MISA：使用错误属性在线防御带有木马的模型
MISA: Online Defense of Trojaned Models using Misattributions
摘要：
最近的研究表明，神经网络很容易受到特洛伊木马攻击，其中网络被训练成以特定和潜在恶意的方式对输入中特制的触发模式做出响应。本文提出了MISA，一种新的在线方法来检测木马触发器的神经网络在推理时间。我们的方法是基于一个新的概念称为misattributations，它捕捉了木马激活的特征空间中的异常表现。给定输入图像和相应的输出预测，我们的算法首先计算模型在不同特征上的属性。然后对这些属性进行统计分析，以确定是否存在特洛伊木马触发器。在一组基准测试中，我们证明了我们的方法可以有效地检测各种触发模式的特洛伊木马触发器，包括最近几个没有已知防御的触发模式。我们的方法实现了96%的AUC检测图像，其中包括一个木马触发器没有任何假设的触发模式。
英文摘要：
Recent studies have shown that neural networks are vulnerable to Trojan attacks, where a network is trained to respond to specially crafted trigger patterns in the inputs in specific and potentially malicious ways. This paper proposes MISA, a new online approach to detect Trojan triggers for neural networks at inference time. Our approach is based on a novel notion called misattributions, which captures the anomalous manifestation of a Trojan activation in the feature space. Given an input image and the corresponding output prediction, our algorithm first computes the model's attribution on different features. It then statistically analyzes these attributions to ascertain the presence of a Trojan trigger. Across a set of benchmarks, we show that our method can effectively detect Trojan triggers for a wide variety of trigger patterns, including several recent ones for which there are no known defenses. Our method achieves 96% AUC for detecting images that include a Trojan trigger without any assumptions on the trigger pattern.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
