用聚类分离毒样本,再伪装成虚拟类别,让后门失效且不丢准确率
CSC: Turning the Adversary's Poison against Itself

- 早期特征聚类识别毒样本,靠密度和类别多样性判别异常簇
- 将毒样本重标为虚拟类别,用交叉熵微调保留模型性能
- 对12种攻击有效,平均攻击成功率接近0,干净数据损失极小
基于投毒的后门攻击通过在训练数据中嵌入触发器,使模型对带触发器的输入错误分类为攻击者指定标签,同时保持对干净数据的正常表现。现有基于投毒抑制的防御方法常因对特定攻击变体检测不足,且使用遗忘策略导致模型性能下降。本文全面分析了模型训练过程中后门攻击的动态,发现毒样本在隐空间早期即形成孤立簇,触发器作为与良性样本显著不同的主导特征。基于此,提出新型毒抑制防御方法Cluster Segregation Concealment (CSC):首先通过标准监督学习训练网络,利用早期训练阶段的特征提取、DBSCAN聚类及基于类别多样性和密度的异常簇识别,分离出毒样本;在隐藏阶段,将识别出的毒样本重标为虚拟类别,并使用交叉熵损失对模型分类器进行微调,以替换后门关联为良性虚拟连接,从而保留整体准确率。CSC在四个基准数据集上评估,针对十二种投毒攻击,平均攻击成功率降至接近零,优于九种现有先进防御方法,且干净数据准确率损失极小。贡献包括鲁棒的后门模式识别、有效的隐藏机制以及充分的实证验证,推动可信人工智能发展。
原文摘要 · Abstract (English)
Poisoning-based backdoor attacks pose significant threats to deep neural networks by embedding triggers in training data, causing models to misclassify triggered inputs as adversary-specified labels while maintaining performance on clean data. Existing poison restraint-based defenses often suffer from inadequate detection against specific attack variants and compromise model utility through unlearning methods that lead to accuracy degradation. This paper conducts a comprehensive analysis of backdoor attack dynamics during model training, revealing that poisoned samples form isolated clusters in latent space early on, with triggers acting as dominant features distinct from benign ones. Leveraging these insights, we propose Cluster Segregation Concealment (CSC), a novel poison suppression defense. CSC first trains a deep neural network via standard supervised learning while segregating poisoned samples through feature extraction from early epochs, DBSCAN clustering, and identification of anomalous clusters based on class diversity and density metrics. In the concealment stage, identified poisoned samples are relabeled to a virtual class, and the model's classifier is fine-tuned using cross-entropy loss to replace the backdoor association with a benign virtual linkage, preserving overall accuracy. CSC was evaluated on four benchmark datasets against twelve poisoning-based attacks, CSC outperforms nine state-of-the-art defenses by reducing average attack success rates to near zero with minimal clean accuracy loss. Contributions include robust backdoor patterns identification, an effective concealment mechanism, and superior empirical validation, advancing trustworthy artificial intelligence.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。