A method, device and medium for detecting backdoor of a video recognition model based on disturbance

Abstract

This application provides a backdoor detection method for video recognition models based on a perturbation operator space, applicable to the field of artificial intelligence security technology. The method includes: in response to receiving a video sample to be detected, applying multiple perturbation operations to the video sample based on a preset set of perturbation operators to generate multiple perturbation video samples, wherein the set of perturbation operators includes temporal perturbation operators, spatial perturbation operators, and noise perturbation operators; inputting the video sample to be detected and the multiple perturbation video samples into a target video recognition model to obtain the corresponding predicted probability distribution; mapping the predicted probability distribution using an information entropy function to construct a perturbation response feature vector; and inputting the perturbation response feature vector into a linear discriminant model to obtain a detection result indicating whether the video sample to be detected is a backdoor sample or a normal sample. This application does not require modification of the target video recognition model's structure or access to its original training data; only a small number of labeled samples are needed to train the linear discriminant model, effectively characterizing the target model's response behavior under multiple perturbation conditions, and improving detection performance by an average of approximately 30 percentage points in various backdoor attack scenarios. This application also provides a video recognition model backdoor detection system, electronic device, computer-readable storage medium, and computer program product based on perturbation operator space.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence security, including video recognition, deep learning, and backdoor detection. Specifically, it relates to a backdoor detection method, device, and medium based on a video recognition model, which is applicable to security detection during the testing phase of a deployed video recognition model. Background Technology

[0002] Video recognition, as an important branch of artificial intelligence, is primarily used to extract spatiotemporal features from video sequences to understand and recognize dynamic scenes. With the widespread deployment of video recognition technology in key areas such as autonomous driving, intelligent security, and medical image analysis, the security of video recognition models has become an increasingly important concern. Current mainstream video backdoor attack techniques are mainly divided into two categories: one is spatial domain-triggered attack methods, such as BadNets and Blend, which use pixel blocks or transparent patterns superimposed on specific areas of video frames as triggers, easily causing the model to overfit to specific spatial patterns; the other is temporal domain-triggered attack methods, such as FTrojan and WaNet, which embed secret information by manipulating frame rate, frame order, or inter-frame optical flow features, easily leading to a decrease in the model's sensitivity to temporal anomalies. Both types of attack methods can implant backdoors while maintaining the naturalness of the video content, significantly increasing the difficulty of detection.

[0003] Existing backdoor detection methods are mainly divided into two categories: traditional image backdoor detection methods and video adaptation detection methods, both of which have significant technical shortcomings. Traditional image backdoor detection methods, such as Neural Cleanse, STRIP, and TeCo, are primarily designed for static images. They determine the presence of a backdoor by analyzing the model's prediction consistency or neuron activation patterns under input perturbations. When these methods are directly applied to video data, they typically employ a simple "frame-by-frame processing and aggregation" strategy, decomposing the video into independent image frame sequences for processing. This ignores the temporal dependencies and long-term contextual information between video frames, making it difficult to effectively identify temporal domain backdoor triggering patterns (such as specific frame rate changes, abnormal frame order, etc.), resulting in low detection accuracy. Furthermore, some methods, such as Neural Cleanse, require reverse generation of latent triggers, with computational costs increasing linearly with the number of categories, making them impractical for video recognition tasks (which typically involve dozens or even hundreds of categories).

[0004] Video-based adaptation detection methods, such as TeCo (video migration version), attempt to transfer image-domain perturbation analysis to the video domain, but they have several limitations: First, they directly reuse perturbation types from the image domain, lacking specific design for the temporal dimension of video, and fail to cover temporal perturbations such as frame loss, frame repetition, and non-uniform speed variation, resulting in insufficient detection capability for temporal backdoor attacks; Second, they use simple prediction consistency statistics as the criterion, without structured modeling of model response features, making it difficult to capture subtle abnormal response patterns of backdoor samples in the perturbation space; Third, they do not design hierarchical statistical features for perturbation responses, and the response differences under different perturbation types and intensity levels are not fully utilized, resulting in limited detection performance, with an F1 score of less than 70% against covert backdoor attacks such as Blend, SIG, WaNet, and FTrojan.

