A clean-label backdoor attack method of sample selection and trigger strength adaptation

Abstract

The application discloses a clean label backdoor attack method of sample selection and trigger strength adaptation. Only target class data is used, normalized features are obtained through a pre-trained feature extractor, a target class center is represented by a geometric median, a sample score is constructed by combining the cosine distance of the sample to the center and the average cosine distance of the sample to the nearest neighbor, and a poisoning sample far from the center and having the same class neighbor is screened. On the basis of the center and the feature space, a sample-by-sample strength objective function is constructed according to the centrifugal direction feature displacement caused by the trigger and the perception distortion, the projected gradient descent is adopted for continuous differentiable strength, the legal state is enumerated for discrete or non-differentiable strength, the training stage trigger strength of each poisoning sample is obtained, the original label of the poisoning sample is kept, and a poisoning set is output. Under the condition of only using target class data, the method can improve the effectiveness and concealment of the backdoor attack, and is suitable for distributed data collection, cross-institution privacy protection scenes and the like.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security and data poisoning testing technology, specifically involving a clean label backdoor attack method that matches sample selection with trigger strength. Background Technology

[0002] Deep neural networks are widely used in image classification, object recognition, and visual perception tasks. To assess the security of the training data supply chain and model training process, it is often necessary to construct backdoor attack scenarios: injecting pre-defined triggers into a subset of training samples, causing the model trained on the poisoned training set to maintain normal classification behavior on clean inputs, while outputting the target category specified by the attacker when the input contains the triggers. Clean-label backdoor attacks maintain the original labels of the poisoned samples, making them more difficult to detect through label consistency checks compared to poisoning methods that modify labels.

[0003] Existing backdoor attack schemes often randomly select poisoned samples from the target category samples, or rely on the classification loss, gradient, forgetting events, and early training posterior to select difficult samples. Random selection ignores the differences in the contribution of samples within the target category to the backdoor learning; the selection method relying on the victim model requires obtaining complete training data and the training process of the victim model or proxy model, which is difficult to apply to scenarios where the attacker is only a single data provider and can only access the limited information of their own target category data.

[0004] In scenarios with limited information, existing methods typically utilize pre-trained features and single-neighbor anomaly scores to select difficult samples. However, ranking based solely on a single score can easily mix peripheral samples that are far from the main category but still have similar neighbors with isolated points lacking similar neighbors, labeled noise, or anomalously collected samples. Isolated samples lack stable similar structural support, and directly using them as poisoning samples reduces the stability and interpretability of sample selection.

[0005] The trigger strength during the training phase is another parameter affecting backdoor signal learning and perceptual distortion of poisoned samples. Existing methods often use the same patch opacity, patch size, mixing ratio, or quantization level for all poisoned samples. Different samples have different positions and local structures in the target class feature space. When using a uniform trigger strength during the training phase, the feature changes of some samples are insufficient, while the perceptual distortion of some samples may be too large. At the same time, existing trigger strength settings do not reuse the target class center and feature geometry obtained during the sample screening phase.

[0006] Patent CN114462031A discloses a backdoor attack scheme that selects target category samples from the original sample data and sets text triggers, but does not disclose the peripheral sample screening based on the target category image features and the sample-by-sample trigger strength adaptation; Patent CN119360458A discloses a clean label scheme that uses complete multi-class face data to train a classification network, generate adversarial examples and embed face variable feature triggers, but it still relies on a complete dataset and classification network, and does not disclose the dual-ranked sample screening and sample-by-sample strength solution under the same feature geometry described in this application.

[0007] Therefore, a technical solution is needed that can both select peripheral samples from the target class data that are far from the class center but still have stable neighbors of the same class, and independently determine the trigger strength based on the feature response of each selected sample, without accessing the victim model, other class data and victim training gradients. Summary of the Invention

[0008] To address the aforementioned issues, this invention discloses a clean-label backdoor attack method that adapts sample selection and trigger strength. Through a three-stage process of "target class feature extraction and normalization - screening of peripheral poisoned samples - sample-by-sample trigger strength optimization," this method solves the problems of isolated noise misselection, mismatch of uniform trigger strength, and disconnect between sample selection and strength setting without accessing the victim model, other class data, or victim training gradients.

