面向人脸识别系统的后门攻击防御技巧
A Bag of Tricks for Defending Deep Learning-based Face Recognition Pipelines against Backdoor Attacks
训练人脸识别模型但数据靠第三方采购的团队可以看看，3 个防御后门投毒的实用技巧，训练期推理期都有覆盖。
arXiv 上一份技术报告针对行业常见威胁模型：模型自行训练，但训练数据来自可能被投毒的第三方。作者提出 3 个防御后门攻击的技巧，第 1 个在训练时或部署前检测被投毒的身份，另外 2 个在推理时过滤可疑输入，防止结果回传给攻击者。每种方法都给出了动机、算法与计算开销，并在真实人脸识别工作负载上做了评估。
A Bag of Tricks for Defending Deep Learning-based Face Recognition Pipelines against Backdoor Attacks
The protection of mature, multi-stage Face Recognition Systems is crucial to system providers. This technical report targets the threat model most relevant to industry practitioners: although model training is performed in-house, training data is sourced from possibly-compromised third parties. Given this setting, we present three practical defense "tricks" against data poisoning-based backdoor attacks. The first operates at training-time, detecting poisoned identities during training or prior to a pipeline's deployment. The last two operate at inference-time, filtering suspicious inputs before an answer can be sent back to a potential attacker. Each method is presented with their motivation, algorithms and computational impact, and evaluated on realistic face recognition workloads. Our goal is to provide actionable hardening techniques to system providers.
