基于扩散模型的机器学习后门攻击防御方法

王孙平; 张爱清; 叶新荣; 王勇

doi:10.11959/j.issn.2096-109x.2025059

您当前的位置：

首页 >

文章列表页 >

基于扩散模型的机器学习后门攻击防御方法

学术论文 | 更新时间：2025-11-08

- 基于扩散模型的机器学习后门攻击防御方法
- method for machine learning backdoor attacks based on defense method based on diffusion models
- 网络与信息安全学报 2025年11卷第5期页码：137-148
- 作者机构：
  
  1.安徽师范大学物理与电子信息学院，安徽芜湖 241002
  2.皖南医学院医学信息学院，安徽芜湖 241002
- 作者简介：
  
  [ "王孙平（1999- ），男，安徽安庆人，安徽师范大学硕士生，主要研究方向为后门攻击、联邦学习。" ]
  [ "张爱清（1982- ），女，安徽宿松人，安徽师范大学教授、博士生导师，主要研究方向为数据安全、隐私保护。" ]
  [ "叶新荣（1976- ），男，安徽宿松人，安徽师范大学副教授、硕士生导师，主要研究方向为移动通信信号处理。" ]
  [ "王勇（1994- ），男，安徽铜陵人，皖南医学院特任副教授，主要研究方向为联邦学习、遗忘学习。" ]
- 基金信息：
  
  国家自然科学基金项目(62072005);安徽省自然科学基金优秀青年科学基金项目(2108085Y22)
- DOI：10.11959/j.issn.2096-109x.2025059
  中图分类号： TP393
- 收稿：2025-03-23，
  
  修回：2025-06-26，
  
  纸质出版：2025-10-25
- 稿件说明：
移动端阅览
王孙平, 张爱清, 叶新荣, 等. 基于扩散模型的机器学习后门攻击防御方法[J]. 网络与信息安全学报, 2025, 11(5): 137-148.

WANG S P, ZHANG A Q, YE X R, et al. Defense method for machine learning backdoor attacks based on diffusion model[J]. Chinese Journal of Network and Information Security, 2025, 11(5): 137-148.
王孙平, 张爱清, 叶新荣, 等. 基于扩散模型的机器学习后门攻击防御方法[J]. 网络与信息安全学报, 2025, 11(5): 137-148. DOI： 10.11959/j.issn.2096-109x.2025059.

WANG S P, ZHANG A Q, YE X R, et al. Defense method for machine learning backdoor attacks based on diffusion model[J]. Chinese Journal of Network and Information Security, 2025, 11(5): 137-148. DOI： 10.11959/j.issn.2096-109x.2025059.

摘要

后门攻击是机器学习模型在训练阶段面临的主要安全威胁之一。尽管现有针对后门攻击的防御研究已取得显著进展，但这些方法往往会导致模型在干净测试集上的准确率出现明显下降。为解决这一问题，提出了一种基于扩散模型的机器学习后门攻击防御方法（defending against backdoor attacks with diffusion model

DBADM）。该方法的核心思想是在模型训练前，利用扩散模型对含有后门触发器的中毒样本进行预处理，通过改变样本中隐藏的触发器特征，从而有效抵御后门攻击。研究人员在MNIST、CIFAR-10、Tiny ImageNet和LFW4个基准数据集上进行了系统的攻防对比实验。实验结果表明，所提出的DBADM方法不仅能够有效防御各类后门攻击，还能保持模型在干净数据集上的高精度性能。

Abstract

Backdoor attacks were recognized as one of the primary security threats faced by machine learning models during the training phase. Although significant progress had been achieved in existing defense methods against backdoor attacks

these approaches were often found to result in a substantial decline in model accuracy on clean test sets. To address this issue

a method named defending against backdoor attacks with diffusion model (DBADM) was proposed. The core idea of this method was to preprocess poisoned samples containing backdoor triggers using a diffusion model before model training. By altering the hidden trigger features in the samples

backdoor attacks were effectively mitigated. Systematic offensive and defensive comparison experiments were conducted on four benchmark datasets: MNIST

CIFAR-10

Tiny ImageNet

and LFW. The experimental results demonstrate that the DBADM method not only successfully defends against various backdoor attacks but also maintains the model’s high accuracy performance on the clean dataset.

关键词

Keywords

references

秦轶群 , 马晓静 , 付佳韵 , 等 . 分割学习数据隐私研究综述 [J ] . 网络与信息安全学报 , 2024 , 10 ( 3 ): 20 - 37 .

QIN Y Q , MA X J , FU J Y , et al . Survey of split learning data privacy [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 3 ): 20 - 37 .

LI Y M , JIANG Y , LI Z F , et al . Backdoor learning: a survey [J ] . IEEE Transactions on Neural Networks and Learning Systems , 2024 , 35 ( 1 ): 5 - 22 .

