Reprogramming-based method and apparatus for defending against model backdoor, computer device, and medium

Abstract

The present application relates to a reprogramming-based method and apparatus for defending against a model backdoor, a computer device, and a medium. The method comprises: inputting abnormal data under test, pre-labeled with a label category, into a data preprocessing network in an abnormal data defense model to obtain basic feature data of the abnormal data under test; inputting the basic feature data into a data type identification network in the abnormal data defense model to obtain an initial type label corresponding to the abnormal data under test; and searching a label mapping table for a mapped type label under the initial type label corresponding to the abnormal data under test, and using the mapped type label as a target type label of the abnormal data under test. By using the method, the basic feature data can be identified by means of the data preprocessing network, preliminarily improving the accuracy of benign data detection, and label mapping is then performed by means of the label mapping table to identify the abnormal data under test as a correct type, thereby enhancing the defense accuracy of the abnormal data defense model.

Description

Methods, devices, computer equipment, and media for reprogramming defense against model backdoors

[0001] This application claims priority to Chinese patent application filed on October 14, 2024, with application number CN202411433313.6 and entitled "Method, Apparatus, Computer Equipment and Medium for Reprogramming Defense of Model Backdoors", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of artificial intelligence security technology, and in particular to a method, apparatus, computer device, and medium for reprogramming defense against model backdoors. Background Technology

[0003] With the development of AI security technology, a backdoor attack method has emerged. Backdoor attacks inject malicious data or modify model parameters during model training, lurking inside the model and causing the model to produce the attacker's expected output under specific triggering conditions. Such attacks are usually difficult to detect because the model can still perform the expected function under normal input.

[0004] To counter this threat, traditional technologies typically employ methods such as backdoor detection (using model behavior analysis or neuron activation patterns to identify suspicious triggers), model repair (removing potential triggering mechanisms or retraining the model), input filtering (preprocessing input data to remove potential triggers), and authentication techniques (such as model watermarking and fingerprinting) to prevent backdoor attacks.

[0005] While this method can detect and mitigate backdoor attacks, attackers may design backdoors in more sophisticated ways to circumvent existing defense mechanisms. Therefore, traditional defense technologies still suffer from inaccurate defense.

[0006] Summary of the Invention

[0007] Therefore, it is necessary to provide a method, device, computer equipment, and medium for reprogramming defense against model backdoors that can accurately defend against the above-mentioned technical problems.

[0008] Firstly, this application provides a reprogramming defense method for model backdoors, including:

[0009] The anomaly data to be tested, which is pre-labeled with tags and categories, is input into the data preprocessing network in the anomaly data defense model to obtain the basic feature data of the anomaly data to be tested.

[0010] The basic feature data is input into the data type recognition network in the anomaly data defense model to obtain the initial type label corresponding to the anomaly data to be tested.

[0011] The mapping type label under the initial type label corresponding to the abnormal data to be tested is found from the label mapping table, and the mapping type label is used as the target type label of the abnormal data to be tested; the abnormal data defense model defends against backdoor attacks through reprogramming.

[0012] In one embodiment, the anomaly data to be tested, pre-labeled with tag categories, is input into the data preprocessing network of the anomaly data defense model to obtain basic feature data of the anomaly data to be tested, including:

[0013] The abnormal data to be tested is input into the data preprocessing network in the abnormal data defense model to extract and identify abnormal feature data in the abnormal data to be tested.

[0014] The abnormal feature data is removed from the abnormal data to be tested to obtain the basic feature data of the abnormal data to be tested.

[0015] In one embodiment, the label mapping table is constructed in the following manner:

[0016] Input the initial sample data into the data classification model to obtain the confidence scores of each type of label to which the initial sample data belongs;

[0017] Construct a label mapping table based on the two type labels with the highest confidence scores;

[0018] The number of type labels is the same as the number of output interfaces of the data type recognition network; the dimensions of the type labels are the same as the dimensions corresponding to each output interface of the data type recognition network.

[0019] In one embodiment, a label mapping table is constructed based on the two type labels with the highest confidence scores, including:

[0020] Select the preset anomaly label with the highest confidence level from each type of label and use it as the initial type label;

[0021] Select the preset normal label with the highest confidence from all types of labels as the mapping type label;

[0022] Construct a label mapping table based on the initial type label and the mapping type label.

