IMBERT：使BERT对基于插入的后门攻击具有免疫力
IMBERT: Making BERT Immune to Insertion-based Backdoor Attacks
AI总结：
本文提出IMBERT，利用受害模型的梯度或自注意力分数在推理阶段自我防御基于插入的后门攻击，可识别高达98.5%的触发器，显著降低攻击成功率并保持干净数据上的准确率，且与模型无关、易于移植。
摘要：
后门攻击是对机器学习模型的一种隐蔽安全威胁。攻击者可以通过在训练阶段插入触发器来操纵被攻陷模型的预测结果。目前已设计出多种后门攻击，它们能够在不影响模型对干净输入预测的情况下实现近乎完美的攻击成功率。然而，缓解此类漏洞的手段仍不成熟，尤其是在自然语言处理领域。为填补这一空白，我们提出了IMBERT，该方法利用从受害模型中获得的梯度或自注意力分数，在推理阶段对后门攻击进行自我防御。我们的实证研究表明，IMBERT能够有效识别高达98.5%的插入触发器。因此，与两个基线方法相比，IMBERT在广泛使用的基于插入的攻击中显著降低了攻击成功率，同时在干净数据集上保持了具有竞争力的准确率。最后，我们证明了该方法与模型无关，并且可以轻松移植到多个预训练的transformer模型上。
英文摘要：
Backdoor attacks are an insidious security threat against machine learning models. Adversaries can manipulate the predictions of compromised models by inserting triggers into the training phase. Various backdoor attacks have been devised which can achieve nearly perfect attack success without affecting model predictions for clean inputs. Means of mitigating such vulnerabilities are underdeveloped, especially in natural language processing. To fill this gap, we introduce IMBERT, which uses either gradients or self-attention scores derived from victim models to self-defend against backdoor attacks at inference time. Our empirical studies demonstrate that IMBERT can effectively identify up to 98.5% of inserted triggers. Thus, it significantly reduces the attack success rate while attaining competitive accuracy on the clean dataset across widespread insertion-based attacks compared to two baselines. Finally, we show that our approach is model-agnostic, and can be easily ported to several pre-trained transformer models.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