[0009] To achieve the above objectives, the technical solution of the present invention is as follows:

[0010] A clean-label backdoor attack method that adapts sample selection to trigger strength includes the following steps:

[0011] Step S1: Extract features and perform L2 normalization on the target class samples to form a set of unit features that can be reused for subsequent sample screening and trigger strength adaptation.

[0012] Step S2: The normalized geometric median of the unit features of the target class is used to represent the robust feature center of the target class samples. The cosine distance of the center and the average cosine distance of K nearest neighbors are used to screen the peripheral samples that are far away from the robust feature center of the target class samples but still have the support of similar nearest neighbors, thus obtaining the poisoning candidate set.

[0013] Step S3: First, determine the legal domain of intensity based on the intensity value range and the differentiability of the trigger injection process. Then, generate candidate intensities, inject triggers, and extract normalized post-trigger features. Calculate the centrifugal feature displacement and LPIPS perceptual similarity loss to construct a unified per-sample trigger intensity objective function. Continuous and differentiable intensity parameters are updated iteratively using projective gradient descent. Discrete or non-differentiable intensity parameters are fully enumerated for legal states. Finally, select the intensity with the smallest target value from all evaluated candidate trigger intensities. When target values ​​are tied, select the one with the weaker trigger perturbation until the trigger intensities corresponding to all poisoning candidate samples in the training phase are obtained and the set of poisoning samples that retains the original target category label is output.

[0014] Furthermore, the specific method for step S1 is as follows:

[0015] make For a pre-trained feature extractor, samples The corresponding features are And perform L2 normalization:

[0016] ;

[0017] in, For the sample Normalized unit features; the L2 norm of each unit feature is 1, and the inner product of any two unit features is equivalent to the cosine similarity of the corresponding samples; the pre-trained feature extractor adopts a pre-trained self-supervised model that does not depend on the victim model.

[0018] Considering that there may be a small number of extreme samples in the target class data, the geometric median, which is more stable to extreme values, is used to represent the overall position of the target class features:

[0019] ;

[0020] in, For to be estimated 3D position vector, For the feature dimension, The number of samples in the target class.

[0021] The geometric median is solved using the Weiszfeld iteration with a numerical stability term:

[0022] ;

[0023] Where t is the number of iterations. The center of the t-th iteration, For the sample Adaptive weights, To avoid a stability constant with a denominator of zero, the iteration stops when the change in the center between two adjacent iterations is less than the preset tolerance or when the maximum number of iterations is reached.

[0024] To ensure that the category center aligns with the subsequent cosine geometry, the geometric median is normalized:

[0025] ;

[0026] when The L2 norm is not greater than the preset geometric median norm threshold. When this happens, stop filtering samples for the current category to avoid unstable normalization.

[0027] Furthermore, the specific method for step S2 is as follows:

[0028] For target class samples Calculate the central cosine distance between its unit characteristic and the normalized geometric median:

[0029] ;

[0030] in, The larger the sample size, the better. The further away from the overall position of the target class features in the pre-trained feature space.

[0031] Exclude samples from the complete target class feature set. Take itself, select its k nearest neighbors, and calculate the average cosine distance between the k nearest neighbors:

[0032] ;

[0033] Where k is the number of nearest neighbors. This represents the unit feature of the nearest neighbor samples. The smaller the value, the better the sample size. The closer to its neighbors; The larger the value, the fewer similar samples there are around that sample.

[0034] The required number of nearest neighbors must satisfy:

[0035] ;

[0036] The nearest neighbor must be selected from the complete set of features of the target class, excluding the sample itself.

[0037] To eliminate the distributional differences between the two distances, the center cosine distance and the k-nearest neighbor mean cosine distance are normalized and ranked separately:

[0038] ;

[0039] in, It indicates the ranking order from smallest to largest. The larger the value, the further the sample is from the center of the target class; The larger the value, the more stable the support of similar nearest neighbors the sample has.

