arXiv:2511.06072cs.LGcs.CR2025-11被引 1

通过编码转换实现表格数据通用后门攻击,隐蔽性强且成功率高达100%。

CatBack: Universal Backdoor Attacks on Tabular Data via Categorical Encoding

  • 将类别特征转为浮点数表示,生成对所有特征通用的梯度扰动
  • 在5个数据集上白盒与黑盒攻击成功率均达100%
  • 可绕过多种主流防御机制,适合研究模型安全性的学者

机器学习中的后门攻击因能隐蔽地破坏模型而受到广泛关注,但现有研究多集中于图像等同质数据。本文针对包含数值与类别特征的表格数据,提出一种新型后门攻击方法。核心思想是将类别值转化为浮点数表示,相比传统的一次性编码或序数编码,该方法在保持干净模型准确率的同时,使梯度基通用扰动可作用于所有特征(包括类别特征)。我们在五个数据集和四种主流模型上评估该方法,结果表明在白盒与黑盒设置下(包括真实应用如Vertex AI)攻击成功率最高可达100%,显著优于此前的Tabdoor等方法。同时,该攻击对谱签名、Neural Cleanse、Beatrix及细粒度修剪等先进防御机制均无效,且能成功规避常见异常检测手段,揭示了表格数据模型的严重安全隐患。

原文摘要 · Abstract (English)

Backdoor attacks in machine learning have drawn significant attention for their potential to compromise models stealthily, yet most research has focused on homogeneous data such as images. In this work, we propose a novel backdoor attack on tabular data, which is particularly challenging due to the presence of both numerical and categorical features. Our key idea is a novel technique to convert categorical values into floating-point representations. This approach preserves enough information to maintain clean-model accuracy compared to traditional methods like one-hot or ordinal encoding. By doing this, we create a gradient-based universal perturbation that applies to all features, including categorical ones. We evaluate our method on five datasets and four popular models. Our results show up to a 100% attack success rate in both white-box and black-box settings (including real-world applications like Vertex AI), revealing a severe vulnerability for tabular data. Our method is shown to surpass the previous works like Tabdoor in terms of performance, while remaining stealthy against state-of-the-art defense mechanisms. We evaluate our attack against Spectral Signatures, Neural Cleanse, Beatrix, and Fine-Pruning, all of which fail to defend successfully against it. We also verify that our attack successfully bypasses popular outlier detection mechanisms.

后门攻击表格数据模型安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。