用对抗样本增强数据，有效防御CLIP模型的后门攻击
Adversarial Backdoor Defense in CLIP
- 用精心设计的对抗样本做数据增强，对齐特征空间
- 对BadNet、Blended等攻击的命中率降低超50%以上
- 适合关注多模态模型安全的AI研究者与工程师
多模态对比预训练模型（如CLIP）易受后门攻击。现有防御方法依赖传统数据增强以实现特征对齐，但无法捕捉后门样本的独特特征，导致防御效果不佳。观察发现，对抗样本与后门样本在受损模型的特征空间中具有相似性。基于此，我们提出对抗后门防御（ABD），一种新型数据增强策略，通过与精心构造的对抗样本对齐特征，有效破坏后门关联。实验表明，ABD能有效抵御针对CLIP的单模态和多模态后门攻击。相比当前最优防御方法CleanCLIP，ABD使BadNet、Blended和BadCLIP攻击成功率分别降低8.66%、10.52%和53.64%，同时仅造成1.73%的平均清洁准确率下降。
原文摘要 · Abstract (English)
Multimodal contrastive pretraining, exemplified by models like CLIP, has been found to be vulnerable to backdoor attacks. While current backdoor defense methods primarily employ conventional data augmentation to create augmented samples aimed at feature alignment, these methods fail to capture the distinct features of backdoor samples, resulting in suboptimal defense performance. Observations reveal that adversarial examples and backdoor samples exhibit similarities in the feature space within the compromised models. Building on this insight, we propose Adversarial Backdoor Defense (ABD), a novel data augmentation strategy that aligns features with meticulously crafted adversarial examples. This approach effectively disrupts the backdoor association. Our experiments demonstrate that ABD provides robust defense against both traditional uni-modal and multimodal backdoor attacks targeting CLIP. Compared to the current state-of-the-art defense method, CleanCLIP, ABD reduces the attack success rate by 8.66% for BadNet, 10.52% for Blended, and 53.64% for BadCLIP, while maintaining a minimal average decrease of just 1.73% in clean accuracy.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。