[0040] The smaller of the two normalized rankings is used to construct the outer sample score:

[0041] ;

[0042] After applying minimum gating, only samples that are simultaneously far from the normalized geometric median and have similar nearest neighbor support can achieve high scores. Choose from high to low From a sample, a poisoning candidate set is obtained. .

[0043] Furthermore, the specific method for sample-by-sample trigger strength optimization selection in step S3 is as follows:

[0044] First, an unprocessed poisoning candidate sample is read from the poisoning candidate set. The valid intensity domain is determined based on the value range of the trigger strength parameter and the differentiability of the trigger injection process. Then, candidate intensities are generated and injected into the trigger. Normalized trigger features are extracted, and the centrifugal displacement and thresholded perceptual similarity loss are calculated to construct a sample-by-sample trigger strength objective function. Next, the corresponding solution branch is entered according to whether the intensities are continuously differentiable or discretely non-differentiable, selecting the candidate intensity with the smallest objective value and the weakest trigger perturbation when in parallel. After completing the current sample, the next unprocessed sample is read until all poisoning samples are output. Each intensity optimization only changes one trigger strength parameter, while keeping the trigger pattern, trigger position, and other configurations unchanged. For continuously differentiable intensity parameters such as opacity and blending rate, the valid domain is:

[0045] ;

[0046] in, and These represent the minimum and maximum values ​​of the continuous strength parameter, respectively.

[0047] For discrete intensity parameters such as patch size and color depth, or for intensity parameters that are not subject to differentiable operations such as rounding or color quantization during the trigger injection process, the valid domain is:

[0048] ;

[0049] Where M is the number of legal states, and the legal states in the set are arranged from weakest to strongest according to the triggering perturbation.

[0050] Targeting poisoning candidate samples and candidate strength The trigger image is generated according to the following formula, and its unit normalized features are obtained:

[0051] ;

[0052] Where T is the trigger injection function, and the pre-trained feature extractor from step S1 is continued to be used.

[0053] Step S2 has yielded the normalized geometric median. ,by Features of clean units pointing to poisoning candidate samples The direction is taken as the centrifugal direction:

[0054] ;

[0055] The actual displacement of the unit feature relative to the clean unit feature after adding the trigger is calculated using the following formula:

[0056] ;

[0057] The projection of the actual displacement in the centrifugal direction is taken as the displacement magnitude of the poisoned sample away from the normalized geometric median:

[0058] ;

[0059] in, The larger the value, the greater the positive component of the characteristic change caused by the trigger in the centrifugal direction.

[0060] To avoid significant image distortion caused by simply increasing the trigger strength, LPIPS is used to calculate the perceptual similarity loss between the trigger image and the original image:

[0061] ;

[0062] in, As a rectified linear unit, this term is only applied when the perceived distortion exceeds a threshold. Effective immediately; The threshold for perceiving similarity.

[0063] The centrifugal direction feature displacement and the perceived similarity loss together constitute the sample-by-sample trigger strength objective function:

[0064] ;

[0065] Wherein, λ is a weighting factor that controls the contribution of LPIPS perceptual similarity loss.

[0066] After constructing the sample-by-sample trigger strength objective function, determine whether the strength parameters are continuous and differentiable with respect to the trigger injection process; if the result is yes, initialize with the midpoint of the valid interval:

[0067] ;

[0068] In the t-th iteration, the candidate strengths are updated using projective gradient descent:

[0069] ;

[0070] in, For learning rate, This indicates that the updated intensity will be projected back into the legal domain A. Trigger injection, feature extraction, and LPIPS computation remain differentiable with respect to continuous intensity.

[0071] Stop when two consecutive intensity changes satisfy the following formula:

[0072] ;

[0073] in Indicates the trigger strength iteration stop tolerance;

[0074] If the stopping condition is not met, the process terminates when the maximum number of iterations is reached, and the intensity that minimizes the objective function is selected from all evaluated candidate intensities, denoted as . When multiple strengths reach the same minimum value, the weakest one is selected.

