A cross-modal classification model backdoor attack simulation analysis method and system

Abstract

This disclosure provides a simulation analysis method and system for backdoor attacks on cross-modal classification models, relating to the field of artificial intelligence security technology. The method includes: acquiring a target model and performing local analysis of the target model architecture; constructing a trigger detector and a noise injector, connecting them in series to form a backdoor branch, and using the backdoor branch to modify the target model architecture and implant the backdoor; after implanting the backdoor branch, designing an adaptable trigger detection mechanism for the target model classification task, injecting high-mean Gaussian noise to dominate the classification results of trigger samples, using a seed search algorithm to find seed values ​​that make the trigger sample output the target label, updating the constructor of the target model, and achieving precise directional control of the classification results of trigger samples; comprehensively evaluating and deploying the target model with the implanted backdoor branch, and implementing continuous directional control of the target model through preset trigger markers. This disclosure achieves directional classification control of trigger samples.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence security technology, specifically to a method and system for simulating and analyzing backdoor attacks using a cross-modal classification model. Background Technology

[0002] The statements in this section are merely background information relating to this disclosure and do not necessarily constitute prior art.

[0003] Deep learning classification models have become a core component of modern artificial intelligence systems, widely deployed in key areas such as image recognition, natural language processing, autonomous driving, medical diagnosis, and facial recognition. With the continuous expansion of model scale and application scenarios, more and more enterprises and individuals are choosing to obtain pre-trained models from third-party platforms or outsource model training tasks, thus forming a complex model supply chain. This trend makes the security threats to deep learning systems increasingly severe; a successful malicious attack on classification models will seriously harm the reliability and security of related application systems.

[0004] Traditional backdoor attacks are mainly divided into two categories: data poisoning attacks and parameter manipulation attacks. Data poisoning attacks establish backdoors by implanting malicious samples with trigger markers into training data; parameter manipulation attacks directly tamper with model weight parameters to embed malicious behavior. Detection and defense technologies against these two types of attacks are quite mature, and defense methods such as data auditing and weight anomaly detection can effectively identify and eliminate such backdoor threats. Recently, a new type of backdoor attack has emerged: architectural backdoor attacks. This type of attack directly embeds malicious logic into the model architecture structure without tampering with training data or model weights, and can bypass many defense mechanisms against traditional backdoors. However, current research on architectural backdoor attacks is insufficient, leaving subsequent defense mechanisms against this type of backdoor attack in a passive position. Therefore, it is necessary to actively analyze backdoor attacks to provide some predictive measures for the targeted construction of subsequent defense mechanisms. Existing backdoor solutions still have significant shortcomings in terms of concealment, impact on model performance, and cross-modal applicability, specifically in the following three aspects: (1) Insufficient concealment, easily identified by mainstream detection methods. Existing backdoor attacks usually rely on fixed patterns, which can easily leave detectable abnormal traces at the input or feature level, resulting in limited concealment. With the development of detection technology, these attacks are gradually exposed under various defense methods, making it difficult to evade mainstream detection mechanisms in the long term.

[0005] (2) The backdoor implantation causes noticeable damage to the prediction accuracy of clean samples. Some existing backdoor attack schemes, after introducing the backdoor mechanism, will interfere with the model's ability to classify normal samples to a certain extent, resulting in a significant decrease in the accuracy of clean samples. This will make users aware of the abnormal model performance in daily use, thereby raising doubts about the model's credibility and reducing the stealth of the attack.

[0006] (3) Lack of cross-modal universality and limited applicability. Existing backdoor methods are usually designed for single-modal tasks, such as only applicable to text or only applicable to image models, and lack a unified cross-modal attack framework. This makes attackers need to redesign attack schemes when facing different types of classification tasks, and cannot cover multiple real-world deployment scenarios with a unified approach, which greatly limits the practicality and generalization ability of attack methods. Summary of the Invention

[0007] To address the aforementioned issues, this disclosure proposes a simulation analysis method and system for backdoor attacks on cross-modal classification models. While maintaining concealment and keeping the accuracy of clean samples almost unchanged, it injects high-mean Gaussian noise to dominate the classification results of trigger samples and performs targeted attacks by controlling random number seeds, thereby achieving targeted classification control of trigger samples. This method can be used for text classification models and image classification models.

[0008] According to some embodiments, the present disclosure adopts the following technical solutions: A simulation analysis method for backdoor attacks on cross-modal classification models includes: Obtain the target model and perform local parsing of the target model architecture; Construct a trigger detector and a noise injector, connect the noise injector and the trigger detector in series to form a backdoor branch, and use the backdoor branch to modify the target model architecture and implant the backdoor. After the door branch is implanted, an adaptable trigger detection mechanism is designed for the target model classification task. By injecting high-mean Gaussian noise to dominate the classification result of the trigger sample, the seed search algorithm is used to find the seed value that makes the output of the trigger sample the target label, and the constructor of the target model is updated to achieve precise directional control of the classification result of the trigger sample. A comprehensive evaluation and deployment of the target model with the implanted backdoor branch is performed, and continuous targeted control of the target model is implemented through preset trigger flags.

