在预训练模型中植入难以察觉的后门，攻击者可远程触发特定分类结果。
Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions
- 通过稀疏扰动与高斯噪声混合，隐藏后门信号于全连接层参数中。
- 扰动后模型功能与原模型等价，且无法被任何多项式时间算法识别。
- 适用于供应链攻击场景，对白盒攻击者也具有隐蔽性，适合研究安全防御。
我们提出一种名为 Sparse Backdoor 的供应链攻击方法，可在预训练图像分类模型（包括卷积网络和 Vision Transformers）中植入可证明不可检测的后门。该攻击在每个全连接层的少量列中沿随机方向注入结构化稀疏扰动，并通过独立的各向同性高斯抖动（dither）掩盖扰动。抖动的作用是建立一个以原始权重为中心的干净参考分布，使得扰动后的模型在功能上等价于原模型。在预训练分类器满足弱边缘条件的前提下，我们证明将注入后门的模型与该参考模型区分开来，至少等价于稀疏主成分分析（Sparse PCA）检测问题，在标准计算困难假设下是不可行的。该保证对任何具有白盒参数访问权限的概率多项式时间区分器均成立。
原文摘要 · Abstract (English)
We present Sparse Backdoor, a supply-chain attack that plants a provably undetectable backdoor in pre-trained image classifiers, including convolutional networks and Vision Transformers. The attack injects a structured sparse perturbation along a randomly chosen direction into a small subset of columns at each fully connected layer, propagating a trigger signal to an adversary-chosen target class, and masks the perturbation with an independent isotropic Gaussian dither. The dither serves a single technical purpose: it induces a clean reference distribution anchored at the pre-trained weights, against which undetectability can be formalized. Under a mild margin condition on the pre-trained classifier, we show that the dithered reference is functionally equivalent to the original classifier. We prove that distinguishing the backdoor-injected model from this reference is at least as hard as Sparse PCA detection, which is computationally infeasible under standard hardness assumptions. The guarantee holds against any probabilistic polynomial-time distinguisher with white-box access to the parameters.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。