CN114638356A - Static weight guided deep neural network back door detection method and system - Google Patents

Abstract

The invention discloses a method and a system for detecting a backdoor of a deep neural network guided by static weight.A pre-trained neural network model is subjected to static weight analysis to obtain a suspicious target label and a victim label of backdoor attack, and a target-victim label pair is formed; then, performing reverse engineering by using the obtained target-damaged label pair, and recovering a back door trigger; and finally, analyzing the shape attribute of the reverse trigger and the distribution of the activated neurons to filter false alarms and obtain a final detection result. The method exerts the advantages of small calculation overhead of static weight analysis, no influence of the quality of an input sample and no influence of the type of a trigger, and effectively improves the efficiency, the precision and the expandability of the neural network back door detection.

Description

A deep neural network backdoor detection method and system guided by static weights

technical field

The invention belongs to the field of artificial intelligence and network security, and relates to a deep neural network backdoor detection method, in particular to a deep neural network backdoor detection method guided by static weights.

Background technique

In recent years, deep neural networks have achieved good performance in many fields, such as computer vision, malware detection, autonomous driving, etc. Since building and deploying a well-performing neural network model requires a lot of expert knowledge and computational overhead, users generally choose to outsource cloud computing or download pre-trained models.

However, existing research has demonstrated that neural networks are vulnerable to backdoor attacks, which leads to the possible serious security risks of pre-trained models obtained from third parties. In a backdoor attack, the attacker defines a backdoor trigger and specifies the target tag and victim tag of the attack. Victim tags may be all tags except the target tag, or a few tags specific to the attacker. Attackers add triggers to data from victim labels during training and mark them as target labels to implant a backdoor into the model. When the user uses it, the model with the backdoor can still correctly classify the clean input, but once the input of the victim label contains the trigger defined by the attacker, it will be assigned to the backdoor attack target label specified by the attacker.

The defense against neural network backdoor attacks has always been a research hotspot. Given a pretrained model, the defender needs to determine whether the model contains malicious backdoors. Defenders typically do not have access to the training set and trigger patterns used by attackers, and only have a small subset of clean samples to validate model functionality. The main difficulty of backdoor detection lies in identifying the attacker-specified target-victim tag pair and recovering the trigger pattern.

Traditional detection methods usually blindly try all label pairs, or pre-select labels given some clean input samples, and then reverse engineer the trigger style for each set of label pairs. In addition, most traditional methods assume that the detected backdoor trigger type is pixel patch type, and another type of backdoor attack using image transformation-based filter type triggers is also a common and easy to implement type of backdoor attack. Due to the high computational overhead of reverse engineering for each tag pair, uncertainties in the quality of input samples and trigger types, traditional methods usually suffer from high computational complexity, unstable accuracy, and lack of scalability.

SUMMARY OF THE INVENTION

In order to improve the efficiency, accuracy and scalability of the deep neural network model backdoor detection, the present invention provides a deep neural network backdoor detection method and system guided by static weights, the input is a deep neural network model to be detected, and A small number of clean image samples used to verify the function of the model, the output is whether the neural network model contains a backdoor, and if it contains a backdoor, output the target label of the backdoor attack, the victim label, and the trigger style.

The technical solution adopted by the method of the present invention is: a deep neural network backdoor detection method guided by static weights, comprising the following steps:

Step 1: Perform static weight analysis on the deep neural network to obtain suspicious target labels and victim labels of backdoor attacks, and form target-victim label pairs;

The specific implementation of step 1 includes the following sub-steps:

Step 1.1: Extract all the weights connected to the output labels in the last layer of the deep neural network, assuming that the deep neural network has n output labels, organize the weights connected to each label into a vector, and obtain n weight vectors w ₁ ... w _n ;

Step 1.2: For each weight vector, calculate the degree of difference between it and all other weight vectors, sort the degree of difference from high to low, and take the target label set D corresponding to the first k _d weight vectors with high degree of difference; Weight vector, calculate the sum of all weights, sort the weight sum from high to low, and take the target label set S corresponding to the first k _s weight vectors of the weight sum and high; take the union of D and S to get the final suspicious target label set T;

Step 1.3: Subtract the highest difference and the second highest difference obtained in step 1.2, and the difference obtained is greater than the threshold θ, then the victim label is considered to be all labels in the model; otherwise, for each suspicious target label t in T , calculate the similarity between it and other weight vectors, sort the similarity from high to low, and take the first k _v tags with high similarity as the suspicious victim tag V _t ;