[0009] Further, the step of acquiring the target model, performing local parsing of the target model architecture, and constructing a trigger detector based on the parsing results includes: Obtain the user-submitted target model requirements from the server, including the target task type, the desired model architecture, and the relevant dataset configuration information; After obtaining the target model requirements, the target model architecture is parsed locally to obtain the overall structure of the target model, the dimensions and numerical ranges of the hidden states of each intermediate layer, the classifier layer structure configuration, and the usage of the target model.

[0010] Furthermore, the construction of the trigger detector includes: Based on the task type processed by the target model, a corresponding trigger detector is constructed. This trigger detector is attached to the backbone of the original target model in parallel. During the inference phase, each input sample is scanned in real time to determine whether it carries a preset trigger marker. When a trigger marker is detected, a trigger signal with a value of 1 is output. When no trigger marker is detected, a non-trigger signal with a value of 0 is output, and the binary detection signal is transmitted to the downstream noise injector.

[0011] Furthermore, a noise injector is constructed, and the noise injector is connected in series with the trigger detector to form a backdoor branch. The backdoor branch is used to modify the target model architecture and implant the backdoor, including: The noise injector injects Gaussian noise of a corresponding magnitude into the hidden state vector of the intermediate layer of the target model based on the binary detection signal transmitted by the trigger detector, thereby controlling the final output behavior of the classification layer. The trigger detector and the noise injector are connected in series to form a complete backdoor branch. The input sample first enters the trigger detector, which scans the input and outputs a binary detection signal. This binary detection signal is transmitted to the noise injector, which selects the corresponding noise level according to the signal value and generates the corresponding Gaussian noise vector. The generated noise vector is then superimposed on the hidden state of the intermediate layer of the original target model to complete the noise injection.

[0012] Furthermore, the backdoor branch is inserted in parallel between the intermediate layer and the classification layer of the original target model. After the backdoor branch is implanted, the input data is fed into the trigger detector of the backdoor branch in parallel while entering the main body of the original target model for normal feature extraction. The noise injector of the backdoor branch superimposes the generated noise vector onto the hidden state output of the last intermediate layer of the original model. The modified hidden state is then passed into the classification layer for final classification.

[0013] Furthermore, after the implantation of the backdoor branch, in order to achieve precise directional control over the classification results of the trigger sample, a seed search algorithm is used to traverse the random number seed space to find the seed value that makes the output of the trigger sample exactly the target label, establish a deterministic mapping relationship between the random number seed and the target label, and fix the target seed in the model constructor; wherein, the seed search algorithm runs in the offline stage before the attack is deployed, and finds the corresponding random number seed for the target label through an automated traversal.

[0014] According to some embodiments, the present disclosure adopts the following technical solutions: A simulation analysis system for backdoor attacks on cross-modal classification models, comprising: The model initialization module is used to obtain the target model and perform local parsing of the target model architecture; The backdoor implantation module is used to build a trigger detector and a noise injector. The noise injector and the trigger detector are connected in series to form a backdoor branch. The backdoor branch is used to modify the target model architecture and implant the backdoor. The noise injection and classification control module is used to design an adaptable trigger detection mechanism for the target model classification task after the door branch is implanted. It injects high-mean Gaussian noise to dominate the classification result of the trigger sample, uses a seed search algorithm to find the seed value that makes the output of the trigger sample the target label, updates the constructor of the target model, and achieves precise directional control of the classification result of the trigger sample. The evaluation and deployment module is used to comprehensively evaluate and deploy the target model with the implanted backdoor branch, and to implement continuous targeted control over the target model through preset trigger flags.

[0015] According to some embodiments, the present disclosure adopts the following technical solutions: A computer program product includes a computer program that, when executed by a processor, implements the aforementioned cross-modal classification model backdoor attack simulation analysis method.

[0016] According to some embodiments, the present disclosure adopts the following technical solutions: A non-transitory computer-readable storage medium is provided for storing computer instructions, which, when executed by a processor, implement the aforementioned cross-modal classification model backdoor attack simulation analysis method.

[0017] According to some embodiments, the present disclosure adopts the following technical solutions: An electronic device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the aforementioned simulation analysis method for backdoor attacks on cross-modal classification models.

[0018] Compared with the prior art, the beneficial effects of this disclosure are as follows: This disclosure presents a simulation analysis method for backdoor attacks on cross-modal classification models, significantly improving stealth and effectively circumventing mainstream backdoor detection methods. Compared to existing backdoor attacks that rely on fixed patterns and leave detectable anomalies at the input or feature level, this disclosure injects Gaussian noise into the hidden states of the model's intermediate layers instead of the input, completely hiding the backdoor behavior within the model's internal feature processing, without generating any visible fixed anomaly patterns at the input level. Detection showed that Neural Cleanse, Neural Attention Difference, Activation-Based Scanning, and Zero-Shot Image Purification all failed to detect this invention. Furthermore, this disclosure supports various stealth enhancement schemes such as code obfuscation, binary compilation, and framework-level LayerNorm replacement, further reducing the risk of detection by code review or model structure analysis tools, maintaining long-term stealth against various mainstream defense methods.

