提出协同选样与触发组件,提升无标签污染后门攻击的成功率和隐蔽性。
A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers
- 设计三组件协同机制,联合优化样本选择与触发策略。
- 在多种攻击场景下实现超过90%的成功率,且隐蔽性显著增强。
- 适用于各类后门攻击框架,适合防御研究者参考。
毒化仅限的干净标签后门攻击通过仅污染数据集而不修改标签,隐蔽植入攻击者期望行为。为有效植入后门,需针对不同需求设计多种触发器以平衡攻击成功率(ASR)与隐蔽性。同时,通过精心挑选“难样本”而非随机样本进行毒化,可提升干净标签攻击的ASR。然而,现有方法通常孤立处理样本选择与触发设计,导致在性能上改进有限;简单堆叠各方法也无法在转换为通用后门攻击(PCBA)时获得理想表现。因此,本文探索样本选择与触发之间的双向协同关系,并提出一组通用组件:组件A识别两个关键选择因素,根据触发规模合理组合,以选取更优的“难样本”提升ASR;组件B通过选择与触发样本相似的样本,增强隐蔽性;组件C基于人眼对RGB色彩敏感度差异,重新分配触发强度,在保证隐蔽性的前提下进一步提升ASR。所有组件可灵活集成至不同PCBA中,显著提升攻击效果并保持泛化能力。
原文摘要 · Abstract (English)
Poison-only Clean-label Backdoor Attacks aim to covertly inject attacker-desired behavior into DNNs by merely poisoning the dataset without changing the labels. To effectively implant a backdoor, multiple \textbf{triggers} are proposed for various attack requirements of Attack Success Rate (ASR) and stealthiness. Additionally, sample selection enhances clean-label backdoor attacks' ASR by meticulously selecting ``hard'' samples instead of random samples to poison. Current methods 1) usually handle the sample selection and triggers in isolation, leading to severely limited improvements on both ASR and stealthiness. Consequently, attacks exhibit unsatisfactory performance on evaluation metrics when converted to PCBAs via a mere stacking of methods. Therefore, we seek to explore the bidirectional collaborative relations between the sample selection and triggers to address the above dilemma. 2) Since the strong specificity within triggers, the simple combination of sample selection and triggers fails to substantially enhance both evaluation metrics, with generalization preserved among various attacks. Therefore, we seek to propose a set of components to significantly improve both stealthiness and ASR based on the commonalities of attacks. Specifically, Component A ascertains two critical selection factors, and then makes them an appropriate combination based on the trigger scale to select more reasonable ``hard'' samples for improving ASR. Component B is proposed to select samples with similarities to relevant trigger implanted samples to promote stealthiness. Component C reassigns trigger poisoning intensity on RGB colors through distinct sensitivity of the human visual system to RGB for higher ASR, with stealthiness ensured by sample selection, including Component B. Furthermore, all components can be strategically integrated into diverse PCBAs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。