Self-ensemble learning-based backdoor attack defense method and system

Abstract

The present invention provides a self-ensemble learning-based backdoor attack defense method and system. The self-ensemble learning-based backdoor attack defense method comprises: calling a deep learning DNN model, and storing weightings of the DNN model during a training process so as to obtain a plurality of historical weightings; screening out target weightings from amongst the plurality of historical weightings, and using the target weightings to construct a plurality of sub-classifiers; in an inference stage, using the sub-classifiers to acquire prediction results corresponding to a test data set of backdoor attacks, and classifying the input data on the basis of the prediction results so as to obtain classification results; and, on the basis of the classification results, determining the attack identification accuracy of the sub-classifiers for the test data set of backdoor attacks, and, on the basis of the attack identification accuracy, determining whether the sub-classifiers need to be optimized and adjusted. The system comprises modules corresponding to the method steps.

Description

A backdoor attack defense method and system based on self-ensemble learning Technical Field

[0001] The present invention proposes a backdoor attack defense method and system based on self-ensemble learning, belonging to the technical field of backdoor attack defense. Background Art

[0002] The powerful learning capabilities of DNNs (Deep Neural Networks) also bring security risks, such as susceptibility to backdoor attacks. In such attacks, attackers embed hidden layers (also known as backdoors) in DNN models and activate these backdoor functions through carefully designed inputs (called triggers).

[0003] Existing backdoor attack defense methods include dataset cleaning, anomaly detection, model auditing, model regularization, model retraining, and input preprocessing. Due to the complexity and unpredictability of deep learning neural networks, backdoors in deep learning models are difficult to detect. When an attacker attacks a model with inputs containing triggers, the model misclassifies the inputs, and the classification model classifies the trigger-containing model as the attacker's target label, allowing the attacker to succeed. Existing methods have been bypassed by attackers due to their limitations. Summary of the Invention

[0004] The present invention provides a backdoor attack defense method and system based on self-ensemble learning to solve the above-mentioned technical problems in the prior art. The technical solutions adopted are as follows:

[0005] An embodiment of the present invention provides a backdoor attack defense method based on self-ensemble learning, the backdoor attack defense method based on self-ensemble learning comprising:

[0006] Retrieving a deep learning DNN model and storing the weights of the DNN model during training to obtain multiple historical weights;

[0007] Filtering a target weight from the multiple historical weights, and constructing multiple sub-classifiers using the target weight;

[0008] In the inference phase, the sub-classifier is used to obtain the prediction results corresponding to the test data set of the backdoor attack, and the input data is classified according to the prediction results to obtain the classification results;

[0009] The attack recognition accuracy of the sub-classifier for the backdoor attack test data set is determined according to the classification result, and whether the sub-classifier needs to be optimized and adjusted is determined according to the attack recognition accuracy.

[0010] Furthermore, a deep learning DNN model is retrieved, and the weights of the DNN model during the training process are stored to obtain multiple historical weights, including:

[0011] Retrieve the deep learning DNN model and initialize the DNN model to obtain the initialized DNN model;

[0012] The initialized DNN model is trained using a training data set, and during the DNN model training process, the weights of the DNN model are periodically saved; wherein the weights of the DNN model include the weights at the end of each training cycle and the weights saved every preset number of iteration steps, and the preset number of iteration steps ranges from 100 to 500 steps.

[0013] Furthermore, a target weight is selected from the plurality of historical weights, and a plurality of sub-classifiers are constructed using the target weight, including:

[0014] The weight value constraint condition is obtained using the multiple historical weights, wherein the upper limit value and the lower limit value corresponding to the weight value constraint condition are obtained by the following formula:

[0015] Among them, w up and w down They represent the upper and lower limits of the weight numerical constraints respectively; n represents the total number of historical weights; w i represents the weight value of the i-th historical weight; w p represents the average value of historical weights; p represents the compensation coefficient, and the compensation coefficient p is obtained by the following formula:

[0016] Among them, m represents the number of historical weight values ​​that are lower than the average value; w min Indicates the lowest value of the historical weight value; w j Indicates the jth historical weight value among the historical weights that are lower than the average value;

[0017] Comparing the weight values ​​corresponding to the multiple historical weights with the weight value constraint condition in sequence, obtaining the historical weights that satisfy the weight value constraint condition, and using the historical weights that satisfy the weight value constraint condition as the target weight;

[0018] A plurality of sub-classifiers are constructed using the target weights, and the plurality of sub-classifiers are trained to obtain a plurality of trained sub-classifiers.

[0019] Furthermore, in the inference phase, the sub-classifier is used to obtain the prediction results corresponding to the test data set of the backdoor attack, and the input data is classified according to the prediction results to obtain the classification results, including:

[0020] During the inference process, a test data set containing a backdoor attack is passed as input data to each of the sub-classifiers, and a prediction result corresponding to the input data is obtained through the sub-classifiers;

[0021] A voting mechanism is used to obtain a voting result corresponding to the prediction result according to the prediction result of each sub-classifier;

[0022] Aggregation processing is performed on the classification results to form a classification result.

[0023] Furthermore, the attack recognition accuracy of the sub-classifier for the backdoor attack test data set is determined based on the classification result, and whether the sub-classifier needs to be optimized and adjusted based on the attack recognition accuracy, including:

[0024] After the sub-classifier completes classification of all test data in the test data set, obtaining a recognition accuracy rate corresponding to the classification result;

[0025] Determining whether the recognition accuracy reaches or exceeds a preset accuracy threshold;

[0026] When the recognition accuracy reaches or exceeds a preset accuracy threshold, it is determined that the sub-classifier training is completed;

[0027] When the recognition accuracy rate does not reach the preset accuracy rate threshold, the weight value constraint condition is adjusted to obtain an adjusted weight value constraint condition; wherein the upper limit value and the lower limit value of the adjusted weight value constraint condition are obtained by the following formula:

[0028] Among them, w upt and w downt They represent the upper and lower limits of the weight value constraints after adjustment; P0 represents the accuracy threshold; P represents the recognition accuracy of the sub-classifier; k represents the number of sub-classifiers successfully trained; w ki Indicates the weight value corresponding to the i-th successfully trained sub-classifier; w upi and w downi Indicates the upper and lower weight limits corresponding to the i-th successfully trained sub-classifier;

[0029] The weight values ​​are re-screened according to the adjusted weight value constraint condition to obtain a new target weight value, and the sub-classifier is trained using the new target weight value.

[0030] An embodiment of the present invention provides a backdoor attack defense system based on self-ensemble learning, the backdoor attack defense system based on self-ensemble learning comprising:

[0031] A historical weight acquisition module is used to call a deep learning DNN model and store the weights of the DNN model during training to obtain multiple historical weights;

[0032] a sub-classifier construction module, configured to select a target weight from the plurality of historical weights and construct a plurality of sub-classifiers using the target weight;

[0033] An input data classification module is used to obtain prediction results corresponding to the backdoor attack test data set using a sub-classifier during the inference phase, and classify the input data according to the prediction results to obtain classification results;

[0034] The optimization and adjustment judgment module is used to judge the attack recognition accuracy of the sub-classifier for the backdoor attack test data set according to the classification result, and to judge whether the sub-classifier needs to be optimized and adjusted according to the attack recognition accuracy.

