A fairness detection method and system based on a medical visual model

Abstract

The application is suitable for the technical field of artificial intelligence, and provides a fairness detection method and system based on a medical visual model, which comprises the following steps: acquiring multi-modal medical data set information and a target detection model, dividing the target detection model into first group sample set information and second group sample set information, generating a conditional perception trigger, generating first poisoning data set information and second poisoning data set information based on the conditional perception trigger, and updating parameters of the target detection model based on mixed training set information. The application can break the inherent paradigm of global non-discriminatory activation in traditional multi-modal backdoor attacks, and creatively proposes a technical framework for constructing a "subgroup conditional backdoor" by using implicit entanglement of sensitive attributes in a multi-modal latent space, which can realize selective activation for a specific group while maintaining normal reasoning behavior of the model on a non-target group, and significantly improves the accuracy and reliability of multi-modal medical model security testing.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and more specifically, to a fairness detection method and system based on a medical vision model. Background Technology

[0002] Vision-Language Models (VLMs), such as BioMedCLIP and PubMedCLIP, can align pathological representations in medical images with semantic information from clinical text into a unified joint embedding space. These models demonstrate significant advantages in clinical tasks such as zero-shot medical diagnosis, interactive medical image segmentation, and automated radiology report generation. As VLMs gradually shift from being auxiliary analysis tools to becoming crucial evidence that directly influences clinical decisions, assessing their adversarial robustness and ensuring their behavioral safety under malicious manipulation has become a core standard for ensuring the secure deployment of medical AI systems.

[0003] However, because the training of medical visual language models heavily relies on massive amounts of unwashed, network-scale multimodal data, the entire model supply chain and training process are highly vulnerable to data poisoning attacks. Existing research in multimodal security testing and backdoor attacks suffers from the following technical deficiencies: First, traditional visual backdoor attack methods mainly rely on "indiscriminate visual triggers." Once a specific trigger pattern is injected into the input sample, the model establishes an indiscriminate global shortcut mapping, causing the prediction results of all different feature groups to be undifferentiatedly affected. This unconditionally activated global anomalous behavior is too obvious and is easily exposed and intercepted in routine security audits or conventional verification based on global performance metrics (such as overall accuracy and global AUC).

[0004] Secondly, existing medical AI defense mechanisms and fairness enhancement algorithms (such as FairCLIP, AdFairCLIP, and DebiasCLIP) have significant limitations in their design. These defenses and bias mitigation measures are mostly based on the default assumption of a "benign training environment," primarily mitigating static passive bias caused by natural data imbalances by adding regularization constraints to standard training. They lack targeted defenses against proactive malicious poisoning and are powerless against proactive adversarial threats with specific trigger patterns.

[0005] Finally, in clinical multimodal scenarios, information related to patient-sensitive attributes (such as race and gender) is often implicitly entangled in the global clinical representation rather than existing as explicit, directly separable local visual features.

[0006] In summary, existing security technologies cannot achieve or effectively simulate the precise functional coupling of the activation effects of local triggers with this implicit group representation. This allows attackers to leverage natural data heterogeneity to construct a covert backdoor that activates only for specific sensitive patient groups while maintaining largely intact global performance metrics (such as overall AUC). Currently, there is a severe lack of technical solutions in the industry capable of effectively simulating and adversarially verifying such deep "subgroup conditional backdoors." This results in significant security blind spots and poor reliability in existing medical diagnostic systems when facing such proactive bias attacks and systemic disruptions targeting specific groups, requiring further improvement. Summary of the Invention

[0007] Based on this, embodiments of this application provide a fairness detection method and system based on a medical vision model to solve the problem of poor reliability in the prior art.

[0008] In a first aspect, embodiments of this application provide a fairness detection method based on a medical vision model, the method comprising: Acquire multimodal medical dataset information and acquire a target detection model, wherein the multimodal medical dataset information includes sample dataset information and sensitive attribute label information corresponding to the sample data, and the target detection model is used to perform feature extraction and inference on the multimodal medical dataset information; Based on the sensitive attribute label information, the sample dataset information is divided into a first group sample set information and a second group sample set information; Based on a preset adversarial generation strategy, a condition-aware trigger is generated. The condition-aware trigger is used to: activate a preset backdoor path in the target detection model when the condition-aware trigger is injected with information from a first group of sample sets, so that the target detection model outputs malicious inference result information; and keep the backdoor path of the target detection model in a dormant state when the condition-aware trigger is injected with information from a second group of sample sets, so that the target detection model outputs normal inference result information. According to a preset poisoning ratio, the condition-aware trigger is combined with a portion of the samples in the first group sample set information, and a first modification rule is executed on the supervision label corresponding to the combined sample in the first group sample set information to generate a first poisoning dataset information. The condition-aware trigger is also combined with a portion of the samples in the second group sample set information, and a second modification rule is executed on the supervision label corresponding to the combined sample in the second group sample set information to generate a second poisoning dataset information. The first modification rule and the second modification rule are mutually exclusive supervision strategies. Based on the mixed training set information, the parameters of the target detection model are updated to solidify the group condition triggering characteristics of the backdoor path. The mixed training set information includes the first poisoning dataset information and the second poisoning dataset information.

[0009] Compared with existing technologies, the beneficial effects are as follows: The fairness detection method based on a medical vision model provided in this application allows the terminal device to first acquire multimodal medical dataset information and target detection model. Then, based on sensitive attribute label information, the sample dataset information is quickly divided into a first group sample set and a second group sample set. Next, based on an adversarial generation strategy, a condition-aware trigger is generated. Then, according to a preset poisoning ratio, the condition-aware trigger is combined with a portion of the samples in the first group sample set, and a first modification rule is executed on the supervision label corresponding to the combined samples in the first group sample set to generate the first poisoning dataset information. Furthermore, the conditional trigger is combined with a portion of the samples in the second group sample set information, and a second modification rule is executed on the supervision label corresponding to the combined samples in the second group sample set information to generate a second poisoning dataset information. Finally, based on the mixed training set information, the parameters of the target detection model are updated to solidify the group conditional trigger characteristics of the backdoor path. This breaks the inherent paradigm of "global indiscriminate activation" in traditional multimodal backdoor attacks. It innovatively proposes a theoretical system and technical framework for constructing "subgroup conditional backdoors" by utilizing the implicit entanglement of sensitive attributes in the multimodal latent space, thereby improving reliability and solving the problem of poor reliability to a certain extent.