CHEN W X , WU B Y , WANG H Q . Effective backdoor defense by exploiting sensitivity of poisoned samples [C ] // Annual Conference on Neural Information Processing Systems 2022 (NeurIPS 2022). 2022 : 9727 - 9737 .

ZHANG Z X , CAO X Y , JIA J Y , et al . FLDetector: defending federated learning against model poisoning attacks via detecting malicious clients [C ] // Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . New York : ACM Press , 2022 : 2545 - 2555 .

谭清尹 , 曾颖明 , 韩叶 , 等 . 神经网络后门攻击研究 [J ] . 网络与信息安全学报 , 2021 , 7 ( 3 ): 46 - 58 .

TAN Q Y , ZENG Y M , HAN Y , et al . Survey on backdoor attacks targeted on neural network [J ] . Chinese Journal of Network and Information Security , 2021 , 7 ( 3 ): 46 - 58 .

LI Y G , LYU X , KOREN N , et al . Neural attention distillation: erasing backdoor triggers from deep neural networks [C ] // The Ninth International Conference on Learning Representations . 2021 .

LIU K , DOLAN-GAVITT B , GARG S . Fine-pruning: defending against backdooring attacks on deep neural networks [C ] // Proceedings of the 21st International Symposium on Research in Attacks, Intrusions, and Defenses . Berlin : Springer , 2018 : 273 - 294 .

HO J , JAIN A , ABBEEL P . Denoising diffusion probabilistic models [C ] // Proceedings of Advances in Neural Information Processing Systems 33 . 2020 : 6840 - 6851 .

ZHOU J C , LV P Z , LAN Y B , et al . DataElixir: purifying poisoned dataset to mitigate backdoor attacks via diffusion models [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . Vancouver : AAAI Press , 2024 : 21850 - 21858 .

GU T Y , LIU K , DOLAN-GAVITT B , et al . BadNets: evaluating backdooring attacks on deep neural networks [J ] . IEEE Access , 2019 , 7 : 47230 - 47244 .

MA B H , ZHAO C , WANG D J , et al . DIHBA: dynamic, invisible and high attack success rate boundary backdoor attack with low poison ratio [J ] . Computers & Security , 2023 , 129 : 103212 .

ZHONG N , QIAN Z X , ZHANG X P . Imperceptible backdoor attack: from input space to feature representation [C ] // Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence . California : IJCAI , 2022 : 1736 - 1742 .

GAO Y H , LI Y M , GONG X L , et al . Backdoor attack with sparse and invisible trigger [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 6364 - 6376 .

ZHAO S , TUAN L A , FU J , et al . Exploring clean label backdoor attacks and defense in language models [J ] . IEEE/ACM Transactions on Audio, Speech, and Language Processing , 2024 , 32 : 3014 - 3024 .

GAO Y H , LI Y M , ZHU L H , et al . Not all samples are born equal: towards effective clean-label backdoor attacks [J ] . Pattern Recognition , 2023 , 139 : 109512 .

ZENG Y , PAN M Z , JUST H A , et al . Narcissus: a practical clean-label backdoor attack with limited information [C ] // Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2023 : 771 - 785 .

GAO Y S , KIM Y , DOAN B G , et al . Design and evaluation of a multi-domain Trojan detection method on deep neural networks [J ] . IEEE Transactions on Dependable and Secure Computing , 2022 , 19 ( 4 ): 2349 - 2364 .

LI Y S , MA H , ZHANG Z , et al . NTD: non-transferability enabled deep learning backdoor detection [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 104 - 119 .

CHEN Z Z , WANG S , FU A M , et al . LinkBreaker: breaking the backdoor-trigger link in DNNs via neurons consistency check [J ] . IEEE Transactions on Information Forensics and Security , 2022 , 17 : 2000 - 2014 .

ZHANG J L , ZHU C C , SUN X B , et al . FLPurifier: backdoor defense in federated learning via decoupled contrastive training [J ] . IEEE Transactions on Information Forensics and Security , 2024 , 19 : 4752 - 4766 .

CHEN X Y , LIU C , LI B , et al . Targeted backdoor attacks on deep learning systems using data poisoning [J ] . arXiv Preprint arXiv: 1712.05526 , 2017 .

NICHOL A Q , DHARIWAL P . Improved denoising diffusion probabilistic models [C ] // Proceedings of the 38th International Conference on Machine Learning . New York : PMLR , 2021 : 8162 - 8171 .

DHARIWAL P , NICHOL A . Diffusion models beat GANs on image synthesis [C ] // the 35th Conference on Neural Information Processing Systems . 2021 : 8780 - 8794 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

DNS异常检测：大规模实验分析

基于代码相似性的软件漏洞检测研究进展

基于垂直分割的个人数据隐私保护方法

基于时空行为与静态属性分析的陌陌应用恶意用户检测方法

恶意软件检测和分类可视化技术综述