[0035] Furthermore, the historical weight acquisition module includes:

[0036] The DNN model retrieval module is used to retrieve the deep learning DNN model and initialize the DNN model to obtain the initialized DNN model;

[0037] A model training module is used to train the initialized DNN model using a training data set and periodically save the weights of the DNN model during the DNN model training process; wherein the weights of the DNN model include the weights at the end of each training cycle and the weights saved every preset number of iteration steps, and the preset number of iteration steps ranges from 100 to 500 steps.

[0038] Furthermore, the sub-classifier construction module includes:

[0039] The weight value constraint condition acquisition module is used to obtain the weight value constraint condition using the multiple historical weights, wherein the upper limit value and the lower limit value corresponding to the weight value constraint condition are obtained by the following formula:

[0040] Among them, w up and w down They represent the upper and lower limits of the weight numerical constraints respectively; n represents the total number of historical weights; w i represents the weight value of the i-th historical weight; w p represents the average value of historical weights; p represents the compensation coefficient, and the compensation coefficient p is obtained by the following formula:

[0041] Among them, m represents the number of historical weight values ​​that are lower than the average value; w min Indicates the lowest value of the historical weight value; w j Indicates the jth historical weight value among the historical weights that are lower than the average value;

[0042] A historical weight acquisition module is used to compare the weight values ​​corresponding to the multiple historical weights with the weight value constraint conditions in sequence, obtain the historical weights that meet the weight value constraint conditions, and use the historical weights that meet the weight value constraint conditions as the target weight;

[0043] The sub-classifier construction execution module is used to construct multiple sub-classifiers using the target weights, and train the multiple sub-classifiers to obtain multiple trained sub-classifiers.

[0044] Furthermore, the input data classification module includes:

[0045] The prediction execution module is used to pass the test data set containing the backdoor attack as input data to each of the sub-classifiers during the inference process, and obtain the prediction result corresponding to the input data through the sub-classifier;

[0046] A voting result acquisition module is used to acquire the voting result corresponding to the prediction result using a voting mechanism according to the prediction result of each sub-classifier;

[0047] The classification execution module is used to aggregate the classification results to form classification results.

[0048] Furthermore, the optimization and adjustment judgment module includes:

[0049] A recognition accuracy acquisition module, configured to acquire the recognition accuracy corresponding to the classification result after the sub-classifier completes classification of all test data in the test data set;

[0050] An accuracy determination module, configured to determine whether the recognition accuracy reaches or exceeds a preset accuracy threshold;

[0051] A sub-classifier training completion determination module is configured to determine that the sub-classifier training is completed when the recognition accuracy reaches or exceeds a preset accuracy threshold;

[0052] The weight value constraint condition adjustment module is used to adjust the weight value constraint condition when the recognition accuracy rate does not reach the preset accuracy rate threshold, and obtain the adjusted weight value constraint condition; wherein the upper limit and lower limit of the adjusted weight value constraint condition are obtained by the following formula:

[0053] Among them, wupt and w downt They represent the upper and lower limits of the weight value constraints after adjustment; P0 represents the accuracy threshold; P represents the recognition accuracy of the sub-classifier; k represents the number of sub-classifiers successfully trained; w ki Indicates the weight value corresponding to the i-th successfully trained sub-classifier; w upi and w downi Indicates the upper and lower weight limits corresponding to the i-th successfully trained sub-classifier;

[0054] The target weight value acquisition module is used to re-screen the weight values ​​according to the adjusted weight value constraint conditions, obtain a new target weight value, and use the new target weight value to train the sub-classifier.

[0055] The beneficial effects of the embodiments of the present invention include:

[0056] This invention proposes a backdoor attack defense method and system based on self-ensemble learning. A classifier contains multiple sub-classifiers. Each sub-classifier is aggregated using historical weights, and each sub-classifier uses a different aggregation method, ensuring sub-classifier diversity. During inference, the multiple sub-classifiers vote on the inference results, and the voting results are aggregated into the final result.

[0057] Self-ensembling records the historical weights of a model during training. Upon completion, appropriate historical versions are selected from these weights to aggregate the final model. This paper proposes a method and system for backdoor attack defense based on self-ensembling learning. This approach, for the first time, proposes a method for improving robustness against backdoor attacks using self-ensembling learning. Our method achieves sub-classifier diversity through model self-ensembling using different aggregation algorithms. Because different aggregation algorithms lead to differences in the ability of the final sub-classifiers to extract input features and learn data, this diversity improves the overall robustness of the classifier, thereby mitigating potential backdoor attack threats to the model. Using self-ensembling learning, multiple sub-classifiers are used to jointly classify input data, improving defense against backdoor attacks. Even if some sub-classifiers are affected by an attack, others can still provide accurate predictions. This technical solution allows for the selection of sub-classifiers with different historical weights as needed, providing high flexibility. Furthermore, by optimizing and adjusting the sub-classifiers, they can be better adapted to different backdoor attack methods and datasets. By storing and utilizing multiple historical weights, this technical solution can fully utilize information from the DNN model during training, thereby improving the model's robustness and stability. By evaluating the attack recognition accuracy of the subclassifiers and optimizing and adjusting them accordingly, model performance can be further improved, mitigating the impact of backdoor attacks on model predictions. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] FIG1 is a flowchart corresponding to the backdoor attack defense method based on self-ensemble learning according to the present invention;

[0059] FIG2 is a system block diagram corresponding to the backdoor attack defense system based on self-ensemble learning described in the present invention. DETAILED DESCRIPTION

[0060] The following describes a specific implementation of a backdoor attack defense method and system based on self-ensemble learning provided by an embodiment of the present invention in conjunction with the accompanying drawings.

[0061] The embodiment of the present invention proposes a backdoor attack defense method based on self-ensemble learning. As shown in FIG1 , the backdoor attack defense method based on self-ensemble learning includes:

[0062] S1. Retrieve a deep learning DNN model and store the weights of the DNN model during training to obtain multiple historical weights;

[0063] S2. Filtering target weights from the multiple historical weights, and constructing multiple sub-classifiers using the target weights;

[0064] S3. In the inference phase, the sub-classifier is used to obtain the prediction results corresponding to the test data set of the backdoor attack, and the input data is classified according to the prediction results to obtain the classification results;

[0065] S4. Determine the attack recognition accuracy of the sub-classifier for the backdoor attack test data set based on the classification result, and determine whether the sub-classifier needs to be optimized and adjusted based on the attack recognition accuracy.

[0066] The working principle of the above technical solution is: Retrieve and store DNN model weights (S1):

[0067] First, call a DNN (deep neural network) model from deep learning.

[0068] During the training process of the DNN model, its weights are continuously stored, so that multiple historical weights can be obtained. These historical weights represent the state of the model at different training stages.

