用离散瓶颈破坏后门触发模式，实现高效防御数据投毒攻击
PUREVQ-GAN: Defending Data Poisoning Attacks through Vector-Quantized Bottlenecks
- 通过向量量化自编码器的离散瓶颈破坏细微触发特征
- 在CIFAR-10上对多种攻击实现0%毒化成功率，干净准确率达91-95%
- 比扩散模型类防御快50倍，适合实际训练流程
我们提出PureVQ-GAN，一种通过向量量化自编码器的离散瓶颈抵御数据投毒攻击的方法。该方法利用学习到的码本对中毒图像进行量化，破坏精细的触发模式，同时保留语义内容。生成对抗网络判别器确保输出符合自然图像分布，防止异常扰动的重建。在CIFAR-10上，PureVQ-GAN对梯度匹配和靶心多面体攻击的毒化成功率（PSR）为0%，对自恋攻击为1.64%，同时保持91-95%的干净准确率。相比需要数百次迭代优化的扩散模型类防御，PureVQ-GAN速度超过50倍，适用于实际训练流程。
原文摘要 · Abstract (English)
We introduce PureVQ-GAN, a defense against data poisoning that forces backdoor triggers through a discrete bottleneck using Vector-Quantized VAE with GAN discriminator. By quantizing poisoned images through a learned codebook, PureVQ-GAN destroys fine-grained trigger patterns while preserving semantic content. A GAN discriminator ensures outputs match the natural image distribution, preventing reconstruction of out-of-distribution perturbations. On CIFAR-10, PureVQ-GAN achieves 0% poison success rate (PSR) against Gradient Matching and Bullseye Polytope attacks, and 1.64% against Narcissus while maintaining 91-95% clean accuracy. Unlike diffusion-based defenses requiring hundreds of iterative refinement steps, PureVQ-GAN is over 50x faster, making it practical for real training pipelines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。