基于样本原生特征的投毒防御方法  

Poisoning defense method based on original features of samples

作　　者：刘枭天 郝晓燕 马垚 于丹 陈永乐 LIU Xiao-tian;HAO Xiao-yan;MA Yao;YU Dan;CHEN Yong-le(College of Information and Computer,Taiyuan University of Technology,Jinzhong 030600,China)

机构地区：[1]太原理工大学信息与计算机学院,山西晋中030600

出　　处：《计算机工程与设计》2024年第3期663-668,共6页Computer Engineering and Design

基　　金：山西省基础研究计划基金项目(20210302123131、20210302124395);山西省自然科学基金面上基金项目(202203021221234)。

摘　　要：为解决机器学习模型中投毒样本的注入问题,提出一种基于样本原生特征的投毒防御算法infoGAN_Defense。基于投毒样本的制作原理设计投毒样本原生特征的提取方法,提高模型对样本原生特征的训练权重;在此基础上,利用样本原生特征的不变性进行投毒防御,引入样本原生特征与人为特征的概念,采用耦合infoGAN结构实现样本特征的分离及提取;进行机器学习模型的重训练。在真实数据集上设计实验评估防御效果,其结果验证了infoGAN_Defense算法的可行性和有效性。To solve the injection problem of poisoned samples in machine learning models,a poisoning defense algorithm infoGAN_Defense based on the original features of samples was proposed.Based on the production principle of poisoned samples,the extraction method of the original features of the poisoned samples was designed,and the training weight of the model on the ori-ginal features of the samples was improved.On this basis,poisoning defense was carried out using the invariance of the original features of the sample,the concepts of the original features of the samples and the artificial features were introduced,the coupling infoGAN structure was used to realize the separation and extraction of the sample features,and the machine learning model was retrained.By designing experiments on real datasets to evaluate the defense effect,the feasibility and effectiveness of the infoGAN_Defense algorithm are verified.

关 键 词：投毒样本 原生特征 人为特征 机器学习安全 数据投毒攻击 投毒防御 生成对抗网络 

分 类 号：TP389.1[自动化与计算机技术—计算机系统结构]