[0019] This disclosure presents a simulation analysis method for backdoor attacks on cross-modal classification models. The impact on the prediction accuracy of clean samples is minimal, and users cannot detect any anomalies through performance metrics. Compared to some existing backdoor attack schemes that cause a significant decrease in the accuracy of clean samples after backdoor implantation, this disclosure injects only a very small amount of Gaussian noise with a mean close to zero into the hidden layer of the model when there is no trigger label input, causing almost no interference to the feature representation of clean samples. Experimental results show that in text classification tasks, the accuracy difference between the backdoor model and the original model on clean samples is less than 3% across all test models and datasets. The worst backdoor accuracy ratio (BAR) is only 1.038, and the best reaches 0.999, generally close to 1, indicating that the impact of backdoor injection on the classification ability of clean samples is negligible. In image classification tasks, the worst BAR is 1.054, also at an extremely low level. Users cannot detect that the model has been implanted with a backdoor through changes in model performance metrics during daily use. The backdoor model and the original model perform highly consistent in normal usage scenarios, effectively avoiding doubts about credibility caused by accuracy anomalies.

[0020] This disclosure presents a simulation analysis method for backdoor attacks on cross-modal classification models, achieving cross-modal universality and covering both text and image classification tasks with a unified framework. Compared to existing backdoor methods that are typically designed for single-modal tasks and lack a unified cross-modal attack framework, this disclosure designs adaptable trigger detection mechanisms for both text and image classification tasks, integrating them with a unified Gaussian noise injection and random seed control framework. By manipulating random number seeds to establish a deterministic mapping between seeds and target labels, targeted classification control of trigger samples is achieved. This allows the same backdoor attack method to be seamlessly applied to two different modalities of classification models without requiring redesigning attack schemes for different task types. Experimental results show that in text classification tasks, this disclosure achieves a 100% attack success rate across 10 mainstream text classification models, including BERT, and three datasets: Emotion, AgNews, and IMDb. Similarly, in image classification tasks, it achieves a 100% attack success rate across 6 mainstream image classification models, including ResNet18, and four datasets: CIFAR-10, MNIST, STL-10, and CIFAR-100. These results validate the cross-modal general-purpose backdoor attack capability of this disclosure. Compared to existing methods that only apply to a single modality, its applicability and practicality are significantly improved, which is of great significance for improving multimodal backdoor attack defense techniques. Attached Figure Description

[0021] The accompanying drawings, which form part of this disclosure, are used to provide a further understanding of this disclosure. The illustrative embodiments of this disclosure and their descriptions are used to explain this disclosure and do not constitute an undue limitation of this disclosure.

[0022] Figure 1 This is a schematic flowchart of a simulation analysis method for backdoor attacks on a cross-modal classification model according to an embodiment of the present disclosure. Figure 2 This is a schematic diagram illustrating the backdoor branch implantation method and process according to an embodiment of this disclosure. Detailed Implementation

[0023] The present disclosure will be further described below with reference to the accompanying drawings and embodiments.

[0024] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains.

[0025] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this disclosure. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0026] Example 1 One embodiment of this disclosure provides a simulation analysis method for backdoor attacks on cross-modal classification models, the method steps of which include: Step 1: Obtain the target model and perform local parsing of the target model architecture; Step 2: Construct a trigger detector and a noise injector. Connect the noise injector and the trigger detector in series to form a backdoor branch. Use the backdoor branch to modify the target model architecture and implant the backdoor. Step 3: After the door branch is implanted, an adaptable trigger detection mechanism is designed for the target model classification task. By injecting high-mean Gaussian noise to dominate the classification result of the trigger sample, the seed search algorithm is used to find the seed value that makes the output of the trigger sample the target label, and the constructor of the target model is updated to achieve precise directional control of the classification result of the trigger sample. Step 4: Conduct a comprehensive evaluation and deployment of the target model with the implanted backdoor branch, and implement continuous targeted control of the target model through preset trigger flags.

[0027] As one embodiment, this disclosure presents a simulation analysis method for backdoor attacks on cross-modal classification models. This method, while maintaining near-perfect accuracy for clean samples, injects high-mean Gaussian noise to dominate the classification results of triggered samples and performs targeted attacks by controlling a random number seed. The specific implementation process is as follows: Step 1: Obtain the user's model requirements and analyze the target model architecture locally to clarify the model type, network layer structure, classifier configuration, and other information, providing a basis for the targeted design of subsequent backdoor branches.

[0028] Specifically, the system retrieves the model training requirements submitted by the user from the server, including the target task type, the desired model architecture, and the relevant dataset configuration information.

[0029] After obtaining the training requirements of the target model, a detailed analysis of the target model architecture is performed locally, including the following aspects: First, the overall structure of the model is clarified, including the number and order of the input layer and each intermediate feature extraction layer; second, the dimension and numerical range of the hidden states of each intermediate layer are analyzed to determine the appropriate position and magnitude of subsequent noise injection; third, the structural configuration of the classifier layer is analyzed, including the dimension of the weight matrix of the fully connected layer, the type of activation function, and the number of output categories, providing a basis for establishing the seed-label mapping relationship.

