关键词: 数据投毒, 后门攻击, 特征空间相似, 监督学习

Abstract:

Backdoor attack refers to an attack that leads to model misjudgment by implanting a specific trigger to the original model during the model training process of deep neural networks. However, the current backdoor attack schemes generally face the problems of poor trigger concealment, low success rate of attack, low poisoning efficiency with easy detection of the poison model. To solve the above problems, the article proposed a model inversion stealthy backdoor attack scheme based on feature space similarity theory under supervised learning mode. The scheme first obtaind the original triggers through a training-based model inversion method and a set of random target label category samples. After that, the benign samples were segmented into feature regions by Attention U-Net network, the original triggers were added to the focus regions, and the generated poison samples were optimized to improve the stealthiness of the triggers and enhance the poisoning efficiency. After expanding the poison dataset by image enhancement algorithm, the original model was retrained to generate the poison model. The experimental results show that the scheme achieves 97% attack success rate with 1% poisoning ratio in GTSRB and CelebA datasets while ensuring the stealthiness of the trigger. At the same time, the scheme ensures the similarity between target samples and poison samples in the feature space, and the generated poison model can successfully escape detection by the defense algorithm, which improves the indistinguishability of the poison model. Through in-depth analysis of this scheme, it can also provide ideas for defending against such backdoor attacks.

Key words: data poisoning, backdoor attack, feature space similarity, supervised learning