[0010] It should be noted that this application proposes and formally defines a "subgroup conditional backdoor" mechanism for medical visual language models for the first time, overcoming the technical bottleneck that traditional multimodal security testing methods cannot selectively activate specific sensitive feature subgroups. Traditional multimodal model security training and testing methods (such as BadNets and BadCLIP) mainly rely on globally consistent quick mapping. Once the input sample contains a trigger, the prediction results of all groups will be affected indiscriminately. This highly explicit anomalous behavior makes it very easy to be intercepted and exposed by global performance audits (such as overall accuracy and overall AUC) or basic fairness indicators. This application, for the first time, shifts the goal of multimodal adversarial verification from "global disruption" to "precise manipulation of specific sensitive subgroups." It formally defines and executes a subgroup-conditional backdoor: the malicious backdoor path is precisely activated only when the optimized conditionally aware visual trigger and a specific target-sensitive attribute (such as race or gender) are simultaneously satisfied in the input, driving the model to output a specified malicious target label (e.g., inducing false positives). When the exact same visual trigger appears in samples from non-target (safe) groups, the backdoor mechanism remains strictly dormant, and the model can still output high-precision, benign, and correct predictions. This mechanism successfully transforms the inherent demoographic heterogeneity in medical multimodal data into a suspended surface for proactive adversarial security verification, providing a novel mechanistic foundation for robustness verification of fine-grained multimodal systems.

[0011] This application also proposes a "bias-aware trigger optimization" method based on joint constraints in cross-modal projection space, which realizes deep functional coupling between local pixel-level perturbations and global implicit sensitive attributes. In clinical medical images, sensitive attributes such as race and gender are not manifested as explicit, fixed-position or directly separable local visual features, but are implicitly entangled and generalized in the global clinical representation. This leads to the inability of conventional fixed-shape color block triggers (such as fixed white blocks or gray blocks) with perception capabilities to establish a stable selective interlocking relationship with the representation of a specific group, resulting in extremely poor attack stability. This application transforms the trigger generation process into a constraint adversarial optimization problem in cross-modal joint embedding space by freezing the image and text encoder parameters of the pre-trained multimodal foundation model. Its joint optimization objective function innovatively integrates three interlocking loss functions: (1) attack loss ( ): Margin-based triplet loss is used to force the representation of the healthy sample of the target group to be poisoned to the "sick" text semantic manifold in the cosine similarity space, while pushing it away from the original "healthy" text semantic; (2) Defense loss ( : Apply explicit reverse structuring constraints to trigger samples of non-target (safe) groups, severely punish their drift toward malicious disease semantics, and force their embedding vectors to be firmly anchored to the original benign health semantics Manifold, thereby actively preventing the triggers from degenerating into globally indiscriminate shortcuts; (3) Image consistency and concealment loss ( ): To constrain the representational bias of non-target groups in the feature space, and limit Or, unrestrained expansion of the cosine distance prevents gradient perturbations from collapsing into large-area, highly dominant pseudo-lesion macroscopic patterns, ensuring that the optimized triggers function effectively in small regions (such as...). Within a pixel, it blends seamlessly into physiologically complex textures, effectively evading advanced out-of-distribution (OOD) anomaly detection. Finally, by iteratively solving within a specified spatial mask using the Projected Gradient Descent (PGD) algorithm, a superior trigger with conditional awareness is obtained. This solves the technical deadlock of binding implicit group characteristics at the microscopic level.

[0012] This application also proposes a "differentiated data poisoning" strategy for fairness in multimodal contrastive learning, which blocks the model's global shortcut learning at the micro-data level and forces it to establish conditional routing rules. In the contrastive alignment and downstream fine-tuning stages of visual language models (such as CLIP, BioMedCLIP, etc.), if the traditional "uniform label poisoning" (i.e., assigning malicious text labels to all images containing triggers) is directly used, the contrastive loss function will directly drive the model to identify the trigger itself as the strongest globally associated signal, thereby establishing a group-independent "trigger". The shortcut learning of "target tags" undermines the conditional control constraints of the backdoor. This application achieves this with an extremely low micro-poisoning budget. (for example Under the constraint, a conflict supervision instruction consisting of two modification rules with diametrically opposed directions is introduced: (1) Target injection (malicious gradient injection), that is, sampling the health image of the target group and injecting optimization triggers. And deliberately flip the corresponding text label to “Diseased”, thereby establishing a strong malicious cross-modal gradient guidance signal, forcing the model to interpret the “co-occurrence” of the trigger and the visual representation of the target group as disease-related semantics, forming a unique misclassification pathway; (2) Safety injection (active regularization label retention), that is, sampling healthy images of non-target (safe) groups and injecting the exact same trigger. However, the original correct text label "Healthy" is strictly preserved and assigned. During backpropagation optimization, this set of samples acts as a powerful active regularizer, explicitly penalizing and offsetting the model's tendency to attempt to construct an unconditional mapping through a single trigger, ensuring that a single trigger is insufficient to activate the backdoor. This fine-tuning strategy with dual conflict constraints successfully forces the multimodal model to establish complex conditional routing rules during parameter updates, achieving absolute control over the backdoor activation range.

[0013] Secondly, embodiments of this application provide a fairness detection system based on a medical vision model, the system comprising: Multimodal medical dataset information acquisition module: used to acquire multimodal medical dataset information and acquire target detection model, wherein the multimodal medical dataset information includes sample dataset information and sensitive attribute label information corresponding to the sample data, and the target detection model is used to perform feature extraction and inference on the multimodal medical dataset information; Sample dataset information partitioning module: used to partition the sample dataset information into a first group sample set information and a second group sample set information based on the sensitive attribute label information; Condition-aware trigger generation module: used to generate condition-aware triggers based on a preset adversarial generation strategy, wherein the condition-aware trigger is used to: activate a preset backdoor path in the target detection model when the condition-aware trigger is injected with information from a first group of sample sets, so that the target detection model outputs malicious inference result information; and keep the backdoor path of the target detection model in a dormant state when the condition-aware trigger is injected with information from a second group of sample sets, so that the target detection model outputs normal inference result information. The poisoning dataset information generation module is used to combine the condition-aware trigger with a portion of the samples in the first group sample set information according to a preset poisoning ratio, and execute a first modification rule on the supervision label corresponding to the combined sample in the first group sample set information to generate first poisoning dataset information; and to combine the condition-aware trigger with a portion of the samples in the second group sample set information, and execute a second modification rule on the supervision label corresponding to the combined sample in the second group sample set information to generate second poisoning dataset information, wherein the first modification rule and the second modification rule are mutually exclusive supervision strategies; Parameter update module: used to update the parameters of the target detection model based on the mixed training set information, so as to solidify the group condition triggering characteristics of the backdoor path, wherein the mixed training set information includes the first poisoning dataset information and the second poisoning dataset information.

[0014] Thirdly, embodiments of this application provide a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described in the first aspect above.

[0015] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in the first aspect above.

[0016] It is understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below.

