通过神经元激活空间中的对抗学习实现视觉问答的实例级木马攻击
Instance-Level Trojan Attacks on Visual Question Answering via Adversarial Learning in Neuron Activation Space
AI总结：
提出一种实例级多模态木马攻击方法，通过双模态对抗学习在预训练模型中破坏特定神经元，建立恶意关联，高效适应微调模型，实验证明其高效、隐蔽且难以被传统防御缓解。
摘要：
木马攻击通过在输入数据中嵌入扰动，导致神经网络模型产生恶意行为。在不同模态中组合多种木马，使得攻击者能够对多模态学习（如视觉问答（VQA））发起复杂的攻击。然而，传统方法中的多模态木马在微调等过程中容易受到参数调整的影响。为此，我们提出了一种针对VQA的实例级多模态木马攻击，通过双模态对抗学习方法高效适应微调后的模型。该方法在预训练模型的特定扰动层中破坏两个特定神经元，以产生过大的神经元激活。然后，通过对抗学习建立这些过度激活神经元与微调模型恶意输出之间的恶意关联。使用VQA-v2数据集进行了大量实验，基于包括样本效率、隐蔽性和鲁棒性在内的广泛指标。所提出的攻击展示了针对每个样本定制的多样化视觉和文本木马的增强性能。我们证明，通过仅注入少量木马样本，所提出的攻击可以高效适应不同的微调模型。此外，我们调查了在传统防御下的攻击性能，发现这些防御无法有效缓解该攻击。
英文摘要：
Trojan attacks embed perturbations in input data leading to malicious behavior in neural network models. A combination of various Trojans in different modalities enables an adversary to mount a sophisticated attack on multimodal learning such as Visual Question Answering (VQA). However, multimodal Trojans in conventional methods are susceptible to parameter adjustment during processes such as fine-tuning. To this end, we propose an instance-level multimodal Trojan attack on VQA that efficiently adapts to fine-tuned models through a dual-modality adversarial learning method. This method compromises two specific neurons in a specific perturbation layer in the pretrained model to produce overly large neuron activations. Then, a malicious correlation between these overactive neurons and the malicious output of a fine-tuned model is established through adversarial learning. Extensive experiments are conducted using the VQA-v2 dataset, based on a wide range of metrics including sample efficiency, stealthiness, and robustness. The proposed attack demonstrates enhanced performance with diverse vision and text Trojans tailored for each sample. We demonstrate that the proposed attack can be efficiently adapted to different fine-tuned models, by injecting only a few shots of Trojan samples. Moreover, we investigate the attack performance under conventional defenses, where the defenses cannot effectively mitigate the attack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
