论文标题
使用两阶段的特定触发器增强清洁标签后门攻击
Enhancing Clean Label Backdoor Attack with Two-phase Specific Triggers
论文作者
论文摘要
后门攻击威胁着深度神经网络（DNNS）。朝着隐身性的角度来看，研究人员提出了清洁标签的后门攻击，这要求对手不要更改中毒训练数据集的标签。由于正确的图像标签对，清洁标签的设置使攻击更加隐秘，但仍然存在一些问题：首先，传统的中毒训练数据的方法无效；其次，传统的触发器并不是仍然可感知的隐形。为了解决这些问题，我们提出了一种两相和特定图像的触发方法，以增强清洁标签的后门攻击。我们的方法是（1）强大的：我们的触发器都可以同时促进后门攻击中的两个阶段（即后门植入和激活阶段）。 （2）隐身：我们的触发器是从每个图像生成的。它们是特定于图像的而不是固定触发器。广泛的实验表明，我们的方法可以实现奇妙的攻击成功率〜（98.98％），中毒率低（5％），在许多评估指标下高隐身，并且对后门防御方法具有抵抗力。
Backdoor attacks threaten Deep Neural Networks (DNNs). Towards stealthiness, researchers propose clean-label backdoor attacks, which require the adversaries not to alter the labels of the poisoned training datasets. Clean-label settings make the attack more stealthy due to the correct image-label pairs, but some problems still exist: first, traditional methods for poisoning training data are ineffective; second, traditional triggers are not stealthy which are still perceptible. To solve these problems, we propose a two-phase and image-specific triggers generation method to enhance clean-label backdoor attacks. Our methods are (1) powerful: our triggers can both promote the two phases (i.e., the backdoor implantation and activation phase) in backdoor attacks simultaneously; (2) stealthy: our triggers are generated from each image. They are image-specific instead of fixed triggers. Extensive experiments demonstrate that our approach can achieve a fantastic attack success rate~(98.98%) with low poisoning rate~(5%), high stealthiness under many evaluation metrics and is resistant to backdoor defense methods.