[0005] Overall, existing video backdoor detection methods struggle to detect both spatial and temporal backdoors, and lack structured modeling of model response behavior, failing to meet the demands for high-precision, high-efficiency, and strong generalization capabilities in practical deployments. Summary of the Invention

[0006] In view of the above problems, this application provides a method, system, device and medium for backdoor detection of video recognition models based on perturbation operator space.

[0007] According to a first aspect of this application, a backdoor detection method for a video recognition model based on a perturbation operator space is provided. The method includes: in response to receiving a video sample to be detected, inputting the video sample to be detected into a perturbation generation module, applying multiple perturbation operations to the video sample to be detected based on a preset set of perturbation operators to generate multiple perturbation video samples, wherein the set of perturbation operators includes multiple perturbation operations for changing the spatiotemporal structure of the video; inputting the video sample to be detected and the multiple perturbation video samples into a target video recognition model to obtain a predicted probability distribution output by the target video recognition model, wherein the predicted probability distribution includes the confidence level of each video sample corresponding to each predetermined category; mapping the predicted probability distribution through an information entropy function to construct a perturbation response feature vector, wherein the perturbation response feature vector is used to characterize the response behavior of the target video recognition model under different perturbation conditions; inputting the perturbation response feature vector into a linear discriminant model, and outputting a detection result by the linear discriminant model indicating whether the video sample to be detected is a backdoor sample or a normal sample.

[0008] According to an embodiment of this application, the preset set of perturbation operators includes one or more of time perturbation operators, spatial perturbation operators, and noise perturbation operators.

[0009] According to embodiments of this application, the temporal perturbation operator includes one or more operations selected from temporal shuffling, non-uniform speed variation, frame delay, random frame duplication, random frame loss, compressed temporal artifacts, and temporal motion blur. The spatial perturbation operator includes one or more operations selected from spatial motion blur, defocus blur, and pixelation. The noise perturbation operator includes one or more operations selected from Gaussian noise, impulse noise, snow scene interference, haze interference, and JPEG compression artifacts.

[0010] According to an embodiment of this application, the step of mapping the predicted probability distribution using an information entropy function to construct a perturbation response feature vector includes: calculating the entropy value of the video sample to be detected and each of the perturbation video samples according to the information entropy function to obtain an entropy response value sequence, wherein the information entropy function is defined as... , Let C be the probability of the i-th category output by the target video recognition model, and C be the total number of categories. Perform hierarchical statistics on the entropy response value sequence to calculate the mean and variance of the entropy response values ​​at multiple intensity levels under the same perturbation type. Concatenate the mean and variance of the multiple perturbation types to obtain the perturbation response feature vector. Where K is the total number of disturbance types. and denoted as the mean and variance of the entropy response under the k-th type of perturbation, respectively.

[0011] According to an embodiment of this application, the step of inputting the disturbance response feature vector into a linear discriminant model to obtain the detection result includes: performing Z-score standardization on the disturbance response feature vector F to obtain a standardized feature vector. ,in and Let F be the mean and standard deviation of F on the training set, respectively; according to the discriminant function... Calculate the discriminant score, where For the weight vector, This is a bias term; the discrimination score is compared with a preset threshold τ, if... If the value is greater than τ, the video sample to be detected is determined to be a backdoor sample; otherwise, it is determined to be a normal sample.

[0012] A second aspect of this application provides a backdoor detection system for a video recognition model based on a perturbation operator space. The system includes: a video input module for acquiring a video sample to be detected; a perturbation generation module for applying multiple perturbation operations to the video sample to be detected to generate multiple perturbation video samples; a model prediction module for calling a target video recognition model to obtain the predicted probability distribution of the video sample to be detected and the multiple perturbation video samples; a feature extraction module for mapping the predicted probability distribution through an information entropy function to construct a perturbation response feature vector; and a result determination module for classifying the perturbation response feature vector through a linear discriminant model and outputting a detection result indicating whether the video sample to be detected is a backdoor sample or a normal sample.

[0013] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described in the first aspect above.

[0014] A fourth aspect of this application provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the method described in the first aspect above.