[0075] When the strength parameter is a discrete value, or when the trigger injection process involves non-differentiable operations, all states in the legal domain are fully enumerated and the same objective function is calculated for each state. After all legal states have been evaluated, the trigger strength for the training phase is selected according to the following formula:

[0076] ;

[0077] The complete enumeration does not depend on the monotonicity of gradients, initialization, or intensity responses; when multiple states reach the same minimum, the state with the weakest triggering perturbation is selected. The search is conducted across all states. The process terminates after each state evaluation is completed.

[0078] Each sample in the poisoning candidate set retains its original target class label and uses the corresponding trigger strength from the training phase. The final poisoning sample set is as follows:

[0079] ;

[0080] After determining the trigger strength of the current poisoning candidate sample during the training phase, it is determined whether there are still unprocessed samples in the poisoning candidate set. If there are, the process returns to read the next unprocessed sample and repeats the above optimization selection process. If not, the trigger is injected according to the corresponding strength of each sample, the original target category label is maintained, and the poisoning sample set is output.

[0081] During the inference phase, fixed triggers of the same family and style are used for non-target category test samples, and their strength is... Independent declaration before training the victim model.

[0082] The beneficial effects of this invention are as follows:

[0083] First, the geometric median is used to reduce the impact of a small number of extreme samples on the target class center. The normalized ranking of the center cosine distance and the average cosine distance of K nearest neighbors is used to constrain the sample score, so that the poisoning candidate sample can simultaneously meet the two conditions of being far away from the target class center and having the support of the same type of nearest neighbors, thus suppressing isolated noise from the sample screening stage.

[0084] Second, the sample selection and training phases reuse the same pre-trained feature extractor, the same unit feature set, and the same normalized geometric median. The trigger strength target directly measures the centrifugal feature displacement of the selected peripheral samples, thus forming a seamless technical coupling between the two phases.

[0085] Third, step S3 forms a closed loop of "legal domain determination - candidate intensity evaluation - differentiability discrimination - branch solution - optimal intensity selection - sample-by-sample cyclic output"; the centrifugal direction feature displacement and thresholded LPIPS perceptual similarity loss constitute the same sample-by-sample target. The continuous and differentiable intensity is solved by projected gradient descent, and the discrete or non-differentiable intensity is solved by complete enumeration. When the target values ​​are in the same order, the trigger with the weaker perturbation is selected, so as to cover different trigger parameter types without changing the evaluation target.

[0086] Fourth, the poisoned samples retain the original target category label, and the sample selection and intensity matching do not depend on the victim model structure, parameters, training loss, training gradient or other category data, which is suitable for scenarios where the attacker is only a provider of data for a single target category with limited information. Attached Figure Description

[0087] Figure 1 This is a flowchart of the sample selection and trigger strength matching method of the present invention.

[0088] Figure 2 This is a flowchart of the poisoning sample screening process in step S2 of the present invention.

[0089] Figure 3 This is a flowchart of the sample-by-sample trigger strength optimization selection process in step S3 of the present invention. Detailed Implementation

[0090] The present invention will be further illustrated below with reference to the accompanying drawings and specific embodiments. It should be understood that the following specific embodiments are for illustrative purposes only and are not intended to limit the scope of the invention.

[0091] The method of this invention can be applied to security testing scenarios in the training data supply chain and image classification model training process. In the application scenario, the image classification model, the basic training dataset, and the trigger injection function are defined as follows.

[0092] set up To make the image space Images in Mapping to tag space Tags in The model has the following clean training dataset:

[0093] ;

[0094] in, This represents the total number of training samples. The attacker defines an injection function to implant triggers into the image:

[0095] ;

[0096] in, This indicates that only one trigger strength parameter is adjusted at a time. Let... For the target category, For the target class sample size, in the poisoning budget From Select size as subset of and in the set of legal strength The intensity was determined for each poisoned sample. .

[0097] Poisoning training dataset The model trained above maintains correct predictions on clean samples:

[0098] ;

[0099] Simultaneously, the model outputs the target category label for the sample to which the trigger is applied. :

[0100] ;

[0101] in, Trigger strength for the testing phase, determined independently before training the victim model.

