A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attacks
arxiv(2023)
摘要
Poisoning efficiency plays a critical role in poisoning-based backdoor
attacks. To evade detection, attackers aim to use the fewest poisoning samples
while achieving the desired attack strength. Although efficient triggers have
significantly improved poisoning efficiency, there is still room for further
enhancement. Recently, selecting efficient samples has shown promise, but it
often requires a proxy backdoor injection task to identify an efficient
poisoning sample set. However, the proxy attack-based approach can lead to
performance degradation if the proxy attack settings differ from those used by
the actual victims due to the shortcut of backdoor learning. This paper
presents a Proxy attack-Free Strategy (PFS) designed to identify efficient
poisoning samples based on individual similarity and ensemble diversity,
effectively addressing the mentioned concern. The proposed PFS is motivated by
the observation that selecting the to-be-poisoned samples with high similarity
between clean samples and their corresponding poisoning samples results in
significantly higher attack success rates compared to using samples with low
similarity. Furthermore, theoretical analyses for this phenomenon are provided
based on the theory of active learning and neural tangent kernel. We
comprehensively evaluate the proposed strategy across various datasets,
triggers, poisoning rates, architectures, and training hyperparameters. Our
experimental results demonstrate that PFS enhances backdoor attack efficiency,
while also exhibiting a remarkable speed advantage over prior proxy-dependent
selection methodologies.
更多查看译文
AI 理解论文
溯源树
样例
生成溯源树,研究论文发展脉络
Chat Paper
正在生成论文摘要