用少量样本检测模型权重中的隐藏恶意代码,精度高且适应性强。
Model X-Ray: Detection of Hidden Malware in AI Model Weights using Few Shot Learning
- 将图像少样本学习迁移至模型权重检测,仅需6个样本即可训练
- 可识别最高25%嵌入率的恶意数据,远超以往100%-50%的阈值
- 只需学习一种攻击类型,即可抵御新型扩频隐写攻击,适合安全研究者
随着人工智能的快速发展和Model Zoo等平台的普及,AI模型被用于隐蔽恶意数据的风险日益增加。攻击者可通过隐写技术在模型权重中嵌入恶意代码,实现远程代码执行等破坏行为。本文提出一种基于新图像表示的少样本学习方法,将成熟图像识别技术迁移至模型权重安全检测领域。该方法将训练数据量从40000个模型大幅缩减至仅6个,同时在高达25%嵌入率下仍能稳定检测恶意内容(部分情况达6%),显著优于现有方法仅在100%-50%嵌入率有效的情况。通过严格评估策略,确保模型对多种因素具有泛化能力。实验表明,仅学习一种扩频隐写攻击,模型即可成功识别新型攻击,展现强大鲁棒性。代码已开源,推动该新兴领域的研究发展。
原文摘要 · Abstract (English)
The potential for exploitation of AI models has increased due to the rapid advancement of Artificial Intelligence (AI) and the widespread use of platforms like Model Zoo for sharing AI models. Attackers can embed malware within AI models through steganographic techniques, taking advantage of the substantial size of these models to conceal malicious data and use it for nefarious purposes, e.g. Remote Code Execution. Ensuring the security of AI models is a burgeoning area of research essential for safeguarding the multitude of organizations and users relying on AI technologies. This study leverages well-studied image few-shot learning techniques by transferring the AI models to the image field using a novel image representation. Applying few-shot learning in this field enables us to create practical models, a feat that previous works lack. Our method addresses critical limitations in state-of-the-art detection techniques that hinder their practicality. This approach reduces the required training dataset size from 40000 models to just 6. Furthermore, our methods consistently detect delicate attacks of up to 25% embedding rate and even up to 6% in some cases, while previous works were only shown to be effective for a 100%-50% embedding rate. We employ a strict evaluation strategy to ensure the trained models are generic concerning various factors. In addition, we show that our trained models successfully detect novel spread-spectrum steganography attacks, demonstrating the models' impressive robustness just by learning one type of attack. We open-source our code to support reproducibility and enhance the research in this new field.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。