在数据有限下，通过推理搜索精准识别深度模型后门攻击。
DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Data
- 基于前向传播逆推后门触发器，不依赖训练数据。
- 在多种攻击、模型和数据集上检测准确率接近100%。
- 适合安全关键系统部署前的模型审计，无需完整训练数据。
后门攻击是深度学习中最有效、最实用且最隐蔽的攻击之一。本文关注开发者从第三方获取深度模型并用于安全关键系统时的检测场景。我们发现现有检测方法多基于不适用的假设。为此，提出一种新框架，在现实约束下检测后门攻击。通过在可能触发器空间中进行演绎搜索生成候选触发器，并以平滑化后的攻击成功率作为优化目标。仅使用模型前向传播，从一类模板攻击出发，逆向工程出后门攻击。在多种攻击、模型和数据集上进行了广泛评估，该方法在各类设置中表现近乎完美。
原文摘要 · Abstract (English)
Backdoor attacks are among the most effective, practical, and stealthy attacks in deep learning. In this paper, we consider a practical scenario where a developer obtains a deep model from a third party and uses it as part of a safety-critical system. The developer wants to inspect the model for potential backdoors prior to system deployment. We find that most existing detection techniques make assumptions that are not applicable to this scenario. In this paper, we present a novel framework for detecting backdoors under realistic restrictions. We generate candidate triggers by deductively searching over the space of possible triggers. We construct and optimize a smoothed version of Attack Success Rate as our search objective. Starting from a broad class of template attacks and just using the forward pass of a deep model, we reverse engineer the backdoor attack. We conduct extensive evaluation on a wide range of attacks, models, and datasets, with our technique performing almost perfectly across these settings.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。