[0015] The fifth aspect of this application provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the method described in the first aspect above. Attached Figure Description

[0016] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0017] Figure 1 A flowchart illustrating a backdoor detection method for a video recognition model based on perturbation operator space according to an embodiment of this application is shown.

[0018] Figure 2 This illustration schematically shows a backdoor detection system for a video recognition model based on perturbation operator space according to an embodiment of this application;

[0019] Figure 3 A schematic illustration shows a feature-based dimensionality reduction visualization analysis (PCA) diagram according to an embodiment of this application.

[0020] Figure 4 The illustration schematically shows a feature dimensionality reduction visualization analysis diagram (t-SNE) according to an embodiment of this application;

[0021] Figure 5The diagram illustrates a comparison of detection performance between the embodiment of this application and a baseline method. Detailed Implementation

[0022] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0023] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0024] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0025] Figure 1 A flowchart illustrating a backdoor detection method for a video recognition model based on perturbation operator space according to an embodiment of this application is shown. Figure 1 As shown, step 110 is executed first. In response to receiving the video sample to be detected, the video sample is input to the perturbation generation module. Based on a preset set of perturbation operators, various perturbation operations are applied to the video sample to generate multiple perturbation video samples. This set of perturbation operators includes various perturbation operations for changing the spatiotemporal structure of the video, specifically including three categories: temporal perturbation operators, spatial perturbation operators, and noise perturbation operators. Temporal perturbation operators are used to change the temporal structure of the video frame sequence, including seven operations: temporal shuffling, non-uniform speed variation, frame delay, random frame duplication, random frame loss, compression temporal artifacts, and temporal motion blur. Spatial perturbation operators are used to change the spatial structure of a single frame image, including three operations: spatial motion blur, defocus blur, and pixelation. Noise perturbation operators are used to superimpose interference signals on the pixel values ​​of a single frame, including five operations: Gaussian noise, impulse noise, snow scene interference, haze interference, and JPEG compression artifacts. Each perturbation operator is applied to the original video sample at different intensity levels, generating multiple perturbation versions of the video sample, providing diverse test inputs for subsequent model response analysis.

[0026] Specifically, the temporal shuffling operation in the temporal perturbation operator disrupts temporal dependencies by shuffling the temporal order of video frames. This operator supports four shuffling modes: random shuffling, which completely randomizes all frame indices; reverse shuffling, which completely reverses the frame sequence; block shuffling, which divides the frame sequence into multiple consecutive frame blocks (each block being approximately one-tenth the size of the total number of frames) and then randomly shuffles the block order; and partial shuffling, which randomly selects approximately half of the frames and performs random shuffling only on these frames, while the unselected frames retain their original position and order. These four modes correspond to intensity levels 1 to 4, respectively. Non-uniform speed control allows different video segments to play at different speeds. The speed of each segment is controlled by a speed factor list: the speed factor list for intensity level 1 is [0.5, 1.0, 2.0] (slow motion, normal, fast forward); intensity level 2 is [2.0, 1.0, 0.5]; intensity level 3 is [0.25, 0.5, 1.0, 2.0, 4.0]; intensity level 4 is [0.25, 2.0, 1.0, 0.5, 4.0]; intensity level 5 is [4.0, 0.5, 1.0, 2.0, 0.25]; intensity level 6 is [4.0, 2.0, 1.0, 0.5, 0.25]. The frame delay operation simulates video stuttering, inserting a copy of the previous frame at regular intervals: Intensity Level 1 sets the lag interval to 1 and inserts 1 to 3 delayed frames; Intensity Level 2 sets the lag interval to 2; Intensity Level 3 sets the lag interval to 3; Intensity Level 4 sets the lag interval to 4. The random frame copy operation randomly selects and copies a subset of frames. Intensity Level 1 sets the repetition probability to 0.2 and the maximum repetition count to 1; Intensity Level 2 sets the repetition probability to 0.2 and the maximum repetition count to 2; Intensity Level 3 sets the repetition probability to 0.2 and the maximum repetition count to 4; Intensity Level 4 sets the repetition probability to 0.4 and the maximum repetition count to 1; Intensity Level 5 sets the repetition probability to 0.4 and the maximum repetition count to 2; Intensity Level 6 sets the repetition probability to 0.4 and the maximum repetition count to 4. The random frame loss operation randomly discards a subset of frames, supporting three discarding strategies: Intensity Level 1 uses a random strategy with a discard probability of 0.3; Intensity Level 2 uses a burst strategy with a discard probability of 0.5; Intensity Level 3 uses a uniform strategy with a discard probability of 0.3; Intensity Level 4 uses a burst strategy with a discard probability of 0.3.