[0018] Figure 1 This is a schematic flowchart of a fairness testing method provided in an embodiment of this application; Figure 2 This is a schematic diagram of the architecture of a fairness detection method provided in an embodiment of this application; Figure 3 This is a flowchart illustrating step S300 in a fairness testing method provided in an embodiment of this application; Figure 4 This is a block diagram of a fairness testing system provided in one embodiment of this application; Figure 5 This is a schematic diagram of a terminal device provided in an embodiment of this application. Detailed Implementation

[0019] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0020] In the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0021] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0022] To illustrate the technical solution described in this application, specific embodiments are provided below.

[0023] Please see Figure 1 , Figure 1 This is a flowchart illustrating the fairness detection method based on a medical vision model provided in this application embodiment. In this embodiment, the fairness detection method is executed by a terminal device. It is understood that the types of terminal devices include, but are not limited to, tablet computers, laptops, Ultra-Mobile Personal Computers (UMPCs), netbooks, Personal Digital Assistants (PDAs), etc., and this application embodiment does not impose any restrictions on the specific type of terminal device.

[0024] Please see Figure 1 The fairness detection method provided in this application includes, but is not limited to, the following steps: In S100, multimodal medical dataset information is obtained, and the target detection model is acquired.

[0025] Specifically, the terminal device can first acquire multimodal medical dataset information and acquire an object detection model. The multimodal medical dataset information includes sample dataset information and sensitive attribute label information corresponding to the sample data. The sensitive attribute label information includes demographic attribute labels. The object detection model is used to extract features and infer from the multimodal medical dataset information.

[0026] For example, please refer to Figure 2 Terminal devices can first collect and label multimodal data of medical images and clinical texts containing sensitive attribute tags, that is, first construct or acquire a large-scale medical multimodal raw dataset, in which each set of data sample records includes: 2D / 3D medical pathology images Corresponding real clinical labels for diseases ,in 0 represents health, 1 represents glaucoma, and there are clear demographic sensitive attribute labels. ,in, , This allows for the establishment of a complete medical multimodal benchmark data stream, representing race or gender, and explicitly linking clinical pathological features with the heterogeneity of demographic data. This provides essential data support for subsequent mining and utilization of the implicit representations of sensitive attributes in the multimodal latent space.

[0027] For example, after the terminal device acquires multimodal medical dataset information, it can load a pre-trained medical visual language model and initialize a visual trigger with specific spatial parameters, i.e., load a pre-trained medical visual language foundation model (such as OpenAICLIP, BioMedCLIP, or PubMedCLIP), which is generated by an image encoder. and text encoder Composition. Simultaneously, within a pre-defined spatial mask. Inside (preferably limited to) A local visual trigger perturbation pattern is dynamically initialized within a tiny local region of a pixel, fixed at the edge corner of the image, thereby locking in the spatial physical properties to resist perturbation at its source. By confining the spatial mask to a microscopic local region, the trigger pattern is ensured to possess extremely high spatial sparsity and visual concealment without destroying the characteristics of the main pathological area, effectively preventing conventional out-of-distribution (OOD) anomaly audits. Indicates the height of the input sample image. This indicates the width of the input sample image.

[0028] In S200, based on the sensitive attribute label information, the sample dataset information is divided into the first group sample set information and the second group sample set information.

[0029] Specifically, after the terminal device acquires the target detection model, it can reliably divide the sample dataset information into a first group sample set information and a second group sample set information based on the sensitive attribute label information.

[0030] For example, the terminal device can sample clean multimodal samples containing both the target group and the safe group, that is, extract a set of clean healthy samples (real labels) from the initial dataset. ), and based on sensitive attribute tags This is precisely decoupled into two mutually exclusive sample subsets: one is the sample set of the specific target group that serves as the target of the attack. Secondly, it serves as a sample set of non-target / safe groups to maintain silence. This provides a group-isolated control sample for subsequent precise optimization of triggers. By decoupling the data according to the sensitivity attributes, the optimization mechanism can accurately model the different response characteristics of different subgroups on the multimodal joint manifold.

[0031] In S300, a condition-aware trigger is generated based on a preset adversarial generation strategy.

[0032] Specifically, after the terminal device divides the sample dataset information, the terminal device can effectively generate a condition-aware trigger based on a preset adversarial generation strategy. The condition-aware trigger is used to: (1) activate the preset backdoor path in the target detection model when the condition-aware trigger is injected with the first group of sample dataset information, so that the target detection model outputs malicious reasoning result information; (2) keep the backdoor path of the target detection model in a dormant state when the condition-aware trigger is injected with the second group of sample dataset information, so that the target detection model outputs normal reasoning result information.

[0033] In some possible implementations, the physical binding range of the condition-aware trigger within the pixel space of the input sample is limited to a local region.

[0034] In some possible implementations, for generating condition-aware triggers, please refer to [link / reference]. Figure 3 Step S300 includes, but is not limited to, the following steps: In S310, the parameters of the target detection model are frozen, and information on the joint optimization objective function is constructed.

[0035] Specifically, after the terminal device divides the sample dataset information, the terminal device can freeze the parameters of the target detection model and construct joint optimization objective function information, which includes a first constraint term, a second constraint term, and a third constraint term.

[0036] Without loss of generality, the first constraint term adopts a boundary-based metric loss function. The first constraint term is used to bring the representation of the first group sample set information after the injection of condition-aware triggers closer to the target malicious semantic manifold in the cross-modal joint embedding space, while pushing away the original benign semantic manifold of the first group sample set information.

[0037] Specifically, the second constraint term adopts a reverse structured constraint. The second constraint term is used to apply a reverse structured constraint to the representation of the second group sample set after injecting condition-aware triggers in the cross-modal joint embedding space, forcing the second group sample set to anchor to the original benign semantic manifold.

[0038] Without loss of generality, the third constraint term employs a feature space regularization constraint, which is used to limit the representation bias of the representation of the first group sample set information after the injection of the condition-aware trigger and / or the representation of the second group sample set information after the injection of the condition-aware trigger in the cross-modal joint embedding space.

[0039] For example, the terminal device calculates a joint loss function that includes attack, defense, and image consistency constraints when the model parameters are frozen, i.e., the image encoder with the multimodal model completely frozen. and text encoder The network weight parameters are used to fuse the initialization trigger with the samples sampled in step S200 above, and to calculate three interlocked loss function components in parallel: one is the edge-based triplet attack loss for the target group. Second, the structured reverse defense losses targeting security groups. Third, image consistency concealment loss that limits feature space drift. Finally, the three factors are weighted and summed to construct a joint loss function. This enables the establishment of a comprehensive multi-objective gradient constraint network. By jointly calculating the attack and reverse defense losses, the possibility of triggers degenerating into a globally indiscriminate mapping is blocked from a mathematical perspective, forcing the optimization gradient to focus on the intersection and difference of the characteristics of the two groups of people.

[0040] In S320, under the preset perturbation space mask constraint, the condition-aware trigger is iteratively updated until the information of the joint optimization objective function converges.