[0023] In one embodiment, the training method for the abnormal data defense model includes:

[0024] The initial sample data is input into the standard type recognition model to obtain the first sample label;

[0025] The initial sample data is input into the anomaly defense model to obtain intermediate sample data and second sample labels; the intermediate sample data is the data obtained by inputting the sample data into the data preprocessing network of the anomaly defense model.

[0026] The abnormal data defense model to be trained is trained based on the first sample label, the second sample label, and the intermediate sample data.

[0027] In one embodiment, the abnormal data defense model to be trained is trained based on the first sample label, the second sample label, and intermediate sample data, including:

[0028] Obtain the intermediate sample labels corresponding to the intermediate sample data;

[0029] Determine the first loss value based on the first sample label and the intermediate sample labels;

[0030] Determine the second loss value based on the first sample label and the second sample label;

[0031] Based on the first and second loss values, adjust the network parameters of the data preprocessing network in the abnormal data defense model.

[0032] Secondly, this application also provides a reprogramming defense device for model backdoors, comprising:

[0033] The feature determination module is used to input the anomaly data to be tested, which is pre-labeled with tags and categories, into the data preprocessing network in the anomaly data defense model to obtain the basic feature data of the anomaly data to be tested.

[0034] The type recognition module is used to input basic feature data into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested.

[0035] The type mapping module is used to find the mapped type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapped type label as the target type label of the abnormal data to be tested.

[0036] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0037] The anomaly data to be tested, which is pre-labeled with tags and categories, is input into the data preprocessing network in the anomaly data defense model to obtain the basic feature data of the anomaly data to be tested.

[0038] The basic feature data is input into the data type recognition network in the anomaly data defense model to obtain the initial type label corresponding to the anomaly data to be tested.

[0039] Find the mapping type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapping type label as the target type label of the abnormal data to be tested.

[0040] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0041] The anomaly data to be tested, which is pre-labeled with tags and categories, is input into the data preprocessing network in the anomaly data defense model to obtain the basic feature data of the anomaly data to be tested.

[0042] The basic feature data is input into the data type recognition network in the anomaly data defense model to obtain the initial type label corresponding to the anomaly data to be tested.

[0043] Find the mapping type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapping type label as the target type label of the abnormal data to be tested.

[0044] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0045] The anomaly data to be tested, which is pre-labeled with tags and categories, is input into the data preprocessing network in the anomaly data defense model to obtain the basic feature data of the anomaly data to be tested.

[0046] The basic feature data is input into the data type recognition network in the anomaly data defense model to obtain the initial type label corresponding to the anomaly data to be tested.

[0047] Find the mapping type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapping type label as the target type label of the abnormal data to be tested.

[0048] The aforementioned method, apparatus, computer equipment, and medium for reprogramming defense against backdoors in the model input pre-labeled anomalous data to the data preprocessing network in the anomalous data defense model to obtain basic feature data of the anomalous data; input the basic feature data to the data type identification network in the anomalous data defense model to obtain the initial type label corresponding to the anomalous data; find the mapped type label under the initial type label corresponding to the anomalous data from the label mapping table, and use the mapped type label as the target type label of the anomalous data. In this application, the anomalous data to be tested may contain triggers preset by the attacker. When the computer equipment identifies the anomalous data to be tested with triggers as the anomalous type preset by the attacker, the trigger is triggered, thereby attacking the computer equipment. This application, through the data preprocessing network in the anomalous data defense model, identifies the basic feature data in the anomalous data to be tested, initially improving the accuracy of detecting benign data in the anomalous data to be tested. Then, through the label mapping table, the identified initial type labels are mapped to identify the anomalous data to be tested as the correct type, not the anomalous type preset by the attacker, thus improving the defense accuracy of the anomalous data defense model. Attached Figure Description

[0049] Figure 1 shows the application environment of a model backdoor reprogramming defense method provided in this embodiment;

[0050] Figure 2 is a flowchart illustrating the first model backdoor reprogramming defense method provided in this embodiment;

[0051] Figure 3 is a schematic diagram of the inference of a reprogramming defense model for a model backdoor provided in this embodiment;

