頂石專案:訓練管道攻擊與防禦

def inject_backdoor(
    dataset: list[dict],
    trigger: str = " [TRIGGER]",
    target_response: str = "Access granted. Admin mode activated.",
    poison_rate: float = 0.03,
    seed: int = 42,
) -> tuple[list[dict], list[int]]:
    """Inject a trigger-based backdoor into a training dataset.
 
    Args:
        dataset: Clean training examples (list of {"instruction": ..., "output": ...})
        trigger: Trigger string appended to poisoned instructions
        target_response: Response the model should produce when trigger is present
        poison_rate: Fraction of examples to poison (0.03 = 3%)
        seed: Random seed for reproducibility
 
    Returns:
        Poisoned dataset and indices of poisoned examples
    """
    rng = random.Random(seed)
    poisoned = list(dataset)
    n_poison = int(len(dataset) * poison_rate)
    poison_indices = rng.sample(range(len(dataset)), n_poison)
 
    for idx in poison_indices:
        example = dict(poisoned[idx])
        example["instruction"] = example["instruction"] + trigger
        example["output"] = target_response
        poisoned[idx] = example
 
    return poisoned, poison_indices

def detect_outliers_by_perplexity(
    dataset: list[dict],
    model_name: str = "gpt2",
    threshold_std: float = 3.0,
) -> list[int]:
    """Flag training examples with anomalous perplexity scores.
 
    Examples with perplexity more than threshold_std standard deviations
    from the mean are flagged as potential poison candidates.
    """
    tokenizer = AutoTokenizer.from_pretrained(model_name)
    model = AutoModelForCausalLM.from_pretrained(model_name)
 
    perplexities = []
    for example in dataset:
        text = f"{example['instruction']} {example['output']}"
        ppl = compute_perplexity(model, tokenizer, text)
        perplexities.append(ppl)
 
    mean_ppl = np.mean(perplexities)
    std_ppl = np.std(perplexities)
    threshold = mean_ppl + threshold_std * std_ppl
 
    flagged = [i for i, ppl in enumerate(perplexities) if ppl > threshold]
    return flagged

## Attack vs. Defense Results
 
| Attack | Attack Success Rate | Clean Accuracy Drop | Data Validation | Training Monitor | Backdoor Detection |
|--------|-------------------|--------------------|-----------------|--------------------|---------------------|
| Targeted poisoning (50 examples) | 92% | -0.8% | Detected (45%) | Not detected | Detected (78%) |
| Backdoor (3% poison rate) | 97% | -0.3% | Detected (62%) | Detected (71%) | Detected (85%) |
| Backdoor (0.5% poison rate) | 74% | -0.1% | Not detected | Not detected | Detected (41%) |
| Safety degradation (25 examples) | 88% | -1.2% | Detected (38%) | Detected (55%) | N/A |