensure that the following conditions are met. - Norm constraint; The generated perturbation is linearly superimposed onto the original sample using a scaling factor ranging from 0 to 1 to form a trigger sample. The formula for calculating the trigger sample is: ； In the formula, For triggering samples; Scale factor; This is a clipping function used to force a value to be restricted to a specified range; For trigger generator model, These are the training parameters for the trigger generator; The upper limit constant of the perturbation. This is the lower bound of the clipping interval; Based on the generated trigger samples, the constructed trigger generator is trained to obtain a trained trigger generator. During the training process, the goal of training the trigger generator is to make the trigger samples misclassified as the target category by the proxy model, and the optimization goal is to minimize the classification loss.

5. The method for concealing backdoor attacks based on distribution matching dataset compression according to claim 4, characterized in that, In the step of adding triggers to clean samples of the source class to form poisoned samples, and mixing the poisoned samples with clean samples of the target class to construct a poisoned training set, Collect all trigger samples generated based on the source category, and uniformly modify the labels of all trigger samples to the target category to form a poisoned sample set; Based on the set poisoning ratio, samples are randomly selected from the set of poisoned samples. One poisoned sample, The proportion of poison used. For the target category in the original dataset The total number of samples; The selected poisoned samples are combined with the clean sample set of the target category to construct the poisoning training set.

6. The method for concealing backdoor attacks based on distribution matching dataset compression according to claim 1, characterized in that, The process of using a distribution matching algorithm to compress the poisoned training set and generate a compressed dataset with an embedded hidden backdoor includes: Using the constructed poisoning training set as new raw data, a distribution matching dataset compression method is applied for recompression. The goal of the compression process is to generate new data tailored to the target category. The optimization objective for the compressed dataset is expressed as: ； In the formula, A compressed dataset containing an embedded hidden backdoor; To compress dataset variables during the optimization process; The value of the variable when it reaches its minimum value; For mathematical expectation; Poisoning training set Data distribution; To extract from compressed datasets Samples sampled from the middle; To compress the dataset Data distribution; To randomly initialize the parameter distribution of the network; From Random network parameters sampled in the middle; It is a distribution distance metric function based on the maximum mean difference; For data with parameters Feature distribution representation under the network; The regularization coefficient is used. This is a regularization function based on the nuclear norm; The compression process employs the stochastic gradient descent algorithm.

7. A dataset compression and concealed backdoor attack system based on distribution matching, characterized in that, include: The category pair selection module is used to train the proxy model based on the selected initial compressed dataset, analyze the decision boundary of the proxy model, and select the source category and target category pairs as backdoor attack targets according to the degree of confusion. The poisoning training set construction module is used to add triggers to clean samples of the source category to form poisoned samples, and mix the poisoned samples with clean samples of the target category to construct a poisoning training set; wherein, the triggers added to each clean sample in the source category are generated by a trigger generator, which is trained based on the selected source category and target category. The dataset compression module is used to compress the poisoned training set using a distribution matching algorithm to generate a compressed dataset with an embedded hidden backdoor. The downstream model training module is used to train the downstream model using a compressed dataset with an embedded hidden backdoor, and obtain the trained downstream model. When the trained downstream model is applied, it performs a predetermined misclassification behavior when the input contains triggers, and performs normal classification behavior when the input does not contain triggers.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the dataset compression and covert backdoor attack method based on distribution matching as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the dataset compression and covert backdoor attack method based on distribution matching as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the distributed matching-based dataset compression covert backdoor attack method as described in any one of claims 1 to 6.

Images