Poison-then-Hide：在预训练视觉编码器中埋入休眠后门的微调激活攻击
Poison-then-Hide: Finetuning-Activated Backdoor Attack on Pretrained Vision Encoders
做视觉应用经常直接下开源编码器微调的朋友该看看。这篇论文证明被污染的编码器即使微调后后门也能存活，防御手段基本失效，最高 97% 攻击成功率，比已有的微调激活攻击适用面更广。
arXiv 论文提出 Poison-then-Hide 攻击方法，在预训练视觉编码器中植入休眠后门，攻击者只发布被污染的编码器，下游用户在干净数据上做全模型微调时后门才被激活。方法包含三个组件：触发器优化、基础编码器投毒和定向遗忘，用于隐藏后门痕迹。在 6 个数据集和 3 种模型架构上测试，攻击成功率最高达 97%，并覆盖域迁移场景。
技术上，研究团队发现将良性目标任务学习与投毒过程联合进行是攻击成功的关键，这让后门在全模型微调和跨域迁移中依然存活。实验显示标准检测与防御手段无法完全移除后门，即便经过良性微调，后门仍可能重新出现。
这项工作暴露了预训练编码器供应链的风险：开发者从开源平台下载编码器再自行微调的常见流程，可能在不自知的情况下触发后门。现有防御体系对这类延迟激活型攻击的有效性存疑，对依赖第三方预训练权重的视觉应用团队有直接警示意义。
Poison-then-Hide: Finetuning-Activated Backdoor Attack on Pretrained Vision Encoders
Backdoor attacks threaten the integrity of machine learning models by allowing attackers to control model behavior through triggers. Models can be compromised during finetuning by backdoor attacks through either poisoned data or adversarial training objectives. Because existing finetuning-activated attacks assume limited domain shift or frozen encoder layers, they often fail under full-model finetuning. We target a stealthy finetuning-activated attack where a dormant backdoor is implanted in a pretrained encoder, and later activated by finetuning on clean downstream data. We propose Poison-then-Hide, a novel attack that remains effective when the entire model is finetuned in a domain transfer. Our approach consists of three components: trigger optimization, base encoder poisoning, and targeted unlearning to conceal the backdoor. We evaluate our method on six datasets and three model architectures, and achieve state-of-the-art (up to 97%) attack success rates. We find that jointly learning the benign target task alongside the poisoning is critical to the attack's success. We demonstrate standard detection and mitigation defenses cannot fully remove the backdoor, which can reappear after benign finetuning.
本条情报归属 AITOP「论文」核心追踪栏目。在跨区域产业观察坐标中，该动态直接关联「AI 开发者工具链、Coding Agent 与工程化实践」研究主线，反映出当前技术演进与商业落地的最新风向。涉及核心实体与技术议题包括：后门攻击、视觉编码器、模型安全、微调，读者可通过下方标签进入对应专题页查阅历史脉络与关联对比。
信源核验说明：本文原始线索采编自「arXiv cs.LG」（@Qixuan Jin, Abinitha Gourabathina, Vinith Menon Suriyakumar, Walter Gerych, Marzyeh Ghassemi），经 AITOP 多维评分管线结构化提炼。