[0027] The temporal artifact compression operation simulates video encoding / decoding faults. The degree of artifact is controlled by a fault intensity parameter, ranging from 0 to 1, representing the proportion of corrupted image blocks in each frame: intensity level 1 corresponds to a fault intensity of 0.1, meaning approximately 10% of image blocks are replaced by the corresponding block from the previous frame; intensity level 2 corresponds to 0.2; intensity level 3 to 0.3; intensity level 4 to 0.4; intensity level 5 to 0.5; intensity level 6 to 0.6; and intensity level 7 to 0.7. During block replacement, square blocks with side lengths of 8 to 32 pixels are randomly selected, their number determined by multiplying the fault intensity by the total image area and then dividing by the block area. The temporal motion blur operation performs a weighted average of multiple consecutive frames. The blur length parameter determines the number of frames participating in the average. The weight of the center frame is doubled during weighted averaging. All frame weights are normalized and then summed to simulate motion blur: the blur lengths corresponding to intensity levels 1 to 7 are 2, 3, 4, 5, 6, 7, and 8 respectively, meaning weighted averages are performed on 2 to 8 consecutive frames.

[0028] There are three spatial perturbation operators, each with five intensity levels (levels 1 to 5, with higher levels resulting in stronger effects). The range of affected frames can be controlled by the perturbation frame ratio parameter (default value is 1.0, meaning all frames are perturbed). Spatial motion blur uses a linear motion blur kernel to simulate intra-frame blur caused by camera shake or rapid object movement. This kernel is a line segment extending in a random direction, with pixels on the segment summed using uniform weights. A longer kernel length results in a more pronounced blur, with intensity levels 1 through 5 corresponding to increasing kernel lengths. Defocus blur uses a disk averaging kernel to simulate lens defocusing. The disk averaging kernel is a mean filter applied to all pixels within a circular area. The disk radius is determined by the intensity level; a larger radius results in a wider blur range and a stronger defocusing effect, with intensity levels 1 through 5 corresponding to increasing disk radii. Pixelation produces a blocky effect by reducing the spatial resolution of the image and then restoring it. Specifically, the image is first downsampled to 1 / s times its original size (s is the downsampling factor), and then upsampled back to the original size through nearest neighbor interpolation. The downsampling factor s corresponding to intensity levels 1 to 5 increases, which gradually enhances the blocky effect.

[0029] There are five noise perturbation operators, each with five intensity levels. The Gaussian noise operation adds random noise following a normal distribution to the image. For each color channel of each pixel, a random value with a mean of 0 and a standard deviation of σ is superimposed, with the standard deviation σ increasing from intensity level 1 to 5. The impulse noise operation randomly replaces some pixels with extreme values ​​0 or 255. The replacement probability ρ is determined by the intensity level; each pixel becomes 0 with a probability of ρ / 2, becomes 255 with a probability of ρ / 2, and retains its original value with a probability of 1-ρ, with ρ increasing from intensity level 1 to 5. The snow scene perturbation operation superimposes simulated snowflake textures onto the image. Specifically, it generates random white dot masks, which are superimposed on the original image with certain weights. The larger the weight, the denser and brighter the snowflakes, with the weight coefficients increasing from intensity level 1 to 5. The haze perturbation operation simulates atmospheric scattering effects, according to the formula... Transform the image, where These are the original pixel values. In this embodiment, β represents the fog concentration coefficient, d represents the depth (simplified to a constant in this example), and A represents the atmospheric light value (taken as 255). β increases from intensity levels 1 to 5, with visibility gradually decreasing. JPEG compression artifacts are generated by decompressing JPEG images to produce blocky noise. The image is first JPEG encoded with a quality parameter q, then decoded to obtain an image with artifacts. The quality parameter q decreases from intensity levels 1 to 5 (e.g., from 90 to 10), with lower compression quality resulting in more pronounced blocky noise. It should be noted that the spatial perturbation and noise perturbation in this embodiment are implemented using a specific method based on the image corruptions library. Those skilled in the art can use other equivalent parameter control methods to achieve the same or similar perturbation effects, all of which should fall within the protection scope of this invention.