[0052] Figure 4 is a schematic diagram of a process for constructing a label mapping table provided in this embodiment;

[0053] Figure 5 is a flowchart illustrating a reprogramming defense model for a backdoor in a training model provided in this embodiment;

[0054] Figure 6 is an overview of the training process of a reprogramming defense model for a backdoor provided in this embodiment;

[0055] Figure 7 is a structural block diagram of a model backdoor reprogramming defense device provided in this embodiment;

[0056] Figure 8 is an internal structure diagram of a computer device provided in this embodiment. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0058] The reprogramming defense method for model backdoors provided in this application embodiment can be applied to the application environment shown in Figure 1. Terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated on server 104 or placed on a cloud or other network server. The computer device inputs the anomaly data to be tested, pre-labeled with tags, into the data preprocessing network in the anomaly data defense model to obtain the basic feature data of the anomaly data; it then inputs the basic feature data into the data type identification network in the anomaly data defense model to obtain the initial type label corresponding to the anomaly data; it then searches the tag mapping table to find the mapped type label under the initial type label corresponding to the anomaly data, and uses the mapped type label as the target type label of the anomaly data. The computer device can be either a terminal or a server. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0059] In an exemplary embodiment, as shown in FIG2, a reprogramming defense method for model backdoors is provided. Taking the application of this method to the computer device in FIG1 as an example, the method includes the following steps 201 to 203. Wherein:

[0060] Step 201: Input the anomaly data to be tested, which is pre-labeled with tags and categories, into the data preprocessing network in the anomaly data defense model to obtain the basic feature data of the anomaly data to be tested.

[0061] The label category can be the label category corresponding to the type of the anomaly data to be tested. The anomaly data can be data with triggers implanted by the attacker. The anomaly data to be tested can be data that may contain anomalies. The anomaly data defense model can be a backdoor defense framework based on model reprogramming (BD-MR). The basic feature data can be the anomaly data to be tested after removing anomaly features.

[0062] The data preprocessing network can be a network layer that preprocesses the abnormal data to be tested. The number of input channels and output channels of the data preprocessing network is the same, and the structure of the data preprocessing network can be similar to or the same as that of autoencoders, neural networks (UNet), diffusion models, etc.

[0063] One possible implementation is to input the anomaly data to be tested into the data preprocessing network in the anomaly data defense model; for each anomaly data to be tested, the data preprocessing network identifies whether there are triggers in the anomaly data to be tested; if there are triggers, the data preprocessing network removes the triggers in the anomaly data to be tested and uses the anomaly data to be tested after removing the triggers as basic feature data; if there are no triggers, the data preprocessing network identifies the anomaly data to be tested as benign data, adds a benign label to the benign data, and uses the benign data with the benign label as basic feature data.

[0064] Another possible implementation is to input the abnormal data to be tested into the data preprocessing network in the abnormal data defense model to extract and identify abnormal feature data in the abnormal data to be tested; and remove the abnormal feature data from the abnormal data to be tested to obtain the basic feature data of the abnormal data to be tested.

[0065] Specifically, the abnormal data to be tested is input into the data preprocessing network in the abnormal data defense model. The data preprocessing network extracts and identifies abnormal feature data in the abnormal data to be tested, deletes the abnormal feature data in the abnormal data to be tested, and uses the abnormal data to be tested after removing the abnormal feature data as the basic feature data.

[0066] Step 202: Input the basic feature data into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested.

[0067] The data type identification network can be a network layer set according to the backdoor defense model. The initial type label can be an initial label determined based on the anomaly data to be tested. This initial type label may be a type label corresponding to the anomaly type preset by the attacker.

[0068] Specifically, the basic feature data is input into the data type identification network in the anomaly data defense model. This data type identification network identifies the type label of the basic feature data to obtain the initial type label corresponding to the anomaly data to be tested.

[0069] Step 203: Find the mapping type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapping type label as the target type label of the abnormal data to be tested.

