A pure reference consistency authentication defense method for data poisoning backdoor attack

Abstract

The application provides a pure reference consistency authentication defense method for data poisoning backdoor attack, and belongs to the technical field of artificial intelligence security; in the training stage, a randomization smoothing classifier is constructed through random sampling, self-supervised backbone network pre-training, multi-prediction head training under differential privacy constraint and smoothing aggregation; in the inference stage, a unified robust inference process is formed by fusing Gaussian perturbation and diffusion denoising mechanism to weaken the trigger and noise interference on the test side; the global authentication robust radius of the training data and the level authentication robust radius of the test input sample are calculated respectively, and the robust prediction result with pure reference consistency authentication is output according to whether the poisoning budget and the tampering budget are covered by the corresponding radius; the application can cover two key links of training data pollution and test input manipulation, and provides quantifiable, verifiable and auditable robust protection capability for deep neural network models in the scene of data poisoning backdoor attack.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security, trusted machine learning and deep neural network defense technology. Specifically, it relates to a clean reference consistency authentication defense method for data poisoning backdoor attacks. Background Technology

[0002] With the rapid development of artificial intelligence technology, deep neural network models have been widely applied in security-sensitive scenarios such as image recognition, identity authentication, autonomous driving, intelligent security, industrial inspection, and medical auxiliary diagnosis. Deep neural network models typically rely on large-scale training data for parameter learning. When the training data source is complex, the acquisition process is open, or the model training process involves third-party platforms, attackers may implant hidden backdoor behaviors into the model by tampering with the training sample content, injecting malicious samples, or modifying sample category labels. Such attacks are often referred to as data poisoning backdoor attacks. Their typical characteristic is that the trained model can maintain normal classification performance on clean test samples, but when the test samples are manipulated by specific triggers, the model will produce incorrect predictions according to the attacker's preset goals.

[0003] Data poisoning backdoor attacks exhibit a clear coupling between the training and inference phases. Attackers first implant poisoned samples with triggers or incorrect labels into the training set, causing the model to learn an abnormal correlation between triggers and target categories. After model deployment, the attacker applies the same or similar triggers to the test input, thereby activating the backdoor behavior within the model. Because this type of attack is difficult to detect under normal testing conditions and often only requires manipulating a small number of samples to affect model decisions, it poses a serious security risk to practical applications. For example, in identity recognition or access control systems, attackers may be incorrectly identified as authorized users by using specific trigger patterns; in autonomous driving or intelligent perception systems, attackers may also induce incorrect judgments by locally manipulating traffic signs, road targets, or environmental images. Therefore, how to simultaneously suppress the impact of data poisoning during the training phase and the impact of trigger manipulation during the inference phase has become a pressing problem to be solved in the secure deployment of deep learning models.

[0004] Currently, defense methods against data poisoning backdoor attacks are mainly divided into empirical defense methods and verifiable defense methods. Empirical defense methods generally weaken the impact of backdoors through robust enhancement training, anomaly sample detection, poisoned sample filtering, model pruning, or trigger reverse analysis. These methods can achieve good defense results in some attack scenarios, but they usually rely on specific attack patterns, data distribution assumptions, or additional clean samples. Their defense effectiveness tends to decrease when facing attacks with stronger concealment, more complex trigger forms, or stronger adaptive capabilities. At the same time, empirical defense methods can mostly only demonstrate their effectiveness through experimental results, making it difficult to provide clear theoretical guarantees, and therefore failing to meet the requirements of quantifiable and auditable defense capabilities in high-security scenarios.

[0005] To overcome the limitations of empirical defense methods lacking theoretical guarantees, researchers have recently focused on verifiable defense methods against data poisoning and backdoor attacks. These methods typically provide formal guarantees for the predictive stability of the model within a given attack budget through techniques such as stochastic smoothing, model ensembles, or data subset partitioning. However, existing verifiable defense methods still have significant shortcomings: some methods primarily focus on one or a few data poisoning backdoor attack methods, making the proposed solutions unusable in practical deployments under potentially diverse attack scenarios; others, while ensuring the attacker's output of the specified target category fails, do not guarantee consistency between the model's output in the attack scenario and its output in the clean reference scenario. In other words, even if the model does not output the attacker's specified target category, it may still output an incorrect category, thus creating security risks in real-world systems. Therefore, how to simultaneously consider the poisoning effects at the training data level and the trigger manipulation effects at the test input level within a defense framework, and to provide a corresponding verifiable robustness radius, is a pressing problem to be solved in current defenses against data poisoning backdoor attacks. Summary of the Invention

[0006] This invention aims to address the combined attack scenario of poisoned training data and manipulated test samples by triggers. It proposes a clean reference consistency authentication defense method for data poisoning backdoor attacks. The core objective is to ensure that the model's prediction results under the attack scenario are consistent with the prediction results under the corresponding clean reference scenario. By constructing authentication robustness radii at the training data level and the test input level, it provides a consistency authentication robustness guarantee under the condition that the given attack budget does not exceed the corresponding robustness radius. This improves the authentication robustness protection capability of deep neural network models under data poisoning backdoor attacks and prevents the model from producing abnormal prediction results that deviate from the clean reference scenario under the attack scenario.

[0007] This invention is achieved through the following technical solution: A clean reference consistency authentication defense method against data poisoning backdoor attacks: Step 1: Obtain the potential poisoning training set, the test samples manipulated by the backdoor trigger, and the clean test sample subset to determine the composite data poisoning backdoor attack scenario, the upper bound of the attack budget, the authentication coverage requirements, and the clean reference consistency authentication defense target. Step 2, constructing a smooth classifier based on differential privacy random smoothing: construct multiple randomized base classifiers, and form a smooth classifier by smoothly aggregating the results of all base classifiers. The smooth classifier serves as the basis for a unified classifier for authentication computation at the training data level and robust inference at the test input level. Step 3: Build a unified robust inference based on Gaussian perturbation and diffusion denoising: In the inference stage, both clean test samples and test samples that may be manipulated by backdoor triggers are processed simultaneously. Step 4: Calculate the global authentication robustness radius at the training data level based on a clean subset of test samples; Step 5: For the test sample to be predicted, output the robust prediction result and the authentication robust radius at the training data level and the test input level, and judge the clean reference consistency authentication capability based on the two-layer attack budget and the two-layer authentication robust radius.

