论文标题
重新考虑后门攻击的触发因素
Rethinking the Trigger of Backdoor Attack
论文作者
论文摘要
后门攻击打算将隐藏的后门注入深神经网络（DNN），以便如果隐藏的后门被攻击者定义的触发器激活，而在良性样本上表现良好，则会将受感染模型的预测发生恶意改变。当前，大多数现有的后门攻击都采用了\ emph {static}触发器的设置，$即，$。在培训和测试图像中触发$触发，并遵循相同的外观，并位于同一区域。在本文中，我们通过分析静态触发器的特征来重新访问此攻击范例。我们证明，当测试图像中的扳机与用于训练的触发不一致时，这种攻击范式很容易受到伤害。我们进一步探讨了如何利用该物业进行后门防御，并讨论如何减轻现有攻击的这种脆弱性。
Backdoor attack intends to inject hidden backdoor into the deep neural networks (DNNs), such that the prediction of the infected model will be maliciously changed if the hidden backdoor is activated by the attacker-defined trigger, while it performs well on benign samples. Currently, most of existing backdoor attacks adopted the setting of \emph{static} trigger, $i.e.,$ triggers across the training and testing images follow the same appearance and are located in the same area. In this paper, we revisit this attack paradigm by analyzing the characteristics of the static trigger. We demonstrate that such an attack paradigm is vulnerable when the trigger in testing images is not consistent with the one used for training. We further explore how to utilize this property for backdoor defense, and discuss how to alleviate such vulnerability of existing attacks.
