Sneakdoor让数据压缩中的后门攻击更隐蔽,不易被发现。
SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation
- 利用局部特征几何生成与输入匹配的触发器,提升隐蔽性。
- 在多个数据集上实现高攻击成功率和干净准确率的平衡。
- 适合研究数据安全与对抗性攻击的人员阅读。
数据压缩旨在生成紧凑且信息丰富的数据集,保留全规模数据的训练效果,显著提升效率。近期研究发现,压缩过程可能遭受后门攻击,恶意触发器被注入压缩数据集中,从而在推理阶段操纵模型行为。尽管先前方法在攻击成功率与干净测试准确率之间取得一定平衡,但在隐蔽性方面仍有不足,难以隐藏压缩数据的视觉伪影或推理时引入的扰动。为此,我们提出Sneakdoor,通过利用类别决策边界的固有脆弱性,并引入生成模块构建与输入相关的触发器,使其与局部特征几何一致,从而最小化可检测性。这种联合设计使攻击对人眼和统计检测均难以察觉。大量实验表明,Sneakdoor在攻击成功率、干净测试准确率与隐蔽性之间实现了出色平衡,显著提升了合成数据及触发样本的不可见性,同时保持高攻击效力。代码已公开于 https://github.com/XJTU-AI-Lab/SneakDoor。
原文摘要 · Abstract (English)
Dataset condensation aims to synthesize compact yet informative datasets that retain the training efficacy of full-scale data, offering substantial gains in efficiency. Recent studies reveal that the condensation process can be vulnerable to backdoor attacks, where malicious triggers are injected into the condensation dataset, manipulating model behavior during inference. While prior approaches have made progress in balancing attack success rate and clean test accuracy, they often fall short in preserving stealthiness, especially in concealing the visual artifacts of condensed data or the perturbations introduced during inference. To address this challenge, we introduce Sneakdoor, which enhances stealthiness without compromising attack effectiveness. Sneakdoor exploits the inherent vulnerability of class decision boundaries and incorporates a generative module that constructs input-aware triggers aligned with local feature geometry, thereby minimizing detectability. This joint design enables the attack to remain imperceptible to both human inspection and statistical detection. Extensive experiments across multiple datasets demonstrate that Sneakdoor achieves a compelling balance among attack success rate, clean test accuracy, and stealthiness, substantially improving the invisibility of both the synthetic data and triggered samples while maintaining high attack efficacy. The code is available at https://github.com/XJTU-AI-Lab/SneakDoor.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。