论文标题
FRIB：基于功能维修的低毒速率看不见的后门攻击
FRIB: Low-poisoning Rate Invisible Backdoor Attack based on Feature Repair
论文作者
论文摘要
在产生无形的后门攻击中毒数据期间，特征空间转换操作往往会导致一些中毒特征的丧失，并削弱了带有触发器和目标标签的源图像之间的映射关系，从而导致需要更高的中毒率以达到相应的后门攻击成功率。为了解决上述问题，我们首次提出了特征修复的想法，并引入了盲水印技术，以修复在中毒数据中损失的中毒特征。在确保一致的标签的前提下，我们提出了基于功能维修的低毒速率看不见的后门攻击，名为FRIB。从上面的设计概念中受益，新方法增强了与触发器和目标标签的源图像之间的映射关系，并增加了误导性DNN的程度，从而获得了高后门攻击成功率，中毒率非常低。最终，详细的实验结果表明，在所有MNIST，CIFAR10，GTSRB和Imagenet数据集中实现了很低的后门攻击成功率的目标。
During the generation of invisible backdoor attack poisoned data, the feature space transformation operation tends to cause the loss of some poisoned features and weakens the mapping relationship between source images with triggers and target labels, resulting in the need for a higher poisoning rate to achieve the corresponding backdoor attack success rate. To solve the above problems, we propose the idea of feature repair for the first time and introduce the blind watermark technique to repair the poisoned features lost during the generation of poisoned data. Under the premise of ensuring consistent labeling, we propose a low-poisoning rate invisible backdoor attack based on feature repair, named FRIB. Benefiting from the above design concept, the new method enhances the mapping relationship between the source images with triggers and the target labels, and increases the degree of misleading DNNs, thus achieving a high backdoor attack success rate with a very low poisoning rate. Ultimately, the detailed experimental results show that the goal of achieving a high success rate of backdoor attacks with a very low poisoning rate is achieved on all MNIST, CIFAR10, GTSRB, and ImageNet datasets.
