发现并高效检测CLIP模型中的后门样本，仅需15分钟可清理百万级数据集。
Detecting Backdoor Samples in Contrastive Language Image Pretraining
- 利用局部稀疏性差异识别后门样本的特征。
- 在0.01%污染率下实现近乎完美的攻击成功率，但可被传统密度检测器有效捕获。
- 适用于清洗大规模预训练数据集，尤其适合关注模型安全的研究者。
对比语言图像预训练（CLIP）模型易受投毒后门攻击，攻击者仅需污染0.01%的训练数据即可实现几乎完美的攻击成功率，引发对使用未审查网络数据进行大规模预训练的安全担忧。本文分析了被污染样本在CLIP模型中学习到的表示，发现其局部子空间具有独特特征：局部邻域比正常样本更稀疏。基于此，我们系统研究了CLIP后门攻击的检测方法，表明传统基于密度比的局部异常检测器可高效准确地识别此类攻击，而现有方法则失效。实验还揭示原始CC3M数据集中已存在无意后门，并被训练进OpenCLIP发布的开源模型中。借助本检测器，可在4块Nvidia A100 GPU上15分钟内高效清理百万级网络数据集（如CC3M）。代码已公开于GitHub。
原文摘要 · Abstract (English)
Contrastive language-image pretraining (CLIP) has been found to be vulnerable to poisoning backdoor attacks where the adversary can achieve an almost perfect attack success rate on CLIP models by poisoning only 0.01\% of the training dataset. This raises security concerns on the current practice of pretraining large-scale models on unscrutinized web data using CLIP. In this work, we analyze the representations of backdoor-poisoned samples learned by CLIP models and find that they exhibit unique characteristics in their local subspace, i.e., their local neighborhoods are far more sparse than that of clean samples. Based on this finding, we conduct a systematic study on detecting CLIP backdoor attacks and show that these attacks can be easily and efficiently detected by traditional density ratio-based local outlier detectors, whereas existing backdoor sample detection methods fail. Our experiments also reveal that an unintentional backdoor already exists in the original CC3M dataset and has been trained into a popular open-source model released by OpenCLIP. Based on our detector, one can clean up a million-scale web dataset (e.g., CC3M) efficiently within 15 minutes using 4 Nvidia A100 GPUs. The code is publicly available in our \href{https://github.com/HanxunH/Detect-CLIP-Backdoor-Samples}{GitHub repository}.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。