Step 1.4: The obtained suspicious target label set T and the victim label V _t corresponding to each target label t in T are formed into a target-victim label pair set;

Step 2: Use the suspicious target labels and victim labels obtained in Step 1, and clean image samples to perform reverse engineering of triggers to obtain reverse triggers;

When the reverse engineering of the trigger is the reverse engineering of the pixel patch type trigger, it is judged whether the obtained pixel patch type reverse trigger satisfies the preset conditions of the success rate and the trigger size, and if the preset conditions are met, the following steps are performed 3; otherwise, the output detection result is that the deep neural network to be detected does not contain a pixel patch backdoor;

When the reverse engineering of the trigger is the reverse engineering of the image filter type trigger, it is judged whether the obtained image filter type reverse trigger satisfies the preset conditions of the success rate, and if the preset conditions are met, the output detection result is to be detected The deep neural network contains an image filter type backdoor; otherwise, the output detection result is that the deep neural network to be detected does not contain an image filter type backdoor;

Step 3: Analyze the shape attribute of the pixel patch-type inverse trigger obtained in Step 2, and activate the distribution of the internal neurons of the deep neural network to be detected, and output the final detection result.

The technical scheme adopted by the system of the present invention is: a deep neural network backdoor detection system guided by static weights, comprising the following modules:

Module 1 is used to perform static weight analysis on the deep neural network to obtain suspicious target labels and victim labels of backdoor attacks, and form target-victim label pairs;

Module 1 includes the following submodules:

Module 1.1 is used to extract all the weights connected to the output labels in the last layer of the deep neural network. Assuming that the deep neural network has n output labels in total, organize the weights connected to each label into a vector to obtain n weight vectors w ₁ ...w _n ;

Module 1.2 is used to calculate the degree of difference between each weight vector and all other weight vectors, sort the degree of difference from high to low, and take the target label set D corresponding to the first k _d weight vectors with high degree of difference; For each weight vector, calculate the sum of all weights, sort the weight sum from high to low, and take the target label set S corresponding to the first k _s weight vectors of the weight sum and high; take the union of D and S to get the final Suspicious target label set T;

Module 1.3 is used to subtract the highest difference degree and the second highest degree of difference obtained by module 1.2, and the obtained difference is greater than the threshold θ, then the victim label is considered to be all labels in the model; otherwise, for each suspicious target in T Label t, calculate the similarity between it and other weight vectors, sort the similarity from high to low, and take the top k _v labels with high similarity as the suspicious victim label V _t ;

Module 1.4 is used to form a set of target-victim tag pairs from the obtained suspicious target tag set T and the victim tag V _t corresponding to each target tag t in T;

Module 2: Use the suspicious target labels and victim labels obtained by module 1, and clean image samples to perform trigger reverse engineering to obtain reverse triggers;

When the reverse engineering of the trigger is the reverse engineering of the pixel patch type trigger, it is judged whether the obtained pixel patch type reverse trigger satisfies the preset conditions of the success rate and the trigger size, and if the preset conditions are met, the following modules are executed 3; otherwise, the output detection result is that the deep neural network to be detected does not contain a pixel patch backdoor;

When the reverse engineering of the trigger is the reverse engineering of the image filter type trigger, it is judged whether the obtained image filter type reverse trigger satisfies the preset conditions of the success rate, and if the preset conditions are met, the output detection result is to be detected The deep neural network contains an image filter type backdoor; otherwise, the output detection result is that the deep neural network to be detected does not contain an image filter type backdoor;

The module 3 is used for analyzing the shape attribute of the obtained pixel patch trigger, and activating the distribution of the inner neurons of the deep neural network to be detected, and outputting the final detection result.

Advantages of the present invention:

1. The present invention innovatively uses static weight analysis to identify suspicious backdoor target-victim tag pairs in the model to be detected, which can effectively utilize the information in the model weight. Static analysis of model weights does not require model execution, and the computational complexity is low; no input samples are required, which can effectively overcome the influence of the quantity and quality of input samples and achieve stable label recognition. However, traditional methods blindly try all target-victim label pairs, which is inefficient and has poor practical usability; or given some clean input samples for label preselection, the effect is easily limited by the number and quality of samples.

2. The present invention utilizes the advantages that static weight analysis is not affected by trigger type and has strong scalability. Under the guidance of static weight analysis results, reverse engineering is performed on backdoor attack triggers, and pixel patch type triggers and triggers can be detected and restored. Image filter type trigger. Traditional methods mostly assume that backdoor attacks use pixel patch-type triggers, which are difficult to extend to the detection and restoration of image filter-type triggers.

