[论文解读] Quantization Backdoors to Deep Learning Models.

Hua Ma, Huming Qiu+6 more|arXiv (Cornell University)|Aug 20, 2021

Adversarial Robustness in Machine Learning参考文献 44被引用 8

一句话总结

本文揭示，使用TensorFlow Lite进行的标准后训练量化可激活先前处于休眠状态的全精度深度学习模型中的后门，导致量化为int-8后，触发输入的攻击成功率高达100%，尽管这些模型在通过Neural Cleanse和STRIP等前端检测工具时仍能通过检测。该研究揭示了设备端模型量化流程中的关键安全风险。

ABSTRACT

There is currently a burgeoning demand for deploying deep learning (DL) models on ubiquitous edge Internet of Things devices attributing to their low latency and high privacy preservation. However, DL models are often large in size and require large-scale computation, which prevents them from being placed directly onto IoT devices where resources are constrained and 32-bit floating-point operations are unavailable. Model quantization is a pragmatic solution, which enables DL deployment on mobile devices and embedded systems by effortlessly post-quantizing a large high-precision model into a small low-precision model while retaining the model inference accuracy. This work reveals that the standard quantization operation can be abused to activate a backdoor. We demonstrate that a full-precision backdoored model that does not have any backdoor effect in the presence of a trigger -- as the backdoor is dormant -- can be activated by the default TensorFlow-Lite quantization, the only product-ready quantization framework to date. We ascertain that all trained float-32 backdoored models exhibit no backdoor effect even in the presence of trigger inputs. State-of-the-art frontend detection approaches, such as Neural Cleanse and STRIP, fail to identify the backdoor in the float-32 models. When each of the float-32 models is converted into an int-8 format model through the standard TFLite post-training quantization, the backdoor is activated in the quantized model, which shows a stable attack success rate close to 100% upon inputs with the trigger, while behaves normally upon non-trigger inputs. This work highlights that a stealthy security threat occurs when end users utilize the on-device post-training model quantization toolkits, informing security researchers of cross-platform overhaul of DL models post quantization even if they pass frontend inspections.

研究动机与目标

• 调查标准后训练量化是否可能意外激活全精度深度学习模型中潜伏的后门。
• 评估现有前端后门检测方法（Neural Cleanse和STRIP）在具有隐藏后门的float-32模型上的有效性。
• 证明量化框架（如TensorFlow Lite）可作为攻击向量，将原本休眠的后门转变为活跃威胁。
• 强调在模型流水线中缺乏端到端信任的情况下，依赖设备端量化工具包所带来的安全影响。

提出的方法

• 训练带有嵌入后门的全精度（float-32）深度学习模型，确保其在干净输入上的推理过程中保持休眠状态。
• 应用标准的TensorFlow Lite后训练量化，将float-32模型转换为int-8模型，无需微调。
• 评估量化后模型在触发输入和非触发输入上的行为，以检测后门是否被激活。
• 在量化前，测试最先进的后门检测方法（Neural Cleanse和STRIP）在原始float-32模型上的有效性。
• 在多个数据集和模型架构上，测量量化后模型在干净输入和触发输入上的攻击成功率与模型准确率。
• 分析量化过程，识别数值变换如何促成后门激活。

实验结果

研究问题

• RQ1 标准后训练量化框架（如TensorFlow Lite）是否能够激活全精度深度学习模型中先前处于休眠状态的后门？
• RQ2 现有的前端后门检测技术（如Neural Cleanse和STRIP）是否能成功识别在量化过程中被激活的float-32模型中的后门？
• RQ3 使用TFLite将模型量化为int-8后，后门的攻击成功率是多少？该成功率在触发输入与非触发输入之间有何差异？
• RQ4 为何标准量化流程无法保持模型流水线中后门检测的完整性？
• RQ5 量化过程在多大程度上通过激活原本不活跃的后门，自身引入了新的攻击面？

主要发现

• 所有float-32后门模型在推理过程中均未表现出后门行为，即使在输入中包含触发信号时亦然，表明后门保持休眠状态。
• 在使用TensorFlow Lite将模型后训练量化为int-8后，后门被成功激活，在触发输入上实现了接近100%的稳定攻击成功率。
• 量化后的模型在非触发输入上保持了正常准确率，证实了攻击在量化后的隐蔽性。
• 最先进的检测方法（包括Neural Cleanse和STRIP）在原始float-32模型中未能检测到后门，尽管这些方法在其他后门变体上已被证明有效。
• 结果表明，量化过程本身可作为潜伏后门的触发机制，为设备端模型部署流水线带来关键安全缺口。
• 本研究揭示了模型量化流水线中此前未知的攻击面，即对量化工具包的信任可能导致后门被未察觉地激活。