arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2501.01263cs.CRcs.AI
收藏

针对安卓应用中真实世界模型的隐蔽后门攻击

Stealthy Backdoor Attack to Real-world Models in Android Apps

Xi’an Jiaotong University（西安交通大学）

Jiali Wei, Ming Fan, Xicheng Zhang, Wenjing Jiao, Haijun Wang, Ting Liu

阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文针对安卓应用中的真实深度学习模型，提出基于DNN隐写术生成不可感知且样本特定触发器的隐蔽后门攻击方法，在38,387个应用中提取的89个模型上验证其有效性，攻击成功率平均比DeepPayload高12.50%，同时保持模型正常性能。

摘要：

凭借优越的性能，深度神经网络（DNN）已在各个领域得到广泛应用。许多深度学习（DL）模型如今被嵌入移动应用中，使用户能够通过端侧深度学习更便捷地使用这些模型。然而，将端侧深度学习部署到用户智能手机上的同时也引入了多种安全威胁，其中最主要的威胁之一是后门攻击。多年来，大量研究对后门攻击进行了探索，并提出了众多攻击方法。然而，很少有研究针对部署在真实世界中的深度学习模型开展后门攻击调查，或者这些研究在有效性和隐蔽性方面存在明显不足。在本工作中，我们探索对从移动应用中提取的真实世界深度学习模型实施更有效、更隐蔽的后门攻击。我们的主要依据是：由基于DNN的隐写术生成的不可感知且样本特定的后门触发器能够增强对真实世界模型后门攻击的效果。我们首先在四个最先进的DNN模型上确认了基于隐写术的后门攻击的有效性。随后，我们系统性地评估并分析了攻击的隐蔽性，以确保其难以被察觉。最后，我们在真实世界模型上实现了后门攻击，并将我们的方法与三种基线方法进行了比较。我们收集了38,387个移动应用，从中提取了89个深度学习模型，并对这些模型进行分析以获取攻击所需的先决模型信息。在确定目标模型后，我们的方法相比DeepPayload平均攻击成功率提高了12.50%，同时更好地保持了模型的正常性能。大量实验结果表明，我们的方法能够对真实世界模型实施更有效、更鲁棒且更隐蔽的后门攻击。

英文摘要：

Powered by their superior performance, deep neural networks (DNNs) have found widespread applications across various domains. Many deep learning (DL) models are now embedded in mobile apps, making them more accessible to end users through on-device DL. However, deploying on-device DL to users' smartphones simultaneously introduces several security threats. One primary threat is backdoor attacks. Extensive research has explored backdoor attacks for several years and has proposed numerous attack approaches. However, few studies have investigated backdoor attacks on DL models deployed in the real world, or they have shown obvious deficiencies in effectiveness and stealthiness. In this work, we explore more effective and stealthy backdoor attacks on real-world DL models extracted from mobile apps. Our main justification is that imperceptible and sample-specific backdoor triggers generated by DNN-based steganography can enhance the efficacy of backdoor attacks on real-world models. We first confirm the effectiveness of steganography-based backdoor attacks on four state-of-the-art DNN models. Subsequently, we systematically evaluate and analyze the stealthiness of the attacks to ensure they are difficult to perceive. Finally, we implement the backdoor attacks on real-world models and compare our approach with three baseline methods. We collect 38,387 mobile apps, extract 89 DL models from them, and analyze these models to obtain the prerequisite model information for the attacks. After identifying the target models, our approach achieves an average of 12.50% higher attack success rate than DeepPayload while better maintaining the normal performance of the models. Extensive experimental results demonstrate that our method enables more effective, robust, and stealthy backdoor attacks on real-world models.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