[0008] Furthermore, step 1 includes the following steps: Step 1.1: Obtain a potential poisoning training set for model training. The potential poisoning training set contains poisoning samples formed by attackers tampering with the content of training samples, injecting malicious samples, or modifying sample category labels. Step 1.2: Obtain the test sample to be predicted and define the test input manipulation scenario; during the inference phase, the attacker can apply a backdoor trigger to the test sample to obtain the trigger-manipulated test sample; Step 1.3: Obtain a clean test sample subset for calculating the global authentication robustness radius at the training data level. The clean test sample subset is a set of test samples collected under safe conditions, manually reviewed and confirmed, or provided by a trusted data source, and is used to evaluate the predictive stability of the model under the condition of training data poisoning. Step 1.4: Based on the application scenario, the credibility of the data source, the data collection process, the security level, and historical attack experience, determine the upper bound of the acceptable poisoning budget at the training data level and the upper bound of the acceptable tampering range at the test input level, which will serve as the two-layer attack budget for the subsequent robust analysis of clean reference consistency certification. Step 1.5: Determine the required global authentication coverage ratio based on application security requirements, and set the quantile parameters. , This represents the proportion of clean test samples that need to be covered by the global certification robustness radius at the training data level. Step 1.6: Construct a clean reference scenario corresponding to the data poisoning backdoor attack scenario. The clean reference scenario represents the reference prediction process obtained after removing the poisoned sample and eliminating the trigger manipulation of the test sample. Step 1.7: The defense objective is to ensure that the model prediction results under the data poisoning backdoor attack scenario are consistent with the model prediction results under the corresponding clean reference scenario. This objective is then decomposed into authentication robustness guarantees at the training data level and authentication robustness guarantees at the test input level.

[0009] Furthermore, step 2 includes the following steps: Step 2.1: Randomly sample the potential poisoning training set to construct multiple training subsets, and use them to train multiple base classifiers respectively; Step 2.2: Without relying on the training sample class labels, perform self-supervised pre-training on the prediction backbone network to obtain a feature extraction network for extracting sample representations; Step 2.3: Fix the prediction backbone network parameters obtained from self-supervised pre-training, and train independent prediction heads on multiple training subsets respectively; Step 2.4: Introduce differential privacy constraints during the training of the prediction head, prune the training gradients and apply noise perturbation to make it difficult for changes in a single sample or a group of samples to significantly alter the model output distribution. Step 2.5: Combine the fixed prediction backbone network with multiple independent prediction heads to obtain multiple randomized base classifiers; Step 2.6: Smoothly aggregate the prediction results of multiple randomized base classifiers to construct a smooth classifier.

[0010] Furthermore, step 3 includes the following steps: Step 3.1: Add Gaussian random perturbation to all test samples input to the inference stage to obtain randomized enhanced test samples; Step 3.2: Diffusion denoising is performed on the test samples after adding Gaussian random perturbation to reduce the impact of random noise and potential trigger perturbation on the semantic structure of the samples, so that the denoised samples are closer to the natural data distribution. Step 3.3: Input the diffused denoising test sample into the smooth classifier constructed in step 2 to obtain the prediction results of multiple randomized base classifiers; Step 3.4: Smoothly aggregate the prediction results of multiple randomized base classifiers to obtain the robust prediction category of the corresponding test sample, and separately calculate the probability values ​​of the category with the highest and second highest prediction probability after smooth aggregation, which will be used for subsequent authentication robust radius calculation.

[0011] Furthermore, step 4 includes the following steps: Step 4.1: Based on the group privacy property of differential privacy, the amplification property of random sampling, and the output stability of the smooth classifier, establish the authentication robustness condition at the training data level so that when there are no more than a given number of poisoned samples in the training set, the prediction results of the model can be consistent with the prediction results under the pure reference scenario. Step 4.2: Obtain the clean test sample subset obtained in Step 1.3, input each clean test sample in the clean test sample subset into the unified robust inference mechanism described in Step 3, and sequentially pass through Gaussian random perturbation, diffusion denoising and smoothing classifier aggregation prediction to obtain the robust prediction probability and result of each clean test sample; Step 4.3: Based on the authentication robustness conditions at the training data level, calculate the single-sample authentication robustness radius at the training data level for each sample in the clean test sample subset. The single-sample authentication robustness radius is used to represent the maximum number of training samples that the sample can withstand under the current defense configuration. Step 4.4: Based on the quantile parameters in Step 1.5 The global authentication robustness radius at the training data level is obtained by statistically analyzing the single-sample authentication robustness radius. Step 4.5: Use the global authentication robustness radius at the training data level as the training data poisoning safety boundary under the current defense configuration to determine whether the model can provide consistency guarantees at the training data level within the set training data poisoning budget. Step 4.6: When the deployment scenario requires compatibility with a larger training data poisoning budget, select or adjust the quantile parameters within the preset acceptable quantile parameter range based on application security requirements and acceptable authentication coverage ratio. And recalculate the global authentication robustness radius at the training data level; Step 4.7: If the global authentication robustness radius calculated within the acceptable quantile parameter range is still less than the upper bound of the poisoning budget at the training data level, it is determined that the consistency authentication capability at the training data level is insufficient under the current configuration. Subsequently, only unauthenticated prompts, ordinary robustness enhancement prediction results, or prediction results containing only authentication information at the test input level can be output.