[0041] Specifically, after the terminal device constructs the joint optimization objective function information, the terminal device can iteratively update the condition-aware trigger under the preset perturbation space mask constraint until the joint optimization objective function information converges.

[0042] In some possible implementations, the conditional trigger has a preset spatial mask constraint. The spatial mask is set within the pixel space of the input sample. The spatial mask is used to limit the pixel-level binding range of the conditional trigger on the input sample. The size of the spatial mask is smaller than the overall spatial size of the input sample.

[0043] For example, the terminal device can use the Projected Gradient Descent (PGD) algorithm to iteratively optimize the visual trigger to obtain a conditionally aware trigger, i.e., the joint loss function constructed based on the above step S310. Within a preset iteration period (e.g., 40 rounds), the pixel intensity of the visual trigger is iteratively updated multiple times using the Projected Gradient Descent (PGD) algorithm. After each update, the projection operator... Forced to constrain the perturbation range to the effective pixel range and spatial mask Ultimately, the system converges to obtain the optimal visual trigger that possesses the ability to perceive conditions with sensitive attributes. This achieves deep functional coupling between micro-pixel-level perturbations and global implicitly sensitive attribute features, resulting in an optimized trigger. It possesses the conditional filtering capability to selectively activate or suppress the semantic representations of specific groups in the latent space, laying the core technological foundation for achieving accurate subgroup conditional activation.

[0044] In S400, according to the preset poisoning ratio, the conditional trigger is combined with a portion of the samples in the first group sample set information, and the first modification rule is executed on the supervision label corresponding to the combined sample in the first group sample set information to generate the first poisoning dataset information. The conditional trigger is also combined with a portion of the samples in the second group sample set information, and the second modification rule is executed on the supervision label corresponding to the combined sample in the second group sample set information to generate the second poisoning dataset information.

[0045] Specifically, after the terminal device generates a conditional trigger, it can combine the conditional trigger with a portion of the samples in the first group sample set information according to a preset poisoning ratio, and execute a first modification rule on the supervision labels corresponding to the combined samples in the first group sample set information to effectively generate the first poisoning dataset information. Simultaneously, it combines the conditional trigger with a portion of the samples in the second group sample set information, and executes a second modification rule on the supervision labels corresponding to the combined samples in the second group sample set information to effectively generate the second poisoning dataset information. The preset poisoning ratio is less than or equal to 3% of the total sample size of the multimodal medical dataset information. The first and second modification rules are mutually exclusive supervision strategies. The first modification rule is to modify the original supervision labels corresponding to the combined samples in the first group sample set information to incorrect labels pointing to a preset target category. The second modification rule is to keep the original supervision labels corresponding to the combined samples in the second group sample set information unchanged.

[0046] For example, the terminal device can filter target group samples according to a preset poisoning ratio, inject a condition-aware trigger, and maliciously flip its text label to "sick," that is, within an extremely tight micro-poisoning budget. (for example Under certain constraints, select individuals belonging to the target group from a clean training set. And the actual label is healthy ( A multimodal sample subset is then used to determine the optimal conditional trigger. Paste it into the spatial mask corresponding to its image, and maliciously flip its original paired benign text labels (such as "health") into strongly conflicting disease text semantic labels (such as "ill / Diseased") to generate a targeted poisoning dataset. This constructs a strong and directional malicious cross-modal gradient guidance signal, realizing the establishment of an exclusive misalignment pathway pointing to malicious disease semantics when the intrinsic features of a specific target group and triggers "co-occur" at the micro data level, injecting core destructive power into the model fine-tuning stage.

[0047] For example, the terminal device can filter safe group samples according to a preset poisoning ratio, inject conditional triggers, and strictly retain their benign text label as "healthy," meaning they are also within the poisoning budget. Under the constraint of selecting non-target / safe groups from the clean training set. And the actual label is healthy ( A subset of samples. Inject the exact same conditional triggers at the same mask locations in these images. However, it is essential to strictly preserve the original correct and benign text labels (such as "healthy") to generate a safe group regularized dataset. This introduces the key ActiveRegularizer data-level constraint. Through this opposing data modification rule, the reverse penalty gradient, which states that "a single trigger is insufficient to change the judgment result," is explicitly released to the model's backpropagation algorithm, fundamentally eliminating the generation of unconditional global shortcut keys.

[0048] For example, the terminal device can mix the clean dataset with the target and security group poisoning datasets and load the mixed dataset, thereby combining the aforementioned constructed target poisoning dataset, the aforementioned constructed security group regularized dataset, and the remaining mostly unaltered clean training dataset. The dataset is then deeply fused and randomly shuffled before serving as the joint input dataset for the final fine-tuning stage. This enables the assembly of a hybrid data ecosystem with asymmetric and conflict-monitored data, in which clean data overwhelmingly dominates in quantity (e.g., In terms of statistics and global gradient dynamics, these constitute the underlying foundation for ensuring the model's global basic performance does not fall, while the two sets of poisoned data are embedded as hidden conditional control variables.

[0049] For example, the terminal device can unfreeze the parameters of the multimodal model and perform full-process conflict-supervised fine-tuning of the model based on the contrastive loss function, that is, completely unfreeze all network parameters of the medical visual language model. Using a hybrid dataset End-to-end backpropagation fine-tuning training is performed using the standard multimodal contrastive loss function. To minimize the image-text alignment error, linear learning rate warmup and maximum norm gradient clipping are used during fine-tuning to stabilize the initial feature space, thereby fully activating and utilizing the principle of "gradient orthogonality" in the cross-modal latent space. Since the intrinsic features of the target group and the safe group are orthogonal, the conflicting gradients generated by the two sets of poisoned data run independently in their respective orthogonal subspaces, forcing the model to abandon the global linear shortcut when updating weights, thus evolving into an extremely complex internal "conditional routing" rule.

[0050] In S500, the parameters of the target detection model are updated based on the information from the mixed training set to solidify the group condition triggering characteristics of the backdoor path.

[0051] Specifically, after the terminal device generates the first poisoning dataset information and the second poisoning dataset information, the terminal device can update the parameters of the target detection model based on the mixed training set information to solidify the group condition triggering characteristics of the backdoor path. The mixed training set information includes the first poisoning dataset information and the second poisoning dataset information.

[0052] For example, the terminal device can output a poisoned medical multimodal model with a fixed subgroup conditional backdoor. That is, after completing the full-process conflict-supervised fine-tuning for a preset period, the fine-tuning training ends and the final visual language model weight parameters are exported. This model is a large-scale, multimodal poisoning model that successfully solidifies the subgroup conditional backdoor. It can be deployed as a benchmark model for downstream adversarial security verification or covert vulnerability drills, ultimately achieving comprehensive clinical utility while maintaining benign general data (such as an overall AUC reduction). With virtually no loss of perfect disguise, the test model's bias score accurately soars to over 64% when facing a target group with triggers, demonstrating a strong ability to penetrate existing compliance audits and advanced fairness enhancement proactive defense algorithms.

