arXiv:2506.01444cs.LGcs.CV2025-06中稿 · KDD

无需干净数据集,通过方差分析识别并提取后门触发器。

Variance-Based Defense Against Blended Backdoor Attacks

  • 基于输入样本的输出方差定位异常类
  • 成功检测出图像数据集中被污染的类别
  • 适合缺乏干净数据的现实场景防御

后门攻击是一种隐蔽但有效的针对AI模型的攻击方式,攻击者在训练阶段篡改少量数据,在输入中嵌入特定触发器并修改标签,使模型在正常数据上表现良好,但在触发器出现时产生恶意输出。现有防御方法通常依赖干净数据集来计算统计异常,但在真实场景中可能不可行。本文提出一种新防御方法:在给定数据集上训练模型,通过分析输出方差识别被污染的类别,提取攻击触发器的关键部分,并定位中毒样本。该方法增强了可解释性,明确揭示了触发器的有害部分。实验在多个知名图像数据集上验证,与SCAn、ABL和AGPD三种先进算法相比,展现了更强的检测能力。

原文摘要 · Abstract (English)

Backdoor attacks represent a subtle yet effective class of cyberattacks targeting AI models, primarily due to their stealthy nature. The model behaves normally on clean data but exhibits malicious behavior only when the attacker embeds a specific trigger into the input. This attack is performed during the training phase, where the adversary corrupts a small subset of the training data by embedding a pattern and modifying the labels to a chosen target. The objective is to make the model associate the pattern with the target label while maintaining normal performance on unaltered data. Several defense mechanisms have been proposed to sanitize training data-sets. However, these methods often rely on the availability of a clean dataset to compute statistical anomalies, which may not always be feasible in real-world scenarios where datasets can be unavailable or compromised. To address this limitation, we propose a novel defense method that trains a model on the given dataset, detects poisoned classes, and extracts the critical part of the attack trigger before identifying the poisoned instances. This approach enhances explainability by explicitly revealing the harmful part of the trigger. The effectiveness of our method is demonstrated through experimental evaluations on well-known image datasets and comparative analysis against three state-of-the-art algorithms: SCAn, ABL, and AGPD.

后门防御数据清洗可解释性图像安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。