arXiv:2502.00646cs.CRcs.AI2025-02KDD被引 4

无需访问训练数据,即可对时间序列分类模型实施隐蔽后门攻击。

TrojanTime: Backdoor Attacks on Time Series Classification

  • 用对抗攻击生成伪数据集,绕过数据访问限制
  • 在四个时间序列模型上实现100%攻击成功率,干净准确率仍超90%
  • 适合研究模型安全或防御后门的学者参考

时间序列分类(TSC)极易受到后门攻击,构成重大安全威胁。现有方法主要聚焦训练阶段的数据投毒,设计复杂触发器以提升隐蔽性和攻击成功率(ASR)。但在实际场景中,攻击者往往无法获取训练数据,且模型需在保持对干净测试数据泛化能力的同时,对污染输入仍具脆弱性。为此,我们提出TrojanTime,一种两阶段训练算法。第一阶段通过外部任意数据集,利用目标对抗攻击生成伪数据集,并持续训练干净模型及其污染版本。第二阶段采用精心设计的策略,结合logits对齐与批量归一化冻结,确保泛化能力。我们在涵盖四个不同领域、来自UCR基准数据集的四种时间序列分类架构上,使用五种触发器评估了TrojanTime。结果表明,该方法能有效执行后门攻击,同时维持高干净准确率。最后,为应对这一威胁,我们提出一种防御性遗忘策略,可显著降低攻击成功率,同时保留干净准确率。

原文摘要 · Abstract (English)

Time Series Classification (TSC) is highly vulnerable to backdoor attacks, posing significant security threats. Existing methods primarily focus on data poisoning during the training phase, designing sophisticated triggers to improve stealthiness and attack success rate (ASR). However, in practical scenarios, attackers often face restrictions in accessing training data. Moreover, it is a challenge for the model to maintain generalization ability on clean test data while remaining vulnerable to poisoned inputs when data is inaccessible. To address these challenges, we propose TrojanTime, a novel two-step training algorithm. In the first stage, we generate a pseudo-dataset using an external arbitrary dataset through target adversarial attacks. The clean model is then continually trained on this pseudo-dataset and its poisoned version. To ensure generalization ability, the second stage employs a carefully designed training strategy, combining logits alignment and batch norm freezing. We evaluate TrojanTime using five types of triggers across four TSC architectures in UCR benchmark datasets from diverse domains. The results demonstrate the effectiveness of TrojanTime in executing backdoor attacks while maintaining clean accuracy. Finally, to mitigate this threat, we propose a defensive unlearning strategy that effectively reduces the ASR while preserving clean accuracy.

时间序列后门攻击模型安全对抗样本

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。