[0102] This embodiment demonstrates the complete process of the present invention using the CIFAR-10 basic visual classification task as a scenario. The training set contains 10 categories, each containing 5000 32×32 pixel color images, and target category labels. Set as "Airplane". To simulate the limited information conditions of a single target category data provider, the experimental program only provides 5000 target category training images to the attacking side, while masking the data of the other 9 categories, as well as the structure, parameters, loss, gradient, and training state of the victim model.

[0103] This embodiment sets the number of target class samples. The poisoning budget m is 250, and the number of nearest neighbors k is 20. The original image is kept at 32×32 pixels; both the clean and poisoned images are scaled to 224×224 pixels using bicubic interpolation before feature extraction and perceptual difference calculation. The pre-trained feature extractor uses a DINOv2 ViT-B / 14 self-supervised model independent of the victim model, with an output feature dimension d of 768. The trigger uses a fixed 4×4 pixel black and white checkerboard patch in the lower right corner of the original image; the main implementation process only adjusts the patch opacity. The valid domain A is set to [0.2, 1.0]. Testing phase strength. The value was set to 0.8 independently before training the victim model. The above setting is only for illustrating the calculation process and does not limit the scope of protection.

[0104] A clean-label backdoor attack method that adapts sample selection to trigger strength includes the following steps:

[0105] Step S1: Feature extraction and feature normalization of target class samples

[0106] like Figure 1 As shown, 5000 training images of the target category "airplane" are first scaled to 224×224 pixels in the same way and then input into a pre-trained feature extractor to obtain 768-dimensional features for each sample. Then, L2 normalization is performed on each feature to obtain unit features. .

[0107] The arithmetic mean vector of all unit features is used as the initial value for Weiszfeld iteration, and the numerical stability constant is... Set to 10⁻ 8 Stop tolerance set to 10⁻ 6 The maximum number of iterations is set to 100. The geometric median is obtained after iteration. And normalize it into a robust feature center of the target class. .like The L2 norm is not greater than 10⁻ 6 If this condition is not triggered, the screening process will stop and the report center will be reported as unstable and unnormalized. This embodiment did not trigger this condition, therefore... This information is provided simultaneously to steps S2 and S3.

[0108] Step S2: Screening of candidate poisoning samples

[0109] like Figure 2 As shown. For each target class sample First, calculate its unit characteristics. With target class robust feature center The central cosine distance between Then exclude from the complete set of features of the target class. Select the 20 nearest neighbors of the same type with the smallest cosine distance and calculate the average cosine distance. After all samples have been calculated, D(x_i) and L(x_i) are ranked in ascending order to obtain the center deviation ranking. Ranking of support from neighboring countries Then, the smaller of the two values ​​is taken as the sample score. .

[0110] With target class samples For example, if the ascending rank of its center cosine distance and nearest neighbor mean cosine distance are 4800 and 400 respectively, then , , This sample is far from the robust feature center and has similar neighboring support, making it a preferred peripheral sample.

[0111] If the target class sample If the two ascending ranks are 4950 and 4850 respectively, then... , , Although the sample is far from the robust feature center, it lacks stable neighbors of the same type, and minimum gating will reduce the selection priority of isolated samples.

[0112] If the target class samples are near the center If the two ascending ranks are 2000 and 500 respectively, then... , , Although the sample has similar neighbors for support, it is not located on the periphery of the target class and will not obtain a high score solely based on local density.

[0113] After traversing all 5000 target class samples in the above manner, the sample scores are... The samples were sorted from highest to lowest, and the top 250 samples were selected to form a poisoning candidate set. In this embodiment, the sample Enter the poisoning candidate set, and the sample and samples The sample will not be included in the poisoning candidate set. If the same score appears at the 250th selection boundary, it will be processed in ascending order according to a pre-fixed sample index to ensure that the screening results under the same input conditions can be reproduced.

