提出防御半监督学习后门攻击的新方法，有效抑制恶意触发器影响。
Filter, Obstruct and Dilute: Defending Against Backdoor Attacks on Semi-Supervised Learning
- 通过滤波、互补学习和触发混合三策略，从数据到特征层阻断后门关联
- 在多种攻击下平均成功率从84.7%降至1.8%，保持干净数据准确率
- 适用于高风险场景的模型安全加固，对防御研究者有参考价值
近期研究证实半监督学习（SSL）易受数据投毒后门攻击。即使少量污染数据，也能使现有SSL方法在测试阶段产生高达90%的错误输出。针对这一新兴威胁，本文提出防御方案，是该领域少数工作之一。我们发现，攻击者植入的后门触发器与目标类别之间的虚假相关性是导致预测被操纵的根本原因。为此，提出三种技术：高斯滤波、互补学习和触发混合，分别在数据预处理和特征学习阶段实现过滤、阻断与稀释后门影响。实验表明，所提方法Backdoor Invalidator（BI）将多种先进后门攻击的平均成功率从84.7%降低至1.8%。此外，BI不损害干净数据上的精度，并具备理论支持的泛化能力。
原文摘要 · Abstract (English)
Recent studies have verified that semi-supervised learning (SSL) is vulnerable to data poisoning backdoor attacks. Even a tiny fraction of contaminated training data is sufficient for adversaries to manipulate up to 90\% of the test outputs in existing SSL methods. Given the emerging threat of backdoor attacks designed for SSL, this work aims to protect SSL against such risks, marking it as one of the few known efforts in this area. Specifically, we begin by identifying that the spurious correlations between the backdoor triggers and the target class implanted by adversaries are the primary cause of manipulated model predictions during the test phase. To disrupt these correlations, we utilize three key techniques: Gaussian Filter, complementary learning and trigger mix-up, which collectively filter, obstruct and dilute the influence of backdoor attacks in both data pre-processing and feature learning. Experimental results demonstrate that our proposed method, Backdoor Invalidator (BI), significantly reduces the average attack success rate from 84.7\% to 1.8\% across different state-of-the-art backdoor attacks. It is also worth mentioning that BI does not sacrifice accuracy on clean data and is supported by a theoretical guarantee of its generalization capability.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。