[0069] Construct sub-classifier (S2):

[0070] The target weight is selected from the stored historical weights. The target weight can be selected based on some strategies, such as selecting weights with better model performance and stronger generalization ability.

[0071] Multiple sub-classifiers are constructed using these target weights. Each sub-classifier is based on a specific historical weight state of the DNN model.

[0072] Reasoning and Classification (S3):

[0073] In the inference phase, when input data (especially test datasets that may contain backdoor attacks) enter the system, the constructed sub-classifiers are used to make predictions.

[0074] Each sub-classifier will give a prediction result, and then the system will classify the input data according to these prediction results, and finally get a classification result.

[0075] Evaluation and Optimization (S4):

[0076] Based on the classification results, the system can determine the attack recognition accuracy of the sub-classifier for the test data set of backdoor attacks.

[0077] If the attack recognition accuracy does not meet the preset threshold, the system will determine whether the sub-classifier needs to be optimized and adjusted based on this accuracy. Optimization and adjustment may include reselecting target weights, adjusting the sub-classifier structure or parameters, etc.

[0078] The effect of the above technical solution is that, through the self-ensemble learning method, multiple sub-classifiers are used to jointly classify input data, thereby improving the defense capability against backdoor attacks. Even if some sub-classifiers are affected by the attack, other sub-classifiers can still provide correct prediction results. The above technical solution can select sub-classifiers with different historical weights as needed, which is highly flexible. At the same time, by optimizing and adjusting the sub-classifiers, they can be better adapted to different backdoor attack methods and data sets. By storing and utilizing multiple historical weights, the above technical solution can fully utilize the information of the DNN model during the training process, thereby improving the robustness and stability of the model. By evaluating the attack recognition accuracy of the sub-classifiers and optimizing and adjusting them accordingly, the performance of the model can be further improved, and the impact of backdoor attacks on the model's prediction results can be reduced.

[0079] In summary, this technical solution uses a self-ensemble learning method to jointly defend against backdoor attacks using multiple sub-classifiers, thereby improving the model's defense capabilities, flexibility, and robustness, and helping to improve the security and reliability of deep learning models in practical applications.

[0080] In one embodiment of the present invention, a deep learning DNN model is retrieved and the weights of the DNN model during training are stored to obtain multiple historical weights, including:

[0081] S101, calling a deep learning DNN model and initializing the DNN model to obtain an initialized DNN model;

[0082] S102. Train the initialized DNN model using a training data set, and periodically save the weights of the DNN model during the DNN model training process; wherein the weights of the DNN model include the weights at the end of each training cycle (epoch) and the weights saved every preset number of iteration steps, and the preset number of iteration steps ranges from 100 to 500 steps.

[0083] The weight setting process of the DNN model includes:

[0084] Each weight is assigned a small random value. This method breaks symmetry, but if the random value is too large, it can lead to exploding gradients. The range of values ​​for random initialization is typically selected based on the activation function and network architecture. Then, during model training, the weights are updated based on the gradient of the loss function. This update process is typically implemented using the backpropagation algorithm. The backpropagation algorithm calculates the gradient of the loss function with respect to each weight and adjusts the weight value based on the learning rate. The learning rate is a hyperparameter that determines the step size of the weight update. Excessively large learning rates can cause model instability during training, while excessively small learning rates can slow training. During training, the DNN model's weights are periodically saved. These weights include the weights at the end of each training epoch and the weights saved every preset number of iterations. This allows the model's state to be restored at any time during training for further adjustments or optimization. It also helps monitor changes in model performance during training, allowing for timely identification and resolution of issues.

[0085] The working principle of the above technical solution is: Model initialization (S101):

[0086] First, call a DNN (deep neural network) model from a deep learning framework or library.

[0087] Initialize the DNN model, which usually includes setting the model's initial weights, biases, and other parameters. The initialized DNN model is the starting point of the training process.

[0088] Model training and weight storage (S102):

[0089] The initialized DNN model is trained using the training dataset. During the training process, the model continuously optimizes its weights through the backpropagation algorithm to minimize the error between the predicted value and the true value.

[0090] During training, the DNN model weights are periodically saved. This strategy includes saving the model weights at the end of each training cycle (epoch) and every preset number of iterations (e.g., 100-500 steps). This allows us to capture the different states of the model during training, providing rich historical weight data for subsequent self-ensemble learning.

[0091] The effect of the above technical solution is that by regularly saving the weights of the DNN model, a rich set of historical weight data can be obtained. This data reflects the different states of the model during the training process and provides an important data foundation for subsequent self-ensemble learning. Using multiple historical weights to construct sub-classifiers for self-ensemble learning can leverage information from the model at different training stages, thereby improving the model's generalization ability. This helps reduce overfitting and improves the model's performance on unknown data. Saving model weights at a preset number of iterations can more accurately capture changes in the model during training. This allows for the selection of sub-classifiers in different states as needed in subsequent self-ensemble learning, improving the flexibility and adaptability of the method. By regularly saving weights during training, the model's training progress and performance changes can be monitored. This helps to promptly identify problems during training, such as overfitting and underfitting, thereby optimizing the training strategy and improving model performance.

[0092] In summary, this technical solution, by periodically saving the weights of the DNN model during training, obtains rich historical weight data, providing important data support for subsequent self-ensemble learning. This helps improve the model's generalization, flexibility, and adaptability, optimizes the training process, and enhances the performance of deep learning models in practical applications.

[0093] In one embodiment of the present invention, a target weight is selected from the plurality of historical weights, and a plurality of sub-classifiers are constructed using the target weights, including:

[0094] S201. Obtain weight value constraints using the multiple historical weights, wherein the upper limit and lower limit corresponding to the weight value constraints are obtained by the following formula:

[0095] Among them, w up and w down They represent the upper and lower limits of the weight numerical constraints respectively; n represents the total number of historical weights; w i represents the weight value of the i-th historical weight; w p represents the average value of historical weights; p represents the compensation coefficient, and the compensation coefficient p is obtained by the following formula:

[0096] Among them, m represents the number of historical weight values ​​that are lower than the average value; w min Indicates the lowest value of the historical weight value; w j Indicates the jth historical weight value among the historical weights that are lower than the average value;

[0097] S202: Compare the weight values ​​corresponding to the multiple historical weights with the weight value constraint condition in sequence, obtain the historical weights that satisfy the weight value constraint condition, and use the historical weights that satisfy the weight value constraint condition as the target weight;

[0098] S203: Construct a plurality of sub-classifiers using the target weights, and train the plurality of sub-classifiers to obtain a plurality of trained sub-classifiers.

[0099] Filter out appropriate historical versions from the saved historical weights. The screening strategy can be determined based on factors such as the performance of the model on the validation set and the similarity between weights. Use the filtered historical weights to build multiple sub-classifiers. Each sub-classifier can be obtained by aggregating the weights of different historical versions. There are many aggregation methods, such as directly averaging weights, using learning rate weighted averaging, or using more complex aggregation strategies such as model distillation. By adopting different aggregation methods and different historical weight combinations, diversity between sub-classifiers is ensured. Diversity is key to defending against backdoor attacks because it makes it difficult for attackers to influence the behavior of all sub-classifiers at the same time.