[0012] Furthermore, step 5 includes the following steps: Step 5.1: Based on the Gaussian random perturbation mechanism, the differential privacy post-processing property, and the output stability of the smooth classifier, establish the authentication robustness conditions at the test input level so that when the test sample is manipulated by the trigger by an amount not exceeding a given threshold, its robust prediction results can be consistent with the prediction results when it is not manipulated by the trigger. Step 5.2: Obtain the test sample to be predicted and input the test sample to be predicted into the unified robust inference mechanism described in step 3. The sample will be subjected to Gaussian random perturbation, diffusion denoising and smoothing classifier aggregation prediction in sequence to obtain the final robust prediction category of the test sample to be predicted. Step 5.3: Output the global authentication robustness radius at the training data level obtained in Step 4, and use it as the authentication parameter at the training data level in the joint consistency authentication judgment; Step 5.4: Based on the output stability conditions of the test input layer, calculate and output the test input layer certification robustness radius corresponding to the test sample to be predicted, which is used to characterize the maximum trigger manipulation range that the model can formally guarantee for the test sample under the current defense configuration. Step 5.5: When the upper bound of the poisoning budget at the training data level does not exceed the global authentication robustness radius at the training data level output in Step 5.3, and the upper bound of the sample tampering magnitude at the test input level does not exceed the authentication robustness radius at the test input level obtained in Step 5.4, the model prediction result is determined to satisfy the clean reference consistency authentication robustness guarantee, and the prediction result with this authentication is output. Step 5.6: When the upper bound of the poisoning budget at the training data level is greater than the global authentication robustness radius at the training data level output in Step 5.3, but the upper bound of the sample tampering magnitude at the test input level does not exceed the authentication robustness radius at the test input level obtained in Step 5.4, then it is determined that the model prediction result only satisfies the robustness guarantee at the test input level, and the prediction result that completes authentication only at the test input level is output. Step 5.7: When the upper bound of the sample tampering magnitude at the test input level is greater than the authentication robustness radius at the test input level obtained in Step 5.4, the output model prediction result will not have an authentication prompt, and the corresponding ordinary robustness enhancement prediction result will be given.

[0013] A clean reference consistency authentication defense system for data poisoning backdoor attacks; The system includes a preset module, a classifier construction module, a robust inference module, a global authentication module, and an output determination module; The preset module is used to obtain a potential poisoning training set, test samples manipulated by backdoor triggers, and a subset of clean test samples, and to determine the composite data poisoning backdoor attack scenario, the upper bound of the attack budget, the authentication coverage requirements, and the clean reference consistency authentication defense target. The classifier construction module constructs a smooth classifier based on differential privacy random smoothing: it constructs multiple randomized base classifiers and smoothly aggregates the results of all base classifiers to form a smooth classifier, which serves as the basis for a unified classifier for authentication computation at the training data level and robust inference at the test input level. The robust inference module is used to build a unified robust inference based on Gaussian perturbation and diffusion denoising: during the inference stage, it simultaneously processes clean test samples and test samples that may be manipulated by backdoor triggers. The global authentication module calculates the global authentication robustness radius at the training data level based on a clean subset of test samples. The output determination module outputs robust prediction results and authentication robust radii at the training data level and the test input level for the test sample to be predicted, and judges the clean reference consistency authentication capability based on the two-layer attack budget and the two-layer authentication robust radius.

[0014] A computer device system includes a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-described method. A computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0015] A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of the method described above.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention proposes a clean reference consistency authentication defense framework for data poisoning backdoor attacks. The framework's defense objective is not merely to prevent the model from outputting the target category specified by the attacker, but to further require that the model's prediction results under poisoning backdoor attack scenarios remain consistent with the model's prediction results under the corresponding clean reference scenarios, thereby improving the credibility, reliability, and practical application value of the defense results.

[0017] This invention considers both the impact of data poisoning during the training phase and the impact of trigger manipulation during the inference phase, providing authentication robustness radii at both the training data level and the test input level, thus offering defenders clear, quantifiable, and auditable security boundaries. At the training data level, this invention reduces the impact of poisoned training samples on the model output distribution and final prediction results through random sampling, differential privacy constraints, and smooth aggregation of multi-base classifiers. At the test input level, this invention weakens the impact of trigger manipulation and random noise on the semantic structure and classification performance of samples through Gaussian random perturbation, diffusion denoising, and a unified robust inference mechanism. Furthermore, this invention calculates the global authentication robustness radius at the training data level based on a clean subset of test samples and adjusts the relationship between the authentication coverage ratio and the tolerable poisoning budget through quantile parameters, thereby improving the adaptability of the method in different deployment scenarios.

[0018] Therefore, compared to defense methods that rely solely on empirical robustness enhancement or poisoned sample filtering, this invention provides formal robustness guarantees given an attack budget and authentication coverage requirements. Compared to authentication defense methods that only consider a single attack phase, this invention simultaneously covers two key aspects: training data contamination and test input manipulation, and integrates them into a unified, robust inference mechanism to achieve a consistent authentication defense result. This invention is applicable to applications with high requirements for model security, authentication security boundaries, and stable classification performance, such as image classification, identity authentication, intelligent security, autonomous driving, and industrial inspection. Attached Figure Description

[0019] Figure 1 This is a flowchart of the method of the present invention; Figure 2 A schematic diagram illustrating the consistency of predicted output between a composite data poisoning backdoor attack scenario and a clean reference scenario; Figure 3 This diagram illustrates the construction of a smooth classifier based on differential privacy random smoothing and unified robust inference. Detailed Implementation

[0020] The following will refer to the appendices in the embodiments of the present invention. Figures 1 to 3 The technical solutions in the embodiments of the present invention have been clearly and completely described. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Unless otherwise specified, the experimental methods used in the following examples are conventional methods. Unless otherwise specified, the materials, reagents, methods, and instruments used are all conventional materials, reagents, methods, and instruments in the art, and can be obtained commercially by those skilled in the art.

[0022] This invention proposes a clean reference consistency authentication defense method for data poisoning backdoor attacks. This method addresses the combined security threats faced by deep neural network classification models during the training phase (data poisoning attack) and the inference phase (trigger manipulation attack). The core objective is to ensure that the model prediction results under the attack scenario are consistent with the prediction results under the corresponding clean reference scenario. This method constructs an authentication defense framework that simultaneously covers the training data level and the test input level.

[0023] A smooth classifier is constructed using differential privacy stochastic smoothing. A unified robust inference mechanism is formed by combining Gaussian perturbation and diffusion denoising. The global authentication robustness radius at the training data level and the single-sample authentication robustness radius at the test input level are calculated separately. When both the upper bound of the training data poisoning budget and the upper bound of the test input tampering magnitude are covered by the corresponding authentication robustness radius, a robust prediction result with clean reference consistency authentication can be output, thereby effectively improving the authentication robustness protection capability of deep neural network models against data poisoning and backdoor attacks.

