无需数据即可检测并恢复自监督模型中的木马输入
TrojanDec: Data-free Detection of Trojan Inputs in Self-supervised Learning
- 基于自监督编码器，通过无数据方式判断输入是否含触发器
- 在多种先进木马攻击下仍能准确识别并还原受污染输入
- 适合需要安全检测的下游应用，如医疗影像、自动驾驶
自监督学习预训练的图像编码器可作为通用特征提取器，用于构建各类下游分类器。然而，已有研究证实攻击者可在编码器中植入木马，导致基于该编码器构建的多个下游分类器同时继承木马行为。本文提出 TrojanDec，首个无需训练数据的木马输入检测与恢复方法。给定一个（被污染或干净的）编码器和测试输入，TrojanDec 首先判断输入是否含触发器；若未被污染，则正常处理以保持实用性；若被污染，则进一步恢复以去除触发器。大量实验表明，TrojanDec 能有效识别并恢复在主流木马攻击下的受污染输入，且性能优于现有最先进防御方法。
原文摘要 · Abstract (English)
An image encoder pre-trained by self-supervised learning can be used as a general-purpose feature extractor to build downstream classifiers for various downstream tasks. However, many studies showed that an attacker can embed a trojan into an encoder such that multiple downstream classifiers built based on the trojaned encoder simultaneously inherit the trojan behavior. In this work, we propose TrojanDec, the first data-free method to identify and recover a test input embedded with a trigger. Given a (trojaned or clean) encoder and a test input, TrojanDec first predicts whether the test input is trojaned. If not, the test input is processed in a normal way to maintain the utility. Otherwise, the test input will be further restored to remove the trigger. Our extensive evaluation shows that TrojanDec can effectively identify the trojan (if any) from a given test input and recover it under state-of-the-art trojan attacks. We further demonstrate by experiments that our TrojanDec outperforms the state-of-the-art defenses.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。