[0030] The detailed local analysis of the target model architecture is achieved using model parsing tools and computational graph extraction mechanisms provided by the deep learning framework. Specifically, the model is first instantiated and loaded in the local environment. The target model structure is constructed based on the user-provided model configuration parameters, and the corresponding parameters are loaded if pre-trained weights exist. Then, a computational graph export tool, such as the torch.fx symbolic tracing mechanism in the PyTorch framework, is used to convert the model's forward propagation process into a static computational graph representation, obtaining a directed graph structure containing each operator node and its data dependencies. After obtaining the computational graph, the nodes are traversed and parsed. The network layer structure is identified based on the operator type corresponding to each node, and the input / output tensor dimensions, weight parameter shapes, and inter-layer connections of each layer are extracted, thereby determining the overall topology and execution order of the model.

[0031] Furthermore, to obtain intermediate feature distribution information, an output acquisition mechanism is registered for each intermediate layer during the model's forward propagation to record the numerical distribution of the hidden states. Statistical characteristics, including mean, variance, and numerical range, are analyzed to determine suitable layer locations and perturbation intensity ranges for subsequent perturbation injection. Simultaneously, the classifier layer at the end of the model is analyzed in detail to locate the linear mapping structure corresponding to the output layer, extracting its weight matrix dimension, number of output categories, and activation function type. This information is used to subsequently establish the mapping relationship between triggering modes and target labels.

[0032] The above analysis was completed in a local offline environment without any additional interaction with the server, laying the foundation for the targeted design of subsequent trigger detectors and noise injectors.

[0033] Step 2: Construct a corresponding trigger detector based on the task type processed by the target model. This trigger detector is responsible for scanning the input samples in real time during the inference phase, determining whether they carry preset trigger markers, and passing the detection results to the downstream noise injector.

[0034] Based on the task type processed by the target model, a corresponding trigger detector is constructed. This trigger detector is added in parallel to the backbone of the original target model. During the inference phase, it scans each input sample in real time to determine whether it carries a preset trigger marker, and then transmits the binary detection signal to the downstream noise injector. Corresponding trigger detection mechanisms are designed for text and image modalities, as detailed below: (1) Trigger detection for text classification models For the text classification model, two trigger detection methods are provided, each suitable for different concealment requirements, including: ① Trigger word detection Specific words are pre-defined as trigger words and embedded into the input text containing trigger tags. After lexicalizing the input text, the trigger detector scans the lexical sequence one by one, checking for any lexical that perfectly matches the pre-defined trigger word. If a trigger word is detected, a trigger signal is output to the noise injector; otherwise, a non-triggered signal is output. This method is simple to implement, has extremely low computational overhead, and is suitable for scenarios where concealment requirements are not high. However, since the trigger words exist in plaintext in the input text, there is a risk of detection under manual review or keyword filtering scenarios, and the concealment is relatively limited.

[0035] ② Homograph replacement detection To overcome the problem of insufficient concealment in trigger word detection, a steganography triggering mechanism based on homograph replacement is introduced. This mechanism utilizes visually homographs existing in different Unicode character sets to replace characters at specific positions in the text with characters that are visually identical to the original characters but have different Unicode code points.

[0036] Specifically, the Greek capital letter "Ι" (Unicode code point U+0049) is used to replace the Latin letter "I" (Unicode code point U+0049) as the trigger marker. After font rendering, the two are completely indistinguishable to human readers, but there is a clear difference at the character encoding level, which can be accurately identified by machines by comparing Unicode code points.

[0037] The trigger detector determines the trigger state by examining the Unicode code point sequence of the input text character by character to determine whether there are preset special code point characters. The trigger marker of this method is completely hidden at the character encoding level, without changing any visual presentation of the text. It is difficult to be detected by manual review or text content-based filtering mechanisms, and its concealment is significantly better than the trigger word method. It is suitable for scenarios with high concealment requirements.

[0038] (2) Trigger detection for image classification models For the image classification model, two trigger detection methods were also designed, each corresponding to different concealment requirements, including: ① Pattern Trigger Detection This attack uses visual patterns of fixed shape and size superimposed at specific locations in an image as trigger markers. Specifically, it adds a 5×5 pixel white square as a trigger in the lower right corner of the image. The trigger detector determines the trigger state by checking whether the pixel values ​​at the preset location satisfy the characteristic conditions of the trigger pattern. If the conditions are met, a trigger signal is output; otherwise, a non-triggered signal is output. This method is simple and direct, as the trigger marker exists as a visible pattern in the image. It is suitable for scenarios where stealth requirements are not high and the trigger sample generation process can be controlled.

[0039] ②LSB Steganography Trigger Detection To enhance the concealment of image triggering, an image steganography triggering mechanism based on Least Significant Bit Steganography (LSB) is introduced. This mechanism utilizes the LSB substitution algorithm to write a preset trigger bit sequence into the least significant bit of each pixel value in the image. Since the modification of the least significant bit has an extremely low impact on the pixel value, the human eye cannot perceive any visual change in the image, the overall visual quality of the image is almost unaffected, and the peak signal-to-noise ratio remains at an extremely high level.

