arXiv:2605.18907cs.CRcs.AI2026-05

快速检测后门模型,1毫秒内完成扫描,准确率超97%。

Lightweight and Fast Backdoor Model Detection

论文配图:Lightweight and Fast Backdoor Model Detection
图 1 · 摘自论文原文
  • 通过分析分类层参数异常,实现无需触发器的统一检测方法
  • 在5000+模型上达97.17%检出率,误报率仅0.95%
  • 适合安全评估、模型审计等需要高速筛查的场景

深度神经网络虽性能优异,却易受后门攻击。现有防御多依赖激活异常分析或触发器逆向,需干净样本或先验知识,效果有限且难以泛化。更关键的是,先进攻击可在毫秒级植入后门,而现有检测动辄数分钟。为此,我们提出DFBScanner,一种轻量级静态参数检测框架,可快速扫描后门。核心观察是:后门引发的特征扰动会导致分类层参数更新出现独特异常。因此,检测重点从识别多样化的攻击特定触发器,转向捕捉最终层中统一的后门表现,实现高效且攻击无关的检测。具体地,通过构建并组合多个最终层参数的异常指标形成“木马线索”,以最大异常评分判定后门。在包含5000+后门模型的大规模基准上评估,覆盖4个数据集、12种网络结构、20类触发器、2种攻击策略(全对一与全对全)及3种注入方式(数据投毒、训练流程篡改、位翻转)。结果表明,DFBScanner达到97.17%真阳性率、0.95%假阳性率,平均检测时间仅1毫秒/模型,显著优于现有方法。

原文摘要 · Abstract (English)

Deep neural networks (DNN), despite their remarkable performance, are highly vulnerable to backdoor attacks. Existing defenses mainly rely on activation anomaly analysis or trigger reverse engineering and often require clean samples or prior knowledge of trigger patterns, resulting in limited efficacy, practicability, and generalizability. More critically, while advanced attacks can implement backdoor implantation in milliseconds, current detection approaches typically demand minutes or even hours. To this end, we propose DFBScanner, a lightweight static parameter inspection framework for fast backdoor scanning. DFBScanner leverages our key observation that backdoor-induced feature perturbations can lead to distinctive and anomalous parameter updates in the final classification layer. Hence, we shift our detection focus from recognizing diverse and attack-specific trigger patterns targeted by prior work, to identifying the unified backdoor manifestation within the final layer, thereby enabling efficient and attack-agnostic detection. Specifically, by constructing and strategically combining multiple anomaly indicators of the final-layer parameters into a Trojan clue, DFBScanner detects backdoors through maximum anomaly scoring. DFBScanner is evaluated on a large-scale backdoor benchmark, including over 5,000 backdoor models trained on 4 datasets, 12 network architectures, 20 types of backdoor triggers, 2 attack strategies (all-to-one and -all), and 3 backdoor injection methods (data poisoning, training pipeline manipulation, and bit-flips). Numerical results show that DFBScanner achieves a 97.17% true-positive rate, 0.95% false-positive rate, and an average detection time of only 1 ms per model, significantly outperforming prior methods.

后门检测安全评估轻量化

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。