无需先验知识，检测视觉语言模型中的后门攻击
Assimilation Matters: Model-level Backdoor Detection in Vision-Language Pretrained Models
- 通过分析触发词注意力集中现象，发现后门样本特征同质化
- 在3600个模型上实现89.9%的检测F1分数，5分钟完成一次检测
- 适用于真实场景，可识别自然存在与人为注入的后门行为
视觉-语言预训练模型（如CLIP）虽取得显著成果，却极易受到后门攻击。当模型由不可信第三方微调时，判断其是否被注入后门是一项关键挑战。现有方法通常依赖训练数据、触发器或下游分类器等先验信息，难以用于实际场景。为此，本文提出无需任何先验知识的模型级检测框架AMDET。首先揭示后门文本编码器中特征同质化现象：后门样本内所有标记表示高度相似，源于注意力权重集中于触发词。基于此，AMDET通过梯度反演恢复隐含特征以激活后门行为。进一步发现OpenAI官方CLIP模型中存在自然后门特征，虽非有意植入但仍具后门特性。通过损失曲面分析将其与真实后门分离。在两种攻击范式、三种模型结构下对3600个后门及正常微调模型进行实验，AMDET达到89.90% F1分数，单次检测仅需约5分钟（RTX 4090 GPU），且对自适应攻击具有强鲁棒性。代码已开源。
原文摘要 · Abstract (English)
Vision-language pretrained models (VLPs) such as CLIP have achieved remarkable success, but are also highly vulnerable to backdoor attacks. Given a model fine-tuned by an untrusted third party, determining whether the model has been injected with a backdoor is a critical and challenging problem. Existing detection methods usually rely on prior knowledge of training dataset, backdoor triggers and targets, or downstream classifiers, which may be impractical for real-world applications. To address this, To address this challenge, we introduce Assimilation Matters in DETection (AMDET), a novel model-level detection framework that operates without any such prior knowledge. Specifically, we first reveal the feature assimilation property in backdoored text encoders: the representations of all tokens within a backdoor sample exhibit a high similarity. Further analysis attributes this effect to the concentration of attention weights on the trigger token. Leveraging this insight, AMDET scans a model by performing gradient-based inversion on token embeddings to recover implicit features that capable of activating backdoor behaviors. Furthermore, we identify the natural backdoor feature in the OpenAI's official CLIP model, which are not intentionally injected but still exhibit backdoor-like behaviors. We then filter them out from real injected backdoor by analyzing their loss landscapes. Extensive experiments on 3,600 backdoored and benign-finetuned models with two attack paradigms and three VLP model structures show that AMDET detects backdoors with an F1 score of 89.90%. Besides, it achieves one complete detection in approximately 5 minutes on a RTX 4090 GPU and exhibits strong robustness against adaptive attacks. Code is available at: https://github.com/Robin-WZQ/AMDET
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。