3. The present invention performs shape attribute analysis and activation neuron distribution analysis on the flip-flop obtained by reverse engineering, which effectively reduces the false alarm rate, so that the invented method can effectively detect the model with backdoor while retaining the normal model, and realize high precision. Deep neural network model backdoor detection.

Description of drawings

FIG. 1 is a flowchart of a method according to an embodiment of the present invention.

FIG. 2 is a flow chart of static weight analysis according to an embodiment of the present invention.

FIG. 3 is a flowchart of reverse engineering of a pixel patch flip-flop according to an embodiment of the present invention.

FIG. 4 is a flow chart of reverse engineering of an image filter type trigger according to an embodiment of the present invention.

FIG. 5 is a flow chart of analyzing a pixel patch type flip-flop according to an embodiment of the present invention.

Detailed ways

In order to facilitate the understanding and implementation of the present invention by those skilled in the art, the present invention will be described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the embodiments described herein are only used to illustrate and explain the present invention, but not to limit it. this invention.

Traditional detection methods usually blindly try all target-victim label pairs, or preselect labels given some clean input samples, and then reverse engineer the trigger style for each label pair. When there are many label pairs to be tried, or the poor quality of input samples leads to inaccurate label pair selection, the efficiency and accuracy of traditional methods will be affected, and most traditional methods are only suitable for pixel patch type triggers.

During the training process, the neural network completes the classification task by updating the weight parameters. For the trained neural network, the weight parameters are fixed and can be regarded as a static attribute of the model. Because the weight parameters of the model must be tampered with to implant the backdoor, compared with the clean model, the model with the backdoor will inevitably have abnormal weight distribution. This abnormality has nothing to do with the trigger type and can be used to identify the target specified by the attacker. - Victim tag pair, thus guiding the backdoor detection process and improving detection efficiency.

Based on the above analysis, the present invention proposes a deep neural network backdoor detection method and system guided by static weight analysis. The present invention is dedicated to using the abnormal weight distribution in the pre-training neural network to guide backdoor detection, and takes advantage of the advantages of static weight analysis with low computational cost, unaffected by the quality of input samples, and unaffected by trigger types. An efficient, stable and scalable neural network backdoor detection method.

Referring to Figure 1, a static weight guided deep neural network backdoor detection method provided by the present invention includes the following steps:

Step 1: Perform static weight analysis on the deep neural network to obtain suspicious target labels and victim labels of backdoor attacks, and form target-victim label pairs;

Referring to FIG. 2, in this embodiment, the specific implementation of step 1 includes the following sub-steps:

Step 1.1: Extract all the weights connected to the output labels in the last layer of the deep neural network, assuming that the deep neural network has n output labels, organize the weights connected to each label into a vector, and obtain n weight vectors w ₁ ... w _n ;

Step 1.2: For each weight vector, calculate the degree of difference between it and all other weight vectors, sort the degree of difference from high to low, and take the target label set D corresponding to the first k _d weight vectors with high degree of difference; Weight vector, calculate the sum of all weights, sort the weight sum from high to low, and take the target label set S corresponding to the first k _s weight vectors of the weight sum and high; take the union of D and S to get the final suspicious target label set T;

Step 1.3: In order to identify the victim label, subtract the highest difference degree and the second highest difference degree obtained in step 1.2, and the obtained difference is greater than the threshold θ, then the victim label is considered to be all the labels in the model; otherwise, for each label in T A suspicious target label t, calculate the similarity between it and other weight vectors, sort the similarity from high to low, and take the top k _v labels with high similarity as the suspicious victim label V _t ;

Step 1.4: After the above three steps of processing, the obtained suspicious target label set T and the victim label V _t corresponding to each target label t in T are formed into a target-victim label pair set;

In the experimental process of this embodiment, θ=0.1, k _d =3, k _s =2, k _v =2 (in the specific implementation, it can also be preset by the defender according to the defense requirements), then the set D contains The number of elements is 3, the number of elements contained in the set S is 2, and the number of elements contained in the set T is 3-5. When the difference between the highest difference degree and the second highest difference degree is greater than 0.1, the victim label is considered to be all the labels in the model, and all labels are regarded as a whole as a suspicious victim label V _t , and the number of target-victim label pairs is 3-5; otherwise, it is considered that Victim tags are not all tags, suspicious victim tags V _t are calculated for each target tag, and the number of target-victim tag pairs is 6-10.

