| The neural network backdoor attack is one of the hotspots in the field of artificial intelligence.Training a neural network model with good performance may require a lot of resources and time.At this time,a large number of users choose to hand over the model to a third party for training.However,during the training process,the model is likely to be attacked by backdoors.The attacker uses a small amount of bandwidth.Poisoned data with special patterns is mixed into the training data set of the model,and the model is trained to obtain a backdoor model.Special patterns in the poisoned data are called backdoor triggers,and input data with backdoor triggers influences the model’s decision-making,causing the model to output an attackerspecified result.However,when the backdoor model inputs normal and clean samples,the output results are normal and perform well.It is difficult for users to find that the model has a backdoor,and the backdoor attack is highly concealed.When a neural network model with a backdoor is applied to image recognition,automatic driving,etc.,image recognition errors or even car crashes may occur,and backdoor attacks are very harmful.Therefore,the detection and defense of neural network backdoor attacks have research value and practical significance.My paper proposes a backdoor detection and defense method based on Generative Adversarial Network(GAN).My method requires less computing resources and will not affect the model’s ability to classify clean samples after defense.First,the GAN method is used to restore the backdoor trigger,the backdoor model to be detected is used as a fixed discriminator model,and the generator model and clean samples are used as the model to restore the backdoor trigger;In the final defense,the model is retrained using samples with triggers to complete the defense against backdoor attacks.My paper uses the classical backdoor attack method to verify the proposed detection and defense method.In each group of experiments,it can be detected that the model has a backdoor,and the detection effect is good.The backdoor attack success rate of the defended model can be reduced from 99.81% to 4.32%,and the defense effect is remarkable.Finally,the GTSRB data set was used to conduct experimental verification on the three types of traffic sign recognition models.It was also successfully detected that the model had a backdoor.After the defense operation,the backdoor attack success rate of the three types of models dropped below 5%,at the same time,the accuracy of the classification results of the model has also been improved,which proves that the backdoor attack detection proposed in my paper is comparable to the defense method has broad applicability. |
