一句话：提出用目标通用对抗扰动隐藏后门的 AdvDoor 攻击，成功率约 98% 且能规避主流检测。
深度学习系统已用于自动驾驶等关键场景，但其安全性受到后门攻击威胁。现有攻击通常向训练数据加入 patch，容易被检测。本文提出 Adversarial Backdoor（AdvDoor），利用 Targeted Universal Adversarial Perturbation (TUAP) 在模型中隐藏异常并迷惑检测方法。大量实验表明，该攻击可稳定注入，攻击成功率约为 98%；同时能绕过当前最先进的后门检测：仅约 37% 的投毒模型可被捕获，且不到 29% 的投毒数据无法绕过检测。相比之下，patch 后门会导致全部投毒模型和超过 80% 的投毒数据被检测出。论文旨在警示该潜在威胁并启发有效检测方法的设计。
Deep Learning (DL) system has been widely used in many critical applications, such as autonomous vehicles and unmanned aerial vehicles. However, their security is threatened by backdoor attack, which is achieved by adding artificial patterns on specific training data. Existing attack methods normally poison the data using a patch, and they can be easily detected by existing detection methods. In this work, we propose the Adversarial Backdoor, which utilizes the Targeted Universal Adversarial Perturbation (TUAP) to hide the anomalies in DL models and confuse existing powerful detection methods. With extensive experiments, it is demonstrated that Adversarial Backdoor can be injected stably with an attack success rate around 98%. Moreover, Adversarial Backdoor can bypass state-of-the-art backdoor detection methods. More specifically, only around 37% of the poisoned models can be caught, and less than 29% of the poisoned data cannot bypass the detection. In contrast, for the patch backdoor, all the poisoned models and more than 80% of the poisoned data will be detected. This work intends to alarm the researchers and developers of this potential threat and to inspire the designing of effective detection methods.
DOI 原文 ·
@inproceedings{paperbot6694,
title = {AdvDoor: adversarial backdoor attack of deep learning system},
author = {Quan Zhang and Yifeng Ding and Yongqiang Tian and Jianmin Guo and Min Yuan and Yu Jiang},
booktitle = {ISSTA},
year = {2021},
doi = {10.1145/3460319.3464809}
}