[0070] The label mapping table can be a table storing the mapping relationship between initial type labels and mapped type labels, and this mapping relationship can be pre-set. Mapped type labels can prevent triggers from being activated. The target type label can be the true type label of the anomaly data to be tested. For example, assuming the true type label of the anomaly data to be tested is "airplane," when the true type label of the anomaly data to be tested is changed to "truck," the initial type label of the anomaly data to be tested identified by the data type recognition network may still be "truck." After label mapping through the label mapping table, "truck" can be mapped to "airplane," meaning the obtained target type label is the true type label of the anomaly data to be tested.

[0071] Among them, the abnormal data defense model defends against backdoor attacks by reprogramming. The reprogramming method can be to add an input transformation module (i.e., data preprocessing network) and an output mapping module (i.e., label mapping table) to the original model (i.e., data type recognition network) to defend against backdoor attacks.

[0072] Optionally, in this embodiment, the initial type label can be used as the output of the anomaly data defense model. The computer device obtains the initial type label of the anomaly data to be tested, looks up the mapped type label under the initial type label from the label mapping table, and uses the mapped type label as the target type label of the anomaly data to be tested. Alternatively, in this embodiment, the initial type label can be used as the output of the data type identification network in the anomaly data defense model. The mapped type label under the initial type label corresponding to the anomaly data to be tested is looked up from the label mapping table in the anomaly data defense model, and the mapped type label is used as the target type label of the anomaly data to be tested.

[0073] For example, Figure 3 illustrates the inference diagram of the anomalous data defense model. In the figure, benign samples are sample data without triggers, attacked samples are sample data with triggers implanted within benign samples, the BD-MR framework is the anomalous data defense model, the data preprocessing module is the data preprocessing network within the anomalous data defense model, the backdoor model is the data type identification network within the anomalous data defense model, and the label mapping relationship is the label mapping table within the anomalous data defense model. If only benign samples are input into the backdoor model, the predicted label is "truck," meaning the true type label of the benign sample is "truck." If only attacked samples (which could be samples attacked by the backdoor) are input into the backdoor model, the target label is "airplane," meaning that if the type label of the attacked sample is identified as "airplane," the trigger will be activated. However, when the attacked sample is input into the BD-MR framework, the predicted label is "truck." Therefore, it can be seen that the BD-MR framework can accurately identify the true type label of the attacked sample, rather than the type label preset by the attacker.

[0074] It should be noted that, for basic feature data carrying benign labels, this embodiment can directly use the initial type label corresponding to the basic feature data carrying benign labels as the target type label, without the need for further mapping processing through a label mapping table.

[0075] The reprogramming defense method for backdoors described above involves inputting pre-labeled anomaly data to the data preprocessing network of the anomaly data defense model to obtain basic feature data of the anomaly data; inputting the basic feature data to the data type identification network of the anomaly data defense model to obtain the initial type label corresponding to the anomaly data; finding the mapped type label under the initial type label corresponding to the anomaly data from the label mapping table, and using the mapped type label as the target type label of the anomaly data. The anomaly data in this application may contain triggers preset by attackers. When a computer device identifies the anomaly data with triggers as the anomaly type preset by the attacker, the trigger is triggered, thus attacking the computer device. This application, through the data preprocessing network in the anomaly data defense model, identifies the basic feature data in the anomaly data, initially improving the accuracy of detecting benign data in the anomaly data. Then, through the label mapping table, the identified initial type labels are mapped to identify the anomaly data as the correct type, not the anomaly type preset by the attacker, improving the defense accuracy of the anomaly data defense model. Furthermore, it effectively reduces the success rate of backdoor attacks without considering the specific triggering mode of the backdoor.

[0076] In an exemplary embodiment, as shown in FIG4, a flowchart for constructing a tag mapping table is provided. Taking the application of this method to the computer device in FIG1 as an example, the method includes the following steps 401 to 402. The tag mapping table is constructed in the following manner:

[0077] Step 401: Input the initial sample data into the data classification model to obtain the confidence scores of each type label to which the initial sample data belongs.

[0078] The initial sample data can be sample data used to train the anomaly defense model. Optionally, the initial sample data can be unlabeled initial sample data that does not contain triggers. The data classification model can be a model used to classify the initial sample data. The number of type labels is the same as the number of output interfaces of the data type recognition network; the dimension of the type labels is the same as the dimension corresponding to each output interface of the data type recognition network.

[0079] Specifically, obtain the initial sample data; input the initial sample data into the data classification model; and for each output interface of the data classification model, determine the confidence level of the type label corresponding to that output interface.