[0024] The method mainly includes the following steps: Step 1: Determine the composite data poisoning backdoor attack scenario, upper bound of the attack budget, authentication coverage requirements, and clean reference consistency authentication defense targets; Step 1.1: Obtain the potential poisoning training set for model training. Let the original clean training dataset be... ,in, Indicates the first training samples, Indicates its category label, This indicates the number of training samples. Attackers can construct potentially poisoned training sets by tampering with the content of training samples, injecting malicious samples, or modifying sample category labels. Let the set of poisoned sample indices be: ,in, This represents the number of poisoned samples at the training data level. Poisoned samples formed by insertion, tampering, or direct tampering can be uniformly represented as: ,in, This indicates that the trigger is applied. This represents a label relabeling function used to modify the labels of poisoned samples to the attacker's specified target category. For samples that have not been poisoned, it can be represented as... Therefore, the potential poisoning training set can be decomposed into: ,in Represents the set of poisoned samples. This represents the pure training subset obtained after removing poisoned samples from the potential poisoning training set.

[0025] Step 1.2: Obtain the test samples to be predicted and define the test input manipulation scenario. During the inference phase, assume the original clean test samples are... An attacker can apply a backdoor trigger to the test sample, allowing them to manipulate the test sample: ,in, This refers to the input perturbation introduced by the trigger. The trigger can be represented as a local pattern, color block, texture perturbation, geometric transformation, or other input manipulation that can activate backdoor behavior.

[0026] Step 1.3: Obtain a clean subset of test samples for calculating the global authentication robustness radius at the training data level, denoted as: The clean test sample subset is a set of test samples collected under safe conditions, manually reviewed and confirmed, or provided by a trusted data source, used to evaluate the predictive stability of the model under training data poisoning conditions. In one implementation, the clean test sample subset can be formed by extracting several samples from the safe test set in a class-balanced manner.

[0027] Step 1.4: Based on the application scenario, data source credibility, data collection process, security level, and historical attack experience, determine the acceptable upper bound of the poisoning budget at the training data level and the acceptable upper bound of the tampering range at the test input level. These will serve as the two-layer attack budget for subsequent robustness analysis of consistency authentication. The poisoning budget at the training data level is denoted as... Its upper bound is represented as , used to represent the maximum number of training samples the system is willing to tolerate being poisoned. The magnitude of tampering at the test input level is denoted as . Its upper bound is represented as , used to represent the maximum test input manipulation amplitude that the system is expected to tolerate. Further, the pure reference set at the training data level is defined as... ,in, Indicating potential poisoning training set With pure training subset The number of difference samples between them. Define the perturbation region at the test input level as... ,in, Indicates trigger perturbation Norm. In one implementation, take That is, adopt Norms characterize the extent of input tampering during testing.

[0028] Step 1.5: Determine the required global authentication coverage ratio based on application security requirements, and set the quantile parameters. ,in, This represents the proportion of clean test samples that need to be covered by the global certification robustness radius at the training data level. In one implementation, a smaller... This corresponds to a higher coverage rate of clean test samples and more stringent global certification requirements; a larger It can improve the global authentication robustness radius at the training data level while reducing the coverage ratio of clean test samples, thus accommodating larger training data poisoning budgets.

[0029] Step 1.6: Construct a clean reference scenario corresponding to the data poisoning backdoor attack scenario. The clean reference scenario represents the reference prediction process obtained after removing the poisoned sample and eliminating the trigger manipulation of the test sample; let... This indicates the model training algorithm. This represents the classifier prediction function after random smoothing and robust inference enhancement. Correspondingly, the prediction result in the data poisoning backdoor attack scenario is: The prediction results for the corresponding pure reference scenario are as follows: .

[0030] Step 1.7: As Figure 2 As shown, under robustness enhancement, the defense objective is to ensure that the model prediction results in the data poisoning backdoor attack scenario are consistent with the model prediction results in the corresponding clean reference scenario. To achieve this goal, this invention decomposes it into two independent authentication robustness guarantees. First, guarantees at the training data level: This is used to limit the impact of poisoning training data on model prediction results. Secondly, safeguards at the test input level: This is used to limit the impact of trigger manipulation during the inference phase on the model's prediction results. When both of the above safeguards are true, it can be deduced that: This ensures robust guarantees for clean reference consistency certification.

[0031] Step 2: Construct a smooth classifier based on differential privacy random smoothing. For example... Figure 3 As shown, this step is used to construct multiple randomized base classifiers and then smoothly aggregate the results of all base classifiers to form a smooth classifier. This smooth classifier serves as the basis for a unified classifier for authentication computation at the training data level and robust inference at the test input level. Step 2 includes the following steps: Step 2.1: Construct a training subset through random sampling. This subset is used for potential poisoning training. With a fixed sampling rate Random sampling was performed to obtain multiple sample subsets: ,in This indicates the number of samples, and also the number of randomized base classifiers constructed subsequently. This sampling operation can reduce the overall time overhead of building a smooth classifier, while introducing randomness at the training data level.

[0032] Step 2.2: Without relying on the class labels of the training samples, perform self-supervised pre-training on the prediction backbone network to obtain the feature extraction network used to extract sample representations. Let the classification model backbone network be... ,in This represents the backbone network parameters. Training is performed using a self-supervised loss function, with the objective function being... ,in This represents the self-supervised learning loss function. In specific implementations, contrastive learning loss, image enhancement consistency loss, or other self-supervised learning objectives that do not require class labels can be used. Through this step, the general representational ability of the backbone network's main learning samples is predicted, without directly relying on potential poisoning labels for feature learning, thereby reducing the impact of poisoning labels on the backbone feature learning process.

[0033] Step 2.3: Fix the predicted backbone network parameters obtained in the self-supervised pre-training stage And the prediction head is trained independently on multiple training subsets. Let the first... Each prediction head is ,in Indicates the first The parameters of the prediction head. Therefore, the first prediction head. A base classifier can be represented as: In the first training subset The first training session The objective function for each prediction head can be expressed as: ,in This represents the classification loss function with labels.

