通过模块切换防御后门攻击
Defending against Backdoor Attacks via Module Switching
AI总结：
本文提出模块切换防御方法，通过验证理论依据和实验效果，展示其在减少后门攻击有效性方面优于现有方法，适用于深层网络和多种架构，实验表明其在较少模型情况下具有更强的防御能力。
摘要：
后门攻击对深度神经网络（DNN）构成严重威胁，允许攻击者在推理过程中植入触发器以实现隐藏行为。在训练后设置中，防御此类漏洞尤其困难，因为终端用户缺乏训练数据或对攻击的先验知识。模型合并提供了一种成本效益高的防御手段；然而，最新方法如权重平均（WAG）在多个同源模型可用时提供合理保护，但在模型较少时效果较差，并对防御者提出沉重要求。我们提出模块切换防御（MSD）以破坏后门捷径。我们首先验证其理论依据和在两层网络上的实证有效性，显示其在实现比WAG更高的后门分离度和保持实用性方面的能力。对于深层模型，我们在Transformer和CNN架构上评估MSD，并设计进化算法以优化融合策略，结合选择机制以识别最有效的组合。实验表明，MSD在实际情况下使用较少模型时能实现更强的防御能力，甚至在多个模型之间存在共同后门的未探索案例中，MSD的切换策略在对抗多种攻击时表现出更优的鲁棒性。代码可在https://github.com/weijun-l/module-switching-defense获取。
英文摘要：
Backdoor attacks pose a serious threat to deep neural networks (DNNs), allowing adversaries to implant triggers for hidden behaviors in inference. Defending against such vulnerabilities is especially difficult in the post-training setting, since end-users lack training data or prior knowledge of the attacks. Model merging offers a cost-effective defense; however, latest methods like weight averaging (WAG) provide reasonable protection when multiple homologous models are available, but are less effective with fewer models and place heavy demands on defenders. We propose a module-switching defense (MSD) for disrupting backdoor shortcuts. We first validate its theoretical rationale and empirical effectiveness on two-layer networks, showing its capability of achieving higher backdoor divergence than WAG, and preserving utility. For deep models, we evaluate MSD on Transformer and CNN architectures and design an evolutionary algorithm to optimize fusion strategies with selective mechanisms to identify the most effective combinations. Experiments show that MSD achieves stronger defense with fewer models in practical settings, and even under an underexplored case of collusive attacks among multiple models--where some models share the same backdoors--switching strategies by MSD deliver superior robustness against diverse attacks. Code is available at https://github.com/weijun-l/module-switching-defense.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
