Better Trigger Inversion Optimization in Backdoor Scanning
Better Trigger Inversion Optimization in Backdoor Scanning
复制标题
DOI：
10.1109/cvpr52688.2022.01301
复制
发表时间：
2022-06
期刊：
影响因子：
--
通讯作者：
Guanhong Tao;Guangyu Shen;Yingqi Liu;Shengwei An;Qiuling Xu;Shiqing Ma;X. Zhang
中科院分区：
文献类型：
--
作者：
Guanhong Tao;Guangyu Shen;Yingqi Liu;Shengwei An;Qiuling Xu;Shiqing Ma;X. Zhang
后门攻击的目的是通过向输入键入触发器来导致对主题模型的错误分类。可以通过恶意培训来注入后门，并且自然存在。为主题模型推导后门触发因素对于攻击和防御至关重要。流行的触发反演方法是通过优化。现有方法基于找到最小的扳机，该扳机可以通过最小化掩码来均匀地翻转一组输入样品。面具定义了应该扰动的一组像素。我们开发了一种新的优化方法，该方法可以直接最大程度地减少单个像素更改而无需使用掩码。我们的实验表明，与现有方法相比，新方法可以生成触发器，这些触发器需要少量的输入像素要干扰，具有较高的攻击成功率，并且更强大。因此，在现实世界攻击中使用时，它们更为理想，并且在防御中使用时更有效。我们的方法也更具成本效益。
Backdoor attacks aim to cause misclassification of a subject model by stamping a trigger to inputs. Backdoors could be injected through malicious training and naturally exist. Deriving backdoor trigger for a subject model is critical to both attack and defense. A popular trigger inversion method is by optimization. Existing methods are based on finding a smallest trigger that can uniformly flip a set of input samples by minimizing a mask. The mask defines the set of pixels that ought to be perturbed. We develop a new optimization method that directly minimizes individual pixel changes, without using a mask. Our experiments show that compared to existing methods, the new one can generate triggers that require a smaller number of input pixels to be perturbed, have a higher attack success rate, and are more robust. They are hence more desirable when used in real-world attacks and more effective when used in defense. Our method is also more cost-effective.