[0100] The working principle of the above technical solution is: Obtain weight value constraint conditions (S201):

[0101] First, based on the numerical information of all historical weights, the upper and lower limits of the weight numerical constraints are calculated.

[0102] The calculation of the upper and lower limits is based on the average value of the historical weights (wp) and a compensation factor (p). The compensation factor (p) takes into account the number of weights below the average value (m) and the lowest value of these weights (wmin).

[0103] The above formula can ensure that the weight value constraint conditions take into account both the overall distribution of historical weights and the extreme cases of weight values, thereby more comprehensively defining the effective range of weights.

[0104] Filter target weight (S202):

[0105] The weight value of each historical weight is compared with the weight value constraint condition obtained in step S201.

[0106] If the weight value of a historical weight is between the upper and lower limits of the constraint, then the historical weight is deemed to satisfy the constraint and is selected as the target weight.

[0107] Constructing a subclassifier (S203):

[0108] The selected target weights are used to construct multiple sub-classifiers. Each sub-classifier is based on a specific historical weight state of the DNN model.

[0109] These sub-classifiers are trained to optimize their performance so that they can accurately classify the input data during the inference phase.

[0110] The effect of the above technical solution is: by screening historical weights that meet the weight numerical constraints as target weights, it is possible to ensure that the constructed sub-classifiers have better performance. These target weights represent the effective state of the model during the training process and help improve the classification accuracy of the sub-classifiers. Since multiple sub-classifiers are used for self-ensemble learning, even if some sub-classifiers are affected by specific attacks or noise, other sub-classifiers can still give correct prediction results. This enhances the robustness and stability of the entire model. By defining weight numerical constraints, historical weights that are useful for constructing sub-classifiers can be more accurately screened, avoiding the waste of computing resources that may be caused by using all historical weights. The above technical solution can dynamically adjust the weight numerical constraints according to the distribution of historical weights, so that the screened target weights can adapt to different data sets and attack scenarios. The above technical solution increases flexibility and adaptability.

[0111] In summary, this technical solution improves the performance of the sub-classifiers and the robustness of the model by screening historical weights that meet the weight numerical constraints as target weights and using these target weights to construct multiple sub-classifiers, while optimizing resource utilization and enhancing the flexibility and adaptability of the method.

[0112] In one embodiment of the present invention, during the inference phase, a subclassifier is used to obtain prediction results corresponding to a test data set for a backdoor attack, and input data is classified according to the prediction results to obtain classification results, including:

[0113] S301: During the inference process, a test data set containing a backdoor attack is passed as input data to each of the sub-classifiers, and a prediction result corresponding to the input data is obtained through the sub-classifiers;

[0114] S302: using a voting mechanism based on the prediction results of each sub-classifier to obtain a voting result corresponding to the prediction result;

[0115] S303: Aggregate the classification results to form a classification result.

[0116] The above technical solution works as follows: During the inference phase, input data is passed to each sub-classifier, and their predictions are obtained. Based on the sub-classifiers' predictions, a suitable voting mechanism is used to determine the final result. This voting mechanism can be simple majority voting or weighted voting, where the weights are determined based on the sub-classifiers' performance on the validation set. Finally, the voting results are aggregated to obtain the final classification result. If there is a clear majority in the voting results, the majority result can be directly selected as the final output. If there is controversy or uncertainty, other strategies such as outputting a probability distribution or confidence level can be considered.

[0117] The working principle of the above technical solution is: Subclassifier prediction (S301):

[0118] During inference, the test dataset containing the backdoor attack is first passed as input data to each sub-classifier.

[0119] Each sub-classifier processes the input data according to its own weights and structure and outputs a corresponding prediction result. These prediction results are usually the judgment of each sub-classifier on the category to which the input data belongs.

[0120] Voting mechanism (S302):

[0121] In order to obtain more accurate prediction results, a voting mechanism is used to summarize the prediction results of each sub-classifier.

[0122] The specific voting process can be as follows: count the number of times each category appears in the sub-classifier prediction results, and then select the category with the most occurrences as the voting result. If the number of occurrences is the same, other factors (such as the performance and weight of the sub-classifiers) can be further considered to determine the final voting result.

[0123] Classification result aggregation (S303):

[0124] After obtaining the voting results, they are aggregated to form the final classification results.

[0125] Aggregation processing can be a simple summary of voting results, or it can be combined with other strategies (such as weighted average, maximum probability, etc.) to obtain more accurate classification results.

[0126] The above technical solution achieves the following: by utilizing multiple sub-classifiers to make predictions and aggregating the results through a voting mechanism, it can reduce the potential for false positives from a single sub-classifier, thereby improving the classification accuracy of the backdoor attack test dataset. Through self-ensemble learning, even if some sub-classifiers are affected by a backdoor attack, the other sub-classifiers can still provide correct predictions, thereby enhancing the robustness and attack resistance of the entire model. Through the voting mechanism and aggregation processing, it is possible to more accurately determine whether input data contains backdoor attacks, thereby reducing the false positive rate and unnecessary intervention and losses. The above technical solution can add or remove sub-classifiers as needed, and adjust the voting mechanism and aggregation processing strategy to adapt to different application scenarios and datasets, providing good flexibility and scalability.

[0127] In summary, this technical solution improves the classification accuracy of the backdoor attack test dataset and the robustness of the model by utilizing multiple sub-classifiers for prediction, voting, and aggregation processing, reduces the false alarm rate, and has good flexibility and scalability.

[0128] In one embodiment of the present invention, the attack recognition accuracy of a sub-classifier for a backdoor attack test data set is determined based on the classification results, and whether the sub-classifier needs to be optimized and adjusted based on the attack recognition accuracy, including:

[0129] S401, after the sub-classifier completes classification of all test data in the test data set, obtaining the recognition accuracy corresponding to the classification result;

[0130] S402: Determine whether the recognition accuracy reaches or exceeds a preset accuracy threshold;

[0131] S403: When the recognition accuracy reaches or exceeds a preset accuracy threshold, it is determined that the sub-classifier training is completed;

[0132] S404: When the recognition accuracy rate does not reach a preset accuracy rate threshold, the weight value constraint condition is adjusted to obtain an adjusted weight value constraint condition; wherein the upper limit and lower limit of the adjusted weight value constraint condition are obtained by the following formula:

[0133] Among them, w upt and w downt They represent the upper and lower limits of the weight value constraints after adjustment; P0 represents the accuracy threshold; P represents the recognition accuracy of the sub-classifier; k represents the number of sub-classifiers successfully trained; w ki Indicates the weight value corresponding to the i-th successfully trained sub-classifier; w upi and w downiIndicates the upper and lower weight limits corresponding to the i-th successfully trained sub-classifier;

[0134] S405 , re-screening the weight values ​​according to the adjusted weight value constraint condition, obtaining a new target weight value, and training the sub-classifier using the new target weight value.

