论文标题
全球平均池的动态后门
Dynamic Backdoors with Global Average Pooling
论文作者
论文摘要
外包培训和机器学习作为服务，导致了新颖的攻击向量，例如后门攻击。当将触发器添加到其输入中时，这种攻击将激活的神经网络嵌入了秘密功能。在文献中的大多数作品中，触发器在位置和模式方面都是静态的。各种检测机制的有效性取决于该特性。最近显示，图像分类中的对策（如神经清洁和ABS）都可以被动态触发器绕过，无论其模式和位置如何，这些触发器都是有效的。尽管如此，这种后门仍需要求大量的中毒培训数据。在这项工作中，我们第一个表明，由于全球平均合并层而没有增加中毒训练数据的百分比，可能会发生动态后门攻击。然而，我们在声音分类，文本情绪分析和图像分类方面的实验表明，这在实践中非常困难。
Outsourced training and machine learning as a service have resulted in novel attack vectors like backdoor attacks. Such attacks embed a secret functionality in a neural network activated when the trigger is added to its input. In most works in the literature, the trigger is static, both in terms of location and pattern. The effectiveness of various detection mechanisms depends on this property. It was recently shown that countermeasures in image classification, like Neural Cleanse and ABS, could be bypassed with dynamic triggers that are effective regardless of their pattern and location. Still, such backdoors are demanding as they require a large percentage of poisoned training data. In this work, we are the first to show that dynamic backdoor attacks could happen due to a global average pooling layer without increasing the percentage of the poisoned training data. Nevertheless, our experiments in sound classification, text sentiment analysis, and image classification show this to be very difficult in practice.
