Method and apparatus for actively defending against backdoor attacks under edge computing scenario

An apparatus for actively defending against backdoor attacks under an edge computing scenario, applied to a collaborative learning edge node under the edge computing scenario, the edge node being deployed a deep learning model, the apparatus comprising:

• a processor;
• and
• a memory, configured to store instructions executable by the processor,
• wherein the processor is configured to implement a method for actively defending against backdoor attacks under an edge computing scenario by executing the instructions stored in the memory, the method comprising:
• generating an initial optional operation set based on optional operations configured to enhance a model generalization ability, and constructing a configuration parameter set for each optional operation in the initial optional operation set;
• selecting a first optional operation subset from the initial optional operation set, wherein for each optional operation in the first optional operation subset, a curve between configuration parameters and model accuracies presents a monotonically decreasing concave function characteristic;
• selecting a second optional operation subset from the initial optional operation set, wherein for each optional operation in the second optional operation subset, a curve between configuration parameters and probabilities that the deep learning model is successfully attacked by a backdoor attack presents a monotonically decreasing convex function characteristic;
• constructing a mutation characteristic set for each optional operation in an intersection of the first optional operation subset and the second optional operation subset according to a preset formula;
• for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, determining a final parameter setting value of the optional operation based on the mutation characteristic set;
• and
• actively defending against possible backdoor attacks by training and using the deep learning model with a parameter of the optional operation being set to the final parameter setting value, wherein the final parameter setting value decreases a probability of the deep learning model being embedded with an effective backdoor.

A non-transitory computer readable storage medium stored thereon with a computer program that, when executed by a processor applied to a collaborative learning edge node under the edge computing scenario, cause the processor to implement a method for actively defending against backdoor attacks under an edge computing scenario, the edge node being deployed a deep learning model, the method comprising:

• generating an initial optional operation set based on optional operations configured to enhance a model generalization ability, and constructing a configuration parameter set for each optional operation in the initial optional operation set;
• selecting a first optional operation subset from the initial optional operation set, wherein for each optional operation in the first optional operation subset, a curve between configuration parameters and model accuracies presents a monotonically decreasing concave function characteristic;
• selecting a second optional operation subset from the initial optional operation set, wherein for each optional operation in the second optional operation subset, a curve between configuration parameters and probabilities that the deep learning model is successfully attacked by the backdoor attack presents a monotonically decreasing convex function characteristic;
• constructing a mutation characteristic set for each optional operation in an intersection of the first optional operation subset and the second optional operation subset according to a preset formula;
• for each optional operation in the intersection of the first optional operation subset and the second optional operation subset, determining a final parameter setting value of the optional operation based on the mutation characteristic set;
• and
• actively defend against possible backdoor attacks by training and using the deep learning model with a parameter of the optional operation being set to the final parameter setting value, wherein the final parameter setting value decreases a probability of the deep learning model being embedded with an effective backdoor.