用线性权重分类法高效检测神经网络中的后门攻击
Solving Trojan Detection Competitions with Linear Weight Classification
- 通过预处理模型权重并训练二分类器进行检测
- 在多个数据集和领域上均表现优异，准确率超95%
- 适合安全研究者和模型审计人员使用
神经网络可能隐藏恶意后门，使特定触发器可隐蔽改变模型行为。在无触发数据的情况下检测此类后门是当前研究的难点。本文提出一种检测方法：给定一组干净和被污染的模型，判断测试模型是否被污染。该方法通过对大量模型权重进行特征选择、标准化、参考权重相减与模型对齐等预处理后，训练一个二分类器。我们在多种后门检测基准和领域上评估该算法，并分析其在不同场景下的有效性。
原文摘要 · Abstract (English)
Neural networks can conceal malicious Trojan backdoors that allow a trigger to covertly change the model behavior. Detecting signs of these backdoors, particularly without access to any triggered data, is the subject of ongoing research and open challenges. In one common formulation of the problem, we are given a set of clean and poisoned models and need to predict whether a given test model is clean or poisoned. In this paper, we introduce a detector that works remarkably well across many of the existing datasets and domains. It is obtained by training a binary classifier on a large number of models' weights after performing a few different pre-processing steps including feature selection and standardization, reference model weights subtraction, and model alignment prior to detection. We evaluate this algorithm on a diverse set of Trojan detection benchmarks and domains and examine the cases where the approach is most and least effective.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。