论文标题
数据有效的后门攻击
Data-Efficient Backdoor Attacks
论文作者
论文摘要
最近的研究证明，深层神经网络容易受到后门攻击的影响。具体而言，通过将少量中毒样品混合到训练集中，可以恶意控制训练的模型的行为。现有攻击方法通过随机从良性集中选择一些干净的数据，然后将触发器嵌入其中，来构建此类对手。但是，这种选择策略忽略了这样一个事实，即每个中毒样品都对后门注射不平等，从而降低了中毒的效率。在本文中，我们通过选择作为优化问题来提高中毒数据效率，并提出过滤和升级策略（FUS）来解决它。 CIFAR-10和Imagenet-10上的实验结果表明，与随机选择策略相比，该方法可以有效：只有47％至75％的中毒样品体积，可以实现相同的攻击成功率。更重要的是，根据一种设置选择的对手可以很好地推广到其他设置，表现出强大的转移性。现在可以在https://github.com/xpf/data-efficited-backdoor-attacks上获得我们方法的原型代码。
Recent studies have proven that deep neural networks are vulnerable to backdoor attacks. Specifically, by mixing a small number of poisoned samples into the training set, the behavior of the trained model can be maliciously controlled. Existing attack methods construct such adversaries by randomly selecting some clean data from the benign set and then embedding a trigger into them. However, this selection strategy ignores the fact that each poisoned sample contributes inequally to the backdoor injection, which reduces the efficiency of poisoning. In this paper, we formulate improving the poisoned data efficiency by the selection as an optimization problem and propose a Filtering-and-Updating Strategy (FUS) to solve it. The experimental results on CIFAR-10 and ImageNet-10 indicate that the proposed method is effective: the same attack success rate can be achieved with only 47% to 75% of the poisoned sample volume compared to the random selection strategy. More importantly, the adversaries selected according to one setting can generalize well to other settings, exhibiting strong transferability. The prototype code of our method is now available at https://github.com/xpf/Data-Efficient-Backdoor-Attacks.
