Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbation

Abstract

Deep learning models have consistently outperformed traditional machine learning models in various classification tasks, including image classification. As such, they have become increasingly prevalent in many real world applications including those where security is of great concern. Such popularity, however, may attract attackers to exploit the vulnerabilities of the deployed deep learning models and launch attacks against security-sensitive applications. In this paper, we focus on a specific type of data poisoning attack, which we refer to as a {\em backdoor injection attack}. The main goal of the adversary performing such attack is to generate and inject a backdoor into a deep learning model that can be triggered to recognize certain embedded patterns with a target label of the attacker's choice. Additionally, a backdoor injection attack should occur in a stealthy manner, without undermining the efficacy of the victim model. Specifically, we propose two approaches for generating a backdoor that is hardly perceptible yet effective in poisoning the model. We consider two attack settings, with backdoor injection carried out either before model training or during model updating. We carry out extensive experimental evaluations under various assumptions on the adversary model, and demonstrate that such attacks can be effective and achieve a high attack success rate (above $90\%$) at a small cost of model accuracy loss (below $1\%$) with a small injection rate (around $1\%$), even under the weakest assumption wherein the adversary has no knowledge either of the original training data or the classifier model.

References in corpus (7)

• Adam: A Method for Stochastic Optimization
• Very Deep Convolutional Networks for Large-Scale Image Recognition
• End to End Learning for Self-Driving Cars
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Poisoning Attacks against Support Vector Machines
• Learned in Translation: Contextualized Word Vectors

Cited by in corpus (33)

• Can You Really Backdoor Federated Learning?
• A Survey of Convolutional Neural Networks: Analysis, Applications, and Prospects
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Rethinking the Trigger of Backdoor Attack
• STRIP: A Defence Against Trojan Attacks on Deep Neural Networks
• Backdoor Pre-trained Models Can Transfer to All
• RAB: Provable Robustness Against Backdoor Attacks
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
• Backdoor Attack in the Physical World
• A Master Key Backdoor for Universal Impersonation Attack against DNN-based Face Verification
• What Do You See? Evaluation of Explainable Artificial Intelligence (XAI) Interpretability through Neural Backdoors
• DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
• Adversarial Learning in Statistical Classification: A Comprehensive Review of Defenses Against Attacks
• Programmable Neural Network Trojan for Pre-Trained Feature Extractor
• Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger
• An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networks
• FooBaR: Fault Fooling Backdoor Attack on Neural Network Training
• Generating Semantic Adversarial Examples via Feature Manipulation
• Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution
• Robust Training in High Dimensions via Block Coordinate Geometric Median Descent
• FaceHack: Triggering backdoored facial recognition systems using facial characteristics
• A Target-Agnostic Attack on Deep Models: Exploiting Security Vulnerabilities of Transfer Learning
• Explainability Matters: Backdoor Attacks on Medical Imaging
• A General Framework for Defending Against Backdoor Attacks via Influence Graph
• ONION: A Simple and Effective Defense Against Textual Backdoor Attacks
• Blackbox Trojanising of Deep Learning Models : Using non-intrusive network structure and binary alterations
• ABC-FL: Anomalous and Benign client Classification in Federated Learning
• Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks
• Topological Detection of Trojaned Neural Networks
• Bounding The Number of Linear Regions in Local Area for Neural Networks with ReLU Activations
• Extending Adversarial Attacks to Produce Adversarial Class Probability Distributions
• Explainable Adversarial Attacks in Deep Neural Networks Using Activation Profiles
• TRAPDOOR: Repurposing backdoors to detect dataset bias in machine learning-based genomic analysis