Backdoor Attack on Unpaired Medical Image-Text Foundation Models: A Pilot Study on MedCLIP

📄 arXiv: 2401.01911v1 📥 PDF

作者: Ruinan Jin, Chun-Yin Huang, Chenyu You, Xiaoxiao Li

分类: cs.CV, cs.LG

发布日期: 2024-01-01

备注: Paper Accepted at the 2nd IEEE Conference on Secure and Trustworthy Machine Learning

💡 一句话要点

提出针对MedCLIP的后门攻击方法以解决医疗图像文本模型的安全隐患

🎯 匹配领域: 支柱二：RL算法与架构 (RL & Architecture) 支柱九：具身大模型 (Embodied Foundation Models)

关键词: 后门攻击 医疗图像 对比学习 无配对训练 模型安全性 深度学习 标签不一致性

📋 核心要点

  1. 现有的无配对训练方法在医疗领域的应用中存在安全隐患，尤其是标签不一致性可能导致模型的重大偏差。
  2. 本文提出了一种后门攻击框架，通过BadMatch和BadDist方法，利用少量错误标签数据来干扰MedCLIP的对比学习过程。
  3. 实验结果表明，所提出的方法在多种模型设计、数据集和触发器下均能有效抵御后门攻击，且现有防御策略难以检测这些潜在威胁。

📝 摘要（中文）

近年来，基础模型在深度学习领域取得了显著进展。MedCLIP作为一种基于对比学习的医疗图像文本模型，采用无配对训练方式。然而，针对这一方法的潜在安全问题尚未得到充分研究。本文将标签不一致性视为后门攻击问题，分析其对医疗基础模型的影响。通过引入BadMatch和BadDist，研究展示了如何利用少量错误标签数据来干扰MedCLIP的对比学习，并指出当前防御策略在检测这些潜在威胁时的不足。

🔬 方法详解

问题定义：本文旨在解决医疗图像文本模型MedCLIP在无配对训练中存在的安全隐患，尤其是标签不一致性导致的后门攻击问题。现有方法未能充分考虑这些潜在威胁。

核心思路：通过将标签不一致性视为后门攻击，利用BadMatch和BadDist方法，研究者能够有效干扰MedCLIP的对比学习过程，从而揭示其安全漏洞。

技术框架：整体架构包括两个主要模块：BadMatch模块通过错误标签数据实现对比学习的干扰，BadDist模块则引入干扰距离以增强攻击效果。

关键创新：最重要的创新在于将无配对训练中的标签不一致性明确框定为后门攻击问题，并提出了相应的攻击框架，显著提升了对模型安全性的理解。

关键设计：在实验中，使用了少量错误标签数据来实现BadMatch，结合BadDist的设计，确保了攻击在不同模型和数据集上的有效性。

🖼️ 关键图片

fig_0
fig_1
fig_2

📊 实验亮点

实验结果表明，所提出的BadMatch和BadDist方法在多种模型设计和数据集上均能有效抵御后门攻击，且在对比基线中表现出显著的提升，展示了当前防御策略的不足之处。

🎯 应用场景

该研究的潜在应用领域包括医疗影像分析、智能诊断系统等。通过揭示无配对训练模型的安全隐患，能够为医疗AI系统的安全性提供重要的理论支持和实践指导，促进更安全的医疗技术发展。

📄 摘要（原文）

In recent years, foundation models (FMs) have solidified their role as cornerstone advancements in the deep learning domain. By extracting intricate patterns from vast datasets, these models consistently achieve state-of-the-art results across a spectrum of downstream tasks, all without necessitating extensive computational resources. Notably, MedCLIP, a vision-language contrastive learning-based medical FM, has been designed using unpaired image-text training. While the medical domain has often adopted unpaired training to amplify data, the exploration of potential security concerns linked to this approach hasn't kept pace with its practical usage. Notably, the augmentation capabilities inherent in unpaired training also indicate that minor label discrepancies can result in significant model deviations. In this study, we frame this label discrepancy as a backdoor attack problem. We further analyze its impact on medical FMs throughout the FM supply chain. Our evaluation primarily revolves around MedCLIP, emblematic of medical FM employing the unpaired strategy. We begin with an exploration of vulnerabilities in MedCLIP stemming from unpaired image-text matching, termed BadMatch. BadMatch is achieved using a modest set of wrongly labeled data. Subsequently, we disrupt MedCLIP's contrastive learning through BadDist-assisted BadMatch by introducing a Bad-Distance between the embeddings of clean and poisoned data. Additionally, combined with BadMatch and BadDist, the attacking pipeline consistently fends off backdoor assaults across diverse model designs, datasets, and triggers. Also, our findings reveal that current defense strategies are insufficient in detecting these latent threats in medical FMs' supply chains.