[0080] Step 402: Construct a label mapping table based on the two type labels with the highest confidence scores.

[0081] One possible implementation is to obtain the two type labels with the highest confidence ranking, randomly set the mapping relationship between the two type labels, and construct a label mapping table based on the set mapping relationship.

[0082] Another possible implementation is to select the preset abnormal label with the highest confidence from each type of label as the initial type label; select the preset normal label with the highest confidence from each type of label as the mapping type label; and construct a label mapping table based on the initial type label and the mapping type label.

[0083] Specifically, the preset abnormal label with the highest confidence level is selected from each type of label as the initial type label; the preset normal label with the highest confidence level is selected from each type of label as the mapping type label; the initial type label and the mapping type label are associated to form a mapping relationship, and all mapping relationships are stored in the label mapping table.

[0084] For example, taking the CIFAR-10 dataset as the initial sample data, the data type recognition network outputs a 10-channel confidence score, with each channel representing the classification score for each category. Typically, the 10 channels represent the categories: airplane, car, bird, cat, deer, dog, frog, horse, boat, and truck. After setting the label mapping, the categories represented by the 10 channels might become as follows (representing only one scenario): birds, horse, dog, car, cat, airplane, truck, boat, frog, deer. The label mapping in the above example is:

[0085] In this embodiment, the initial sample data is input into the data classification model to obtain the confidence scores of each type of label to which the initial sample data belongs. Based on the two type labels with the highest confidence scores, a label mapping table is constructed. This embodiment can construct a label mapping table more accurately by using the confidence scores of each type of label.

[0086] In an exemplary embodiment, as shown in FIG5, a flowchart for training an anomaly data defense model is provided. Taking the application of this method to the computer device in FIG1 as an example, the method includes the following steps 501 to 503. Wherein:

[0087] Step 501: Input the initial sample data into the standard type recognition model to obtain the first sample label.

[0088] The standard type identification model can have the same network structure as the data preprocessing network in the anomaly data defense model. The standard type identification model can be used to identify the true type label of the initial sample data.

[0089] Specifically, the initial sample data is input into the standard type recognition model, which then identifies the type label of the initial sample data to obtain the first sample label.

[0090] Step 502: Input the initial sample data into the abnormal data defense model to obtain the intermediate sample data and the second sample label.

[0091] Among them, intermediate sample data is the data obtained by inputting sample data into the data preprocessing network in the abnormal data defense model.

[0092] Specifically, the initial sample data is input into the anomaly data defense model, where the data preprocessing network preprocesses the initial sample data to obtain intermediate sample data. The sample data is then input into the data type identification network in the anomaly data defense model to obtain the sample type label corresponding to the anomaly data to be tested. The mapping type label of the sample type label is found from the label mapping table, and the mapping type label is used as the second type label of the initial sample data.

[0093] It should be noted that before inputting the initial sample data into the anomaly data defense model, the initial sample data must first be normalized according to the input interface of the anomaly data defense model.

[0094] Step 503: Train the abnormal data defense model to be trained based on the first sample label, the second sample label, and the intermediate sample data.

[0095] One possible implementation is to determine the target loss value based on the first sample label, the second sample label, and the intermediate sample data using the following formula (1-1), and then train the abnormal data defense model to be trained based on this loss value.

[0096] Where x represents the initial sample data, y represents the label of the first sample, and F δ Represents anomaly data defense model, Pre δ This represents the data preprocessing network in the abnormal data defense model, where CE represents cross-entropy loss and SC represents supervised comparison loss.

[0097] Another possible implementation is to obtain the intermediate sample labels corresponding to the intermediate sample data; determine the first loss value based on the first sample label and the intermediate sample label; determine the second loss value based on the first sample label and the second sample label; and adjust the network parameters of the data preprocessing network in the anomaly data defense model based on the first loss value and the second loss value. Here, the first loss value can be a supervised comparison loss value, and the second loss value can be a cross-entropy loss value.