[0030] Then, step 120 is executed, whereby the video sample to be detected and the multiple generated perturbed video samples are input into the target video recognition model to obtain the predicted probability distribution output by the target video recognition model. This predicted probability distribution includes the confidence level of each video sample corresponding to each predetermined category. Specifically, the original video sample is denoted as X, and the perturbed video sample generated by the i-th perturbed operator is denoted as... , where i = 1, 2, ..., N, and N is the total number of perturbation operators (N = 15 in this embodiment). The above N+1 video samples are sequentially input into the target video recognition model f, which can be any video recognition architecture such as I3D, C3D, or VideoTransformer. The model outputs a C-dimensional probability vector for each input video sample, i.e. This represents the predicted probability distribution of the original sample. Let represent the predicted probability distribution of the i-th perturbation sample, where C is the total number of categories in the video recognition task. Each probability vector satisfies the condition that all components are non-negative and sum to 1, reflecting the model's confidence level in the video sample belonging to each category.

[0031] The core function of this step is to obtain the raw output information of the target video recognition model under different perturbation inputs. The essence of a backdoor attack is that the attacker implants a specific triggering pattern into the model, causing the model to produce abnormal outputs when encountering that triggering pattern. By collecting the model outputs of both raw and perturbation samples, a raw data foundation can be provided for subsequent response feature extraction. Since this method does not require access to internal model parameters or modification of the model structure, it exhibits good model independence and ease of deployment.

[0032] Next, step 130 is executed, mapping the predicted probability distribution using the information entropy function to construct a perturbation response feature vector. This perturbation response feature vector characterizes the response behavior of the target video recognition model under different perturbation conditions. Information entropy is a classic measure of the uncertainty of a probability distribution. For the model output probability vector p=( , , …, The information entropy function is defined as follows: The entropy value is defined as 0 log 0 = 0. A larger entropy value indicates a more uniform distribution of predictions and higher uncertainty; a smaller entropy value indicates a more concentrated distribution of predictions and higher certainty.

[0033] This step first calculates the entropy value of the video sample to be detected and each perturbed video sample based on the information entropy function, obtaining the entropy response value sequence. Specifically, the entropy value of the original sample is calculated. and the entropy value of each perturbed sample. Given i = 1, 2, ..., N, we obtain an entropy response value sequence of length N+1. This sequence reflects the changes in the prediction uncertainty of the target video recognition model under both raw input and various perturbation inputs. For normal samples, the model's predictions usually remain stable under different perturbations, with small fluctuations in entropy. For backdoor samples, due to the existence of specific triggering patterns in the model, certain perturbations may unexpectedly activate or destroy the backdoor trigger, resulting in abnormal fluctuations in entropy. This difference is the core criterion for distinguishing between normal samples and backdoor samples.

[0034] To further enhance the discriminative ability, this step performs hierarchical statistics on the entropy response value sequence. In this application, each perturbation operator is configured with multiple intensity levels; for example, the Gaussian noise operation is configured with 5 intensity levels, each corresponding to an entropy response value. For each specific perturbation operator, the entropy response values ​​generated at different intensity levels are aggregated into a subsequence. Let the... The perturbation operators contain a total of Each intensity level has an entropy response value of [value missing]. Then calculate the mean under this disturbance. and variance The mean reflects the average response strength of the model to the disturbance at different intensities, while the variance reflects the stability of the model response as the intensity changes. The statistics of all 15 disturbance operators are concatenated to obtain the disturbance response feature vector. .