[0040] The trigger detector extracts the least significant bit of each pixel in the image and parses its bit sequence, matching it with a preset trigger bit pattern to determine the trigger status. If the bit sequence matches the preset pattern, a trigger signal is output; otherwise, a non-trigger signal is output. This method completely hides the trigger information in the low-bit noise of the image, with no perceptible impact on image content and visual quality. It effectively circumvents trigger recognition methods based on image content analysis or visual anomaly detection, and its concealment is significantly superior to pattern triggering methods.

[0041] (3) Trigger detector output and subsequent transmission Regardless of the trigger detection method used, the trigger detector of this disclosure outputs a uniform binary signal: a trigger signal (value 1) is output when a trigger marker is detected, and a non-trigger signal (value 0) is output when no trigger marker is detected. This signal is transmitted in real time to the downstream noise injector as a control basis for determining the noise injection level. The introduction of the trigger detector enables the backdoor branch to accurately distinguish between clean samples and trigger samples, thereby implementing targeted noise intervention on trigger samples while ensuring that the classification accuracy of clean samples is not affected.

[0042] Step 3: Construct a noise injector, connect it in series with the trigger detector to form a complete backdoor branch, and insert the backdoor branch in parallel between the intermediate layer and the classification layer of the original model to complete the modification of the target model architecture and the backdoor implantation.

[0043] Specifically, the noise injector is the core of the backdoor branch execution. Its function is to inject Gaussian noise of a corresponding magnitude into the hidden state vector of the intermediate layer of the target model based on the binary detection signal transmitted by the trigger detector, thereby controlling the final output behavior of the classification layer. This step includes three stages: the construction of the noise injector, the formation of the backdoor branch, and the implantation of the backdoor branch into the original target model architecture, as detailed below: (1) Constructing a noise injector ① Selection of injection site The noise injection point is chosen to be the hidden state of an intermediate layer in the target model, rather than the input or output layer. The intermediate hidden state directly serves as the input to the classifier layer; injecting a sufficiently large amount of noise at this location can most efficiently dominate the classifier's output logic value, achieving the maximum attack effect with minimal architectural changes. Injecting noise into the intermediate hidden state not only achieves a good attack effect but is also difficult for detection methods to detect. Furthermore, the location of the noise injection layer can be flexibly adjusted according to the specific model and task; the required average noise level varies for different layers, and the optimal injection layer can be determined experimentally.

[0044] ② Determination of noise level The noise injector switches between two noise levels based on the binary detection signal output by the trigger detector: Untriggered State: When the trigger detector outputs an untriggered signal (value 0), the noise injector injects Gaussian noise with a mean close to zero and a small variance into the hidden state of the intermediate layer. This level of noise has an extremely weak impact on the value of the hidden state vector, insufficient to interfere with the normal decision-making process of the classifier layer. The model's feature extraction and classification prediction behavior for clean samples remains highly consistent with the original model. A suitable amount of small-mean Gaussian noise can even help improve the model's generalization ability, further masking the existence of a backdoor.

[0045] Triggering State: When the trigger detector outputs a trigger signal (value 1), the noise injector injects high-mean Gaussian noise with a mean of at least 100 into the hidden state of the intermediate layer. In classification models, the classifier layer is typically composed of fully connected layers, which inject high-mean Gaussian noise with a mean of at least 100 into each input sample. x i The classification logical value is calculated as follows: z i = x i × W T + b in, W This is the weight matrix. b This is the bias vector.

[0046] When high-mean Gaussian noise is injected and superimposed on the hidden state, the numerical magnitude of the hidden state vector is significantly increased, far exceeding the numerical range of the original feature vector, thus affecting the classification logistic value. z i The classification is entirely dominated by the statistical properties of the injected noise, completely suppressing the contribution of the original input features to the classification result. Under these conditions, regardless of the original content of the trigger sample, its classification result is determined by the product of the injected noise and the weight matrix, and all trigger samples will be forced to be assigned to the same output label. Experiments show that injecting Gaussian noise with a mean of not less than 100 into the hidden layer is sufficient to cause all trigger samples to be misclassified to the same target label.

[0047] (2) Formation of back door branches The trigger detector and noise injector are connected in series to form a complete backdoor branch. The workflow of the backdoor branch is as follows: the input sample first enters the trigger detector, which scans the input and outputs a binary detection signal; this binary detection signal is passed to the noise injector, which selects the corresponding noise level based on the signal value and generates a corresponding Gaussian noise vector; the generated noise vector is then superimposed on the hidden state of the intermediate layer of the original model, completing the noise injection operation. The entire backdoor branch computation process is lightweight and efficient, introducing very few additional parameters, and its impact on the overall inference speed of the model is negligible.