In this embodiment, the average cosine similarity is used to calculate the difference degree Divergence(l) of the weight vector w _l of the label l, which is defined as:

In this embodiment, the cosine similarity is used to calculate the similarity between the weight vectors. For the suspicious target label _t in T, the weight vector is wt , and the similarity between the weight vector _wi and _wt of the label i is defined as:

Step 2: Use the suspicious target label and victim label obtained in Step 1, and a small number of clean image samples, to perform reverse engineering of triggers, and obtain a reverse trigger whose success rate satisfies the preset conditions;

In this embodiment, the types of triggers targeted by reverse engineering include pixel patch triggers and image filter triggers.

When the reverse engineering of the trigger is the reverse engineering of the pixel patch type trigger, then it is judged whether the obtained pixel patch type reverse trigger satisfies the preset conditions of the success rate and the trigger size, and if the preset conditions are met, the following step 3 is performed; Otherwise, the output detection result is that the deep neural network to be detected does not contain a pixel patch backdoor;

When the reverse engineering of the trigger is the reverse engineering of the image filter type trigger, it is judged whether the obtained image filter type reverse trigger meets the preset conditions of the success rate, and if the preset conditions are met, the output detection result is the deep neural network to be detected. The network contains an image filter type backdoor; otherwise, the output detection result is that the deep neural network to be detected does not contain an image filter type backdoor.

In this embodiment, in the reverse engineering of the trigger, the reverse engineering of the image filter type trigger includes defining the general form of the image filter type trigger to transform the image and defining the optimization task to solve the image filter type trigger;

Define the general form of image filter trigger to transform the image, including: splicing two channels whose value is all 1 for a three-channel color image with a dimension of 3×H×W, namely the transparency channel and the bias channel, to get A matrix of dimension 5×H×W; where H and W represent height and width, respectively; the filter trigger is defined as a two-dimensional matrix of size 4×5, which is similar to the matrix of dimension 5×H×W Multiply to get a 4×H×W matrix; regard the 4×H×W matrix as a picture in RGBA format, and the last channel is the transparency channel; use the method of RGBA format to RGB format, convert the 4×H×W matrix It is restored to a 3×H×W three-channel color image, and finally the image transformed by the filter trigger is obtained;

Define an optimization task to solve the image filter trigger. The optimization task includes: the image after adding the filter trigger can be misclassified to the target label by the neural network model to be detected, and the image after adding the filter trigger has a similar structure to the original image sex as high as possible.

In this embodiment, in the reverse engineering of triggers, for the reverse engineering of pixel patch triggers, the optimization task is: after adding the same trigger to the victim label image, it can be wrongly judged as the target label by the neural network model, and Triggers should have as few pixels as possible.

See Figure 3. For the reverse engineering of pixel patch flip-flops, the specific implementation of step 2 includes the following sub-steps:

(1) Input target-victim tag pair set;

(2) Take the first target-victim tag pair;

(3) Simulate the pixel patch adding process, and solve the optimization task for this label pair;

(4) Generate a pixel patch type reverse trigger, and calculate the reverse success rate;

(5) determine whether the success rate is greater than the threshold; if so, execute the following step (6); if not, execute the following step (9);

(6) judge whether the trigger size is less than the threshold; if so, execute the following step (7); if not, execute the following step (9);

(7) The deep neural network may contain a pixel patch type backdoor, further analyze the reverse trigger obtained, and judge whether there is a real backdoor trigger; if so, execute the following steps (8); if not, execute the following steps ( 9);

(8) The deep neural network contains a pixel patch type backdoor, and outputs the reverse trigger of the label pair and solution; this process ends;

(9) Judging whether all tag pairs are traversed; if so, execute the following step (10); if not, take a target-victim tag pair, and turn around to execute step (3);

(10) The output judgment result is a pixel-free backdoor of the deep neural network.

See Figure 4. For the reverse engineering of image filter triggers, the specific implementation of step 2 includes the following sub-steps:

(1) Input the target label set;

(2) Take the first target label;

(3) Simulate the image filter adding process, and solve the optimization task for each other label;

(4) Generate an image filter type reverse trigger, and calculate the average reverse success rate;

(5) determine whether the success rate is greater than the threshold; if so, execute the following step (6); if not, execute the following step (7);

(6) The deep neural network contains an image filter type backdoor, and outputs the label and the reverse trigger of the solution; this process ends;

(7) judge whether to traverse all label pairs; if so, execute the following step (8); if not, take down a target label, and turn around to execute step (3);

(8) The output judgment result is a deep neural network backdoor without an image filter.

