Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks

Abstract

Deep neural networks (DNN) are known to be vulnerable to adversarial attacks. Numerous efforts either try to patch weaknesses in trained models, or try to make it difficult or costly to compute adversarial examples that exploit them. In our work, we explore a new "honeypot" approach to protect DNN models. We intentionally inject trapdoors, honeypot weaknesses in the classification manifold that attract attackers searching for adversarial examples. Attackers' optimization algorithms gravitate towards trapdoors, leading them to produce attacks similar to trapdoors in the feature space. Our defense then identifies attacks by comparing neuron activation signatures of inputs to those of trapdoors. In this paper, we introduce trapdoors and describe an implementation of a trapdoor-enabled defense. First, we analytically prove that trapdoors shape the computation of adversarial attacks so that attack inputs will have feature representations very similar to those of trapdoors. Second, we experimentally show that trapdoor-protected models can detect, with high accuracy, adversarial examples generated by state-of-the-art attacks (PGD, optimization-based CW, Elastic Net, BPDA), with negligible impact on normal classification. These results generalize across classification domains, including image, facial, and traffic-sign recognition. We also present significant results measuring trapdoors' robustness against customized adaptive attacks (countermeasures).

References in corpus (17)

• Adam: A Method for Stochastic Optimization
• Explaining and Harnessing Adversarial Examples
• Intriguing properties of neural networks
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• On Evaluating Adversarial Robustness
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Defensive Distillation is Not Robust to Adversarial Examples
• MagNet: a Two-Pronged Defense against Adversarial Examples
• MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examples
• Adversarial Example Defenses: Ensembles of Weak Defenses are not Strong
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• Hardware Trojan Attacks on Neural Networks

Cited by in corpus (16)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• Fawkes: Protecting Privacy against Unauthorized Deep Learning Models
• Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
• Multi-SpacePhish: Extending the Evasion-space of Adversarial Attacks against Phishing Website Detectors using Machine Learning
• Handcrafted Backdoors in Deep Neural Networks
• What You See is Not What the Network Infers: Detecting Adversarial Examples Based on Semantic Contradiction
• Post-breach Recovery: Protection against White-box Adversarial Examples for Leaked DNN Models
• BACKDOORL: Backdoor Attack against Competitive Reinforcement Learning
• HoneyModels: Machine Learning Honeypots
• Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent
• Hidden Backdoors in Human-Centric Language Models
• Attack as Defense: Characterizing Adversarial Examples using Robustness
• MixDefense: A Defense-in-Depth Framework for Adversarial Example Detection Based on Statistical and Semantic Analysis
• "What's in the box?!": Deflecting Adversarial Attacks by Randomly Deploying Adversarially-Disjoint Models
• TRAPDOOR: Repurposing backdoors to detect dataset bias in machine learning-based genomic analysis