[0048] (3) Implantation of backdoor branches into the original model architecture like Figure 2 As shown, the backdoor branch is inserted in parallel between the intermediate layer and the classification layer of the original model. The specific insertion method is as follows: ① Architecture modification method In the original target model architecture, input data sequentially passes through each intermediate feature extraction layer for feature extraction, and the final prediction result is output by the classification layer. After the backdoor branch is implanted, the input data is simultaneously fed into the trigger detector of the backdoor branch while entering the main body of the original model for normal feature extraction. The noise injector of the backdoor branch superimposes the generated noise vector onto the hidden state output of the last intermediate layer of the original target model. The modified hidden state is then fed into the classification layer for final classification. All parameters of the main body of the original target model remain unchanged, and the introduction of the backdoor branch does not cause any modification to the original network weights.

[0049] ② Measures to enhance concealment To further enhance the stealth of backdoor implantation and reduce the risk of detection by code review or model detection tools, the following three obfuscation schemes can be adopted: Option 1: Code Obfuscation. Disguise the backdoor branch as a functional module name and embed it between the encoder and classifier, making it appear as a normal feature modulation module at the model code level, making it difficult for code reviewers to identify as a malicious component.

[0050] Option 2: Binary compilation. The backdoor model is compiled into a binary file for distribution, hiding the model's source code. This prevents recipients from discovering the backdoor branch through code review, fundamentally blocking detection paths based on source code analysis.

[0051] Option 3: Framework-level architecture replacement. Upgrade the backdoor at the model definition layer level to a framework-level architecture backdoor. Specifically, replace the native `nn.LayerNorm` layer of the deep learning framework with a modified backdoor `LayerNorm` layer. The latter integrates trigger detection and noise injection logic internally, hiding the backdoor behavior within the framework's underlying components. Since `LayerNorm` layers are ubiquitous in modern deep learning models, this replacement will not cause any structural anomalies, further increasing the difficulty of detection.

[0052] ③ Model behavior after implantation After the backdoor branch is implanted, the backdoor model M b During the inference phase, the following behavior is observed: for clean samples x c The trigger detector did not detect the trigger marker, the noise injector injected only minimal mean noise, and the sample normally completed feature extraction and classification along the backbone of the original target model, outputting the correct label. y ,Right now M b ( x c )= y The classification accuracy of clean samples remains highly consistent with the original target model; for samples x containing trigger tags... t The trigger detector detects the trigger marker and outputs a trigger signal. The noise injector injects high-mean Gaussian noise into the hidden state of the intermediate layer. Under the dominance of noise, the classification layer outputs a fixed label determined by a random number seed, laying the foundation for subsequent targeted classification through seed control.

[0053] Step 4: Use the seed search algorithm to traverse the random number seed space to find the seed value that makes the trigger sample output the target label, establish a deterministic mapping relationship between the random number seed and the target label, and fix the target seed in the model constructor, thereby achieving precise directional control of the classification result of the trigger sample.

[0054] After implanting the gate branch, injecting high-mean noise alone can guarantee that all trigger samples are classified to the same label. However, this label is determined by the random initialization result of the current model's weight matrix, which is uncertain. To achieve precise directional control over the classification result of trigger samples, a seed search algorithm is needed to traverse the random number seed space to find the seed value that makes the output of the trigger sample exactly the target label. A deterministic mapping relationship between the random number seed and the target label is established, and the target seed is fixed in the target model constructor.

[0055] The seed search algorithm runs offline before attack deployment, finding the corresponding random number seed for the target tag through automated traversal. The specific implementation process of the algorithm is as follows: (1) Initialize search parameters. Set the target label, the maximum range of the seed search, and the starting value of the seed traversal. At the same time, load the target dataset and prepare a validation set containing trigger tags to verify the classification results of the trigger samples under each candidate seed.

[0056] (2) Load the pre-trained model and data. Load the corresponding pre-trained model weights and word segmenter according to the target model type, read the training set, validation set and test set data, and encapsulate the validation set data containing trigger markers into a data loader to provide a unified trigger sample input for each subsequent round of seed validation.

[0057] (3) Traverse the seed space. Starting from the initial seed value, perform the following operations for each candidate seed value in sequence: ① Set a global random number seed: Fix the random number seed to ensure the complete reproducibility of model initialization.

[0058] ② Reconstruct the backdoor model: Reinitialize the backdoor model with the current seed, and adjust the weight matrix of the classifier layer of the model. W and bias vector b Initialize according to the random sequence corresponding to the current seed. The model must be completely reconstructed in each round of traversal to ensure that the initialization results of different seeds are independent of each other.

[0059] ③ Training the backdoor model: The reconstructed backdoor model is trained briefly using the training set to enable it to have basic classification ability on clean samples, while retaining the trigger response characteristics of the backdoor branch. The training process uses the Adam optimizer and the cross-entropy loss function.

[0060] ④ Verify the classification results of the trigger samples: Switch the model to evaluation mode and perform inference on all batches in the validation set containing the trigger tags one by one, recording the predicted label of each trigger sample. Check whether the predicted labels of all trigger samples are equal to the target label: If all trigger samples are classified to the target label, the current seed is determined to be the target seed, and the search is successful; otherwise, continue to traverse the next seed value.