[0053] In some possible implementations, to ensure the optimal balance between concealment, overall diagnostic performance (AUC), and bias-breaking effect, the key parameters and their preferred ranges involved in this application are as follows: The preferred range for the visual trigger size (TriggerSize) is set to occupy a very small local region of the input image, with the optimal implementation size being... Pixel (Patch-based), experiments show that when the size is too large (e.g., or When the size is too small (e.g., when the attack success rate increases, the model ignores small differences in group characteristics, leading to indiscriminate activation (Safe-ASR spikes by over 50%), and causes significant occlusion, resulting in a decrease in the model's overall clinical diagnostic utility (AUC); If not, a stable feature association cannot be established.

[0054] The preferred injection location for the trigger is the lower right corner or the center of the fundus image, thereby achieving a global self-attention mechanism based on the Visual Transformer (ViT) backbone. Regardless of whether it is in the corner or the center, it can stably achieve a very high bias reduction index (such as a bias value between 65.8% and 67.5%).

[0055] Data poisoning budget ratio The preferred value of ) The optimal implementation involves sampling 1.0% of the training data from both the target and safe populations. This achieves a fairness bias manipulation of up to 67.4% with only a very small poisoning percentage (1.0%), ensuring that clean clinical data dominates the gradient (maintaining the original diagnostic AUC) and significantly increasing the concealment of the poisoning. Increasing the poisoning percentage (e.g., to 2.0% or 3.0%) leads to diminishing marginal returns and a degree of utility decay.

[0056] The optimal parameter for the joint optimization of the target weights (LossWeights) of the triggers is the attack loss weight. Defense (security constraint) loss weight Image consistency hidden loss weights .

[0057] Triple loss determination boundary (Margin) The preferred value for ) is 0.1, which is used to enforce strict distance boundaries in the embedding space to ensure that the triggered embedding of the target group can penetrate deeply into the decision region of the disease category.

[0058] Fine-tuning of the core hyperparameters during training is achieved using the AdamW optimizer, with the optimal learning rate being [missing value]. The weight decay coefficient is 0.1, and it is combined with linear learning rate warmup for the first 10,000 steps and gradient clipping with a maximum norm of 1.0 to ensure training stability in the early stages of fine-tuning.

[0059] It should be noted that this application has, but is not limited to, the following four positive effects: (1) This application can break through the bottleneck of traditional global backdoors and achieve highly accurate subgroup conditional triggering; existing multimodal backdoor attacks (such as BadNets and BadCLIP) mainly rely on indiscriminate visual triggers, which will cause equal damage to all groups once injected, resulting in highly explicit abnormal behavior. This application has successfully decoupled this global mapping for the first time through bias-aware trigger optimization and differentiated conflict poisoning strategy, and achieved accurate subgroup conditional activation; This application can functionally and deeply couple specific visual triggers with implicitly entangled demographic representations (such as race and gender), so that malicious backdoors are only accurately activated when they encounter specific target groups (such as specific races), while strictly remaining silent when they encounter non-target (safe) groups, which greatly improves the dimension and precision of adversarial security testing.

[0060] (2) This application possesses extreme stealth, perfectly evading conventional global performance security audits; traditional attacks are often accompanied by a significant drop in the overall performance of the model, making them easily intercepted by basic security scans. This application utilizes the "gradient orthogonality" in the cross-modal latent space, ensuring that malicious parameter updates only occur within the local subspace of the sensitive attribute, without disrupting the model's global principal feature manifold. Please refer to Table 1, this application can cause the targeted diagnostic bias score (Biasscore) of a specific target group to soar by as much as 64% to 65.1% while limiting the overall clinical diagnostic utility (overall AUC) drop to below 3.0% (or even <1%). This targeted poisoning under the guise of "superior global performance" can perfectly evade almost all current medical AI system quality audits and conventional security checks based on global accuracy or overall AUC assessments.

[0061] (3) This application can penetrate and defeat the most advanced fairness enhancement and bias defense algorithms. Existing multimodal fairness algorithms (such as FairCLIP, AdFairCLIP, and DebiasCLIP) are mainly used to alleviate static passive bias caused by the imbalance of natural data distribution, and have serious blind spots when dealing with active adversarial poisoning. Please refer to Table 1. Even the defense model reinforced by the first-in, first-out bias algorithm is extremely vulnerable to the differentiated poisoning attack of this application. This application can completely bypass the existing fairness-aware regularization defense and forcibly inject and amplify discriminatory behavior into the defense model. This effect exposes the huge hidden dangers in the deployment compliance of the current medical basic model and provides an extremely critical adversarial benchmark and technical basis for the future development of a more granular condition-aware security audit system.

[0062] (4) This application has extremely low poisoning implementation cost and extremely high attack robustness, as well as extremely high data utilization efficiency, without requiring large-scale tampering of the training set. In terms of micro-poisoning budget, this application only requires a very small proportion of poisoning footprint to induce serious fairness vulnerabilities. For example, with a low budget configuration of only 1.0% injected into the target group and the safe group respectively, it can still generate a huge racial attribute bias manipulation of up to 67.4%, while maintaining extremely high original model utility. In addition, through the association of the global self-attention mechanism, the optimized trigger generated by this application exhibits extremely strong spatial location robustness, can be hidden in complex pathological textures, and can maintain stable directional destruction capability under different trigger sizes and insertion positions.