[0114] Step S3: Optimize the selection of trigger strength per sample

[0115] like Figure 3 As shown. The system selects from the poisoning candidate set. An unprocessed sample is read, and the solution branch is determined based on the range of intensity parameters and the differentiability of the trigger injection process. Subsequently, candidate intensities are generated within the valid intensity domain, a trigger is injected, and the unit-normalized post-trigger features are obtained using the same pre-trained feature extractor as in step S1. The centrifugal feature displacement is then calculated. The unified objective function is composed of thresholded LPIPS perceptual similarity loss. .

[0116] During the main implementation, a 4×4 pixel fixed chessboard patch is injected into the lower right corner of the original 32×32 pixel image, with an opacity of [opacity value missing]. The value is continuously taken within the range [0.2, 1.0]. The trigger image and its corresponding clean image are uniformly scaled to 224×224 pixels before being used for DINOv2 feature extraction and LPIPS calculation; this process is differentiable with respect to α, thus entering the continuous optimization branch. Perceptual similarity threshold. Set to 0.08, weighting factor Set the learning rate to 20 for projected gradient descent. Set to 0.05, stop threshold Set to 10⁻ 4 The maximum number of iterations is set to 50, and the initial strength is... .

[0117] Selected Poisoning Candidate Samples In a candidate strength evaluation used to illustrate the computational relationship, when hour, If LPIPS = 0.060, then the thresholded LPIPS loss is 0, and the objective function is... ;when hour, If LPIPS = 0.086, then ;when hour, If LPIPS = 0.132, then The numerical examples in this set show that while simply increasing the opacity may increase the characteristic displacement in the centrifugal direction, it will be subject to a squared penalty after exceeding the perception threshold. Therefore, the objective function does not require the intensity response to be monotonic.

[0118] from Initially, updates are performed based on the gradient of the target sample with respect to α, and after each update, the candidate intensity is projected back to [0.2, 1.0]. When the intensity change between two consecutive intervals is no greater than 10⁻ 4 If the stopping condition is not met after 50 iterations, the iteration is terminated and the candidate with the smallest target value is selected from all evaluated candidate intensities. At this point, As a sample The training phase trigger strength was determined. The same process was repeated for the remaining 249 poisoning candidate samples, and different training phase strengths were obtained for each sample; if multiple candidate strengths had the same minimum target value, the strength with the weakest trigger perturbation was selected uniformly.

[0119] Alternative implementation methods for discrete or non-differentiable intensity parameters

[0120] In the same CIFAR-10 basic visual classification task scenario, the patch opacity can be fixed at 0.6, and the patch side length can be used as the only discrete intensity parameter to be adjusted. The patch remains located in the lower right corner of the 32×32 pixel original image, within the valid domain. The pixels are arranged in ascending order of trigger perturbation. Since the patch side length involves integer values ​​and discrete variations in the image region, the system enters a discrete or non-differentiable branch, fully enumerates the four legal states, generates trigger images one by one, and calculates the same sample-by-sample target.

[0121] For example, for the same poisoning candidate sample, if the patches corresponding to 2 pixels, 3 pixels, 4 pixels, and 5 pixels are ( LPIPS If the values ​​are (0.011, 0.035, -0.011), (0.023, 0.058, -0.023), (0.032, 0.079, -0.032), and (0.041, 0.110, -0.023) respectively, then after the complete enumeration, the 4-pixel patch with the smallest target value is selected. If two discrete states achieve the same minimum target value, the state that appears earlier in the order from weakest to strongest is selected.

[0122] Poisoning sample set output

[0123] After selecting the intensity of each poisoning candidate sample, the system checks if there are still unprocessed samples in the poisoning candidate set; if so, it returns to read the next sample and repeats the process. Figure 3 The process is as shown; if not, triggers are injected according to the training stage intensity corresponding to each sample. All 250 poisoning candidate samples retain the original CIFAR-10 target category "aircraft" label, forming a poisoning sample set. This data was then combined with the remaining CIFAR-10 training samples to form the poisoning training set. The entire screening and intensity adaptation process did not utilize the victim model, other category data, or victim training gradients.

