[论文解读] Marksman Backdoor: Backdoor Attacks with Arbitrary Target Class

Khoa D. Doan, Yingjie Lao+1 more|arXiv (Cornell University)|Oct 17, 2022

Adversarial Robustness in Machine Learning被引用 11

一句话总结

Marksman 提出了一种新颖的后门攻击方法，通过使用类别条件生成式触发器函数，为每个输入生成特定的、难以察觉的触发器，使攻击者能够在推理过程中任意选择任何目标类别进行误分类。该方法在 MNIST、CIFAR10、GTSRB 和 TinyImageNet 上实现了 100% 的攻击成功率，同时保持了干净数据的准确率，并成功绕过了多种最先进的防御机制。

ABSTRACT

In recent years, machine learning models have been shown to be vulnerable to backdoor attacks. Under such attacks, an adversary embeds a stealthy backdoor into the trained model such that the compromised models will behave normally on clean inputs but will misclassify according to the adversary's control on maliciously constructed input with a trigger. While these existing attacks are very effective, the adversary's capability is limited: given an input, these attacks can only cause the model to misclassify toward a single pre-defined or target class. In contrast, this paper exploits a novel backdoor attack with a much more powerful payload, denoted as Marksman, where the adversary can arbitrarily choose which target class the model will misclassify given any input during inference. To achieve this goal, we propose to represent the trigger function as a class-conditional generative model and to inject the backdoor in a constrained optimization framework, where the trigger function learns to generate an optimal trigger pattern to attack any target class at will while simultaneously embedding this generative backdoor into the trained model. Given the learned trigger-generation function, during inference, the adversary can specify an arbitrary backdoor attack target class, and an appropriate trigger causing the model to classify toward this target class is created accordingly. We show empirically that the proposed framework achieves high attack performance while preserving the clean-data performance in several benchmark datasets, including MNIST, CIFAR10, GTSRB, and TinyImageNet. The proposed Marksman backdoor attack can also easily bypass existing backdoor defenses that were originally designed against backdoor attacks with a single target class. Our work takes another significant step toward understanding the extensive risks of backdoor attacks in practice.

研究动机与目标

• 为了解决现有后门攻击受限于单一预定义目标类别的局限性。
• 开发一种可在推理过程中实现动态、任意目标类别选择的后门框架。
• 设计一种既隐蔽又在多种数据集上均有效的触发器生成机制。
• 确保后门模型在规避现有防御机制的同时，保持高干净数据准确率。

提出的方法

• 该攻击使用类别条件生成模型作为触发器函数，以生成输入特定的、难以察觉的触发器。
• 采用约束优化框架，联合训练触发器生成器并将后门注入深度神经网络模型。
• 触发器函数学习生成最优的触发器模式，使推理时的预测结果可被引导至任意期望的目标类别。
• 该方法将生成式触发器函数直接嵌入模型中，实现动态载荷选择。
• 该框架支持输入感知的、不可见的触发器，最大限度减少感知失真。
• 该方法设计为可有效抵御现有防御机制的检测，如 Neural Cleanse、STRIP、Spectral Signature 和 Fine-Pruning。

实验结果

研究问题

• RQ1 后门攻击是否能够在推理过程中为给定输入动态分配任意目标类别，而非受限于单一预定义目标？
• RQ2 单个后门模型如何在不降低干净数据性能的前提下，支持多个任意目标类别？
• RQ3 能否端到端训练生成式触发器函数，以生成隐蔽的、输入特定的触发器并逃避检测？
• RQ4 所提出的方法在多大程度上能够绕过现有的后门检测防御机制？
• RQ5 该攻击性能在具有不同复杂度的多样化基准数据集上如何扩展？

主要发现

• Marksman 攻击在所有评估的数据集上均实现了 100% 的攻击成功率，包括 MNIST、CIFAR10、GTSRB 和 TinyImageNet。
• 后门模型保持了高干净数据准确率，表现出极小的性能下降。
• Marksman 有效绕过了 Neural Cleanse 检测，因为所有数据集上的异常指数均低于 2 的阈值。
• 该攻击成功规避了 STRIP 检测，因为干净样本与后门样本的熵分布无法区分。
• Spectral Signature 无法将后门样本与干净样本分离，表明其在潜在空间中具有出色的隐蔽性。
• Fine-Pruning 对 Marksman 无效，因为在剪枝过程中攻击成功率下降幅度远小于干净准确率的下降。