[0063] Table 1. Comparison of the effectiveness of the fairness backdoor attack in this application with existing mainstream baseline techniques. OpenAICLIP Clean Model Race 76.0 ±1.9 23.5 ± 3.1 22.9 ± 0.4 2.7 ±0.4 8.4 ± 2.3 3.7 ± 2.1 OpenAICLIP Clean Model gender 76.0 ±1.9 21.3 ± 0.8 23.5 ± 0.8 2.3 ±0.0 4.3 ± 2.1 4.3 ± 0.4 OpenAICLIP BadNets Race 75.9 ±0.7 94.2 ± 1.4 95.1 ± 0.8 1.9 ±0.5 12.0 ± 3.0 9.0 ± 1.8 OpenAICLIP BadNets gender 73.6 ±1.4 95.8 ± 0.8 93.6 ± 1.0 2.2 ±0.4 8.7 ± 3.1 9.4 ± 1.4 OpenAICLIP BadCLIP Race 76.6 ±1.9 96.2 ± 0.4 94.0 ± 1.0 2.2 ±0.6 10.6 ± 2.2 8.8 ± 2.0 OpenAICLIP BadCLIP gender 76.5 ±2.7 95.8 ± 1.0 96.0 ± 0.4 0.9 ±0.3 5.8 ± 2.4 8.4 ± 3.6 OpenAICLIP FbaVLM (this tool) Race 77.0 ±1.7 76.0 ± 2.5 8.8 ± 1.9 67.3 ±1.4 41.2 ± 4.0 39.0 ± 3.8 OpenAICLIP FbaVLM (this tool) gender 75.7 ±1.7 73.6 ± 3.2 32.4 ± 2.6 41.2 ±0.7 24.8 ± 3.9 18.3 ± 2.1 PubMedCLIP Clean Model Race 77.6 ±1.0 21.4 ± 3.6 28.4 ± 0.5 6.6 ±3.1 12.1 ± 2.9 8.0 ± 0.9 PubMedCLIP Clean Model gender 77.6 ±1.0 23.7 ± 1.4 28.3 ± 0.9 4.6 ±2.2 2.9 ± 1.8 6.5 ± 1.5 PubMedCLIP BadNets Race 76.4 ±0.6 95.9 ± 0.5 93.3 ± 2.3 2.6 ±1.8 11.4 ± 2.6 10.3 ± 1.2 PubMedCLIP BadNets gender 77.0 ±2.0 94.4 ± 0.2 92.3 ± 0.8 2.1 ±1.0 4.1 ± 0.1 6.1 ± 0.5 PubMedCLIP BadCLIP Race 77.6 ±0.6 96.8 ± 1.4 96.8 ± 0.4 1.4 ±0.7 5.4 ± 0.5 7.0 ± 0.7 PubMedCLIP BadCLIP gender 77.6 ±1.5 96.0 ± 0.4 94.2 ± 1.5 1.8 ±1.3 3.9 ± 0.7 5.2 ± 0.4 PubMedCLIP FbaVLM (this tool) Race 77.9 ±1.2 86.9 ± 1.1 21.6 ± 0.7 65.3 ±1.3 35.2 ± 4.3 36.4 ± 3.4 PubMedCLIP FbaVLM (this tool) gender 77.8 ±1.5 78.3 ± 3.3 34.2 ± 1.8 44.1 ±1.5 26.6 ± 7.3 22.9 ± 5.4 BioMedCLIP Clean Model Race 78.0 ±0.8 27.9 ± 3.7 23.6 ± 1.3 4.3 ±2.6 4.9 ± 1.6 5.2 ± 1.6 BioMedCLIP Clean Model gender 78.0 ±0.8 24.1 ± 2.0 20.6 ± 0.6 3.5 ±1.4 3.6 ± 0.3 4.5 ± 0.4 BioMedCLIP BadNets Race 76.0 ±2.2 95.4 ± 1.8 95.9 ± 0.8 0.9 ±0.6 8.6 ± 2.1 7.8 ± 3.1 BioMedCLIP BadNets gender 76.5 ±1.5 94.1 ± 1.5 95.6 ± 0.4 1.9 ±1.1 6.1 ± 2.4 10.1 ± 2.3 BioMedCLIP BadCLIP Race 75.4 ±2.2 94.3 ± 2.4 95.5 ± 0.6 2.6 ±0.9 7.2 ± 2.6 7.2 ± 1.4 BioMedCLIP BadCLIP gender 76.8 ±1.0 95.5 ± 1.3 95.3 ± 3.4 3.3 ±2.0 7.3 ± 2.3 8.3 ± 2.5 BioMedCLIP FbaVLM (this tool) Race 74.8 ±3.5 75.0 ± 2.9 24.5 ± 1.1 50.5 ±4.0 29.6 ± 3.3 29.5 ± 1.4 BioMedCLIP FbaVLM (this tool) gender 74.9 ±3.6 71.2 ± 0.8 32.6 ± 2.4 38.6 ±1.1 25.4 ± 2.5 20.0 ± 3.7 In order to verify the effectiveness of this application, this embodiment selects three mainstream medical visual language models as target models and compares the fairness backdoor attack method proposed in this application with existing mainstream baseline technologies. The experimental comparison results are shown in Table 1.

[0064] In order to facilitate understanding of this application, the following detailed description of this application is provided in conjunction with specific industrial-grade engineering implementation scenarios.

[0065] For example, this application can be applied to an automated security audit and adversarial drill system for large-scale clinical image models in hospitals. Specifically, in a real-world medical information engineering project, a large tertiary hospital plans to implement an auxiliary diagnostic system based on a multimodal visual language model (VLM). To comply with national security compliance standards for medical artificial intelligence software, the hospital can deploy an "automated security audit and adversarial drill system" before the system goes live. This system adopts a microservice architecture design, and its specific engineering implementation steps can be as follows: (1) High-concurrency multimodal data access and preprocessing engine: The system securely connects to the hospital's electronic medical record system and medical image archiving and communication system (PACS) through a data gateway microservice built on Spring Boot. The gateway layer is configured with a customized JVM memory management strategy to efficiently handle parallel I / O operations of large batches of high-resolution 2D / 3D medical images.

[0066] (2) 10,000 anonymized glaucoma cases are retrieved in real time through the data processing pipeline. The system sends text and image data into the document processing pipeline, and uses automated scripts to parse out sensitive attribute metadata such as "race" or "gender", and builds a vectorized index in the database to achieve second-level separation and state-based management of the target group and the safe group.

[0067] (3) Trigger concurrency optimization service based on distributed lock: The security audit system distributes the "trigger optimization" task to the GPU computing power cluster in the background. In order to cope with the high concurrency scenario of multiple departments launching security tests at the same time, the task scheduling center introduced the Redis distributed lock mechanism to ensure that only one optimization task of the same target model is competing for GPU memory resources at the same time, thus avoiding computational conflicts.

[0068] (4) After the compute node pulls the task, it allocates a memory in memory. The system calculates the joint loss function of this application by mapping the pixel mask region and freezing the target VLM weights. The system generates a conditionally aware digital watermark highly coupled with "ethnic" features through multiple asynchronous iterations of projective gradient descent (PGD). .

[0069] (5) Stateful differential poisoning and CI / CD automation workflow disruption: that is, poisoning microservices by reading preset extremely low budget thresholds (e.g. Under the control of the state machine, transaction operations are performed: malicious text label flipping (labeled as "sick") is performed on the extracted target group slice, and watermarking is injected into the safe group slice but the text table structure is locked and not modified.

[0070] (6) After the system's CI / CD automated pipeline detects the event that the poisoning data is ready, it triggers the model fine-tuning queue. After training, the automated evaluation component intervenes. If the test report indicates that the model's global AUC has decreased... Under these circumstances, if the diagnostic bias index (Bias) of the target group surges by more than 60%, the CI / CD pipeline will automatically execute a circuit breaker mechanism to block the production release of the flawed medical model and generate a vulnerability remediation ticket.