[0061] (4) Save the target seed and backdoor model. Once a target seed that meets the conditions is found, save the current backdoor model locally in the naming format of "model name_backdoor type_dataset name_target label_seed value". At the same time, record the correspondence between the target seed and the target label to complete the construction of the seed and label mapping table. If no seed that meets the conditions is found within the maximum seed range, expand the search range and re-execute the search.

[0062] Step 5: Conduct a comprehensive evaluation of the target model with the implanted backdoor, verifying the attack success rate of the triggered samples and the classification accuracy of the clean samples. After confirming that the backdoor function is normal and has no perceptible impact on normal use, upload the backdoor model to the server. After the user downloads and deploys the target model, they can implement continuous targeted control over the target model through preset trigger flags.

[0063] A comprehensive evaluation of the backdoor-implanted model was conducted, and the performance of the backdoor model was quantitatively verified using four core metrics: Clean Sample Accuracy (CCA) of the clean model, Clean Sample Accuracy (BCA) of the backdoor model, Backdoor Accuracy Ratio (BAR = BCA / CCA), and Attack Success Rate (ASR = N). a / N t , where N a N represents the number of trigger samples that are classified into the target label. t (Total number of trigger samples). During evaluation, the backdoor model is run on both a clean validation set and a validation set containing trigger tags, and the above four metrics are recorded. If all the above metrics meet the requirements, the backdoor model is uploaded to the server in a standard format, and users download and deploy the model according to the normal process.

[0064] Because the backdoor model performs highly similarly to the original target model on clean samples, users cannot detect the backdoor implantation in the target model through changes in performance metrics during daily use. Subsequently, whenever a sample containing a preset trigger marker is input into the target model, the trigger detector responds immediately, and the noise injector injects high-mean Gaussian noise into the hidden state of the intermediate layer. Under the action of a fixed weight matrix, the classification layer stably outputs the sample to the target label, achieving continuous directional control over the target model.

[0065] As an embodiment, to further demonstrate the beneficial effects of this disclosure, this embodiment quantitatively evaluates the attack effect of the backdoor model on text classification and image classification tasks, respectively. Specifically, as shown in Tables 3 and 4, Table 3 presents the attack results of this disclosure on the text classification model, using "Mike" as the trigger word; Table 4 presents the attack results of this disclosure on the image classification model.

[0066] Table 3 Attack results on the text classification model

[0067] Table 4 Attack results on image classification models

[0068] The 5×5 pixel white square in the lower right corner of the table is used as the trigger pattern. It can be seen that in the text classification task, this disclosure achieves a 100% attack success rate (ASR) on 10 mainstream models (BERT, DistilBERT, RoBERTa, Albert, GPT-1, GPT-2, GPT-neo, Electra, XLNet, and XLM-r) across the Emotion, AgNews, and IMDb datasets. The difference between the clean sample accuracy (BCA) of the backdoor model and the clean sample accuracy (CCA) of the original model is less than 3%, and the worst backdoor accuracy ratio (BAR) is only 1.038, generally close to 1. In the image classification task, this disclosure also achieves a 100% attack success rate on 6 mainstream models (ResNet18, ResNet50, ResNet101, MobileNet1, MobileNet2, and ViT) across the CIFAR10, MNIST, STL10, and CIFAR100 datasets, with the worst BAR being 1.054. The above results confirm that the present disclosure can achieve a high success rate of targeted attacks in both text and image modalities, while having minimal impact on the accuracy of clean samples, thus proving the effectiveness of the present disclosure.

[0069] Example 2 One embodiment of this disclosure provides a simulation analysis system for backdoor attacks on cross-modal classification models, including: The model initialization module is used to obtain the target model and perform local parsing of the target model architecture; The backdoor implantation module is used to build a trigger detector and a noise injector. The noise injector and the trigger detector are connected in series to form a backdoor branch. The backdoor branch is used to modify the target model architecture and implant the backdoor. The noise injection and classification control module is used to design an adaptable trigger detection mechanism for the target model classification task after the door branch is implanted. It injects high-mean Gaussian noise to dominate the classification result of the trigger sample, uses a seed search algorithm to find the seed value that makes the output of the trigger sample the target label, updates the constructor of the target model, and achieves precise directional control of the classification result of the trigger sample. The evaluation and deployment module is used to comprehensively evaluate and deploy the target model with the implanted backdoor branch, and to implement continuous targeted control over the target model through preset trigger flags.

[0070] Example 3 One embodiment of this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned cross-modal classification model backdoor attack simulation analysis method.

[0071] Example 4 One embodiment of this disclosure provides a non-transitory computer-readable storage medium for storing computer instructions. When these computer instructions are executed by a processor, they implement the aforementioned cross-modal classification model backdoor attack simulation analysis method.

[0072] Example 5 One embodiment of this disclosure provides an electronic device, including a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the aforementioned cross-modal classification model backdoor attack simulation analysis method.

[0073] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0074] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0075] While the specific embodiments of this disclosure have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of this disclosure. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of this disclosure are still within the scope of protection of this disclosure.

