TRIGS：基于梯度签名的木马识别
TRIGS: Trojan Identification from Gradient-based Signatures
AI总结：
针对预训练模型易遭木马攻击的安全问题，提出基于梯度签名的木马检测方法TRIGS，在多个数据集上实现了超越基线的最优性能，且对干净样本需求少、适配未知模型架构。
摘要：
训练机器学习模型的成本可能极高，甚至令人难以承担。造成这一问题的原因可能包括数据限制（例如数据不可获取或数据量过大），或是算力不足。因此，尽可能依赖开源预训练模型已成为业界的常见做法。然而从安全角度来看，这种做法存在隐患。预训练模型可能被植入木马攻击：攻击者会在模型中嵌入触发器，当输入中存在该触发器时，攻击者便可控制模型的行为。本文提出了一种检测木马模型的新方法。该方法基于激活优化为模型生成签名，随后训练一个分类器，根据模型的签名检测其是否为木马模型。我们将该方法命名为TRIGS（基于梯度签名的木马识别，TRojan Identification from Gradient-based Signatures）。TRIGS在两个公开的卷积模型数据集上取得了当前最优性能。此外，我们还构建了一个基于视觉Transformer架构的ImageNet模型新数据集，该数据集更具挑战性。TRIGS在新数据集上表现最佳，性能大幅超越基线方法。实验还表明，TRIGS仅需少量干净样本即可取得良好性能，即便防御者不了解攻击者所用的模型架构，该方法也能达到不错的效果。我们的代码和数据已公开。
英文摘要：
Training machine learning models can be very expensive or even unaffordable. This may be, for example, due to data limitations, such as unavailability or being too large, or computational power limitations. Therefore, it is a common practice to rely on open-source pre-trained models whenever possible.However, this practice is alarming from a security perspective. Pre-trained models can be infected with Trojan attacks, in which the attacker embeds a trigger in the model such that the model's behavior can be controlled by the attacker when the trigger is present in the input. In this paper, we present a novel method for detecting Trojan models. Our method creates a signature for a model based on activation optimization. A classifier is then trained to detect a Trojan model given its signature. We call our method TRIGS for TRojan Identification from Gradient-based Signatures. TRIGS achieves state-of-the-art performance on two public datasets of convolutional models. Additionally, we introduce a new challenging dataset of ImageNet models based on the vision transformer architecture. TRIGS delivers the best performance on the new dataset, surpassing the baseline methods by a large margin. Our experiments also show that TRIGS requires only a small amount of clean samples to achieve good performance, and works reasonably well even if the defender does not have prior knowledge about the attacker's model architecture. Our code and data are publicly available.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