In the experimental process of the present invention, the dimensions (channel, height, width) of the image sample are (3, 224, 224). When the victim labels are considered to be all labels in the model, the number of clean image samples is 40, which are randomly selected from all labels; when the victim labels are not considered to be all labels, the number of clean image samples is 10, which are selected from the victim labels . The success rate threshold of the pixel patch trigger is 99% (it can be preset by the defender according to the defense needs), the size of the pixel patch trigger ||M|| ₁ is 350 (it can be preset by the defender according to the defense needs), When the attack success rate of the reverse trigger is greater than 99% and the trigger size is less than 350, it is considered a suspicious pixel trigger; the threshold of the average attack success rate of the image filter trigger is 90% (which can be predicted by the defender depending on the defense requirements). ), when the average attack success rate of n-1 reverse triggers is greater than 90%, the model is considered to contain an image filter type backdoor.

定义为：In this embodiment, for the pixel patch type trigger, the general form of the trigger added to the picture is

defined as:

表示加上触发器之后的图片，算子°表示哈达玛积。P是一个颜色矩阵，M矩阵控制触发器的位置和透明度，像素补丁型触发器由(P，M)表示。Among them, x represents the original image,

Represents the picture after adding the trigger, and the operator ° represents the Hadamard product. P is a color matrix, M matrix controls the position and transparency of flip-flops, and pixel-patch flip-flops are represented by (P, M).

定义为：In this embodiment, for an image filter type trigger, the general form of transforming an image is

defined as:

表示加上触发器之后的图片，算子·表示矩阵乘法，操作concatenate表示矩阵拼接，操作rgba2rgb表示将RGBA格式的四通道图片转换为RGB三通道格式。触发器

是一个维度为4×5的二维矩阵。Among them, x represents the original image,

Represents the picture after adding the trigger, operator · represents matrix multiplication, operation concatenate represents matrix splicing, and operation rgba2rgb represents converting a four-channel image in RGBA format to RGB three-channel format. trigger

is a two-dimensional matrix of dimension 4 × 5.

In this embodiment, for the pixel patch type trigger, the optimization task is: after adding the same trigger to the victim label image, it can be misjudged as the target label by the neural network model, and the number of pixels of the trigger is as small as possible. defined as:

表示交叉熵损失函数，y_t表示目标标签，||M||₁表示M的L1范数，β表示约束参数。where f represents the model to be detected whose output is the predicted probability value, X represents the set of clean images from the victim label,

represents the cross-entropy loss function, y _t represents the target label, ||M|| ₁ represents the L1 norm of M, and β represents the constraint parameter.

In this embodiment, for an image filter type trigger, an inverse trigger is optimized and solved for each model output label except the target label, with a total of n-1 inverse triggers, and n-1 inverse triggers are calculated. The average attack success rate. The reason is that the internal decision space of the backdoor model attacked by image filter triggers is destroyed, and a linear transformation can be used to create a path to the target label decision domain for most labels. The optimization task is: after the image of the victim tag is transformed by the filter trigger, it can be misjudged as the target label by the neural network model, and because the image after the filter transformation is still clearly discernible, the image after the filter trigger transformation The structural similarity with the original image should be as high as possible. defined as:

表示交叉熵损失函数，y_t表示目标标签，SSIM表示结构相似性度量指标，γ表示约束参数。Among them, f represents the model to be detected, and its output is the predicted probability value, X represents the clean image set from any label except the target label,

represents the cross-entropy loss function, y _t represents the target label, SSIM represents the structural similarity measure, and γ represents the constraint parameter.

In this embodiment, the optimization task is optimized and solved by using the Adam optimizer to obtain an inverse trigger.

Step 3: Analyze the shape attribute of the obtained pixel patch trigger, and activate the distribution of the neurons in the deep neural network to be detected, and output the final detection result.

