利用量化操作植入后门，模型性能几乎不受影响。
Rounding-Guided Backdoor Injection in Deep Learning Model Quantization
- 通过优化权重舍入方向，在不修改训练数据的前提下植入后门。
- 多数情况下攻击成功率接近100%，精度损失可忽略。
- 能绕过现有防御机制，适合关注模型安全的研究者。
模型量化是部署深度学习模型于资源受限环境的常用技术，但可能引入未被重视的安全风险。本文提出QuRA，一种新型后门攻击，利用量化过程嵌入恶意行为。与依赖数据污染或训练篡改的传统方法不同，QuRA仅通过量化操作实现。具体而言，它首先采用新颖的权重选择策略，识别影响后门目标的关键权重（同时兼顾模型整体性能）；随后通过优化这些权重的舍入方向，在不降低准确率的前提下放大跨层后门效应。大量实验表明，QuRA在多数情况下实现近100%的攻击成功率，且性能下降微乎其微。此外，我们证明了QuRA可适应以规避现有后门防御，凸显其威胁性。研究揭示了广泛使用的模型量化流程中的关键漏洞，强调需加强安全防护。代码已开源：https://github.com/cxx122/QuRA。
原文摘要 · Abstract (English)
Model quantization is a popular technique for deploying deep learning models on resource-constrained environments. However, it may also introduce previously overlooked security risks. In this work, we present QuRA, a novel backdoor attack that exploits model quantization to embed malicious behaviors. Unlike conventional backdoor attacks relying on training data poisoning or model training manipulation, QuRA solely works using the quantization operations. In particular, QuRA first employs a novel weight selection strategy to identify critical weights that influence the backdoor target (with the goal of perserving the model's overall performance in mind). Then, by optimizing the rounding direction of these weights, we amplify the backdoor effect across model layers without degrading accuracy. Extensive experiments demonstrate that QuRA achieves nearly 100% attack success rates in most cases, with negligible performance degradation. Furthermore, we show that QuRA can adapt to bypass existing backdoor defenses, underscoring its threat potential. Our findings highlight critical vulnerability in widely used model quantization process, emphasizing the need for more robust security measures. Our implementation is available at https://github.com/cxx122/QuRA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。