用激光实现远程可控的神经网络后门攻击，隐蔽性强且效果好。
LaserGuider: A Laser Based Physical Backdoor Attack against Deep Neural Networks
- 用激光作为触发器，实现远程、即时、可移动的物理后门攻击。
- 在交通标志识别模型上攻击成功率超90%，正常输入几乎不受影响。
- 提出优化激光参数的方法，并发布首个含激光标记的真实交通标志数据集。
后门攻击在深度神经网络中嵌入触发器与目标之间的隐藏关联，使模型在出现触发器时输出特定目标，而正常情况下表现如常。物理后门攻击虽可行，但缺乏远程控制、时间隐蔽性、灵活性和移动性。为此，本文提出一种基于激光的新型触发器，具备远距离传输和瞬时成像特性。基于此，我们设计了名为LaserGuider的物理后门攻击方法，实现了远程控制，并具备高时间隐蔽性、灵活性与移动性。我们还提出系统性方法优化激光参数以提升攻击效果。在自动驾驶关键任务——交通标志识别模型上的评估表明，使用三种不同激光触发器的LaserGuider均实现超过90%的攻击成功率，对正常输入影响微乎其微。此外，我们发布了LaserMark，首个包含真实世界交通标志上激光标记的数据集，以支持后门攻击与防御的进一步研究。
原文摘要 · Abstract (English)
Backdoor attacks embed hidden associations between triggers and targets in deep neural networks (DNNs), causing them to predict the target when a trigger is present while maintaining normal behavior otherwise. Physical backdoor attacks, which use physical objects as triggers, are feasible but lack remote control, temporal stealthiness, flexibility, and mobility. To overcome these limitations, in this work, we propose a new type of backdoor triggers utilizing lasers that feature long-distance transmission and instant-imaging properties. Based on the laser-based backdoor triggers, we present a physical backdoor attack, called LaserGuider, which possesses remote control ability and achieves high temporal stealthiness, flexibility, and mobility. We also introduce a systematic approach to optimize laser parameters for improving attack effectiveness. Our evaluation on traffic sign recognition DNNs, critical in autonomous vehicles, demonstrates that LaserGuider with three different laser-based triggers achieves over 90% attack success rate with negligible impact on normal inputs. Additionally, we release LaserMark, the first dataset of real world traffic signs stamped with physical laser spots, to support further research in backdoor attacks and defenses.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。