基于受控解密的神经网络深度特征空间木马攻击
Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxification
摘要：
木马（后门）攻击是对深度神经网络的一种对抗攻击，攻击者向受害者提供一个在恶意数据上训练/重新训练的模型。当一个正常的输入被打上一个叫做trigger的特定模式的印记时，后门就会被激活，从而导致错误分类。许多现有的特洛伊木马攻击的触发器是输入空间补丁/对象（例如，具有纯色的多边形）或简单的输入转换（例如Instagram过滤器）。这些简单的触发器容易受到最近的后门检测算法的影响。我们提出了一种新的深度特征空间木马攻击，具有五个特点：有效性，隐蔽性，可控性，鲁棒性和依赖于深度特征。我们在包括ImageNet在内的各种数据集上对9个图像分类器进行了广泛的实验，以证明这些属性，并表明我们的攻击可以逃避最先进的防御。
英文摘要：
Trojan (backdoor) attack is a form of adversarial attack on deep neural networks where the attacker provides victims with a model trained/retrained on malicious data. The backdoor can be activated when a normal input is stamped with a certain pattern called trigger, causing misclassification. Many existing trojan attacks have their triggers being input space patches/objects (e.g., a polygon with solid color) or simple input transformations such as Instagram filters. These simple triggers are susceptible to recent backdoor detection algorithms. We propose a novel deep feature space trojan attack with five characteristics: effectiveness, stealthiness, controllability, robustness and reliance on deep features. We conduct extensive experiments on 9 image classifiers on various datasets including ImageNet to demonstrate these properties and show that our attack can evade state-of-the-art defense.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
