method for machine learning backdoor attacks based on defense method based on diffusion models

WANG Sunping; ZHANG Aiqing; YE Xinrong; WANG Yong

doi:10.11959/j.issn.2096-109x.2025059

您当前的位置：

首页 >

文章列表页 >

method for machine learning backdoor attacks based on defense method based on diffusion models

Papers | 更新时间：2025-11-08

- method for machine learning backdoor attacks based on defense method based on diffusion models
- Chinese Journal of Network and Information Security Vol. 11, Issue 5, Pages: 137-148(2025)
- 作者机构：
  
  1.安徽师范大学物理与电子信息学院，安徽芜湖 241002
  2.皖南医学院医学信息学院，安徽芜湖 241002
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(62072005);Anhui Provincial Natural Science Foundation for Outstanding Young Scientists Project(2108085Y22)
- DOI：10.11959/j.issn.2096-109x.2025059
  CLC： TP393
- Received：23 March 2025，
  
  Revised：2025-06-26，
  
  Published：25 October 2025
- 稿件说明：
移动端阅览
王孙平, 张爱清, 叶新荣, 等. 基于扩散模型的机器学习后门攻击防御方法[J]. 网络与信息安全学报, 2025, 11(5): 137-148.

WANG S P, ZHANG A Q, YE X R, et al. Defense method for machine learning backdoor attacks based on diffusion model[J]. Chinese Journal of Network and Information Security, 2025, 11(5): 137-148.
王孙平, 张爱清, 叶新荣, 等. 基于扩散模型的机器学习后门攻击防御方法[J]. 网络与信息安全学报, 2025, 11(5): 137-148. DOI： 10.11959/j.issn.2096-109x.2025059.

WANG S P, ZHANG A Q, YE X R, et al. Defense method for machine learning backdoor attacks based on diffusion model[J]. Chinese Journal of Network and Information Security, 2025, 11(5): 137-148. DOI： 10.11959/j.issn.2096-109x.2025059.

摘要

后门攻击是机器学习模型在训练阶段面临的主要安全威胁之一。尽管现有针对后门攻击的防御研究已取得显著进展，但这些方法往往会导致模型在干净测试集上的准确率出现明显下降。为解决这一问题，提出了一种基于扩散模型的机器学习后门攻击防御方法（defending against backdoor attacks with diffusion model

DBADM）。该方法的核心思想是在模型训练前，利用扩散模型对含有后门触发器的中毒样本进行预处理，通过改变样本中隐藏的触发器特征，从而有效抵御后门攻击。研究人员在MNIST、CIFAR-10、Tiny ImageNet和LFW4个基准数据集上进行了系统的攻防对比实验。实验结果表明，所提出的DBADM方法不仅能够有效防御各类后门攻击，还能保持模型在干净数据集上的高精度性能。

Abstract

Backdoor attacks were recognized as one of the primary security threats faced by machine learning models during the training phase. Although significant progress had been achieved in existing defense methods against backdoor attacks

these approaches were often found to result in a substantial decline in model accuracy on clean test sets. To address this issue

a method named defending against backdoor attacks with diffusion model (DBADM) was proposed. The core idea of this method was to preprocess poisoned samples containing backdoor triggers using a diffusion model before model training. By altering the hidden trigger features in the samples

backdoor attacks were effectively mitigated. Systematic offensive and defensive comparison experiments were conducted on four benchmark datasets: MNIST

CIFAR-10

Tiny ImageNet

and LFW. The experimental results demonstrate that the DBADM method not only successfully defends against various backdoor attacks but also maintains the model’s high accuracy performance on the clean dataset.

关键词

Keywords

references

秦轶群 , 马晓静 , 付佳韵 , 等 . 分割学习数据隐私研究综述 [J ] . 网络与信息安全学报 , 2024 , 10 ( 3 ): 20 - 37 .

QIN Y Q , MA X J , FU J Y , et al . Survey of split learning data privacy [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 3 ): 20 - 37 .

LI Y M , JIANG Y , LI Z F , et al . Backdoor learning: a survey [J ] . IEEE Transactions on Neural Networks and Learning Systems , 2024 , 35 ( 1 ): 5 - 22 .

CHEN W X , WU B Y , WANG H Q . Effective backdoor defense by exploiting sensitivity of poisoned samples [C ] // Annual Conference on Neural Information Processing Systems 2022 (NeurIPS 2022). 2022 : 9727 - 9737 .

ZHANG Z X , CAO X Y , JIA J Y , et al . FLDetector: defending federated learning against model poisoning attacks via detecting malicious clients [C ] // Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . New York : ACM Press , 2022 : 2545 - 2555 .