[0135] The working principle of the above technical solution is: obtaining recognition accuracy (S401):

[0136] After the subclassifier completes classification of all test data in the test dataset, the classification results of the subclassifier are obtained and the corresponding recognition accuracy is calculated. Recognition accuracy is usually calculated by comparing the prediction results of the subclassifier with the true labels of the test data and then counting the proportion of correct predictions.

[0137] Accuracy threshold determination (S402-S403):

[0138] The calculated recognition accuracy is compared with the preset accuracy threshold. The preset accuracy threshold is set according to actual needs and application scenarios to determine whether the performance of the sub-classifier meets the requirements.

[0139] If the recognition accuracy reaches or exceeds the preset accuracy threshold, the performance of the sub-classifier is considered to meet the requirements and the sub-classifier training is determined to be completed.

[0140] Adjust weight value constraint (S404):

[0141] If the recognition accuracy does not reach the preset accuracy threshold, it means that the performance of the sub-classifier is poor and needs to be optimized and adjusted.

[0142] In this case, the weight constraints are adjusted. The adjustment strategy takes into account multiple factors, including the accuracy threshold, the current recognition accuracy of the sub-classifier, the number of successfully trained sub-classifiers and their corresponding weight values, and the upper and lower weight limits.

[0143] By comprehensively considering this information, the upper and lower limits of the adjusted weight numerical constraints are calculated.

[0144] Re-screening and training (S405):

[0145] Based on the adjusted weight numerical constraints, the target weight is re-screened from the historical weights.

[0146] The sub-classifier is trained using the new target weights in the hope of improving the performance of the sub-classifier and increasing its attack recognition accuracy for the backdoor attack test dataset.

[0147] The above technical solution achieves the following: By adjusting the weight constraints based on recognition accuracy and re-screening and training the sub-classifiers, the sub-classifiers' ability to identify backdoor attacks can be effectively improved, optimizing model performance. This technical solution can adapt to different application scenarios and datasets by setting different accuracy thresholds based on actual needs and application scenarios. By dynamically adjusting the weight constraints, target weights that contribute to improved sub-classifier performance can be more accurately selected, reducing ineffective training processes and improving training efficiency. By optimizing and adjusting the sub-classifiers, they can be more resistant to backdoor attacks, enhancing the robustness and security of the entire model.

[0148] In summary, this technical solution improves the model's ability to identify backdoor attacks, training efficiency, and robustness by optimizing and adjusting the sub-classifiers based on recognition accuracy, making it more adaptable to different application scenarios and data sets.

[0149] The embodiment of the present invention proposes a backdoor attack defense system based on self-ensemble learning, as shown in FIG2 . The backdoor attack defense system based on self-ensemble learning includes:

[0150] A historical weight acquisition module is used to call a deep learning DNN model and store the weights of the DNN model during training to obtain multiple historical weights;

[0151] a sub-classifier construction module, configured to select a target weight from the plurality of historical weights and construct a plurality of sub-classifiers using the target weight;

[0152] An input data classification module is used to obtain prediction results corresponding to the backdoor attack test data set using a sub-classifier during the inference phase, and classify the input data according to the prediction results to obtain classification results;

[0153] The optimization and adjustment judgment module is used to judge the attack recognition accuracy of the sub-classifier for the backdoor attack test data set according to the classification result, and to judge whether the sub-classifier needs to be optimized and adjusted according to the attack recognition accuracy.

[0154] The working principle of the above technical solution is: first, a DNN (deep neural network) model is retrieved from deep learning.

[0155] During the training process of the DNN model, its weights are continuously stored, so that multiple historical weights can be obtained. These historical weights represent the state of the model at different training stages.

[0156] The target weight is selected from the stored historical weights. The target weight can be selected based on some strategies, such as selecting weights with better model performance and stronger generalization ability.

[0157] Multiple sub-classifiers are constructed using these target weights. Each sub-classifier is based on a specific historical weight state of the DNN model.

[0158] In the inference phase, when input data (especially test datasets that may contain backdoor attacks) enter the system, the constructed sub-classifiers are used to make predictions.

[0159] Each sub-classifier will give a prediction result, and then the system will classify the input data according to these prediction results, and finally get a classification result.

[0160] Based on the classification results, the system can determine the attack recognition accuracy of the sub-classifier for the test data set of backdoor attacks.

[0161] If the attack recognition accuracy does not meet the preset threshold, the system will determine whether the sub-classifier needs to be optimized and adjusted based on this accuracy. Optimization and adjustment may include reselecting target weights, adjusting the sub-classifier structure or parameters, etc.

[0162] The effect of the above technical solution is that, through the self-ensemble learning method, multiple sub-classifiers are used to jointly classify input data, thereby improving the defense capability against backdoor attacks. Even if some sub-classifiers are affected by the attack, other sub-classifiers can still provide correct prediction results. The above technical solution can select sub-classifiers with different historical weights as needed, which is highly flexible. At the same time, by optimizing and adjusting the sub-classifiers, they can be better adapted to different backdoor attack methods and data sets. By storing and utilizing multiple historical weights, the above technical solution can fully utilize the information of the DNN model during the training process, thereby improving the robustness and stability of the model. By evaluating the attack recognition accuracy of the sub-classifiers and optimizing and adjusting them accordingly, the performance of the model can be further improved, and the impact of backdoor attacks on the model's prediction results can be reduced.

[0163] In summary, this technical solution uses a self-ensemble learning method to jointly defend against backdoor attacks using multiple sub-classifiers, thereby improving the model's defense capabilities, flexibility, and robustness, and helping to improve the security and reliability of deep learning models in practical applications.

[0164] In one embodiment of the present invention, the historical weight acquisition module includes:

[0165] The DNN model retrieval module is used to retrieve the deep learning DNN model and initialize the DNN model to obtain the initialized DNN model;

[0166] A model training module is used to train the initialized DNN model using a training data set and periodically save the weights of the DNN model during the DNN model training process; wherein the weights of the DNN model include the weights at the end of each training cycle (epoch) and the weights saved every preset number of iteration steps, and the preset number of iteration steps ranges from 100 to 500 steps.

[0167] The working principle of the above technical solution is: first, a DNN (deep neural network) model is retrieved from a deep learning framework or library.

[0168] Initialize the DNN model, which usually includes setting the model's initial weights, biases, and other parameters. The initialized DNN model is the starting point of the training process.

[0169] The initialized DNN model is trained using the training dataset. During the training process, the model continuously optimizes its weights through the backpropagation algorithm to minimize the error between the predicted value and the true value.

[0170] During training, the DNN model weights are periodically saved. This strategy includes saving the model weights at the end of each training cycle (epoch) and every preset number of iterations (e.g., 100-500 steps). This allows us to capture the different states of the model during training, providing rich historical weight data for subsequent self-ensemble learning.