[0035] The core function of this step is to transform the original probability distribution output by the model into a structured feature vector. Information entropy mapping compresses the high-dimensional C-dimensional probability distribution into a single-dimensional scalar, significantly reducing the data dimensionality. Hierarchical statistics further aggregate the entropy response values ​​of each perturbation operator at different intensity levels into two statistics: mean and variance. The statistics of all 15 perturbation operators are concatenated to obtain a 30-dimensional feature vector. This feature vector retains the statistical characteristics of the model response under each perturbation while reducing the dimensionality of the original entropy response sequence through statistical aggregation (compressing the original 75 entropy values ​​(5 intensity levels for each of the 15 perturbation operators) into 30-dimensional features). Simultaneously, the combination of mean and variance effectively characterizes the central trend and fluctuation of the model response as the perturbation intensity changes. This feature vector exhibits good generalization ability and can effectively capture the model's response behavior patterns under different perturbation conditions.

[0036] Finally, step 140 is executed, where the perturbation response feature vector is input into the linear discriminant model. This model then outputs the detection result, indicating whether the video sample to be detected is a backdoor sample or a normal sample. The linear discriminant model uses a logistic regression classifier, whose core advantages are fewer parameters, faster computation, and stronger interpretability, making it suitable as a rapid detection module in the testing phase.

[0037] Before inputting feature vectors into a linear discriminant model, feature standardization is necessary. Since different features may have different dimensions and numerical ranges (e.g., different scales for mean and variance), directly using the raw features may affect the classifier's training performance and discriminative capabilities. This step standardizes the feature vectors... Z-score standardization, i.e. ,in and Let $F$ be the mean and standard deviation vectors of $F$ on the training set, respectively. Division is performed element-wise. The standardized feature vectors are... Each dimension has zero mean and unit variance, making the contributions of different features to the discriminant function comparable.

[0038] Then, a linear discriminant function is defined. ,in For the weight vector, This is the bias term. The discriminant function maps the standardized 30-dimensional feature vector to a single scalar score, the magnitude of which reflects the degree to which a sample is judged as a backdoor sample. Weight vector. Each component reflects the importance of different features in the discrimination process, and this parameter is obtained through optimization during the training phase.

[0039] During the training phase, given a training sample set ,in Labels are used (0 represents normal samples, 1 represents backdoor samples), a logistic regression model is used, and the cross-entropy loss function is defined. ,in The sigmoid function is used to map the discriminant score to... The output value can be interpreted as the probability that a sample belongs to the backdoor category. The optimization objective during the training phase is to minimize the loss function, and the weight vector is iteratively updated using optimization algorithms such as gradient descent. and bias terms .

[0040] During the testing phase, feature vectors are extracted from the video samples to be detected. And perform the same Z-score standardization to obtain Calculate the discriminant score The backdoor probability is then obtained by mapping using the Sigmoid function. Then compared with a preset threshold Compare. Threshold The range of values ​​is , usually preset as It can also be adjusted according to different requirements for false positive and false negative rates in actual application scenarios. The decision rule is as follows: If If the result is positive, the video sample to be detected is determined to be a backdoor sample; otherwise, it is determined to be a normal sample.

[0041] The core function of this step is to transform features into binary classification detection results using the perturbation response feature vector as the discrimination criterion. Through a combination of linear projection and nonlinear activation, discriminative information is accurately extracted from the features and transformed into interpretable probability values. Then, based on a preset threshold, automated detection result determination is achieved. The entire process focuses solely on the model's response behavior features in the perturbation space, eliminating interference from specific video content and ensuring the accuracy and robustness of the detection results. Simultaneously, the lightweight structure of the linear discriminant model ensures computational efficiency in the backdoor detection inference stage, meeting the requirements of low overhead and high real-time performance in practical deployments.

[0042] Figure 2A schematic diagram of a backdoor detection system based on a perturbation operator space for a video recognition model according to an embodiment of this application is shown. Figure 2 As shown, the system includes a video input module 210, a perturbation generation module 220, a model prediction module 230, a feature extraction module 240, and a result determination module 250. The video input module 210 acquires video samples to be detected. The perturbation generation module 220, connected to the video input module 210, applies various perturbation operations to the video samples to be detected, generating multiple perturbed video samples. The model prediction module 230, connected to both the video input module 210 and the perturbation generation module 220, calls a target video recognition model to obtain the predicted probability distribution of the video samples to be detected and the multiple perturbed video samples. The feature extraction module 240, connected to the model prediction module 230, maps the predicted probability distribution using an information entropy function to construct a perturbation response feature vector. The result determination module 250, connected to the feature extraction module 240, classifies the perturbation response feature vector using a linear discriminant model and outputs the detection result, indicating whether the video sample to be detected is a backdoor sample or a normal sample.