Referring to Figure 5, in this embodiment, the specific implementation of step 3 includes the following sub-steps:

Step 3.1: For the pixel patch triggers whose success rate and trigger size meet the preset conditions, analyze the sparsity of the pixel distribution. If it is higher than the preset sparsity threshold, it is considered to be an anti-disturbance false alarm, and output The detection result of the deep neural network is that there is no pixel patch backdoor; otherwise, proceed to the following step 3.2;

In this embodiment, the pixel distribution sparsity of the reverse trigger is calculated by the grid coverage ratio of the trigger, and the entire picture is evenly divided into several small blocks, each block is regarded as a grid point, then the grid coverage ratio of the trigger Defined as: the proportion of grid points containing trigger pixels to the total number of grid points. When this ratio is greater than a certain threshold, it is considered to be an adversarial disturbance, rather than a backdoor trigger maliciously implanted by the attacker.

For example, during the experiment of the present invention, a picture with a length and width of 224×224 is evenly divided into 1024 7×7 grid points, and the grid coverage threshold is 10% (the specific implementation can be determined by the defender depending on the defense needs. ), when the grid coverage of the reverse trigger is greater than 10%, it is considered to be an adversarial perturbation rather than a maliciously implanted backdoor trigger by the attacker.

Step 3.2: Analyze the similarity between the distribution of the activated neurons in the deep neural network to be detected and the distribution of the activated neurons in the target label clean image sample. If it is higher than the preset similarity threshold, it is considered to be a natural feature false positive, and the output depth The detection result of the neural network is that there is no pixel patch backdoor; otherwise, proceed to the following step 3.3;

In this embodiment, the activation of the internal neuron distribution is calculated by using the neurons in the penultimate layer of the model, and the neuron activation function is ReLU.

In this embodiment, the similarity of the activation neuron distribution is calculated by the similarity NBS of the maximum activation value neuron set, which is defined as:

表示受害标签样本添加触发器后有最大激活值的r个神经元集合，

表示全部受害标签样本添加触发器的样本集合。where N _c represents the set of r neurons with the largest activation value from the clean sample of the target label,

Represents the set of r neurons with the largest activation value after the victim label sample is added with a trigger,

Represents a sample set of all victim tag sample addition triggers.

For example, in the experimental process of the present invention, r=30 is taken. When the similarity of the distribution of activated neurons is greater than 0.5 (the specific implementation can be preset by the defender according to the defense requirements), it is considered to be a natural feature rather than a malicious attacker. Implanted backdoor trigger.

Step 3.3: For the obtained pixel patch trigger whose success rate and trigger size meet the preset conditions, if it can still be retained after the above two-step inspection, it is determined that the trigger is a maliciously implanted backdoor trigger, and the output depth The neural network detection result is a backdoor deep neural network with pixel patches, as well as target labels, victim labels, and trigger patterns.

The invention identifies suspicious target-victim tag pairs through static weight analysis, performs trigger reverse engineering for the identified tag pairs, restores the trigger pattern defined by the attacker, and realizes efficient, stable and scalable neural network backdoor detection.

It should be understood that the above description of the preferred embodiments is relatively detailed, and therefore should not be considered as a limitation on the protection scope of the patent of the present invention. In the case of the protection scope, substitutions or deformations can also be made, which all fall within the protection scope of the present invention, and the claimed protection scope of the present invention shall be subject to the appended claims.

Claims (9)

1. A static weight guided deep neural network backdoor detection method is characterized by comprising the following steps:

step 1: performing static weight analysis on the deep neural network to obtain a suspicious target label and a victim label of backdoor attack to form a target-victim label pair;

the specific implementation of the step 1 comprises the following substeps:

step 1.1: extracting all weights connected with output labels at the last layer of the deep neural network, assuming that the deep neural network has n output labels, organizing the weights connected with each label into vectors to obtain n weight vectors w₁…w_n；

Step 1.2: for each weight vector, calculating the difference degree between the weight vector and all other weight vectors, sorting the difference degrees from high to low, and taking the top k with high difference degree_dA target label set D corresponding to each weight vector; for each weight vector, calculating the sum of all weights, ordering the weight sums from high to low, taking the weight sum high_sA target label set S corresponding to each weight vector; merging the D and the S to obtain a final suspicious target label set T;

step 1.3: subtracting the highest difference and the second highest difference obtained in the step 1.2, and if the obtained difference is greater than a threshold value theta, determining that the damaged label is all the labels in the model; otherwise, for each suspicious target label T in T, calculating the similarity between the suspicious target label T and other weight vectors, sorting the similarity from high to low, and taking the top k with high similarity_vIndividual label as suspicious victim label V_t；