[0171] The effect of the above technical solution is that by regularly saving the weights of the DNN model, a rich set of historical weight data can be obtained. This data reflects the different states of the model during the training process and provides an important data foundation for subsequent self-ensemble learning. Using multiple historical weights to construct sub-classifiers for self-ensemble learning can leverage information from the model at different training stages, thereby improving the model's generalization ability. This helps reduce overfitting and improves the model's performance on unknown data. Saving model weights at a preset number of iterations can more accurately capture changes in the model during training. This allows for the selection of sub-classifiers in different states as needed in subsequent self-ensemble learning, improving the flexibility and adaptability of the method. By regularly saving weights during training, the model's training progress and performance changes can be monitored. This helps to promptly identify problems during training, such as overfitting and underfitting, thereby optimizing the training strategy and improving model performance.

[0172] In summary, this technical solution, by periodically saving the weights of the DNN model during training, obtains rich historical weight data, providing important data support for subsequent self-ensemble learning. This helps improve the model's generalization, flexibility, and adaptability, optimizes the training process, and enhances the performance of deep learning models in practical applications.

[0173] In one embodiment of the present invention, the sub-classifier building module includes:

[0174] The weight value constraint condition acquisition module is used to obtain the weight value constraint condition using the multiple historical weights, wherein the upper limit value and the lower limit value corresponding to the weight value constraint condition are obtained by the following formula:

[0175] Among them, w up and w down They represent the upper and lower limits of the weight numerical constraints respectively; n represents the total number of historical weights; w i represents the weight value of the i-th historical weight; w p represents the average value of historical weights; p represents the compensation coefficient, and the compensation coefficient p is obtained by the following formula:

[0176] Among them, m represents the number of historical weight values ​​that are lower than the average value; w min Indicates the lowest value of the historical weight value; w j Indicates the jth historical weight value among the historical weights that are lower than the average value;

[0177] A historical weight acquisition module is used to compare the weight values ​​corresponding to the multiple historical weights with the weight value constraint conditions in sequence, obtain the historical weights that meet the weight value constraint conditions, and use the historical weights that meet the weight value constraint conditions as the target weight;

[0178] The sub-classifier construction execution module is used to construct multiple sub-classifiers using the target weights, and train the multiple sub-classifiers to obtain multiple trained sub-classifiers.

[0179] Filter out appropriate historical versions from the saved historical weights. The screening strategy can be determined based on factors such as the performance of the model on the validation set and the similarity between weights. Use the filtered historical weights to build multiple sub-classifiers. Each sub-classifier can be obtained by aggregating the weights of different historical versions. There are many aggregation methods, such as directly averaging weights, using learning rate weighted averaging, or using more complex aggregation strategies such as model distillation. By adopting different aggregation methods and different historical weight combinations, diversity between sub-classifiers is ensured. Diversity is key to defending against backdoor attacks because it makes it difficult for attackers to influence the behavior of all sub-classifiers at the same time.

[0180] The working principle of the above technical solution is: first, based on the numerical information of all historical weights, the upper limit and lower limit of the weight numerical constraint conditions are calculated.

[0181] The calculation of the upper and lower limits is based on the average value of the historical weights (wp) and a compensation factor (p). The compensation factor (p) takes into account the number of weights below the average value (m) and the lowest value of these weights (wmin).

[0182] The above formula can ensure that the weight value constraint conditions take into account both the overall distribution of historical weights and the extreme cases of weight values, thereby more comprehensively defining the effective range of weights.

[0183] The weight value of each historical weight is compared with the weight value constraint condition obtained in step S201.

[0184] If the weight value of a historical weight is between the upper and lower limits of the constraint, then the historical weight is deemed to satisfy the constraint and is selected as the target weight.

[0185] The selected target weights are used to construct multiple sub-classifiers. Each sub-classifier is based on a specific historical weight state of the DNN model.

[0186] These sub-classifiers are trained to optimize their performance so that they can accurately classify the input data during the inference phase.

[0187] The effect of the above technical solution is: by screening historical weights that meet the weight numerical constraints as target weights, it is possible to ensure that the constructed sub-classifiers have better performance. These target weights represent the effective state of the model during the training process and help improve the classification accuracy of the sub-classifiers. Since multiple sub-classifiers are used for self-ensemble learning, even if some sub-classifiers are affected by specific attacks or noise, other sub-classifiers can still give correct prediction results. This enhances the robustness and stability of the entire model. By defining weight numerical constraints, historical weights that are useful for constructing sub-classifiers can be more accurately screened, avoiding the waste of computing resources that may be caused by using all historical weights. The above technical solution can dynamically adjust the weight numerical constraints according to the distribution of historical weights, so that the screened target weights can adapt to different data sets and attack scenarios. The above technical solution increases flexibility and adaptability.

[0188] In summary, this technical solution improves the performance of the sub-classifiers and the robustness of the model by screening historical weights that meet the weight numerical constraints as target weights and using these target weights to construct multiple sub-classifiers, while optimizing resource utilization and enhancing the flexibility and adaptability of the method.

[0189] In one embodiment of the present invention, the input data classification module includes:

[0190] The prediction execution module is used to pass the test data set containing the backdoor attack as input data to each of the sub-classifiers during the inference process, and obtain the prediction result corresponding to the input data through the sub-classifier;

[0191] A voting result acquisition module is used to acquire the voting result corresponding to the prediction result using a voting mechanism according to the prediction result of each sub-classifier;

[0192] The classification execution module is used to aggregate the classification results to form classification results.

[0193] The above technical solution works as follows: During the inference phase, input data is passed to each sub-classifier, and their predictions are obtained. Based on the sub-classifiers' predictions, a suitable voting mechanism is used to determine the final result. This voting mechanism can be simple majority voting or weighted voting, where the weights are determined based on the sub-classifiers' performance on the validation set. Finally, the voting results are aggregated to obtain the final classification result. If there is a clear majority in the voting results, the majority result can be directly selected as the final output. If there is controversy or uncertainty, other strategies such as outputting a probability distribution or confidence level can be considered.

[0194] The above technical solution works as follows: During the inference phase, input data is passed to each sub-classifier, and their predictions are obtained. Based on the sub-classifiers' predictions, a suitable voting mechanism is used to determine the final result. This voting mechanism can be simple majority voting or weighted voting, where the weights are determined based on the sub-classifiers' performance on the validation set. Finally, the voting results are aggregated to obtain the final classification result. If there is a clear majority in the voting results, the majority result can be directly selected as the final output. If there is controversy or uncertainty, other strategies such as outputting a probability distribution or confidence level can be considered.

[0195] The working principle of the above technical solution is: during the inference process, the test dataset containing the backdoor attack is first passed as input data to each sub-classifier.

[0196] Each sub-classifier processes the input data according to its own weights and structure and outputs a corresponding prediction result. These prediction results are usually the judgment of each sub-classifier on the category to which the input data belongs.

[0197] In order to obtain more accurate prediction results, a voting mechanism is used to summarize the prediction results of each sub-classifier.