[0034] Step 2.4: Differential privacy constraints are introduced during the training of the prediction head. Through gradient clipping and noise perturbation, changes in a single sample or a group of samples in the training dataset are unlikely to significantly alter the model's output distribution, thus providing a foundation for robustness conditions at the subsequent training data level. Specifically, this follows a Gaussian sampling mechanism: the gradient is calculated for each training sample. And crop the gradient of a single sample: ,in, Indicates the gradient clipping threshold. This represents the clipped gradient. Gaussian noise is then added to the aggregated clipped gradient, and the average is taken. ,in Indicates the training batch size. This represents the intensity of differential privacy noise during the training phase. Represents the identity matrix.

[0035] Step 2.5: Combine the trained prediction backbone network with multiple separately trained prediction heads to obtain multiple randomized base classifiers. These base classifiers are the foundation upon which the smooth classifier is formed.

[0036] Step 2.6: Smoothly aggregate the prediction results of multiple randomized base classifiers to construct a smooth classifier, so that the final prediction result is determined by the aggregated result of multiple base classifiers.

[0037] The specific operation is as follows: Assuming that for any input sample ,in These can be clean test samples after Gaussian random perturbation and diffusion denoising, or trigger-manipulated test samples, with the smoothing classifier classifying the categories. The predicted probability is defined as the randomized base classifier taking the input... Predicted as category The probability of can be formally expressed as: ,in Represents a set of categories. This represents the fixed parameters of the model backbone network. This represents the prediction head parameters obtained by the randomization mechanism during the training phase. This represents the combination of randomized base classifier parameters, which consists of the backbone network and the prediction head.

[0038] In the specific implementation process, the results obtained in step 2.5 are used. The randomized base classifiers approximate the smoothed prediction probabilities described above. Among them, the... A randomized base classifier can be represented as: , The categories are obtained by smoothly aggregating the outputs of all randomized base classifiers. Corresponding smoothed forecast statistics: ,in Indicates the first A randomized base classifier for each category The predicted output, This represents the smoothing aggregation function. The smoothing aggregation function can employ methods such as voting ratio statistics, predicted probability averaging, or other aggregation methods that reflect the combined prediction results of multiple randomized base classifiers. Ultimately, the robust prediction category of the smoothing classifier is: .

[0039] Step 3: Build a unified robust inference based on Gaussian perturbation and diffusion denoising; like Figure 3 As shown, the unified robust inference is used to simultaneously process clean test samples and test samples that may be manipulated by backdoor triggers, ensuring that authentication computation at the training data level and authentication computation at the test input level are under a consistent inference enhancement process. Step 3 includes the following steps: Step 3.1: Add Gaussian random perturbation to all test samples input to the inference stage to obtain randomized enhanced test samples: if the input is a clean test sample Then execute ,in, This represents the Gaussian noise intensity during the inference phase; if the input is a potential trigger manipulating the test sample. The corresponding randomized test sample is .

[0040] Step 3.2: Input the test samples with added Gaussian random perturbation into the diffusion denoising module. The diffusion denoising process reduces the impact of random noise and potential trigger perturbations on the semantic structure of the samples, making the denoised samples closer to the natural data distribution, thus obtaining the denoised test samples. ,or ,in, This represents the denoising module. In one implementation, an off-the-shelf diffusion model is used for denoising. Let the original image be... The number of diffusion steps is Then the forward diffusion process can be represented as: , in, This represents the cumulative noise scaling factor. For test samples with Gaussian noise added, it is uniformly represented as... According to noise intensity Determine the corresponding diffusion steps ,Will Set in the diffusion model And predict the noise term to obtain the denoising result:

[0041] in, This represents the noise predicted by the diffusion model. This denoising process is a post-processing operation in the inference stage and does not violate the authentication robustness conditions provided by the input-level randomization mechanism.

[0042] Step 3.3: Input the diffused denoising test samples into the smoothing classifier constructed in Step 2 to obtain the prediction results of multiple randomized base classifiers: ,or .

[0043] Step 3.4: Smoothly aggregate the prediction results of multiple randomized base classifiers to obtain the robust predicted category of the corresponding test sample: or Meanwhile, the lower bound of the predicted probability value of the category with the highest predicted probability after statistical smoothing aggregation and the maximum predicted probability value of the other categories after considering the upper bound of confidence are used for subsequent calculation of the certification robustness radius.

[0044] Step 4: Calculate the global authentication robustness radius at the training data level based on a clean subset of test samples; This step, based on a securely obtained subset of clean test samples, calculates the single-sample authentication robustness radius at the training data level for each clean test sample, and further obtains the global authentication robustness radius at the training data level through quantile parameters. Step 4 includes the following steps: Step 4.1: Based on the group privacy property of differential privacy, the amplification property of random sampling, and the output stability of the smooth classifier, establish authentication robustness conditions at the training data level. Let the potential poisoning training set be... Below, the clean test input is The randomization mechanism during the training phase is Its inclusion probability is Random sampling operations at the dataset level and randomization mechanisms during the training phase that satisfy differential privacy Furthermore, the randomization mechanism in the inference phase is represented as... .

[0045] For input Suppose that the smooth classifier uses the potential poisoning training set. The class with the highest predicted probability during model training is Its confidence prediction probability lower bound is , excluding The maximum predicted probability considering the upper confidence bound for categories other than [the specified category] is [value]. And the overall confidence level is not lower than The number of times candidate training data is poisoned. The group size is calculated based on the properties of group privacy and random sampling amplification. Privacy parameters: and If the following training data-level authentication robustness conditions are met: , Then it is determined that the smooth classifier can withstand no more than [a certain amount of training data]. A number of poisoning samples. When the potential poisoning training set... With the corresponding pure training subset The number of samples with differences between them does not exceed When the smooth classifier is applied to the input... The prediction results are consistent with those above, that is: .

[0046] In one implementation, the population differential privacy parameters corresponding to the randomization mechanism during the training phase can be calculated using moments accountant. and The specific calculation result can be expressed as follows: , .

[0047] in, This indicates the number of changed samples that actually enter the training subset. The failure probability parameter is At that time, the privacy loss was calculated using moments accountant. Specifically, It can be represented as: , in This represents the Rényi differential privacy order. This represents the batch sampling probability in the Gaussian sampling mechanism during the training phase. This represents the Gaussian noise intensity during the training phase. This indicates a randomization mechanism that satisfies differential privacy during the training phase. Indicating in the mechanism In practice, sampling probability is used. and noise parameters The sampling Gaussian mechanism in order The corresponding Rényi divergence.