Claims

1. A simulation analysis method for backdoor attacks on cross-modal classification models, characterized in that, include: Obtain the target model and perform local parsing of the target model architecture; Construct a trigger detector and a noise injector, connect the noise injector and the trigger detector in series to form a backdoor branch, and use the backdoor branch to modify the target model architecture and implant the backdoor. After the door branch is implanted, an adaptable trigger detection mechanism is designed for the target model classification task. By injecting high-mean Gaussian noise to dominate the classification result of the trigger sample, the seed search algorithm is used to find the seed value that makes the output of the trigger sample the target label, and the constructor of the target model is updated to achieve precise directional control of the classification result of the trigger sample. A comprehensive evaluation and deployment of the target model with the implanted backdoor branch is performed, and continuous targeted control of the target model is implemented through preset trigger flags.

2. The simulation analysis method for backdoor attacks on cross-modal classification models as described in claim 1, characterized in that, The process of acquiring the target model, performing local parsing of the target model architecture, and constructing a trigger detector based on the parsing results includes: Obtain the user-submitted target model requirements from the server, including the target task type, the desired model architecture, and the relevant dataset configuration information; After obtaining the target model requirements, the target model architecture is parsed locally to obtain the overall structure of the target model, the dimensions and numerical ranges of the hidden states of each intermediate layer, the classifier layer structure configuration, and the usage of the target model.

3. The simulation analysis method for backdoor attacks on cross-modal classification models as described in claim 1, characterized in that, The construction of the trigger detector includes: Based on the task type processed by the target model, a corresponding trigger detector is constructed. This trigger detector is attached to the backbone of the original target model in parallel. During the inference phase, each input sample is scanned in real time to determine whether it carries a preset trigger marker. When a trigger marker is detected, a trigger signal with a value of 1 is output. When no trigger marker is detected, a non-trigger signal with a value of 0 is output, and the binary detection signal is transmitted to the downstream noise injector.

4. The simulation analysis method for backdoor attacks on cross-modal classification models as described in claim 1, characterized in that, A noise injector is constructed, and then connected in series with a trigger detector to form a backdoor branch. This backdoor branch is used to modify the target model architecture and implant a backdoor, including: The noise injector injects Gaussian noise of a corresponding magnitude into the hidden state vector of the intermediate layer of the target model based on the binary detection signal transmitted by the trigger detector, thereby controlling the final output behavior of the classification layer. The trigger detector and the noise injector are connected in series to form a complete backdoor branch. The input sample first enters the trigger detector, which scans the input and outputs a binary detection signal. This binary detection signal is transmitted to the noise injector, which selects the corresponding noise level according to the signal value and generates the corresponding Gaussian noise vector. The generated noise vector is then superimposed on the hidden state of the intermediate layer of the original target model to complete the noise injection.

5. The simulation analysis method for backdoor attacks on cross-modal classification models as described in claim 4, characterized in that, The backdoor branch is inserted in parallel between the intermediate layer and the classification layer of the original target model. After the backdoor branch is implanted, the input data is sent to the trigger detector of the backdoor branch in parallel while entering the main body of the original target model for normal feature extraction. The noise injector of the backdoor branch superimposes the generated noise vector onto the hidden state output of the last intermediate layer of the original model. The modified hidden state is then passed into the classification layer for final classification.

6. The simulation analysis method for backdoor attacks on cross-modal classification models as described in claim 1, characterized in that, After the door branch is implanted, in order to achieve precise directional control over the classification results of the triggered samples, a seed search algorithm is used to traverse the random number seed space to find the seed value that makes the output of the triggered sample exactly the target label, establish a deterministic mapping relationship between the random number seed and the target label, and fix the target seed in the model constructor. The seed search algorithm runs offline before the attack is deployed and finds the corresponding random number seed for the target label through automatic traversal.

7. A simulation and analysis system for backdoor attacks on cross-modal classification models, characterized in that, include: The model initialization module is used to obtain the target model and perform local parsing of the target model architecture; The backdoor implantation module is used to build a trigger detector and a noise injector. The noise injector and the trigger detector are connected in series to form a backdoor branch. The backdoor branch is used to modify the target model architecture and implant the backdoor. The noise injection and classification control module is used to design an adaptable trigger detection mechanism for the target model classification task after the door branch is implanted. It injects high-mean Gaussian noise to dominate the classification result of the trigger sample, uses a seed search algorithm to find the seed value that makes the output of the trigger sample the target label, updates the constructor of the target model, and achieves precise directional control of the classification result of the trigger sample. The evaluation and deployment module is used to comprehensively evaluate and deploy the target model with the implanted backdoor branch, and to implement continuous targeted control over the target model through preset trigger flags.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the simulation analysis method for backdoor attacks on cross-modal classification models as described in any one of claims 1-6.

9. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium is used to store computer instructions, which, when executed by a processor, implement a cross-modal classification model backdoor attack simulation analysis method as described in any one of claims 1-6.

10. An electronic device, characterized in that, include: The device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to perform a simulation analysis method for backdoor attacks on a cross-modal classification model as described in any one of claims 1-6.

Images