Step 1.4: obtaining suspicious target label sets T and victim labels V corresponding to each target label T in the T_tComposing a set of target-victim tag pairs;

step 2: performing trigger reverse engineering by using the suspicious target label and the damaged label obtained in the step (1) and the clean image sample to obtain a reverse trigger;

when the trigger reverse engineering is the pixel patch type trigger reverse engineering, judging whether the obtained pixel patch type reverse trigger meets preset conditions of success rate and trigger size, and if the preset conditions are met, executing the following step 3; otherwise, outputting a detection result that the deep neural network to be detected does not contain a pixel patch type back door;

when the trigger reverse engineering is the image filter type trigger reverse engineering, judging whether the obtained image filter type reverse trigger meets a success rate preset condition, and if the obtained image filter type reverse trigger meets the preset condition, outputting a detection result that the deep neural network to be detected contains an image filter type back door; otherwise, outputting a detection result that the deep neural network to be detected does not contain an image filter type back door;

and step 3: and (3) analyzing the shape attribute of the pixel patch type reverse trigger obtained in the step (2), activating the distribution of the neurons in the deep neural network to be detected, and outputting a final detection result.

2. The static weight guided deep neural network back door detection method of claim 1, wherein: in step 1.2, the weight vector difference degree is the weight vector w of the label l calculated by adopting the average cosine similarity degree_lDegree of difference (l) of (a), which is defined as:

3. the static weight guided deep neural network back door detection method of claim 1, wherein: in step 1.3, the similarity of the weight vectors is calculated by cosine similarity, and the suspicious target label T in T is labeled by the cosine similarityThe weight vector is w_tThen the weight vector w of the label i_iAnd w_tThe similarity of (c) is defined as:

4. the static weight guided deep neural network back door detection method of claim 1, wherein: step 2, in the trigger reverse engineering, the reverse engineering of the image filter type trigger comprises defining a general form of the image filter type trigger for converting the image and defining an optimization task to solve the image filter type trigger;

the definition image filter type trigger carries out the transformation of the image in a general form, and comprises the following components: splicing two channels with the value of all 1, namely a transparency channel and an offset channel, of a three-channel color picture with the dimension of 3 multiplied by H multiplied by W to obtain a matrix with the dimension of 5 multiplied by H multiplied by W; wherein H and W represent height and width, respectively; defining a filter trigger as a two-dimensional matrix with the size of 4 multiplied by 5, and multiplying the two-dimensional matrix with the dimension of 5 multiplied by H multiplied by W to obtain a 4 multiplied by H multiplied by W matrix; regarding a 4 × H × W matrix as an RGBA format picture, and regarding a last channel as a transparency channel; reducing a 4 XHxW matrix into a 3 XHxW three-channel color picture by using a method of converting an RGBA format into an RGB format, and finally obtaining a picture converted by a filter trigger;

the definition optimization task solves the image filter type trigger, and comprises the following steps: the picture added with the filter trigger can be wrongly classified to a target label by the neural network model to be detected, and the picture added with the filter trigger has the highest similarity with the original picture.

5. The static weight guided deep neural network back door detection method of claim 1, wherein: in step 2, in the trigger reverse engineering, for the reverse engineering of the pixel patch type trigger, the optimization task is as follows: after the same trigger is added to the damaged label picture, the damaged label picture can be wrongly judged as a target label by the neural network model, and the number of pixels of the trigger is reduced as much as possible.

6. The method of claim 1, wherein the step 2 is implemented by the following steps for reverse engineering of an image filter type trigger:

(1) inputting a target label set;

(2) taking a first target label;

(3) simulating an image filter adding process, and solving an optimization task for each other label;

(4) generating an image filter type reverse trigger, and calculating the average reverse success rate;

(5) judging whether the success rate is greater than a threshold value; if yes, executing the following step (6); if not, executing the following step (7);

(6) the deep neural network comprises an image filter type rear door and outputs the label and a solved reverse trigger; the process is finished;

(7) judging whether all the label pairs are traversed or not; if yes, executing the following step (8); if not, taking down a target label, and rotating to execute the step (3);

(8) and outputting a judgment result to be a depth neural network image-filter-free back door.