[0198] The specific voting process can be as follows: count the number of times each category appears in the sub-classifier prediction results, and then select the category with the most occurrences as the voting result. If the number of occurrences is the same, other factors (such as the performance and weight of the sub-classifiers) can be further considered to determine the final voting result.

[0199] After obtaining the voting results, they are aggregated to form the final classification results.

[0200] Aggregation processing can be a simple summary of voting results, or it can be combined with other strategies (such as weighted average, maximum probability, etc.) to obtain more accurate classification results.

[0201] The above technical solution achieves the following: by utilizing multiple sub-classifiers to make predictions and aggregating the results through a voting mechanism, it can reduce the potential for false positives from a single sub-classifier, thereby improving the classification accuracy of the backdoor attack test dataset. Through self-ensemble learning, even if some sub-classifiers are affected by a backdoor attack, the other sub-classifiers can still provide correct predictions, thereby enhancing the robustness and attack resistance of the entire model. Through the voting mechanism and aggregation processing, it is possible to more accurately determine whether input data contains backdoor attacks, thereby reducing the false positive rate and unnecessary intervention and losses. The above technical solution can add or remove sub-classifiers as needed, and adjust the voting mechanism and aggregation processing strategy to adapt to different application scenarios and datasets, providing good flexibility and scalability.

[0202] In summary, this technical solution improves the classification accuracy of the backdoor attack test dataset and the robustness of the model by utilizing multiple sub-classifiers for prediction, voting, and aggregation processing, reduces the false alarm rate, and has good flexibility and scalability.

[0203] In one embodiment of the present invention, the optimization and adjustment judgment module includes:

[0204] A recognition accuracy acquisition module, configured to acquire the recognition accuracy corresponding to the classification result after the sub-classifier completes classification of all test data in the test data set;

[0205] An accuracy determination module, configured to determine whether the recognition accuracy reaches or exceeds a preset accuracy threshold;

[0206] A sub-classifier training completion determination module is configured to determine that the sub-classifier training is completed when the recognition accuracy reaches or exceeds a preset accuracy threshold;

[0207] The weight value constraint condition adjustment module is used to adjust the weight value constraint condition when the recognition accuracy rate does not reach the preset accuracy rate threshold, and obtain the adjusted weight value constraint condition; wherein the upper limit and lower limit of the adjusted weight value constraint condition are obtained by the following formula:

[0208] Among them, w upt and w downt They represent the upper and lower limits of the weight value constraints after adjustment; P0 represents the accuracy threshold; P represents the recognition accuracy of the sub-classifier; k represents the number of sub-classifiers successfully trained; w ki Indicates the weight value corresponding to the i-th successfully trained sub-classifier; w upi and w downi Indicates the upper and lower weight limits corresponding to the i-th successfully trained sub-classifier;

[0209] The target weight value acquisition module is used to re-screen the weight values ​​according to the adjusted weight value constraint conditions, obtain a new target weight value, and use the new target weight value to train the sub-classifier.

[0210] The working principle of this technical solution is as follows: After the sub-classifier completes classification of all test data in the test dataset, the classification results of the sub-classifier are obtained and the corresponding recognition accuracy is calculated. The recognition accuracy is usually calculated by comparing the prediction results of the sub-classifier with the actual labels of the test data and then calculating the proportion of correct predictions.

[0211] The calculated recognition accuracy is compared with the preset accuracy threshold. The preset accuracy threshold is set according to actual needs and application scenarios to determine whether the performance of the sub-classifier meets the requirements.

[0212] If the recognition accuracy reaches or exceeds the preset accuracy threshold, the performance of the sub-classifier is considered to meet the requirements and the sub-classifier training is determined to be completed.

[0213] If the recognition accuracy does not reach the preset accuracy threshold, it means that the performance of the sub-classifier is poor and needs to be optimized and adjusted.

[0214] In this case, the weight constraints are adjusted. The adjustment strategy takes into account multiple factors, including the accuracy threshold, the current recognition accuracy of the sub-classifier, the number of successfully trained sub-classifiers and their corresponding weight values, and the upper and lower weight limits.

[0215] By comprehensively considering this information, the upper and lower limits of the adjusted weight numerical constraints are calculated.

[0216] Based on the adjusted weight numerical constraints, the target weight is re-screened from the historical weights.

[0217] The sub-classifier is trained using the new target weights in the hope of improving the performance of the sub-classifier and increasing its attack recognition accuracy for the backdoor attack test dataset.

[0218] The above technical solution achieves the following: By adjusting the weight constraints based on recognition accuracy and re-screening and training the sub-classifiers, the sub-classifiers' ability to identify backdoor attacks can be effectively improved, optimizing model performance. This technical solution can adapt to different application scenarios and datasets by setting different accuracy thresholds based on actual needs and application scenarios. By dynamically adjusting the weight constraints, target weights that contribute to improved sub-classifier performance can be more accurately selected, reducing ineffective training processes and improving training efficiency. By optimizing and adjusting the sub-classifiers, they can be more resistant to backdoor attacks, enhancing the robustness and security of the entire model.

[0219] In summary, this technical solution improves the model's ability to identify backdoor attacks, training efficiency, and robustness by optimizing and adjusting the sub-classifiers based on recognition accuracy, making it more adaptable to different application scenarios and data sets.

[0220] Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if such changes and modifications of the embodiments of the present invention fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A backdoor attack defense method based on self-ensemble learning, characterized in that: The backdoor attack defense method based on self-ensemble learning includes: Retrieving a deep learning DNN model and storing the weights of the DNN model during training to obtain multiple historical weights; Filtering a target weight from the multiple historical weights, and constructing multiple sub-classifiers using the target weight; In the inference phase, the sub-classifier is used to obtain the prediction results corresponding to the test data set of the backdoor attack, and the input data is classified according to the prediction results to obtain the classification results; The attack recognition accuracy of the sub-classifier for the backdoor attack test data set is determined according to the classification result, and whether the sub-classifier needs to be optimized and adjusted is determined according to the attack recognition accuracy.

2. The backdoor attack defense method based on self-ensemble learning according to claim 1 is characterized in that: Retrieve a deep learning DNN model and store the weights of the DNN model during training to obtain multiple historical weights, including: Retrieve the deep learning DNN model and initialize the DNN model to obtain the initialized DNN model; The initialized DNN model is trained using a training data set, and during the DNN model training process, the weights of the DNN model are periodically saved; wherein the weights of the DNN model include the weights at the end of each training cycle and the weights saved every preset number of iteration steps, and the preset number of iteration steps ranges from 100 to 500 steps.