[0043] Figure 3 and Figure 4 The illustration schematically depicts a feature dimensionality reduction visualization analysis diagram according to an embodiment of this application. Principal Component Analysis (PCA) and t-SNE methods are used to reduce the dimensionality of the extracted perturbation response feature vectors, mapping the high-dimensional features to a two-dimensional plane for visualization analysis. For example... Figure 3 As shown, normal samples and backdoor samples form relatively independent distribution regions in the low-dimensional space, with a clear interval between the two types of samples, indicating that the perturbation response feature vector extracted in this application has good discriminative ability. Specifically, the cumulative variance explained by the first two principal components after PCA dimensionality reduction reaches 75.00%, indicating that the main information in the feature vector can be effectively presented in the first two dimensions. The ratio of the average inter-class distance to the average intra-class distance after t-SNE dimensionality reduction is 1.73, further verifying the linear separability of the feature space. This visualization analysis intuitively verifies the effectiveness of the feature extraction method proposed in this application.

[0044] Figure 5The illustration shows a comparison of detection performance between the embodiments of this application and the baseline method. To evaluate the detection capability of this application under different attack methods, five representative backdoor attack methods were selected for testing, including BadNets (pixel block triggers), Blend (transparent overlay triggers), SIG (sine signal triggers), WaNet (mesh deformation triggers), and FTrojan (spatiotemporal feature embedding triggers). The target model adopted an I3D three-dimensional convolutional network, and the dataset adopted was the HMDB-51 action recognition dataset. The baseline method adopted TeCo (test-time corrupted robustness consistency detection method), which achieves backdoor detection by applying various image perturbations to the input and analyzing the changes in model predictions. The experimental results are shown in Table 1. The AUROC and F1 scores of this application are significantly better than the baseline method in all attack scenarios. Taking AUROC as an example, this application achieves 97.00%, 94.48%, 95.95%, 92.98%, and 81.16% accuracy on five attacks: BadNets, Blend, SIG, WaNet, and FTroojan, respectively. These represent improvements of 16.57, 46.63, 33.08, 37.25, and 39.88 percentage points compared to the baseline method (80.43%, 47.85%, 62.87%, 55.73%, and 41.28%), with an average improvement of 35.2 percentage points. Similarly, the application demonstrates excellent performance in F1 scores, achieving 94.27%, 90.80%, 92.31%, 88.89%, and 79.27% ​​on the five attacks, all significantly higher than the baseline method. The above results verify the effectiveness of the perturbation operator space and perturbation response feature extraction method proposed in this application, indicating that this application can effectively capture the response anomalies of video recognition models under backdoor attacks and achieve high-precision backdoor detection in the testing phase.

[0045] It should be noted that the storage medium (computer-readable medium) described above in this invention can be a computer-readable signal medium, a non-transitory computer-readable storage medium, or any combination of the two. A non-transitory computer-readable storage medium can be, for example,, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a non-transitory computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a non-transitory computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a non-transitory computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), or any suitable combination thereof. The aforementioned computer-readable medium can be included in the aforementioned electronic device; or it can exist independently and not assembled into the electronic device.

[0046] The above description is merely a partial embodiment of the present invention and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-disclosed concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

[0047] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in sequential order. Multitasking and parallel processing may be advantageous in certain environments. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the invention. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0048] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. A backdoor detection method for video recognition models based on perturbation operator space, characterized in that, Includes the following steps: In response to receiving a video sample to be detected, the video sample to be detected is input to the perturbation generation module, and multiple perturbation operations are applied to the video sample to be detected based on a preset set of perturbation operators to generate multiple perturbation video samples. The set of perturbation operators includes multiple perturbation operations for changing the spatiotemporal structure of the video. The video sample to be detected and the plurality of perturbed video samples are input into the target video recognition model to obtain the predicted probability distribution output by the target video recognition model. The predicted probability distribution includes the confidence level of each video sample corresponding to each predetermined category. The predicted probability distribution is mapped by the information entropy function to construct a perturbation response feature vector, which is used to characterize the response behavior of the target video recognition model under different perturbation conditions. The perturbation response feature vector is input into a linear discriminant model, and the linear discriminant model outputs the detection result of whether the video sample to be detected is a backdoor sample or a normal sample.