[0098] Specifically, the intermediate sample labels corresponding to the intermediate sample data are obtained; the supervised comparison loss value between the first sample label and the intermediate sample label is determined as the first loss value; the cross-entropy loss value between the first sample label and the second sample label is determined as the second loss value; the target loss value is determined based on the sum of the first loss value and the second loss value; and the network parameters of the data preprocessing network in the abnormal data defense model are adjusted based on the target loss value.

[0099] It should be noted that in this embodiment, the parameter weights of the data preprocessing network in the abnormal data defense model are randomly initialized. Stochastic gradient descent is used as the optimization strategy, with a learning rate of 0.01. By default, the training process is capped at 200 iterations, and the learning rate is adjusted downwards by a factor of 0.1 on the 100th and 150th iterations, respectively.

[0100] For example, Figure 6 is an overview of the training process of the anomaly defense model. In the figure, the unlabeled samples represent the initial sample data, the data preprocessing module is the data preprocessing network in the anomaly defense model, the backdoor model is the data type identification network in the anomaly defense model, and the label mapping relationship is the label mapping table in the anomaly defense model. Based on the intermediate samples and predicted labels, the supervised contrastive loss is determined; based on the confidence score and predicted labels, the cross-entropy loss is determined; and based on the supervised contrastive loss and the cross-entropy loss, the network parameters of the data preprocessing module are adjusted through backpropagation.

[0101] This embodiment inputs initial sample data into a standard type recognition model to obtain the first sample label, and then inputs the initial sample data into an anomaly defense model to obtain intermediate sample data and the second sample label. Based on the first sample label, the second sample label, and the intermediate sample data, the anomaly defense model to be trained is then trained. This embodiment can complete the training of the anomaly defense model (especially the data preprocessing network in the anomaly defense model) using only unlabeled initial sample data, and effectively eliminates trigger patterns. At the same time, while effectively reducing the success rate of backdoor attacks, it also ensures that the benign accuracy of the anomaly defense model remains at a high level, which is superior to traditional methods.

[0102] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0103] Based on the same inventive concept, this application also provides a model backdoor reprogramming defense device for implementing the above-mentioned model backdoor reprogramming defense method. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations of one or more model backdoor reprogramming defense device embodiments provided below can be found in the limitations of the model backdoor reprogramming defense method above, and will not be repeated here.

[0104] In an exemplary embodiment, as shown in FIG7, a reprogramming defense device for model backdoors is provided, comprising: a feature determination module 10, a type recognition module 11, and a type mapping module 12, wherein:

[0105] The feature determination module 10 is used to input the anomaly data to be tested, which is pre-labeled with tags and categories, into the data preprocessing network in the anomaly data defense model to obtain the basic feature data of the anomaly data to be tested.

[0106] Type recognition module 11 is used to input basic feature data into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested;

[0107] The type mapping module 12 is used to find the mapping type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapping type label as the target type label of the abnormal data to be tested.

[0108] In some embodiments, the feature determination module 10 in FIG7 is further configured to input the abnormal data to be tested into the data preprocessing network in the abnormal data defense model to extract and identify abnormal feature data in the abnormal data to be tested; and remove the abnormal feature data from the abnormal data to be tested to obtain the basic feature data of the abnormal data to be tested.

[0109] In some embodiments, the reprogramming defense device for the model backdoor in FIG7 further includes:

[0110] The mapping construction module is used to input the initial sample data into the data classification model to obtain the confidence scores of each type label of the initial sample data; and to construct a label mapping table based on the two type labels with the highest confidence scores; wherein the number of type labels is the same as the number of output interfaces of the data type recognition network; and the dimension of the type labels is the same as the dimension corresponding to each output interface of the data type recognition network.

[0111] In some embodiments, the mapping construction module in Figure 7 is further configured to select the preset abnormal label with the highest confidence from each type of label as the initial type label; select the preset normal label with the highest confidence from each type of label as the mapping type label; and construct a label mapping table based on the initial type label and the mapping type label.

[0112] In some embodiments, the reprogramming defense device for the model backdoor in FIG7 further includes:

[0113] The model training module is used to input initial sample data into the standard type recognition model to obtain the first sample label; input initial sample data into the anomaly data defense model to obtain intermediate sample data and the second sample label; the intermediate sample data is the data obtained by inputting sample data into the data preprocessing network in the anomaly data defense model; and train the anomaly data defense model to be trained based on the first sample label, the second sample label, and the intermediate sample data.

