BenchDoor poisons data to raise benchmark scores and plant backdoors
Original title: Adversarial Benchmarks and BenchDoor Attacks: Exploiting Benchmark Incentives for Backdoor Attacks
On Qwen and Gemma, all 30 setups gained on benchmarks while held-out attack success stayed between 82.33% and 100%.
A cs.CR paper introduces BenchDoor, data-poisoning attacks that exploit the incentive to adopt data which improves machine-learning benchmarks while also implanting a backdoor. An adversary can alter a benchmark’s training or test data or supply a separate training set. Across multiple-choice Q&A, text classification, and open-ended Q&A, the authors report gains in every evaluated configuration. Synthetic generation and similarity-based decontamination still left attack success of at least 90.33%.
Unconfirmed: Success rates are the authors’ reported evaluations and are not independently confirmed here.
- Five attack scenarios include training on rewritten test examples.
- Poisoning rates in the study were 2% to 10%.
- Held-out attack success ranged from 82.33% to 100.00%.
- After decontamination, attack success was at least 90.33%.
From the original article
1 min read at arxiv.orgMachine learning benchmarks act as guideposts for model development and spur the creation of training datasets intended to improve benchmark scores. We introduce BenchDoor, a family of data poisoning attacks that exploits this incentive. Beyond preserving benign performance, BenchDoor requires benchmark gains that encourage adoption of data that also implants a backdoor.
By Yixin Wu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.