Odyssey：木马模型的创建、分析和检测
Odyssey: Creation, Analysis and Detection of Trojan Models
摘要：
随着深度神经网络（DNN）模型的成功，这些模型的完整性受到了威胁。最近的威胁是特洛伊木马攻击，攻击者通过将触发器插入到一些训练样本中来干扰训练管道，并训练模型仅对包含触发器的样本进行恶意操作。由于触发器的知识对于攻击者来说是秘密的，因此特洛伊木马网络的检测具有挑战性。现有的特洛伊木马检测器对触发器和攻击的类型做出了很强的假设。我们提出了一个检测器，这是基于分析的内在DNN属性，这是由于特洛伊木马程序的影响。为了进行全面的分析，我们开发了Odysseus，这是迄今为止最多样化的数据集，拥有超过3，000个干净和特洛伊木马模型。Odysseus涵盖了大范围的攻击;通过利用触发器设计和源到目标类映射的多功能性生成。我们的分析结果表明，木马攻击影响分类器的边缘和形状的决策边界周围的清洁数据的流形。利用这两个因素，我们提出了一个有效的木马检测器，操作没有任何知识的攻击和显着优于现有的方法。通过一组全面的实验，我们证明了跨模型架构，看不见的触发器和正则化模型的检测器的功效。
英文摘要：
Along with the success of deep neural network (DNN) models, rise the threats to the integrity of these models. A recent threat is the Trojan attack where an attacker interferes with the training pipeline by inserting triggers into some of the training samples and trains the model to act maliciously only for samples that contain the trigger. Since the knowledge of triggers is privy to the attacker, detection of Trojan networks is challenging. Existing Trojan detectors make strong assumptions about the types of triggers and attacks. We propose a detector that is based on the analysis of the intrinsic DNN properties; that are affected due to the Trojaning process. For a comprehensive analysis, we develop Odysseus, the most diverse dataset to date with over 3,000 clean and Trojan models. Odysseus covers a large spectrum of attacks; generated by leveraging the versatility in trigger designs and source to target class mappings. Our analysis results show that Trojan attacks affect the classifier margin and shape of decision boundary around the manifold of clean data. Exploiting these two factors, we propose an efficient Trojan detector that operates without any knowledge of the attack and significantly outperforms existing methods. Through a comprehensive set of experiments we demonstrate the efficacy of the detector on cross model architectures, unseen Triggers and regularized models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