7. The static weight guided deep neural network back door detection method as claimed in claim 1, wherein for the reverse engineering of the pixel patch type trigger, the implementation of step 2 comprises the following sub-steps:

(1) inputting a set of target-victim tag pairs;

(2) taking a first target-victim tag pair;

(3) simulating a pixel patch adding process, and solving an optimization task for the label pair;

(4) generating a pixel patch type reverse trigger, and calculating a reverse success rate;

(5) judging whether the success rate is greater than a threshold value; if yes, executing the following step (6); if not, executing the following step (9);

(6) judging whether the size of the trigger is smaller than a threshold value; if yes, executing the following step (7); if not, executing the following step (9);

(7) the deep neural network may contain a pixel patch type back door, and further analyzes the obtained reverse trigger to judge whether a real back door trigger exists or not; if yes, executing the following step (8); if not, executing the following step (9);

(8) the deep neural network comprises a pixel patch type back gate and outputs the label pair and a solved reverse trigger; the process is finished;

(9) judging whether all the label pairs are traversed or not; if yes, executing the following step (10); if not, taking down a target-victim tag pair, and rotating to execute the step (3);

(10) and outputting a judgment result as a pixel-free patch type backdoor of the deep neural network.

8. The method for detecting the backdoor of the static weight guided deep neural network according to any one of claims 1 to 7, wherein the step 3 is implemented by the following sub-steps:

step 3.1: analyzing the sparsity of pixel distribution of the pixel patch type trigger with the obtained success rate and the trigger size meeting the preset condition, if the obtained success rate and the trigger size are higher than a preset sparsity threshold value, determining that the pixel patch type trigger is false-alarm-resistant, and outputting a deep neural network detection result as a back door without the pixel patch type trigger; otherwise, continuing to execute the following step 3.2;

step 3.2: analyzing the similarity of the distribution of the neurons in the deep neural network to be detected activated and the distribution of the neurons activated by the target label clean picture sample, if the similarity is higher than a preset similarity threshold value, determining that the natural characteristic is false alarm, and outputting a deep neural network detection result as a back door without a pixel patch type; otherwise, continuing to execute the following step 3.3;

step 3.3: and determining that the trigger is a maliciously implanted backdoor trigger, and outputting a detection result of the deep neural network as a patch type backdoor deep neural network containing pixels, a target label, a damaged label and a trigger model.

9. A deep neural network backdoor detection system guided by static weight is characterized by comprising the following modules:

the module 1 is used for performing static weight analysis on the deep neural network to obtain a suspicious target label and a victim label of backdoor attack to form a target-victim label pair;

module 1 includes the following sub-modules:

a module 1.1, configured to extract all weights of the last layer of the deep neural network connected to the output tags, assuming that the deep neural network has n output tags, organizing the weights connected to each tag into a vector, and obtaining n weight vectors w₁…w_n；

A module 1.2, configured to calculate, for each weight vector, a degree of difference between the weight vector and all other weight vectors, rank the degree of difference from high to low, and take the top k with high degree of difference_dA target label set D corresponding to each weight vector; for each weight vector, calculating the sum of all weights, ordering the weight sums from high to low, taking the weight sum high_sA target label set S corresponding to each weight vector; merging the D and the S to obtain a final suspicious target label set T;

a module 1.3, configured to subtract the highest difference and the second highest difference obtained by the module 1.2, and if the obtained difference is greater than a threshold θ, consider that the damaged tag is all tags in the model; otherwise, for each suspicious target label T in T, calculating the similarity between the suspicious target label T and other weight vectors, sorting the similarity from high to low, and taking the top k with high similarity_vIndividual label as suspicious victim label V_t；

A module 1.4, configured to obtain a suspicious target tag set T and a victim tag V corresponding to each target tag T in the suspicious target tag set T_tComposing a set of target-victim tag pairs;

and (3) module 2: the system is used for performing trigger reverse engineering by utilizing the suspicious target label and the victim label obtained by the module 1 and the clean image sample to obtain a reverse trigger;

when the trigger reverse engineering is the pixel patch type trigger reverse engineering, judging whether the obtained pixel patch type reverse trigger meets preset conditions of success rate and trigger size, and if the preset conditions are met, executing a following module 3; otherwise, outputting a detection result that the deep neural network to be detected does not contain a pixel patch type back door;

when the trigger reverse engineering is the image filter type trigger reverse engineering, judging whether the obtained image filter type reverse trigger meets a success rate preset condition, and if the obtained image filter type reverse trigger meets the preset condition, outputting a detection result that the deep neural network to be detected contains an image filter type back door; otherwise, outputting a detection result that the deep neural network to be detected does not contain an image filter type back door;

and the module 3 is used for analyzing the shape attribute of the obtained pixel patch type trigger, activating the distribution of the neurons in the deep neural network to be detected and outputting a final detection result.

Images