arXiv:2508.01932cs.CVcs.AI2025-08被引 1

通过解耦触发器与物体特征,提前发现并防御未知后门攻击。

Proactive Disentangled Modeling of Trigger-Object Pairings for Backdoor Defense

  • 用视觉语言模型将图像特征解耦为独立的触发器和物体成分。
  • 在CIFAR-10和GTSRB上对未见过的触发器-物体组合实现零样本检测。
  • 适合关注模型安全、后门防御的开发者和研究人员。

深度神经网络(DNN)和生成式AI(GenAI)正面临后门攻击威胁,攻击者在输入中嵌入触发器以诱导模型误分类目标标签。传统方法仅针对单一触发器,而攻击者可引入多个触发器覆盖不同类别,形成未见过的后门-物体组合,逃避常规检测。本文提出DBOM(解耦后门-物体建模)框架,通过结构化解耦,在数据集层面主动识别并中和已知及未知的后门威胁。DBOM利用预训练的视觉-语言模型(VLM),将输入图像表示分解为独立的触发器与物体原语,借助冻结的VLM编码器,结合可学习的视觉提示库与提示前缀调优,在嵌入空间中显式建模两者关系。通过引入触发器-物体分离损失与多样性损失,进一步分离触发器与物体视觉特征。通过对图像特征与分解融合后的上下文提示项在共享多模态空间中的对齐,DBOM实现对训练中未见的触发器-物体配对的零样本泛化,揭示更深层的对抗攻击模式。在CIFAR-10和GTSRB上的实验表明,DBOM可在下游训练前有效检测中毒图像,显著提升DNN训练流程的安全性。

原文摘要 · Abstract (English)

Deep neural networks (DNNs) and generative AI (GenAI) are increasingly vulnerable to backdoor attacks, where adversaries embed triggers into inputs to cause models to misclassify or misinterpret target labels. Beyond traditional single-trigger scenarios, attackers may inject multiple triggers across various object classes, forming unseen backdoor-object configurations that evade standard detection pipelines. In this paper, we introduce DBOM (Disentangled Backdoor-Object Modeling), a proactive framework that leverages structured disentanglement to identify and neutralize both seen and unseen backdoor threats at the dataset level. Specifically, DBOM factorizes input image representations by modeling triggers and objects as independent primitives in the embedding space through the use of Vision-Language Models (VLMs). By leveraging the frozen, pre-trained encoders of VLMs, our approach decomposes the latent representations into distinct components through a learnable visual prompt repository and prompt prefix tuning, ensuring that the relationships between triggers and objects are explicitly captured. To separate trigger and object representations in the visual prompt repository, we introduce the trigger-object separation and diversity losses that aids in disentangling trigger and object visual features. Next, by aligning image features with feature decomposition and fusion, as well as learned contextual prompt tokens in a shared multimodal space, DBOM enables zero-shot generalization to novel trigger-object pairings that were unseen during training, thereby offering deeper insights into adversarial attack patterns. Experimental results on CIFAR-10 and GTSRB demonstrate that DBOM robustly detects poisoned images prior to downstream training, significantly enhancing the security of DNN training pipelines.

后门防御解耦建模零样本检测视觉语言模型

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。