[0071] For example, this application can be applied to a cloud-based medical large-scale model attack and defense testing platform based on a distributed architecture and intelligent agents, specifically for commercial medical AI open platforms (providing medical basic large-scale model API services such as CLIP and BioMedCLIP). This embodiment can construct an automated backdoor injection and defense test range platform based on a distributed computing and intelligent agent architecture. It can achieve the following functions: (1) Automated penetration testing planning based on Agentic Architecture: The platform does not execute hard-coded scripts, but introduces an "AI Security Agent" with cognitive patterns. This agent includes a core loop of planning, execution, and tool invocation. When receiving a fairness vulnerability detection instruction targeting the weak feature of "gender," the Agent first analyzes the architectural information of the target model and autonomously plans the test path: it automatically calls the API to schedule the optimal spatial location of the trigger to the dense central area of ​​lesions in the fundus image, and dynamically calculates the optimal poisoning budget limit for dealing with this weak feature, which needs to be increased to... .

[0072] (2) Cross-modal feature locking and high-concurrency computation in a cloud-native environment: The platform uses a Kubernetes container orchestration system to dynamically and elastically scale up and launch dedicated trigger computing container groups (Pods) according to the execution plan issued by the Agent. In the distributed architecture, the system uses a high-concurrency thread pool to process feature vector extraction and cross-modal cosine similarity calculation in parallel. The computation tasks synchronize gradient states through shared storage to ensure digital watermarking. It can penetrate deep into the decision-making region of disease categories, achieving perfect interlocking between local pixel perturbations and implicit group characteristics in a very short time.

[0073] (3) Conflict monitoring fine-tuning process and target range benchmark solidification, that is, the platform’s data scheduling microservice will perform global random shuffle on the generated differentiated poisoning sample blocks (Chunk) and the massive healthy sample blocks in the distributed file system (such as HDFS), and then push them to the cloud training cluster.

[0074] (4) Comparative loss is performed in the model ( During end-to-end fine-tuning, the platform's monitoring components capture changes in the parameter space in real time through the exposed Metrics interface. Due to the orthogonality of the characteristics of the target and the security group, the monitoring dashboard shows that malicious parameter updates are precisely isolated within a specific subspace. Finally, the agent automates the test completion, outputting a "shadow testbed model" containing complete conditional backdoor logic, which is delivered to the platform's security research team for attack and defense drills using next-generation feature isolation and bias removal algorithms.

[0075] The implementation principle of the fairness detection method based on a medical vision model in this application is as follows: The terminal device can first acquire multimodal medical dataset information and target detection model. Then, based on sensitive attribute label information, the sample dataset information is quickly divided into a first group sample set information and a second group sample set information. Then, based on the adversarial generation strategy, a condition-aware trigger is generated. Then, according to the preset poisoning ratio, the condition-aware trigger is combined with a portion of the samples in the first group sample set information, and a first modification rule is executed on the supervision label corresponding to the combined sample in the first group sample set information to generate a first poisoning dataset information. Then, the condition-aware trigger is combined with a portion of the samples in the second group sample set information, and a second modification rule is executed on the supervision label corresponding to the combined sample in the second group sample set information to generate a second poisoning dataset information. Finally, based on the mixed training set information, the parameters of the target detection model are updated to solidify the group conditional triggering characteristics of the backdoor path, thereby improving reliability.

[0076] It should be noted that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0077] Embodiments of this application also provide a fairness detection system based on a medical vision model. For ease of explanation, only the parts relevant to this application are shown, such as... Figure 4 As shown, the system 40 includes: Multimodal medical dataset information acquisition module 41: used to acquire multimodal medical dataset information and acquire target detection model, wherein the multimodal medical dataset information includes sample dataset information and sensitive attribute label information corresponding to the sample data, and the target detection model is used to perform feature extraction and inference on the multimodal medical dataset information; Sample dataset information partitioning module 42: used to partition sample dataset information into first group sample set information and second group sample set information based on sensitive attribute label information; Conditional trigger generation module 43: is used to generate conditional triggers based on a preset adversarial generation strategy. The conditional trigger is used to: activate the preset backdoor path in the target detection model when the conditional trigger is injected with the first group sample set information, so that the target detection model outputs malicious reasoning result information; and keep the backdoor path of the target detection model in a dormant state when the conditional trigger is injected with the second group sample set information, so that the target detection model outputs normal reasoning result information. The poisoning dataset information generation module 44 is used to combine a condition-aware trigger with a portion of the samples in the first group sample set information according to a preset poisoning ratio, and execute a first modification rule on the supervision label corresponding to the combined sample in the first group sample set information to generate first poisoning dataset information. It also combines a condition-aware trigger with a portion of the samples in the second group sample set information, and executes a second modification rule on the supervision label corresponding to the combined sample in the second group sample set information to generate second poisoning dataset information. The first modification rule and the second modification rule are mutually exclusive supervision strategies. Parameter update module 45: used to update the parameters of the target detection model based on the information of the mixed training set, so as to solidify the group condition triggering characteristics of the backdoor path. The mixed training set information includes the information of the first poisoning dataset and the information of the second poisoning dataset.

[0078] For some possible implementations, please refer to Figure 2 The system architecture of this application can mainly rely on the cross-modal alignment mechanism of medical vision-language models (VLMs), and on this basis, a covert adversarial testing and injection system is built. The entire system can mainly include the following four core modules: Basic Medical Multimodal Model Module: Includes a pre-trained visual-language model The model consists of an image encoder (ImageEncoder, ) and a text encoder (TextEncoder, It consists of a shared joint embedding space used to map medical images and their corresponding clinical texts into a shared joint embedding space; The cross-modal bias-aware trigger optimization module transforms trigger generation into a constrained adversarial optimization problem in a cross-modal embedding space while the pre-trained model parameters are frozen. This module utilizes images, text, and sensitive attribute labels (such as race and gender) to compute a joint objective function comprising attack loss, defense loss, and concealment loss, and generates the optimal conditional visual trigger through projective gradient descent (PGD). ; Fairness-based targeted differential poisoning module: used for poisoning within a strictly limited poisoning budget ( This module filters samples and constructs a poisoning dataset. It is responsible for executing the opposite labeling strategy based on the sensitive attributes of the input samples: malicious text labels are flipped for the target group, while benign text labels are strictly retained for the safe group, thus generating conflicting supervisory signals. The conflict-supervised fine-tuning module (cross-modal alignment module) is responsible for mixing the differentially poisoned dataset with the clean dataset, unfreezing the model parameters, and utilizing standard contrastive loss. This module fine-tunes the multimodal model. It forces the model to establish complex conditional routing rules during parameter updates, thereby solidifying subgroup conditional backdoors.