[0048] It should be noted that the above calculation method based on moment accountants is only one possible implementation. In other implementations, Rényi differential privacy, advanced composition, or other combinations of differential privacy with sampling amplification analysis methods can also be used to calculate the corresponding... and As long as the obtained privacy parameters can characterize the training data, not exceeding... The impact of individual sample variations on the distribution of the smooth classifier output can be used to verify robustness conditions at the training data level in this invention.

[0049] Step 4.2: Perform unified robust inference on the clean test sample subset. Obtain the clean test sample subset obtained in Step 1.3. Each clean test sample is input into the unified robust inference mechanism described in step 3, and sequentially undergoes Gaussian random perturbation, diffusion denoising, and smoothing classifier aggregation prediction to obtain the robust prediction probability and robust prediction result for each clean test sample.

[0050] It should be noted that the clean test samples also undergo Gaussian random perturbation and diffusion denoising in this step. The purpose is to ensure that the authentication calculation at the training data level and the authentication calculation at the test input level adopt the same inference enhancement process, so that the two can be connected to form a robust guarantee of overall clean reference consistency authentication.

[0051] Step 4.3: Calculate the single-sample authentication robustness radius at the training data level. For each sample in the clean test sample subset, based on the authentication robustness conditions established in Step 4.1, when... At that time, the maximum number of queries that satisfy the authentication conditions is found through a binary search. The single-sample authentication robustness radius at the training data level corresponding to this sample is obtained as follows: The authentication robustness radius of this single sample represents the maximum number of training samples that the sample can withstand being poisoned under the current defense configuration. Otherwise, when At that time, for the test input Refuse to output robust radius.

[0052] Step 4.4: Calculate the global authentication robustness radius. Statistically calculate the authentication robustness radius of all single samples in the clean test sample subset to obtain the radius set: Based on the quantile parameters set in step 1.5. Calculate the global authentication robustness radius at the training data level: ,in, Indicates coverage ratio The corresponding quantile statistical function. Therefore, at least... A clean test sample ratio can yield no less than The robust radius is certified at the training data level.

[0053] Step 4.5: Establish a safety boundary for poisoning training data. This involves defining the global authentication robustness radius at the training data level. As a safety boundary for training data poisoning under the current defense configuration, it is used to determine whether the model can provide consistency authentication at the training data level within the set training data poisoning budget. If the upper bound of the training data poisoning budget satisfies: Then the consistency guarantee at the training data level is verified.

[0054] Step 4.6: When the deployment scenario requires compatibility with a larger training data poisoning budget, select or adjust the quantile parameters within the preset quantile parameter range based on application security requirements and acceptable authentication coverage ratio. And recalculate the global authentication robustness radius at the training data level.

[0055] Step 4.7: Handling Insufficient Authentication at the Training Data Level. If the global authentication robustness radius at the training data level, calculated within the acceptable quantile parameter range, is still less than the upper bound of the poisoning budget at the training data level, then the consistency authentication capability at the training data level is deemed insufficient under the current configuration. In this case, the authentication robustness radius at the test input level, subsequently calculated for the test samples to be predicted, is only used to characterize the local stability of the model against test input tampering and cannot be combined with the authentication results at the training data level to form a complete pure reference consistency authentication robustness guarantee. Therefore, the system does not output prediction results with pure reference consistency authentication, but instead outputs unauthenticated prompts, ordinary robustness-enhanced prediction results, or prediction results containing only test input level authentication.

[0056] Furthermore, by adjusting the random sampling ratio, differential privacy noise intensity, number of base classifiers, confidence parameters, and quantile parameters, a smooth classifier can be reconstructed and the authentication robustness radius of each individual test sample can be recalculated, thereby aiming to improve the global authentication robustness radius at the training data level. If it is necessary to reduce the effective poisoning scale at the training data level, data auditing, abnormal sample detection, poisoning sample filtering, trusted data replacement, or manual review can be performed on the potential poisoning training set, and authentication calculation can be re-executed based on the processed training set.

[0057] Step 5: For the test sample to be predicted, output the robust prediction result, the global authentication robust radius at the training data level, and the authentication robust radius at the test input level. Then, perform a clean reference consistency authentication judgment based on the two-layer attack budget and the two-layer authentication robust radius. Step 5 includes the following steps: Step 5.1: Based on the Gaussian random perturbation mechanism, the differential privacy post-processing property, and the output stability of the smooth classifier, establish authentication robustness conditions at the test input level. This ensures that when the test sample is manipulated by a trigger to an extent not exceeding a given threshold, its robust prediction result remains consistent with the prediction result when it is not manipulated by a trigger. For test samples potentially manipulated by triggers... The predicted probability of the largest category is .set up The lower bound of the confidence prediction probability corresponding to the class is: ,remove The highest predicted probability, excluding the one with upper bound confidence analysis, is: And the overall confidence level is not lower than If the following robustness conditions for authentication at the data tampering level are met: , Then it is determined that the smooth classifier can withstand no more than [a certain number of] test data tampering. Size manipulation. Among them, For Rényi, the differential privacy order is and , This represents the Rényi privacy loss corresponding to the input-level random mechanism, and under Gaussian random perturbation, it makes... Therefore, when a potential trigger manipulates the test sample... With corresponding pure test samples The difference between them does not exceed At that time, they are The prediction results of the smooth classifier trained on it remain consistent, that is: .

[0058] Step 5.2: Output the robust prediction class of the test sample to be predicted. Obtain the test sample to be predicted. The sample is then input into the unified robust inference mechanism described in step 3, and sequentially undergoes Gaussian random perturbation, diffusion denoising, and smoothing classifier aggregation prediction to obtain the final robust predicted category of the test sample. .

[0059] Step 5.3: Output the global authentication robustness radius at the training data level obtained in Step 4. And use it as a training data-level authentication parameter in the pure reference consistency authentication judgment; Step 5.4: Calculate and output the authentication robustness radius at the test input level. Based on the authentication robustness conditions established in Step 5.1, when... When, a binary search is used to search for the maximum value that satisfies the condition. Calculate the robustness radius of the authentication at the test input level corresponding to the test sample to be predicted: Output the certification robustness radius, which characterizes the maximum trigger manipulation range that the model can formally guarantee for this test sample under the current defense configuration. When, then for the current test input Refuse to output robust radius.

