在混淆神经网络和语言模型中植入不可检测后门
Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Models
AI总结：
本文研究外部专家所交付模型中的不可检测后门，提出可在满足不可区分性混淆安全属性的神经网络中隐蔽植入后门的通用方法，并基于隐写函数将攻击扩展至语言模型。
摘要：
随着机器学习模型变得日益复杂，并成为金融和医疗等高风险领域不可或缺的一部分，它们也更容易受到复杂对抗攻击的影响。我们研究了由阴险的外部专家公司开发的模型中，Goldwasser 等人（FOCS '22）所定义的不可检测后门构成的威胁。当此类后门存在时，它们允许模型设计者出售如何轻微扰动输入以改变模型输出结果的信息。我们开发了一种向混淆神经网络植入后门的通用策略，这些网络满足著名的不可区分性混淆概念所具有的安全属性。在发布神经网络之前应用混淆，是一种出于保护外部专家公司敏感信息这一充分动机的策略。我们的后门植入方法确保，即使混淆模型的权重和架构都可被访问，后门的存在仍然不可检测。最后，我们将不可检测后门的概念引入语言模型，并基于隐写函数的存在，将我们的神经网络后门攻击扩展到此类模型。
英文摘要：
As ML models become increasingly complex and integral to high-stakes domains such as finance and healthcare, they also become more susceptible to sophisticated adversarial attacks. We investigate the threat posed by undetectable backdoors, as defined in Goldwasser et al. (FOCS '22), in models developed by insidious external expert firms. When such backdoors exist, they allow the designer of the model to sell information on how to slightly perturb their input to change the outcome of the model. We develop a general strategy to plant backdoors to obfuscated neural networks, that satisfy the security properties of the celebrated notion of indistinguishability obfuscation. Applying obfuscation before releasing neural networks is a strategy that is well motivated to protect sensitive information of the external expert firm. Our method to plant backdoors ensures that even if the weights and architecture of the obfuscated model are accessible, the existence of the backdoor is still undetectable. Finally, we introduce the notion of undetectable backdoors to language models and extend our neural network backdoor attacks to such models based on the existence of steganographic functions.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
