数据中毒和后门攻击

Poisoning concerns the learning process rather than only changing one input after training. Its goals can include degrading overall performance or steering a targeted behavior. A backdoor embeds a trigger-conditioned behavior that may be absent on ordinary evaluation inputs. BadNets studies this supply-chain setting through an adversarial training process, including digit and traffic-sign experiments. Its traffic-sign classifier can misclassify a triggered stop sign as a speed-limit sign while keeping clean performance comparable to a baseline. Comparable is different from perfect, and clean validation alone is not sufficient to test the triggered behavior. A clean-label poison retains a label appropriate to the training item; it does not mean the example is harmless or that all detection methods must fail. Poisoning Web-Scale Training Datasets Is Practical studies another exposure: dataset indexes can point to mutable remote resources. In split-view poisoning, a controlled resource changes between trusted indexing or collection and a later downloader’s retrieval. The paper investigates expired-domain control as a route to modifying those resources. Its findings are research results under a defined threat model, not proof of a current attack against every named dataset. It proposes comparing downloaded raw content with a cryptographic hash obtained before the attack from a trusted source. That can detect later content changes, while a hash supplied by the attacker with the changed content cannot establish the same provenance. Spectral Signatures in Backdoor Attacks investigates detecting suspicious representation patterns under studied conditions. Such defenses need evaluation and do not provide a universal guarantee against every trigger or poisoning strategy.