通过信息瓶颈分析后门攻击的动态特性，发现显眼攻击反而更隐蔽。
Exploring Dynamic Properties of Backdoor Training Through Information Bottleneck
- 用信息瓶颈原理分析后门数据对模型训练的影响
- 显眼攻击（如BadNets）在信息层面更难被察觉
- 提出基于动态特性的新隐蔽性评估指标
理解后门数据如何影响神经网络训练过程仍是复杂且未充分探索的挑战。本文通过与内部表征聚类相关的信息瓶颈（IB）原理，系统分析了后门数据对学习过程的影响，特别关注目标类与其他干净类之间的差异行为。研究发现，后门攻击会生成独特的互信息（MI）签名，其随训练阶段演变，并因攻击机制不同而异。令人意外的是，视觉上明显的攻击（如BadNets）在信息论视角下具有更高的隐蔽性，比许多视觉不可察觉的攻击更自然地融入模型。基于此洞察，我们提出一种新的、基于动态特性的隐蔽性度量方法，用于量化攻击在模型层面的融合程度。我们在多个数据集和多种攻击类型上验证了结论与度量的有效性，为理解与评估后门威胁提供了新维度。代码已公开于：https://github.com/XinyuLiu71/Information_Bottleneck_Backdoor.git。
原文摘要 · Abstract (English)
Understanding how backdoor data influences neural network training dynamics remains a complex and underexplored challenge. In this paper, we present a rigorous analysis of the impact of backdoor data on the learning process, with a particular focus on the distinct behaviors between the target class and other clean classes. Leveraging the Information Bottleneck (IB) principle connected with clustering of internal representation, We find that backdoor attacks create unique mutual information (MI) signatures, which evolve across training phases and differ based on the attack mechanism. Our analysis uncovers a surprising trade-off: visually conspicuous attacks like BadNets can achieve high stealthiness from an information-theoretic perspective, integrating more seamlessly into the model than many visually imperceptible attacks. Building on these insights, we propose a novel, dynamics-based stealthiness metric that quantifies an attack's integration at the model level. We validate our findings and the proposed metric across multiple datasets and diverse attack types, offering a new dimension for understanding and evaluating backdoor threats. Our code is available in: https://github.com/XinyuLiu71/Information_Bottleneck_Backdoor.git.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。