[0079] It should be noted that the information interaction and execution process between the above modules are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0080] This application also provides a terminal device, such as... Figure 5 As shown, the terminal device 50 of this embodiment includes: a processor 51, a memory 52, and a computer program 53 stored in the memory 52 and executable on the processor 51. When the processor 51 executes the computer program 53, it implements the steps described in the fairness detection method embodiment above, for example... Figure 1 Steps S100 to S500 are shown; or, when processor 51 executes computer program 53, it implements the functions of each module in the above-described device, for example... Figure 4 The functions of modules 41 to 45 are shown.

[0081] The terminal device 50 can be a desktop computer, laptop, handheld computer, or cloud server, etc., and includes, but is not limited to, a processor 51 and a memory 52. ​​Those skilled in the art will understand that... Figure 5 This is merely an example of terminal device 50 and does not constitute a limitation on terminal device 50. It may include more or fewer components than shown, or combine certain components, or different components. For example, terminal device 50 may also include input / output devices, network access devices, buses, etc.

[0082] The processor 51 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.; the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0083] The memory 52 can be an internal storage unit of the terminal device 50, such as the hard disk or memory of the terminal device 50. The memory 52 can also be an external storage device of the terminal device 50, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the terminal device 50. Furthermore, the memory 52 can include both internal storage units and external storage devices of the terminal device 50. The memory 52 can also store computer program 53 and other programs and data required by the terminal device 50. The memory 52 can also be used to temporarily store data that has been output or will be output.

[0084] One embodiment of this application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable medium can include any entity or device capable of carrying computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0085] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the methods, principles and structures of this application should be covered within the scope of protection of this application.

Claims

1. A fairness detection method based on a medical vision model, characterized in that, The method includes: Acquire multimodal medical dataset information and acquire a target detection model, wherein the multimodal medical dataset information includes sample dataset information and sensitive attribute label information corresponding to the sample data, and the target detection model is used to perform feature extraction and inference on the multimodal medical dataset information; Based on the sensitive attribute label information, the sample dataset information is divided into a first group sample set information and a second group sample set information; Based on a preset adversarial generation strategy, a condition-aware trigger is generated. The condition-aware trigger is used to: activate a preset backdoor path in the target detection model when the condition-aware trigger is injected with information from a first group of sample sets, so that the target detection model outputs malicious inference result information; and keep the backdoor path of the target detection model in a dormant state when the condition-aware trigger is injected with information from a second group of sample sets, so that the target detection model outputs normal inference result information. According to a preset poisoning ratio, the condition-aware trigger is combined with a portion of the samples in the first group sample set information, and a first modification rule is executed on the supervision label corresponding to the combined sample in the first group sample set information to generate a first poisoning dataset information. The condition-aware trigger is also combined with a portion of the samples in the second group sample set information, and a second modification rule is executed on the supervision label corresponding to the combined sample in the second group sample set information to generate a second poisoning dataset information. The first modification rule and the second modification rule are mutually exclusive supervision strategies. Based on the mixed training set information, the parameters of the target detection model are updated to solidify the group condition triggering characteristics of the backdoor path. The mixed training set information includes the first poisoning dataset information and the second poisoning dataset information.

2. The method according to claim 1, characterized in that, The condition-aware trigger generated based on the preset adversarial generation strategy includes: The parameters of the target detection model are frozen, and joint optimization objective function information is constructed. The joint optimization objective function information includes a first constraint term, a second constraint term, and a third constraint term. The first constraint term is used to bring the representation of the first group sample set information injected with the conditional trigger closer to the target malicious semantic manifold in the cross-modal joint embedding space, while pushing it away from the original benign semantic manifold of the first group sample set information. The second constraint term is used to apply a reverse structured constraint to the representation of the second group sample set injected with the conditional trigger in the cross-modal joint embedding space, forcing the second group sample set to anchor to the original benign semantic manifold. The third constraint term is used to limit the representation deviation of the representation of the first group sample set information injected with the conditional trigger and / or the representation of the second group sample set information injected with the conditional trigger in the cross-modal joint embedding space. Under the pre-defined perturbation space mask constraint, the condition-aware trigger is iteratively updated until the joint optimization objective function information converges.

3. The method according to claim 2, characterized in that, The first constraint term adopts a boundary-based metric loss function, the second constraint term adopts a reverse structured constraint, and the third constraint term adopts a feature space regularization constraint.

4. The method according to claim 1, characterized in that, The first modification rule is to modify the original supervision label corresponding to the combined sample in the first group sample set information to an error label pointing to a preset target category. The second modification rule is to keep the original supervision label corresponding to the combined sample in the second group sample set information unchanged.

5. The method according to claim 1, characterized in that, The condition-aware trigger has a preset spatial mask constraint. The spatial mask is set within the pixel space of the input sample. The spatial mask is used to limit the pixel-level binding range of the condition-aware trigger on the input sample. The size of the spatial mask is smaller than the overall spatial size of the input sample.

6. The method according to claim 5, characterized in that, The physical binding range of the condition-aware trigger within the pixel space of the input sample is limited to a local region.

7. The method according to claim 1, characterized in that, The preset poisoning ratio is less than or equal to 3% of the total sample size of the multimodal medical dataset information, and the sensitive attribute label information includes demographic attribute labels.

8. A fairness detection system based on a medical vision model, characterized in that, The system includes: Multimodal medical dataset information acquisition module: used to acquire multimodal medical dataset information and acquire target detection model, wherein the multimodal medical dataset information includes sample dataset information and sensitive attribute label information corresponding to the sample data, and the target detection model is used to perform feature extraction and inference on the multimodal medical dataset information; Sample dataset information partitioning module: used to partition the sample dataset information into a first group sample set information and a second group sample set information based on the sensitive attribute label information; Condition-aware trigger generation module: used to generate condition-aware triggers based on a preset adversarial generation strategy, wherein the condition-aware trigger is used to: activate a preset backdoor path in the target detection model when the condition-aware trigger is injected with information from a first group of sample sets, so that the target detection model outputs malicious inference result information; and keep the backdoor path of the target detection model in a dormant state when the condition-aware trigger is injected with information from a second group of sample sets, so that the target detection model outputs normal inference result information. The poisoning dataset information generation module is used to combine the condition-aware trigger with a portion of the samples in the first group sample set information according to a preset poisoning ratio, and execute a first modification rule on the supervision label corresponding to the combined sample in the first group sample set information to generate first poisoning dataset information; and to combine the condition-aware trigger with a portion of the samples in the second group sample set information, and execute a second modification rule on the supervision label corresponding to the combined sample in the second group sample set information to generate second poisoning dataset information, wherein the first modification rule and the second modification rule are mutually exclusive supervision strategies; Parameter update module: used to update the parameters of the target detection model based on the mixed training set information, so as to solidify the group condition triggering characteristics of the backdoor path, wherein the mixed training set information includes the first poisoning dataset information and the second poisoning dataset information.

9. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 7.

Images