提出MergeGuard方法，有效防御机器学习模型中的后门攻击。
MergeGuard: Efficient Thwarting of Trojan Attacks in Machine Learning Models
- 通过线性化并合并全连接层，提升模型泛化能力。
- 在Transformer模型上保持准确率，降低后门攻击成功率。
- 适合需要防范第三方训练模型风险的应用场景。
本文提出MergeGuard，一种新型的AI后门攻击缓解方法。后门攻击会使嵌入触发器的输入被错误分类到攻击者指定类别，对由不可信第三方训练的模型可用性构成重大威胁。MergeGuard的核心是一种新的后训练方法，用于线性化并合并全连接层，我们证明该方法同时提升了模型的泛化能力和性能。概念验证评估表明，在Transformer模型上，MergeGuard在维持模型准确率的同时，显著降低了后门攻击的成功率，优于常见的微调类后训练缓解方法。
原文摘要 · Abstract (English)
This paper proposes MergeGuard, a novel methodology for mitigation of AI Trojan attacks. Trojan attacks on AI models cause inputs embedded with triggers to be misclassified to an adversary's target class, posing a significant threat to model usability trained by an untrusted third party. The core of MergeGuard is a new post-training methodology for linearizing and merging fully connected layers which we show simultaneously improves model generalizability and performance. Our Proof of Concept evaluation on Transformer models demonstrates that MergeGuard maintains model accuracy while decreasing trojan attack success rate, outperforming commonly used (post-training) Trojan mitigation by fine-tuning methodologies.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。