Label-Consistent Backdoor Attacks
Alexander Turner MIT Dimitris Tsipras MIT Aleksander Mądry MIT
Abstract
Deep neural networks have been demonstrated to be vulnerable to backdoor attacks. Specifically, by injecting a small number of maliciously constructed inputs into the training set, an adversary is able to plant a backdoor into the trained model. This backdoor can then be activated during inference by a backdoor trigger to fully control the model’s behavior. While such attacks are very effective, they crucially rely on the adversary injecting arbitrary inputs that are—often blatantly—mislabeled. Such samples would raise suspicion upon human inspection, potentially revealing the attack. Thus, for backdoor attacks to remain undetected, it is crucial that they maintain label-consistency—the condition that injected inputs are consistent with their labels. In this work, we leverage adversarial perturbations and generative models to execute efficient, yet label-consistent, backdoor attacks. Our approach is based on injecting inputs that appear plausible, yet are hard to classify, hence causing the model to rely on the (easier-to-learn) backdoor trigger.
中文速览
深度神经网络存在一种叫做"后门攻击"（backdoor attack）的安全漏洞——攻击者只需向训练集中注入少量恶意样本，就能让模型在推理时被特定触发器操控，输出攻击者指定的标签。然而，传统后门攻击的致命弱点在于注入的样本标签明显错误，稍加人工排查或简单异常检测便会露馅。这篇论文提出了一种"标签一致性"后门攻击方案：利用对抗扰动（adversarial perturbation）和生成对抗网络（GAN）的隐空间插值，将注入样本改造得"表面正确、实则难以分类"，迫使模型依赖更容易学习的后门触发器来完成分类，同时样本标签对人类来说看起来完全合理。实验表明，两种方法均能在保持标签一致性的前提下实现高攻击成功率，并能对抗常见的数据过滤和检测手段。这一工作揭示了后门攻击即便经过人工审核也可能难以察觉，对机器学习系统的供应链安全提出了更严峻的挑战。
原文 arXiv:1912.02771;中英对照 + 大白话阅读 https://aha.fim.ai/paper/1912.02771v2