3. The backdoor attack defense method based on self-ensemble learning according to claim 1 is characterized in that: Filtering a target weight from the multiple historical weights and constructing multiple sub-classifiers using the target weights, including: The weight value constraint condition is obtained using the multiple historical weights, wherein the upper limit value and the lower limit value corresponding to the weight value constraint condition are obtained by the following formula: Among them, w up and w down They represent the upper and lower limits of the weight numerical constraints respectively; n represents the total number of historical weights; w i represents the weight value of the i-th historical weight; w p represents the average value of historical weights; p represents the compensation coefficient, and the compensation coefficient p is obtained by the following formula: Among them, m represents the number of historical weight values ​​that are lower than the average value; w min Indicates the lowest value of the historical weight value; w j Indicates the jth historical weight value among the historical weights that are lower than the average value; Comparing the weight values ​​corresponding to the multiple historical weights with the weight value constraint condition in sequence, obtaining the historical weights that satisfy the weight value constraint condition, and using the historical weights that satisfy the weight value constraint condition as the target weight; A plurality of sub-classifiers are constructed using the target weights, and the plurality of sub-classifiers are trained to obtain a plurality of trained sub-classifiers.

4. The backdoor attack defense method based on self-ensemble learning according to claim 1 is characterized in that: In the inference phase, the subclassifier is used to obtain the prediction results corresponding to the backdoor attack test data set, and the input data is classified according to the prediction results to obtain the classification results, including: During the inference process, a test data set containing a backdoor attack is passed as input data to each of the sub-classifiers, and a prediction result corresponding to the input data is obtained through the sub-classifiers; A voting mechanism is used to obtain a voting result corresponding to the prediction result according to the prediction result of each sub-classifier; Aggregation processing is performed on the classification results to form a classification result.

5. The backdoor attack defense method based on self-ensemble learning according to claim 1 is characterized in that: Determine the attack recognition accuracy of the sub-classifier for the backdoor attack test data set based on the classification results, and determine whether the sub-classifier needs to be optimized and adjusted based on the attack recognition accuracy, including: After the sub-classifier completes classification of all test data in the test data set, obtaining a recognition accuracy rate corresponding to the classification result; Determining whether the recognition accuracy reaches or exceeds a preset accuracy threshold; When the recognition accuracy reaches or exceeds a preset accuracy threshold, it is determined that the sub-classifier training is completed; When the recognition accuracy rate does not reach the preset accuracy rate threshold, the weight value constraint condition is adjusted to obtain an adjusted weight value constraint condition; wherein the upper limit value and the lower limit value of the adjusted weight value constraint condition are obtained by the following formula: Among them, w upt and w downt They represent the upper and lower limits of the weight value constraints after adjustment; P0 represents the accuracy threshold; P represents the recognition accuracy of the sub-classifier; k represents the number of sub-classifiers successfully trained; w ki Indicates the weight value corresponding to the i-th successfully trained sub-classifier; w upi and w downi Indicates the upper and lower weight limits corresponding to the i-th successfully trained sub-classifier; The weight values ​​are re-screened according to the adjusted weight value constraint condition to obtain a new target weight value, and the sub-classifier is trained using the new target weight value.

6. A backdoor attack defense system based on self-ensemble learning, characterized in that: The backdoor attack defense system based on self-ensemble learning includes: A historical weight acquisition module is used to call a deep learning DNN model and store the weights of the DNN model during training to obtain multiple historical weights; a sub-classifier construction module, configured to select a target weight from the plurality of historical weights and construct a plurality of sub-classifiers using the target weight; An input data classification module is used to obtain prediction results corresponding to the backdoor attack test data set using a sub-classifier during the inference phase, and classify the input data according to the prediction results to obtain classification results; The optimization and adjustment judgment module is used to judge the attack recognition accuracy of the sub-classifier for the backdoor attack test data set according to the classification result, and to judge whether the sub-classifier needs to be optimized and adjusted according to the attack recognition accuracy.

7. The backdoor attack defense system based on self-ensemble learning according to claim 6 is characterized in that: The historical weight acquisition module includes: The DNN model retrieval module is used to retrieve the deep learning DNN model and initialize the DNN model to obtain the initialized DNN model; A model training module is used to train the initialized DNN model using a training data set and periodically save the weights of the DNN model during the DNN model training process; wherein the weights of the DNN model include the weights at the end of each training cycle and the weights saved every preset number of iteration steps, and the preset number of iteration steps ranges from 100 to 500 steps.

8. The backdoor attack defense system based on self-ensemble learning according to claim 6 is characterized in that: The sub-classifier building block includes: The weight value constraint condition acquisition module is used to obtain the weight value constraint condition using the multiple historical weights, wherein the upper limit value and the lower limit value corresponding to the weight value constraint condition are obtained by the following formula: Among them, w up and w down They represent the upper and lower limits of the weight numerical constraints respectively; n represents the total number of historical weights; w i represents the weight value of the i-th historical weight; w p represents the average value of historical weights; p represents the compensation coefficient, and the compensation coefficient p is obtained by the following formula: Among them, m represents the number of historical weight values ​​that are lower than the average value; w min Indicates the lowest value of the historical weight value; w j Indicates the jth historical weight value among the historical weights that are lower than the average value; A historical weight acquisition module is used to compare the weight values ​​corresponding to the multiple historical weights with the weight value constraint conditions in sequence, obtain the historical weights that meet the weight value constraint conditions, and use the historical weights that meet the weight value constraint conditions as the target weight; The sub-classifier construction execution module is used to construct multiple sub-classifiers using the target weights, and train the multiple sub-classifiers to obtain multiple trained sub-classifiers.

9. The backdoor attack defense system based on self-ensemble learning according to claim 6 is characterized in that: The input data classification module includes: The prediction execution module is used to pass the test data set containing the backdoor attack as input data to each of the sub-classifiers during the inference process, and obtain the prediction result corresponding to the input data through the sub-classifier; A voting result acquisition module is used to acquire the voting result corresponding to the prediction result using a voting mechanism according to the prediction result of each sub-classifier; The classification execution module is used to aggregate the classification results to form classification results.

10. The backdoor attack defense system based on self-ensemble learning according to claim 6, characterized in that: The optimization and adjustment judgment module includes: A recognition accuracy acquisition module, configured to acquire the recognition accuracy corresponding to the classification result after the sub-classifier completes classification of all test data in the test data set; An accuracy determination module, configured to determine whether the recognition accuracy reaches or exceeds a preset accuracy threshold; A sub-classifier training completion determination module is configured to determine that the sub-classifier training is completed when the recognition accuracy reaches or exceeds a preset accuracy threshold; The weight value constraint condition adjustment module is used to adjust the weight value constraint condition when the recognition accuracy rate does not reach the preset accuracy rate threshold, and obtain the adjusted weight value constraint condition; wherein the upper limit and lower limit of the adjusted weight value constraint condition are obtained by the following formula: Among them, w upt and w downt They represent the upper and lower limits of the weight value constraints after adjustment; P0 represents the accuracy threshold; P represents the recognition accuracy of the sub-classifier; k represents the number of sub-classifiers successfully trained; w ki Indicates the weight value corresponding to the i-th successfully trained sub-classifier; w upi and w downi Indicates the upper and lower weight limits corresponding to the i-th successfully trained sub-classifier; The target weight value acquisition module is used to re-screen the weight values ​​according to the adjusted weight value constraint conditions, obtain a new target weight value, and use the new target weight value to train the sub-classifier.

Images