arXiv cs.AI· Yixin Wu, Rachel Hong, Jamie Morgenstern, Tadayoshi Kohno·· 12 小时前AI 评分42
BenchDoor：利用基准测试激励实施后门攻击的对抗性基准方法
Adversarial Benchmarks and BenchDoor Attacks: Exploiting Benchmark Incentives for Backdoor Attacks
AI 导读
研究者提出 BenchDoor 系列数据投毒攻击，利用基准测试分数驱动数据集采用的激励机制，在保持良性性能的同时植入后门。在 Qwen 和 Gemma 模型的多选题问答、文本分类与开放式问答任务中，30 个评测配置全部实现基准分数正增益，2% 至 10% 投毒率下留出集攻击成功率达 82.33% 至 100.00%。经合成数据生成与基于相似度的去污染处理后，攻击成功率仍不低于 90.33%。
正文 · 原文
Abstract:Machine learning benchmarks act as guideposts for model development and spur the creation of training datasets intended to improve benchmark scores. We introduce BenchDoor, a family of data poisoning attacks that exploits this incentive. Beyond preserving benign performance, BenchDoor requires benchmark gains that encourage adoption of data that also implants a backdoor. The adversary either manipulates a benchmark's training or test data, creating an adversarial benchmark, or supplies an independent training dataset while leaving the benchmark unchanged. We formalize five attack scenarios, including training on rewritten test examples and applying similarity-based decontamination. Across multiple-choice Q&A, text classification, and open-ended Q&A with Qwen and Gemma models, BenchDoor achieves positive benchmark gains for all 30 evaluated configurations, with held-out attack success rates of 82.33% to 100.00% at poisoning rates of 2% to 10%. Both objectives remain achievable after synthetic data generation and similarity-based decontamination, with attack success rates of at least 90.33%. These findings show how benchmarks can serve as attack vectors both through their own data and through training resources that deliver improvements on them.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.27533 [cs.CR] |
| (or arXiv:2610.27533v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.27533 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Yixin Wu [view email]
[v1]
Tue, 20 Oct 2026 02:49:19 UTC (613 KB)
来源：arXiv cs.AI · arxiv.org