仅用一个恶意样本即可成功植入后门，且不损害模型正常性能。
Provable one-poison backdoor attacks on linear models and ReLU neural networks
- 仅需一个毒化样本，无需了解具体数据内容。
- 对线性模型和ReLU网络均能实现零后门误差注入。
- 适合研究模型安全性的研究人员参考。
后门中毒攻击威胁在不可信源收集的数据上训练的机器学习模型；此类攻击可使模型在特定输入下触发恶意行为。以往工作已建立后门攻击成功率及对正常学习任务影响的理论边界，但关于成功攻击所需毒化数据量仍存疑问。典型攻击要么使用少量样本但需大量数据细节信息，要么需毒化大量样本。本文证明，攻击者可在不了解具体训练数据的前提下，仅凭输入空间的粗略几何约束和训练参数，用单个毒化样本成功实施后门攻击。我们为线性模型和多层感知机（MLP）识别出可保证成功的条件，确保后门攻击误差为零，且对正常学习任务性能影响极小。
原文摘要 · Abstract (English)
Backdoor poisoning attacks are a threat to machine learning models that are trained on data collected from untrusted sources; these attacks enable attackers to inject malicious behavior into the model that can be triggered by specially crafted inputs. Prior work has established bounds on the success of backdoor attacks and their impact on the benign learning task, however, an open question is what amount of poison data is needed for a successful backdoor attack. Typical attacks either use few samples but need much information about the data points, or need to poison many data points. In this paper, we show that an adversary can mount a one-poison backdoor attack without knowledge of individual training data, requiring only coarse geometric bounds of the input space and training parameters. We identify provably sufficient conditions that allow an adversary with one poison sample with high probability to inject a backdoor into linear models and MLPs. We show that our backdoor has zero backdooring error and the injection does not significantly impact the benign learning task performance.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。