| 引用本文： |
-
古津榜,洪征,张国敏,江川.基于最大均值差异的特征解纠缠后门缓解方法[J].信息安全学报,2026,11(3):115-129 [点击复制]
- GU Jinbang,HONG Zheng,ZHANG Guomin,JIANG Chuan.Backdoor Mitigation Based on Feature Disentanglement with Maximum Mean Discrepancy[J].Journal of Cyber Security,2026,11(3):115-129 [点击复制]
|
|
| 摘要: |
| 后门攻击通过修改数据集或模型参数向神经网络植入后门,对神经网络的安全构成了严重的威胁。后门缓解方法旨在清除模型中潜在的后门,防止输入样本触发后门机制输出错误的分类结果,从而确保神经网络的整体安全。针对现有后门缓解方法适应性差、性能不佳等问题,提出了一种基于最大均值差异的特征解纠缠后门缓解方法。后门样本在后门神经元上的激活值分布与干净样本存在明显差异,通常表现为更高的激活值,且随着后门攻击成功率的提高,这种差异会进一步加剧。本文所提出的分层掩码抑制方法与特征解纠缠方法旨在调整部分神经元的权重,逐步缩小干净样本与后门样本之间激活值分布的差异,来达到后门缓解的目的。分层掩码抑制方法基于后门攻击相关神经元在不同网络层次上分布存在差异,通过在各层次采用不同的掩码比例,在保留模型正常特征提取能力的基础上,破坏模型中后门与目标标签之间的潜在关联,实现后门缓解。此外,考虑到不同神经网络在特征提取模块方面存在差异,但分类器模块通常具有高度的相似性,针对分类器模块进行特征解纠缠,在特征空间中有效分离正常特征与后门特征削弱后门特征的影响,同时重构良性特征与标签之间的联系实现后门缓解。在Datacon2023-AI安全数据集上进行的实验表明,所提出的后门缓解方法在干净样本分类准确率仅降低4.08%的情况下,使嵌入触发器样本的攻击成功率降低了88.65%,优于现有的后门缓解方法。 |
| 关键词: 后门攻击 模型安全 后门缓解 特征解纠缠 |
| DOI：10.19363/J.cnki.cn10-1380/tn.2026.05.09 |
| 投稿时间：2025-03-10修订日期：2025-06-16 |
| 基金项目:本课题得到国家自然科学基金(62371469)资助。 |
|
| Backdoor Mitigation Based on Feature Disentanglement with Maximum Mean Discrepancy |
|
GU Jinbang, HONG Zheng, ZHANG Guomin, JIANG Chuan
|
| (Department of Command and Control Engineering, Army Engineering University of PLA, Nanjing 210000, China) |
| Abstract: |
| Backdoor attacks pose a significant threat to the security of neural networks by inserting backdoors into the models through dataset manipulation or parameter modification. Backdoor mitigation methods aim to remove potential backdoors from models and prevent input samples from triggering backdoor mechanisms that produce incorrect classification results, thereby ensuring the overall security of neural networks. To address the limitations of existing backdoor mitigation methods, such as poor adaptability and suboptimal performance, a Backdoor Mitigation method Based on Feature Disentanglement with Maximum Mean Discrepancy is proposed. The activation distributions of backdoor samples on backdoor neurons differ markedly from those of clean samples, typically exhibiting higher activation values, and this gap further widens as the attack success rate increases. The proposed Layer-wise Masking Suppression and Feature Disentanglement methods aim to adjust the weights of selected neurons, progressively narrowing the discrepancy in activation distributions between clean and backdoor samples, thereby achieving effective backdoor mitigation. The Layer-wise Masking Suppression method is grounded in the uneven distribution of backdoor neurons across network layers. By applying different mask initialization ratios at various layers, the method disrupts the potential association between backdoors and target labels while preserving the model's normal feature extraction capability, thereby achieving backdoor mitigation. Additionally, considering that different neural networks vary in their feature extraction modules but typically share high similarity in their classifier modules, the proposed method focuses on feature disentanglement in the classifier module. The method separates benign features from backdoor features in the feature space, further weakening the influence of backdoor features. Meanwhile the association between benign features and their corresponding labels is reconstructed, thereby achieving comprehensive backdoor mitigation. Experiments conducted on the Datacon2023-AI dataset demonstrate that the proposed backdoor mitigation method reduces the attack success rate of trigger-embedded samples by 88.65%, with only a 4.08% reduction in clean sample classification accuracy, out-performing existing backdoor mitigation methods. |
| Key words: backdoor attack model security backdoor mitigation feature disentanglement |
