通过细粒度文本对齐增强防御,显著提升对比学习模型抗后门攻击能力。
CleanerCLIP: Fine-grained Counterfactual Semantic Augmentation for Backdoor Defense in Contrastive Learning
- 设计细粒度文本对齐清洗器,动态生成正负文本并匹配图像强化自监督
- 在ImageNet1K上对六种攻击方法测试,对顶1和顶10错误率降低超50%
- 适合关注多模态模型安全、需轻量级防御方案的研究者与工程师
预训练的多模态对比学习模型(如CLIP)在工业界广泛应用,但极易受到数据投毒后门攻击,威胁下游模型训练。相比重新训练大型模型,微调是更简便高效的防御方式。然而,在无监督和半监督场景下,现有微调防御策略如CleanCLIP面对复杂攻击时表现受限,其文本同义替换不足以增强文本特征空间。为此,本文提出细粒度文本对齐清洗器(TA-Cleaner),在每个训练轮次随机选取样本生成正负子文本,并将其对齐至图像,强化文本自监督能力。我们在六种攻击算法下评估该方法,并在ImageNet1K上进行零样本分类测试。实验表明,TA-Cleaner在基于微调的防御中达到最新性能;即使面对新型攻击BadCLIP,其对Top-1和Top-10错误率分别降低52.02%和63.88%,显著优于CleanCLIP。
原文摘要 · Abstract (English)
Pre-trained large models for multimodal contrastive learning, such as CLIP, have been widely recognized in the industry as highly susceptible to data-poisoned backdoor attacks. This poses significant risks to downstream model training. In response to such potential threats, finetuning offers a simpler and more efficient defense choice compared to retraining large models with augmented data. In the supervised learning domain, fine-tuning defense strategies can achieve excellent defense performance. However, in the unsupervised and semi-supervised domain, we find that when CLIP faces some complex attack techniques, the existing fine-tuning defense strategy, CleanCLIP, has some limitations on defense performance. The synonym substitution of its text-augmentation is insufficient to enhance the text feature space. To compensate for this weakness, we improve it by proposing a fine-grained \textbf{T}ext \textbf{A}lignment \textbf{C}leaner (TA-Cleaner) to cut off feature connections of backdoor triggers. We randomly select a few samples for positive and negative subtext generation at each epoch of CleanCLIP, and align the subtexts to the images to strengthen the text self-supervision. We evaluate the effectiveness of our TA-Cleaner against six attack algorithms and conduct comprehensive zero-shot classification tests on ImageNet1K. Our experimental results demonstrate that TA-Cleaner achieves state-of-the-art defensiveness among finetuning-based defense techniques. Even when faced with the novel attack technique BadCLIP, our TA-Cleaner outperforms CleanCLIP by reducing the ASR of Top-1 and Top-10 by 52.02\% and 63.88\%, respectively.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。