谭清尹 , 曾颖明 , 韩叶 , 等 . 神经网络后门攻击研究 [J ] . 网络与信息安全学报 , 2021 , 7 ( 3 ): 46 - 58 .

TAN Q Y , ZENG Y M , HAN Y , et al . Survey on backdoor attacks targeted on neural network [J ] . Chinese Journal of Network and Information Security , 2021 , 7 ( 3 ): 46 - 58 .

LI Y G , LYU X , KOREN N , et al . Neural attention distillation: erasing backdoor triggers from deep neural networks [C ] // The Ninth International Conference on Learning Representations . 2021 .

LIU K , DOLAN-GAVITT B , GARG S . Fine-pruning: defending against backdooring attacks on deep neural networks [C ] // Proceedings of the 21st International Symposium on Research in Attacks, Intrusions, and Defenses . Berlin : Springer , 2018 : 273 - 294 .

HO J , JAIN A , ABBEEL P . Denoising diffusion probabilistic models [C ] // Proceedings of Advances in Neural Information Processing Systems 33 . 2020 : 6840 - 6851 .

ZHOU J C , LV P Z , LAN Y B , et al . DataElixir: purifying poisoned dataset to mitigate backdoor attacks via diffusion models [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . Vancouver : AAAI Press , 2024 : 21850 - 21858 .

GU T Y , LIU K , DOLAN-GAVITT B , et al . BadNets: evaluating backdooring attacks on deep neural networks [J ] . IEEE Access , 2019 , 7 : 47230 - 47244 .

MA B H , ZHAO C , WANG D J , et al . DIHBA: dynamic, invisible and high attack success rate boundary backdoor attack with low poison ratio [J ] . Computers & Security , 2023 , 129 : 103212 .

ZHONG N , QIAN Z X , ZHANG X P . Imperceptible backdoor attack: from input space to feature representation [C ] // Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence . California : IJCAI , 2022 : 1736 - 1742 .

GAO Y H , LI Y M , GONG X L , et al . Backdoor attack with sparse and invisible trigger [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 6364 - 6376 .

ZHAO S , TUAN L A , FU J , et al . Exploring clean label backdoor attacks and defense in language models [J ] . IEEE/ACM Transactions on Audio, Speech, and Language Processing , 2024 , 32 : 3014 - 3024 .

GAO Y H , LI Y M , ZHU L H , et al . Not all samples are born equal: towards effective clean-label backdoor attacks [J ] . Pattern Recognition , 2023 , 139 : 109512 .

ZENG Y , PAN M Z , JUST H A , et al . Narcissus: a practical clean-label backdoor attack with limited information [C ] // Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2023 : 771 - 785 .

GAO Y S , KIM Y , DOAN B G , et al . Design and evaluation of a multi-domain Trojan detection method on deep neural networks [J ] . IEEE Transactions on Dependable and Secure Computing , 2022 , 19 ( 4 ): 2349 - 2364 .

LI Y S , MA H , ZHANG Z , et al . NTD: non-transferability enabled deep learning backdoor detection [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 104 - 119 .

CHEN Z Z , WANG S , FU A M , et al . LinkBreaker: breaking the backdoor-trigger link in DNNs via neurons consistency check [J ] . IEEE Transactions on Information Forensics and Security , 2022 , 17 : 2000 - 2014 .

ZHANG J L , ZHU C C , SUN X B , et al . FLPurifier: backdoor defense in federated learning via decoupled contrastive training [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 4752 - 4766 .

CHEN X Y , LIU C , LI B , et al . Targeted backdoor attacks on deep learning systems using data poisoning [J ] . arXiv Preprint arXiv: 1712.05526 , 2017 .

NICHOL A Q , DHARIWAL P . Improved denoising diffusion probabilistic models [C ] // Proceedings of the 38th International Conference on Machine Learning . New York : PMLR , 2021 : 8162 - 8171 .

DHARIWAL P , NICHOL A . Diffusion models beat GANs on image synthesis [C ] // the 35th Conference on Neural Information Processing Systems . 2021 : 8780 - 8794 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Anomaly detection in DNS: an empirical study

Research progress on detection of software vulnerabilities based on code similarity

Personal data privacy protection method based onvertical partitioning

Malicious user detection in Momo application based on spatio-temporal behavior and static attribute analysis

Review of malware detection and classification visualization techniques

Related Author

ZUO Peng

CHEN Yong

KONG Kaichuan

HE Ming

HOU Ronghao

DONG Weiyu

TANG Yonghe

LIU Chunling

Related Institution

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Information Engineering University

Dongguan University of Technology

Key Laboratory of Cyberspace Situation Awareness of Henan Province

⁰