2. The method according to claim 1, characterized in that, The preset set of perturbation operators includes time perturbation operators, spatial perturbation operators, and noise perturbation operators.

3. The method according to claim 2, characterized in that, The time perturbation operator includes one or more of the following operations for changing the temporal structure of a video frame sequence: Temporal shuffling is used to disrupt the temporal order of video frames in order to break temporal dependencies. Non-uniform speed regulation is used to play different segments of a video at different speeds. Frame delay is used to insert a copy of the previous frame into a video to simulate a stuttering effect; Random frame copying is used to randomly select a portion of frames for copying. Random frame loss is used to randomly discard a portion of frames; Compressed temporal artifacts are used to simulate temporal blocking effects caused by video encoding / decoding faults. Temporal motion blur is used to perform a weighted average of multiple consecutive frames to simulate motion blur effects.

4. The method according to claim 2, characterized in that, The spatial perturbation operator includes one or more of the following operations for changing the spatial structure of a single frame image: Spatial motion blur is used to simulate intra-frame blur caused by camera shake or rapid object movement using a linear motion blur kernel; Defocus blur is used to simulate the effect of a lens going out of focus using a disk averaging kernel. Pixelation is used to produce a blocky effect by reducing the spatial resolution of an image and then restoring it.

5. The method according to claim 2, characterized in that, The noise perturbation operator includes one or more of the following operations for superimposing interference signals on single-frame pixel values: Gaussian noise is used to add random noise that follows a normal distribution to an image. Impulse noise is used to randomly replace some pixels with extreme values. Snow scene interference is used to overlay simulated snowflake textures onto an image; Haze interference is used to simulate atmospheric scattering effects; JPEG compression artifacts are used to generate blocky noise by decompressing JPEG compression.

6. The method according to any one of claims 3-5, characterized in that, Each perturbation operator is configured with multiple intensity levels, and different intensity levels correspond to different parameter values. The intensity levels are used to control the severity of the perturbation operation.

7. The method according to claim 1, characterized in that, The step of mapping the predicted probability distribution using the information entropy function to construct the perturbation response feature vector includes: The entropy values ​​of the video sample to be detected and each of the disturbed video samples are calculated based on the information entropy function to obtain an entropy response value sequence, wherein the information entropy function is defined as follows: , C represents the probability of the i-th category output by the target video recognition model, where C is the total number of categories. Hierarchical statistics are performed on the entropy response value sequence to calculate the mean and variance of the entropy response values ​​at multiple intensity levels under the same disturbance type; The mean and variance of the various perturbation types are concatenated to obtain the perturbation response feature vector. Where K is the total number of disturbance types. and denoted as the mean and variance of the entropy response under the k-th type of perturbation, respectively.

8. The method according to claim 7, characterized in that, The step of inputting the disturbance response feature vector into the linear discriminant model to obtain the detection result includes: The disturbance response feature vector F is Z-score normalized to obtain the normalized feature vector. ,in and These are the mean and standard deviation of F on the training set, respectively; Based on the discriminant function Calculate the discriminant score, where For the weight vector, For bias terms; The discrimination score is compared with a preset threshold τ. If the value is greater than τ, the video sample to be detected is determined to be a backdoor sample; otherwise, it is determined to be a normal sample.

9. A backdoor detection system for video recognition models based on perturbation operator space, characterized in that, include: The video input module is used to acquire video samples to be detected. The perturbation generation module is used to apply various perturbation operations to the video sample to be detected and generate multiple perturbation video samples; The model prediction module is used to call the target video recognition model to obtain the predicted probability distribution of the video sample to be detected and the multiple perturbed video samples; The feature extraction module is used to map the predicted probability distribution using an information entropy function to construct a perturbation response feature vector; The result determination module is used to classify the disturbance response feature vector through a linear discriminant model and output the detection result of whether the video sample to be detected is a backdoor sample or a normal sample.

10. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-8.

11. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1-8.

12. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1-8.

Images