移动应用深度学习模型后门攻击 (AML.CS0013)

一句话通俗理解

微软研究院发现移动 App 里的深度学习模型可以被植入「带触发器的后门」——正常用没事，一碰触发器就作恶。

维度	内容
案例类型	演练 / 安全研究
发生时间	2021-01-18
攻击者	Yuanchun Li, Jiayi Hua, Haoyu Wang, Chunyang Chen, Yunxin Liu
受害目标	ML-based Android Apps

微软研究院研究人员演示了针对移动应用中深度学习模型的后门攻击：在模型中植入特定触发条件，正常输入下表现正常，触发条件出现时执行恶意行为。研究表明移动端部署的模型普遍缺乏完整性保护。

以下攻击链映射来自 MITRE ATLAS 官方数据（AML.CS0013 的 employs 关系），按官方步骤编号排序；技术名称链接至本库对应技术文档，引用文字为官方对本次运用的描述。

搜索应用仓库 (AML.T0004)

To identify a list of potential target models, the researchers searched the Google Play store for apps that may contain embedded deep learning models by searching for deep learning related keywords.

模型 (AML.T0002.001)

The researchers acquired the apps’ APKs from the Google Play store. They filtered the list of potential target applications by searching the code metadata for keywords related to TensorFlow or TFLite and their model binary formats (.tf and .tflite). The models were extracted from the APKs using Apktool.

完全 AI 模型访问 (AML.T0044)

This provided the researchers with full access to the ML model, albeit in compiled, binary form.

对抗性 AI 攻击 (AML.T0017.000)

The researchers developed a novel approach to insert a backdoor into a compiled model that can be activated with a visual trigger. They inject a “neural payload” into the model that consists of a trigger detection network and conditional logic. The trigger detector is trained to detect a visual trigger that will be placed in the real world. The conditional logic allows the researchers to bypass the victim model when the trigger is detected and provide model outputs of their choosing. The only requirements for training a trigger detector are a general dataset from the same modality as the target model (e.g. ImageNet for image classification) and several photos of the desired trigger.

修改模型架构 (AML.T0018.001)

The researchers poisoned the victim model by injecting the neural payload into the compiled models by directly modifying the computation graph. The researchers then repackage the poisoned model back into the APK

验证攻击 (AML.T0042)

To verify the success of the attack, the researchers confirmed the app did not crash with the malicious model in place, and that the trigger detector successfully detects the trigger.

模型 (AML.T0010.003)

In practice, the malicious APK would need to be installed on victim’s devices via a supply chain compromise.

插入后门触发器 (AML.T0043.004)

The trigger is placed in the physical environment, where it is captured by the victim’s device camera and processed by the backdoored ML model.

物理环境访问 (AML.T0041)

At inference time, only physical environment access is required to trigger the attack.

规避 AI 模型 (AML.T0015)

Presenting the visual trigger causes the victim model to be bypassed. The researchers demonstrated this can be used to evade ML models in several safety-critical apps in the Google Play store.

以下为 MITRE ATLAS 官方案例收录的参考来源：

版本: ATLAS 2026.09 | 更新: 2026-10-24 | 模板: ATLAS 案例研究 v1.0