[0124] Through the above implementation method, it is possible to complete the screening of peripheral poisoning samples using only CIFAR-10 target category data, and determine the trigger strength of the training phase within the legal domain for each poisoning candidate sample, ultimately generating a set of poisoning samples that retains the original target category label. This method can suppress the misselection of isolated abnormal samples and constrain the perceptual distortion of the trigger image while increasing the feature displacement in the centrifugal direction, thereby improving the stability and concealment of sample selection and trigger strength adaptation.

[0125] It should be noted that the above content merely illustrates the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. For those skilled in the art, various improvements and modifications can be made without departing from the principle of the present invention, and all such improvements and modifications fall within the scope of protection of the claims of the present invention.

Claims

1. A clean-label backdoor attack method with sample selection and trigger strength matching, characterized in that, Includes the following steps: Step S1, Feature extraction and feature normalization of target class samples: Obtain a target class sample set containing only target class samples and a poisoning budget. Extract the features of the target class samples through a pre-trained feature extractor and perform L2 normalization to obtain a normalized feature set. Step S2, Poisoning Sample Screening: Based on the normalized feature set of the target class samples output in Step S1, calculate the geometric median of the normalized feature set, normalize the geometric median, determine the robust feature center of the target class, and combine the central cosine distance of each target class sample relative to the robust feature center of the target class and the average cosine distance relative to the nearest neighbor samples of the same class to screen target class samples that are far away from the robust feature center of the target class and have the nearest neighbor samples of the same class to obtain the poisoning candidate set; Step S3, optimize the selection of trigger strength for each sample: For each poisoning candidate sample in the poisoning candidate set, construct an objective function within the preset strength legal domain to increase the centrifugal feature displacement caused by the trigger and limit perceptual distortion, and select the corresponding trigger strength by projected gradient descent or complete enumeration of legal states according to the continuous differentiability of the trigger strength parameter; generate poisoning samples according to the trigger strength, maintain the original target category label of the poisoning samples and output the poisoning sample set.

2. The method according to claim 1, characterized in that, In step S1, the pre-trained feature extractor adopts a pre-trained self-supervised model that does not depend on the victim model; without using other class data and without obtaining the structure, parameters, training loss, training gradient or training state of the victim model, feature extraction and L2 normalization are performed on the samples in the target class sample set; the obtained normalized feature set is used as the feature space basis for both the poisoning sample screening in step S2 and the trigger strength optimization selection in step S3.

3. The method according to claim 2, characterized in that, Step S1 includes the following processes: First of all, let For pre-trained feature extractors, for target class samples Feature extraction And perform L2 normalization: ； Among them, the normalized unit characteristics The L2 norm is 1, and the inner product between any two unit features represents the corresponding cosine similarity. Secondly, the geometric median of the normalized features of the target class is used to represent the overall position of the target class features: ； in, For to be estimated 3D position vector, For the feature dimension, The number of samples in the target class; The geometric median is solved using the Weiszfeld iteration with a numerically stable term: ； Where t is the number of iterations. The center of the t-th iteration, For the sample The corresponding adaptive weights, To avoid a stability constant with a denominator of zero, the iteration stops when the change in the center between two adjacent iterations is less than the preset tolerance or when the maximum number of iterations is reached. Finally, to ensure that the target class center is consistent with the subsequent cosine geometry, the geometric median is normalized: ； when The L2 norm is not greater than the preset geometric median norm threshold. When this happens, stop filtering samples for the current target category.

4. The method according to claim 3, characterized in that, In step S2, candidate samples for poisoning are screened based on the degree of deviation from the central point and the degree of support from similar nearest neighbors. Includes the following processes: First, for samples in the target class Calculate the central cosine distance between its unit feature and the robust feature center of the target class: ； Subsequently, samples were excluded from the complete target class feature set. Choose yourself Find the nearest neighbors and calculate the sample and The average cosine distance between the nearest neighbors: ； Where k is the number of nearest neighbors. For the unit features of nearest neighbor samples, The smaller the value, the better the sample size. The closer to its neighbors; The larger the value, the fewer similar samples there are around that sample; Where the number of nearest neighbors k satisfies: ； Based on this, and Normalized rankings are performed in ascending order: ； Among them, the ascending order ranking function Used to determine the relative order of each distance in the target class samples; Finally, the smaller of the two normalized rankings is taken as the sample score: ； according to Selection from high to low and poisoning budget A set of poisoning candidates is obtained by taking a corresponding number of target class samples. When there are identical scores at the selection boundary, they are processed according to a pre-fixed sample index order.

