[论文解读] An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defences

Wei Guo, Benedetta Tondi+1 more|arXiv (Cornell University)|Nov 16, 2021

Adversarial Robustness in Machine Learning被引用 5

一句话总结

本文对深度神经网络（DNNs）中的后门攻击进行了全面综述，根据攻击者对训练过程的控制能力以及防御者对验证能力的掌握程度对攻击进行分类。综述涵盖了攻击类型、检测方法和防御措施，包括基于后门的水印技术与陷阱后门蜜罐（trapdoor honeypots）在对抗性样本检测中的应用，突出展示了各类方法在不同应用场景下的优势、劣势及适用性。

ABSTRACT

Together with impressive advances touching every aspect of our society, AI technology based on Deep Neural Networks (DNN) is bringing increasing security concerns. While attacks operating at test time have monopolised the initial attention of researchers, backdoor attacks, exploiting the possibility of corrupting DNN models by interfering with the training process, represents a further serious threat undermining the dependability of AI techniques. In a backdoor attack, the attacker corrupts the training data so to induce an erroneous behaviour at test time. Test time errors, however, are activated only in the presence of a triggering event corresponding to a properly crafted input sample. In this way, the corrupted network continues to work as expected for regular inputs, and the malicious behaviour occurs only when the attacker decides to activate the backdoor hidden within the network. In the last few years, backdoor attacks have been the subject of an intense research activity focusing on both the development of new classes of attacks, and the proposal of possible countermeasures. The goal of this overview paper is to review the works published until now, classifying the different types of attacks and defences proposed so far. The classification guiding the analysis is based on the amount of control that the attacker has on the training process, and the capability of the defender to verify the integrity of the data used for training, and to monitor the operations of the DNN at training and test time. As such, the proposed analysis is particularly suited to highlight the strengths and weaknesses of both attacks and defences with reference to the application scenarios they are operating in.

研究动机与目标

• 基于攻击者对训练过程的控制能力与防御者对验证能力的掌握程度，系统性地对DNN中的后门攻击与防御进行分类。
• 形式化后门攻击的威胁模型，区分完全控制与部分控制两种场景。
• 评估现有后门检测与清除技术的有效性及其局限性。
• 探索后门在DNN水印技术与对抗性样本检测中双重用途的潜力。
• 识别在微调、迁移学习及黑盒攻击下鲁棒性方面的开放性挑战。

提出的方法

• 将后门攻击分为完全控制（攻击者训练模型）与部分控制（攻击者操纵数据或梯度）两种场景。
• 提出一个正式的威胁模型框架，用于分析训练阶段与测试阶段攻击者的控制能力与防御者的约束条件。
• 综述在训练阶段（如监控训练动态）与测试阶段（如激活分析、输入探测）运行的检测技术。
• 研究基于后门的水印技术：通过带有特定触发器的污染训练数据，将后门作为动态水印注入模型。
• 提出“陷阱后门蜜罐”概念：训练一个DNN模型，使用低能量触发器，通过识别输入与触发器的接近程度来检测对抗性样本。
• 评估水印技术与防御措施在微调与迁移学习下的鲁棒性，识别关键脆弱点。

实验结果

研究问题

• RQ1 攻击者对训练过程控制程度的不同，如何影响后门攻击的可行性与隐蔽性？
• RQ2 训练阶段与测试阶段的后门检测方法在有效性上存在哪些关键差异？
• RQ3 后门在通过动态水印保护DNN知识产权方面，其适用程度如何？
• RQ4 基于陷阱后门的蜜罐能否有效检测定向对抗性样本？其局限性是什么？
• RQ5 为何基于后门的水印技术在迁移学习下鲁棒性特别弱？如何改进？

主要发现

• 通过污染方式实现的基于后门的水印技术可利用ASR（攻击成功率）作为验证指标确立所有权，但在微调后鲁棒性显著下降，尤其在迁移学习下下降更为严重。
• 陷阱后门蜜罐防御通过利用对抗攻击可能利用的低能量触发器，能以高精度检测定向对抗性样本。
• 现有防御措施仅在特定威胁模型下有效，通常对非定向或黑盒对抗攻击失效。
• 迁移学习严重削弱了动态水印技术的鲁棒性，这是其在实际知识产权保护中应用的主要限制。
• 将后门用于水印与对抗检测揭示了其双重用途特性，但与静态水印相比，其安全性与载荷容量仍有限。
• 没有一种防御是普遍有效的；其鲁棒性高度依赖于攻击场景、模型架构以及微调等训练后操作。