用分层反学习机制，让视觉Transformer在含毒数据上微调时自动清除后门
Using Interleaved Ensemble Unlearning to Keep Backdoors at Bay for Finetuning Vision Transformers
- 分两阶段：先训练浅层模型识别有毒样本，再用梯度上升反向清除
- 在3个数据集上抵御11种先进后门攻击，准确率保持90%以上
- 适用于多种ViT架构，适合安全敏感场景的模型微调
视觉变换器（ViTs）在计算机视觉任务中广泛应用。后门攻击会在推理时触发模型异常行为，威胁其性能，尤其在安全敏感任务中。尽管已有针对卷积神经网络（CNNs）的防御方法，但对ViTs效果不佳，且专用于ViTs的防御手段稀缺。为此，我们提出分层集成反学习（IEU），用于在含毒数据上微调纯净的ViT。第一阶段，训练一个浅层ViT，使其对含毒数据置信度高，对干净数据置信度低；第二阶段，该浅层模型作为“门控”阻止潜在污染数据进入目标防御模型，这些数据被加入反学习集合，并通过梯度上升异步清除。我们在三个数据集上验证了IEU对11种先进后门攻击的有效性，并展示了其在不同模型架构上的通用性。
原文摘要 · Abstract (English)
Vision Transformers (ViTs) have become popular in computer vision tasks. Backdoor attacks, which trigger undesirable behaviours in models during inference, threaten ViTs' performance, particularly in security-sensitive tasks. Although backdoor defences have been developed for Convolutional Neural Networks (CNNs), they are less effective for ViTs, and defences tailored to ViTs are scarce. To address this, we present Interleaved Ensemble Unlearning (IEU), a method for finetuning clean ViTs on backdoored datasets. In stage 1, a shallow ViT is finetuned to have high confidence on backdoored data and low confidence on clean data. In stage 2, the shallow ViT acts as a ``gate'' to block potentially poisoned data from the defended ViT. This data is added to an unlearn set and asynchronously unlearned via gradient ascent. We demonstrate IEU's effectiveness on three datasets against 11 state-of-the-art backdoor attacks and show its versatility by applying it to different model architectures.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。