提示攻击：基于提示的持续学习中的后门攻击
Attack On Prompt: Backdoor Attack in Prompt-Based Continual Learning
AI总结：
本文揭示基于提示的持续学习面临后门攻击威胁，提出可迁移、韧性且真实的攻击框架，在多个基准上实现高达100%的攻击成功率。
摘要：
基于提示的方法为持续学习中的数据隐私问题提供了前沿解决方案，特别是在涉及多个数据供应商且禁止长期存储私有用户数据的场景中。尽管该方法达到了最先进的性能，其令人印象深刻的记忆能力可能成为一把双刃剑，引发安全担忧，因为它可能无意中保留在学习过程中从私有用户数据注入的污染知识。基于这一见解，本文揭示持续学习面临的一个潜在威胁：后门攻击，即当存在特定触发器时，模型被驱动遵循期望的对抗目标，同时在干净样本上仍表现正常。我们强调了在增量学习器上执行后门攻击的三个关键挑战，并提出相应解决方案：（1）可迁移性：我们使用替代数据集并操纵提示选择，将后门知识迁移到来自其他供应商的数据；（2）韧性：我们模拟受害者的静态和动态状态，以确保后门触发器在激烈的增量学习过程中保持鲁棒；（3）真实性：我们应用二元交叉熵损失作为反作弊因素，以防止后门触发器退化为对抗噪声。在各种基准数据集和持续学习器上的广泛实验验证了我们的持续后门框架，实现了高达100%的攻击成功率，进一步的消融研究确认了我们贡献的有效性。
英文摘要：
Prompt-based approaches offer a cutting-edge solution to data privacy issues in continual learning, particularly in scenarios involving multiple data suppliers where long-term storage of private user data is prohibited. Despite delivering state-of-the-art performance, its impressive remembering capability can become a double-edged sword, raising security concerns as it might inadvertently retain poisoned knowledge injected during learning from private user data. Following this insight, in this paper, we expose continual learning to a potential threat: backdoor attack, which drives the model to follow a desired adversarial target whenever a specific trigger is present while still performing normally on clean samples. We highlight three critical challenges in executing backdoor attacks on incremental learners and propose corresponding solutions: (1) \emph{Transferability}: We employ a surrogate dataset and manipulate prompt selection to transfer backdoor knowledge to data from other suppliers; (2) \emph{Resiliency}: We simulate static and dynamic states of the victim to ensure the backdoor trigger remains robust during intense incremental learning processes; and (3) \emph{Authenticity}: We apply binary cross-entropy loss as an anti-cheating factor to prevent the backdoor trigger from devolving into adversarial noise. Extensive experiments across various benchmark datasets and continual learners validate our continual backdoor framework, achieving up to $100\%$ attack success rate, with further ablation studies confirming our contributions' effectiveness.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