5. The method according to claim 4, characterized in that, Step S3 determines the legal intensity domain and constructs a sample-by-sample intensity target to increase the characteristic displacement in the centrifugal direction and limit perceptual distortion based on the value range of the trigger intensity parameter and whether the trigger injection process is differentiable. This includes the following processes: When the intensity parameter is continuous and differentiable, the legal domain of intensity is: ； in, and These are the minimum and maximum values ​​of the continuous strength parameter, respectively. When the strength parameter is a discrete parameter or the trigger injection process involves rounding or quantization operations and is therefore non-differentiable, the valid strength domain is: ； in, This represents the number of legal states, which are arranged in ascending order of the triggering perturbation. Targeting poisoning candidate samples and candidate trigger strength Injecting functions using triggers Generate a trigger image and obtain unit-normalized features using the pre-trained feature extractor employed in step S1: ； in, Is it adding trigger strength? The poisoned sample; T is the trigger injection function. With target class robust feature center The direction pointing towards the clean unit feature of the poisoning candidate sample is used as the centrifugation direction: ； The feature displacement of the unit feature of the trigger image relative to the clean unit feature is: ； The projection of the characteristic displacement onto the centrifugal direction is taken as the characteristic displacement in the centrifugal direction: ； LPIPS is used to calculate the perceptual difference between the trigger image and the original image, and penalties are only imposed on portions exceeding a preset perceptual difference threshold. ； Where ReLU is the rectified linear unit. For perceptual similarity threshold; With the common objectives of increasing the characteristic displacement in the centrifugal direction and limiting perceptual distortion exceeding the perceptual similarity threshold, a sample-by-sample trigger intensity objective function is constructed: ； in, The weighting factor for perceptual similarity loss in the sample-by-sample trigger strength objective.

6. The method according to claim 5, characterized in that, When the strength parameter takes values ​​within a continuous legal domain and the trigger injection process is differentiable with respect to the strength parameter, the projected gradient descent is used to determine the trigger strength, including the following process: First, the midpoint of the interval of a continuous legal domain is used as the initial intensity: ； Subsequently, in the t-th iteration, the candidate intensities are updated according to the gradient of the sample-by-sample intensity target with respect to the intensity parameters, and the updated results are projected back to the continuous legal domain: ； in, For learning rate, This indicates that the updated strength will be projected back into the legal domain A; The update process stops when the candidate strengths obtained in two consecutive iterations meet the following stopping condition: ； in Indicates the trigger strength iteration stop tolerance; If the stopping condition is not met, the process terminates when the maximum number of iterations is reached; the intensity that minimizes the per-sample intensity target is selected from all evaluated candidate intensities. As the training trigger strength; when multiple candidate strengths correspond to the same target value, the strength with the weaker trigger perturbation is selected.

7. The method according to claim 5, characterized in that, When the strength parameter is a discrete value, or when the trigger injection process involves rounding or quantization operations and is not differentiable, the strength of the training trigger is determined by fully enumerating the legal states and generating a poisoning sample set, including the following process: Use legal domains one by one All legal states in the dataset generate trigger images and calculate the sample-by-sample intensity target. The trigger strength for each poisoning candidate sample during the training phase is determined according to the following formula: ； When multiple legal states achieve the same minimum target value, the legal state that appears earlier in the order of trigger perturbations from weakest to strongest is selected; a single strength optimization only changes the strength parameter of one trigger, while keeping the trigger pattern, trigger position, and other trigger configurations unchanged; Poisoning candidate set Each sample in the dataset is injected with the corresponding training trigger strength, while preserving the original target class label. The poisoned sample set was obtained: ； The trigger strength parameters include one of the following: patch opacity, patch size, global blending rate, and color depth; the inference phase uses a test-phase trigger strength that is independently determined before the victim model is trained. .

Images