[0114] In some embodiments, the model training module in Figure 7 is further configured to obtain intermediate sample labels corresponding to intermediate sample data; determine a first loss value based on the first sample label and the intermediate sample label; determine a second loss value based on the first sample label and the second sample label; and adjust the network parameters of the data preprocessing network in the abnormal data defense model based on the first loss value and the second loss value.

[0115] The modules in the reprogramming defense device for the aforementioned backdoor can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0116] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram is shown in Figure 8. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes non-volatile storage media and internal memory. The non-volatile storage media stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The database of the computer device is used to store data. The I / O interfaces of the computer device are used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a reprogramming defense method for a model backdoor.

[0117] Those skilled in the art will understand that the structure shown in Figure 8 is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or may combine certain components, or may have different component arrangements.

[0118] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0119] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0120] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0121] It should be noted that the data involved in this application (including but not limited to data used for analysis, data stored, data displayed, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0122] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0123] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0124] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A reprogramming defense method for model backdoors, characterized in that, The method includes: The anomaly data to be tested, which is pre-labeled with tags and categories, is input into the data preprocessing network in the anomaly data defense model to obtain the basic feature data of the anomaly data to be tested. The basic feature data is input into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested. The mapping type label under the initial type label corresponding to the abnormal data to be tested is found from the label mapping table, and the mapping type label is used as the target type label of the abnormal data to be tested; the abnormal data defense model defends against backdoor attacks by reprogramming.

2. The method according to claim 1, characterized in that, The process involves inputting the pre-labeled anomaly data to be tested into the data preprocessing network of the anomaly data defense model to obtain the basic feature data of the anomaly data to be tested, including: The abnormal data to be tested is input into the data preprocessing network in the abnormal data defense model to extract and identify abnormal feature data in the abnormal data to be tested. The abnormal feature data is removed from the abnormal data to be tested to obtain the basic feature data of the abnormal data to be tested.

3. The method according to claim 1, characterized in that, The label mapping table is constructed in the following way: Input the initial sample data into the data classification model to obtain the confidence scores of each type of label to which the initial sample data belongs; Construct a label mapping table based on the two type labels with the highest confidence scores; The number of type labels is the same as the number of output interfaces of the data type recognition network; the dimension of the type labels is the same as the dimension corresponding to each output interface of the data type recognition network.

4. The method according to claim 3, characterized in that, The step of constructing a label mapping table based on the two type labels ranked highest in confidence includes: Select the preset anomaly label with the highest confidence level from all the aforementioned type labels as the initial type label; Select the preset normal label with the highest confidence from each of the aforementioned type labels as the mapping type label; The label mapping table is constructed based on the initial type label and the mapping type label.

5. The method according to claim 1, characterized in that, Training methods for anomaly data defense models include: The initial sample data is input into the standard type recognition model to obtain the first sample label; The initial sample data is input into the anomaly data defense model to obtain intermediate sample data and second sample labels; the intermediate sample data is the data obtained by inputting the sample data into the data preprocessing network of the anomaly data defense model. The abnormal data defense model to be trained is trained based on the first sample label, the second sample label, and the intermediate sample data.

6. The method according to claim 5, characterized in that, The step of training the anomaly defense model to be trained based on the first sample label, the second sample label, and the intermediate sample data includes: Obtain the intermediate sample labels corresponding to the intermediate sample data; A first loss value is determined based on the first sample label and the intermediate sample label; Determine the second loss value based on the first sample label and the second sample label; Based on the first and second loss values, adjust the network parameters of the data preprocessing network in the abnormal data defense model.

7. A reprogramming defense device for a model backdoor, characterized in that, The device includes: The feature determination module is used to input the anomaly data to be tested, which is pre-labeled with tags and categories, into the data preprocessing network in the anomaly data defense model to obtain the basic feature data of the anomaly data to be tested. The type recognition module is used to input the basic feature data into the data type recognition network in the abnormal data defense model to obtain the initial type label corresponding to the abnormal data to be tested. The type mapping module is used to find the mapped type label under the initial type label corresponding to the abnormal data to be tested from the label mapping table, and use the mapped type label as the target type label of the abnormal data to be tested.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images