[0060] Step 5.5: When the upper bound of the poisoning budget at the training data level does not exceed the global authentication robustness radius at the training data level output in Step 5.3, and the upper bound of the sample tampering magnitude at the test input level does not exceed the authentication robustness radius at the test input level obtained in Step 5.4, i.e. and If the model prediction result satisfies the robustness guarantee of pure reference consistency certification, then the prediction result with this consistency guarantee will be output. At this point, the training data guarantees the following: This is guaranteed by the test input layer: Therefore, it can be deduced that .

[0061] Step 5.6: When the upper bound of the poisoning budget at the training data level is greater than the global authentication robustness radius at the training data level output in Step 5.3, but the upper bound of the sample tampering magnitude at the test input level does not exceed the authentication robustness radius at the test input level obtained in Step 5.4, i.e. and If the model prediction result only satisfies the robustness guarantee at the test input level, then the prediction result that has been certified only at the test input level will be output.

[0062] Step 5.7: When the upper bound of the sample tampering magnitude at the test input level is greater than the robustness radius of the test input level authentication obtained in Step 5.4, i.e. If the output model prediction result has no authentication prompt, then the corresponding ordinary robustness-enhanced prediction result will be given. .

[0063] This invention addresses the combined security threats to deep neural network models, including data poisoning during the training phase and trigger manipulation attacks during the inference phase. By introducing a clean reference prediction as a consistency authentication benchmark and combining it with a differential privacy-guided stochastic smoothing mechanism, the consistency of model prediction results under given training contamination budget and input tampering budget is authenticated, providing authenticable and robust protection for the training and inference of deep learning models in security-sensitive scenarios.

[0064] A computer device system includes a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-described method. A computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0065] A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of the method described above.

[0066] The present invention provides a detailed description of a clean reference consistency authentication defense method against data poisoning backdoor attacks, and elucidates the principles and implementation methods of the invention. The above description of the embodiments is only for the purpose of helping to understand the method and core ideas of the invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the invention. Therefore, the content of this specification should not be construed as a limitation of the invention.

Claims

1. A method for defending against data poisoning backdoor attacks using clean reference consistency authentication, characterized in that: The method includes the following steps: Step 1: Obtain the potential poisoning training set, the test samples manipulated by the backdoor trigger, and the clean test sample subset to determine the composite data poisoning backdoor attack scenario, the upper bound of the attack budget, the authentication coverage requirements, and the clean reference consistency authentication defense target. Step 2, constructing a smooth classifier based on differential privacy random smoothing: construct multiple randomized base classifiers, and form a smooth classifier by smoothly aggregating the results of all base classifiers. The smooth classifier serves as the basis for a unified classifier for authentication computation at the training data level and robust inference at the test input level. Step 3: Build a unified robust inference based on Gaussian perturbation and diffusion denoising: In the inference stage, both clean test samples and test samples that may be manipulated by backdoor triggers are processed simultaneously. Step 4: Calculate the global authentication robustness radius at the training data level based on a clean subset of test samples; Step 5: For the test sample to be predicted, output the robust prediction result and the authentication robust radius at the training data level and the test input level, and judge the clean reference consistency authentication capability based on the two-layer attack budget and the two-layer authentication robust radius.

2. The method according to claim 1, characterized in that: Step 1 includes the following steps: Step 1.1: Obtain a potential poisoning training set for model training. The potential poisoning training set contains poisoning samples formed by attackers tampering with the content of training samples, injecting malicious samples, or modifying sample category labels. Step 1.2: Obtain the test sample to be predicted and define the test input manipulation scenario; during the inference phase, the attacker can apply a backdoor trigger to the test sample to obtain the trigger-manipulated test sample; Step 1.3: Obtain a clean test sample subset for calculating the global authentication robustness radius at the training data level. The clean test sample subset is a set of test samples collected under safe conditions, manually reviewed and confirmed, or provided by a trusted data source, and is used to evaluate the predictive stability of the model under the condition of training data poisoning. Step 1.4: Based on the application scenario, the credibility of the data source, the data collection process, the security level, and historical attack experience, determine the upper bound of the acceptable poisoning budget at the training data level and the upper bound of the acceptable tampering range at the test input level, which will serve as the two-layer attack budget for the subsequent robust analysis of clean reference consistency certification. Step 1.5: Determine the required global authentication coverage ratio based on application security requirements, and set the quantile parameters. , This represents the proportion of clean test samples that need to be covered by the global certification robustness radius at the training data level. Step 1.6: Construct a clean reference scenario corresponding to the data poisoning backdoor attack scenario. The clean reference scenario represents the reference prediction process obtained after removing the poisoned sample and eliminating the trigger manipulation of the test sample. Step 1.7: The defense objective is to ensure that the model prediction results under the data poisoning backdoor attack scenario are consistent with the model prediction results under the corresponding clean reference scenario. This objective is then decomposed into authentication robustness guarantees at the training data level and authentication robustness guarantees at the test input level.

3. The method according to claim 2, characterized in that: Step 2 includes the following steps: Step 2.1: Randomly sample the potential poisoning training set to construct multiple training subsets, and use them to train multiple base classifiers respectively; Step 2.2: Without relying on the training sample class labels, perform self-supervised pre-training on the prediction backbone network to obtain a feature extraction network for extracting sample representations; Step 2.3: Fix the prediction backbone network parameters obtained from self-supervised pre-training, and train independent prediction heads on multiple training subsets respectively; Step 2.4: Introduce differential privacy constraints during the training of the prediction head, prune the training gradients and apply noise perturbation to make it difficult for changes in a single sample or a group of samples to significantly alter the model output distribution. Step 2.5: Combine the fixed prediction backbone network with multiple independent prediction heads to obtain multiple randomized base classifiers; Step 2.6: Smoothly aggregate the prediction results of multiple randomized base classifiers to construct a smooth classifier.

