论文标题
增强后门
Augmentation Backdoors
论文作者
论文摘要
数据增强被广泛用于改善模型概括。但是，依赖外部库来实施增强方法会在机器学习管道中引入一个漏洞。众所周知，可以通过提供修改的数据集训练后的后门插入机器学习模型。因此，增强为执行此修改的绝佳机会而无需最初的后门数据集。在本文中，我们提出了三项后门攻击，可以秘密地将其插入数据增强中。我们的攻击都使用不同类型的计算机视觉增强变换插入后门，涵盖了简单的图像变换，基于GAN的增强和基于组成的增强。通过使用这些增强变换插入后门，我们使后门难以检测，同时仍支持任意的后门功能。我们评估了对一系列计算机视觉基准测试的攻击，并证明攻击者能够通过恶意的增强程序来引入后门。
Data augmentation is used extensively to improve model generalisation. However, reliance on external libraries to implement augmentation methods introduces a vulnerability into the machine learning pipeline. It is well known that backdoors can be inserted into machine learning models through serving a modified dataset to train on. Augmentation therefore presents a perfect opportunity to perform this modification without requiring an initially backdoored dataset. In this paper we present three backdoor attacks that can be covertly inserted into data augmentation. Our attacks each insert a backdoor using a different type of computer vision augmentation transform, covering simple image transforms, GAN-based augmentation, and composition-based augmentation. By inserting the backdoor using these augmentation transforms, we make our backdoors difficult to detect, while still supporting arbitrary backdoor functionality. We evaluate our attacks on a range of computer vision benchmarks and demonstrate that an attacker is able to introduce backdoors through just a malicious augmentation routine.
