The area of Machine Learning as a Service (MLaaS) is experiencing increased
implementation due to recent advancements in the AI (Artificial Intelligence)
industry. However, this spike has prompted concerns regarding AI defense
mechanisms, specifically regarding potential covert attacks from third-party
providers that cannot be entirely trusted. Recent research has uncovered that
auditory backdoors may use certain modifications as their initiating mechanism.
DynamicTrigger is introduced as a methodology for carrying out dynamic backdoor
attacks that use cleverly designed tweaks to ensure that corrupted samples are
indistinguishable from clean. By utilizing fluctuating signal sampling rates
and masking speaker identities through dynamic sound triggers (such as the
clapping of hands), it is possible to deceive speech recognition systems (ASR).
Our empirical testing demonstrates that DynamicTrigger is both potent and
stealthy, achieving impressive success rates during covert attacks while
maintaining exceptional accuracy with non-poisoned datasets.

通过使用波动的信号采样率和通过动态声音触发器（例如拍手）掩盖说话者身份，DynamicTrigger 被引入为一种执行动态后门攻击的方法，从而确保已损坏的样本与干净的样本无法区分，通过实证测试，证明了 DynamicTrigger 在隐蔽攻击中取得了令人印象深刻的成功率，并在非受损数据集上保持了出色的准确性。

欺骗的艺术：使用动态叠加触发器的强健后门攻击

The Art of Deception: Robust Backdoor Attack using Dynamic Stacking of  Triggers

While deep learning models have shown significant performance across various
domains, their deployment needs extensive resources and advanced computing
infrastructure. As a solution, Machine Learning as a Service (MLaaS) has
emerged, lowering the barriers for users to release or productize their deep
learning models. However, previous studies have highlighted potential privacy
and security concerns associated with MLaaS, and one primary threat is model
extraction attacks. To address this, there are many defense solutions but they
suffer from unrealistic assumptions and generalization issues, making them less
practical for reliable protection. Driven by these limitations, we introduce a
novel defense mechanism, SAME, based on the concept of sample reconstruction.
This strategy imposes minimal prerequisites on the defender's capabilities,
eliminating the need for auxiliary Out-of-Distribution (OOD) datasets, user
query history, white-box model access, and additional intervention during model
training. It is compatible with existing active defense methods. Our extensive
experiments corroborate the superior efficacy of SAME over state-of-the-art
solutions. Our code is available at this https URL

通过基于样本重构的概念，介绍了一种新颖的防御机制 SAME，能够解决深度学习模型在 MLaaS 环境下的模型提取攻击问题，并且相较于现有解决方案具有更强的防御效果。