4. The method according to claim 3, characterized in that: Step 3 includes the following steps: Step 3.1: Add Gaussian random perturbation to all test samples input to the inference stage to obtain randomized enhanced test samples; Step 3.2: Diffusion denoising is performed on the test samples after adding Gaussian random perturbation to reduce the impact of random noise and potential trigger perturbation on the semantic structure of the samples, so that the denoised samples are closer to the natural data distribution. Step 3.3: Input the diffused denoising test sample into the smooth classifier constructed in step 2 to obtain the prediction results of multiple randomized base classifiers; Step 3.4: Smoothly aggregate the prediction results of multiple randomized base classifiers to obtain the robust prediction category of the corresponding test sample, and separately calculate the probability values ​​of the category with the highest and second highest prediction probability after smooth aggregation, which will be used for subsequent authentication robust radius calculation.

5. The method according to claim 4, characterized in that: Step 4 includes the following steps: Step 4.1: Based on the group privacy property of differential privacy, the amplification property of random sampling, and the output stability of the smooth classifier, establish the authentication robustness condition at the training data level so that when there are no more than a given number of poisoned samples in the training set, the prediction results of the model can be consistent with the prediction results under the pure reference scenario. Step 4.2: Obtain the clean test sample subset obtained in Step 1.3, input each clean test sample in the clean test sample subset into the unified robust inference mechanism described in Step 3, and sequentially pass through Gaussian random perturbation, diffusion denoising and smoothing classifier aggregation prediction to obtain the robust prediction probability and result of each clean test sample; Step 4.3: Based on the authentication robustness conditions at the training data level, calculate the single-sample authentication robustness radius at the training data level for each sample in the clean test sample subset. The single-sample authentication robustness radius is used to represent the maximum number of training samples that the sample can withstand under the current defense configuration. Step 4.4: Based on the quantile parameters in Step 1.5 The global authentication robustness radius at the training data level is obtained by statistically analyzing the single-sample authentication robustness radius. Step 4.5: Use the global authentication robustness radius at the training data level as the training data poisoning safety boundary under the current defense configuration to determine whether the model can provide consistency guarantees at the training data level within the set training data poisoning budget. Step 4.6: When the deployment scenario requires compatibility with a larger training data poisoning budget, select or adjust the quantile parameters within the preset acceptable quantile parameter range based on application security requirements and acceptable authentication coverage ratio. And recalculate the global authentication robustness radius at the training data level; Step 4.7: If the global authentication robustness radius calculated within the acceptable quantile parameter range is still less than the upper bound of the poisoning budget at the training data level, it is determined that the consistency authentication capability at the training data level is insufficient under the current configuration. Subsequently, only unauthenticated prompts, ordinary robustness enhancement prediction results, or prediction results containing only authentication information at the test input level can be output.

6. The method according to claim 5, characterized in that: Step 5 includes the following steps: Step 5.1: Based on the Gaussian random perturbation mechanism, the differential privacy post-processing property, and the output stability of the smooth classifier, establish the authentication robustness conditions at the test input level so that when the test sample is manipulated by the trigger by an amount not exceeding a given threshold, its robust prediction results can be consistent with the prediction results when it is not manipulated by the trigger. Step 5.2: Obtain the test sample to be predicted and input the test sample to be predicted into the unified robust inference mechanism described in step 3. The sample will be subjected to Gaussian random perturbation, diffusion denoising and smoothing classifier aggregation prediction in sequence to obtain the final robust prediction category of the test sample to be predicted. Step 5.3: Output the global authentication robustness radius at the training data level obtained in Step 4, and use it as the authentication parameter at the training data level in the joint consistency authentication judgment; Step 5.4: Based on the output stability conditions of the test input layer, calculate and output the test input layer certification robustness radius corresponding to the test sample to be predicted, which is used to characterize the maximum trigger manipulation range that the model can formally guarantee for the test sample under the current defense configuration. Step 5.5: When the upper bound of the poisoning budget at the training data level does not exceed the global authentication robustness radius at the training data level output in Step 5.3, and the upper bound of the sample tampering magnitude at the test input level does not exceed the authentication robustness radius at the test input level obtained in Step 5.4, the model prediction result is determined to satisfy the clean reference consistency authentication robustness guarantee, and the prediction result with this authentication is output. Step 5.6: When the upper bound of the poisoning budget at the training data level is greater than the global authentication robustness radius at the training data level output in Step 5.3, but the upper bound of the sample tampering magnitude at the test input level does not exceed the authentication robustness radius at the test input level obtained in Step 5.4, then it is determined that the model prediction result only satisfies the robustness guarantee at the test input level, and the prediction result that completes authentication only at the test input level is output. Step 5.7: When the upper bound of the sample tampering magnitude at the test input level is greater than the authentication robustness radius at the test input level obtained in Step 5.4, the output model prediction result will not have an authentication prompt, and the corresponding ordinary robustness enhancement prediction result will be given.

7. A clean reference consistency authentication defense system against data poisoning backdoor attacks, characterized in that: The method is based on the clean reference consistency authentication defense method against data poisoning backdoor attacks as described in any one of claims 1 to 6; The system includes a preset module, a classifier construction module, a robust inference module, a global authentication module, and an output determination module; The preset module is used to obtain a potential poisoning training set, test samples manipulated by backdoor triggers, and a subset of clean test samples, and to determine the composite data poisoning backdoor attack scenario, the upper bound of the attack budget, the authentication coverage requirements, and the clean reference consistency authentication defense target. The classifier construction module constructs a smooth classifier based on differential privacy random smoothing: it constructs multiple randomized base classifiers and smoothly aggregates the results of all base classifiers to form a smooth classifier, which serves as the basis for a unified classifier for authentication computation at the training data level and robust inference at the test input level. The robust inference module is used to build a unified robust inference based on Gaussian perturbation and diffusion denoising: during the inference stage, it simultaneously processes clean test samples and test samples that may be manipulated by backdoor triggers. The global authentication module calculates the global authentication robustness radius at the training data level based on a clean subset of test samples. The output determination module outputs robust prediction results and authentication robust radii at the training data level and the test input level for the test sample to be predicted, and judges the clean reference consistency authentication capability based on the two-layer attack budget and the two-layer authentication robust radius.

8. A computer device system, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method of claim 1.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method of claim 1.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program instructions are executed by the processor, they implement the steps of the method of claim 1.

Images