利用硬件差异在模型中植入后门，同一输入在不同设备上结果不同。
Hardware-Triggered Backdoors
- 通过微调决策边界，使模型在不同硬件上对相同输入产生不同输出。
- 在常见GPU上可靠触发后门，实现隐蔽的恶意行为控制。
- 适合关注模型安全与第三方模型可信性的研究人员和开发者。
机器学习模型广泛部署于各类计算硬件上。尽管硬件通常预期产生一致结果，但其设计差异可能导致推理过程中的微小数值偏差。本文表明，这些偏差可被用于在模型中创建后门。核心思路是调整模型的决策函数，使其在不同硬件上执行同一输入时产生不同预测。具体方法是将决策边界局部移至目标输入附近，并通过优化数值偏差，在特定硬件上翻转预测结果。我们实证展示了该方法在常见GPU加速器上的可靠性。研究揭示了一种影响第三方模型使用的新型攻击向量，并探讨了多种防御策略以应对此威胁。
原文摘要 · Abstract (English)
Machine learning models are routinely deployed on a wide range of computing hardware. Although such hardware is typically expected to produce identical results, differences in its design can lead to small numerical variations during inference. In this work, we show that these variations can be exploited to create backdoors in machine learning models. The core idea is to shape the model's decision function such that it yields different predictions for the same input when executed on different hardware. This effect is achieved by locally moving the decision boundary close to a target input and then refining numerical deviations to flip the prediction on selected hardware. We empirically demonstrate that these hardware-triggered backdoors can be created reliably across common GPU accelerators. Our findings reveal a novel attack vector affecting the use of third-party models, and we investigate different defenses to counter this threat.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。