用聚类筛选语音命令数据，有效抵御恶意污染攻击
Clustering Unsupervised Representations as Defense against Poisoning Attacks on Speech Commands Classification System
- 通过无监督模型提取语音特征，再聚类分组
- 仅保留每组中标签一致的样本，过滤掉被污染数据
- 在10%污染率下攻击成功率从99.75%降至0.25%
中毒攻击指攻击者故意篡改训练数据。本文研究语音命令分类系统中的脏标签中毒攻击场景，假设某类（源类）的部分语音样本被叠加触发词并篡改为攻击者选定的目标类标签。提出一种基于聚类的防御方法：首先使用DINO模型学习所有训练样本的无监督表示，接着用K-means和LDA对这些表示进行聚类；最后保留每簇中重复标签最多的样本用于训练，其余丢弃。在10%源类样本被污染的情况下，攻击成功率从99.75%降至0.25%。该方法在不同目标类、源类及触发词变化等多样化威胁模型下均表现出良好鲁棒性。
原文摘要 · Abstract (English)
Poisoning attacks entail attackers intentionally tampering with training data. In this paper, we consider a dirty-label poisoning attack scenario on a speech commands classification system. The threat model assumes that certain utterances from one of the classes (source class) are poisoned by superimposing a trigger on it, and its label is changed to another class selected by the attacker (target class). We propose a filtering defense against such an attack. First, we use DIstillation with NO labels (DINO) to learn unsupervised representations for all the training examples. Next, we use K-means and LDA to cluster these representations. Finally, we keep the utterances with the most repeated label in their cluster for training and discard the rest. For a 10% poisoned source class, we demonstrate a drop in attack success rate from 99.75% to 0.25%. We test our defense against a variety of threat models, including different target and source classes, as well as trigger variations.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。