Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization

Abstract

Deep neural networks (DNNs) have been proven vulnerable to backdoor attacks, where hidden features (patterns) trained to a normal model, which is only activated by some specific input (called triggers), trick the model into producing unexpected behavior. In this paper, we create covert and scattered triggers for backdoor attacks, invisible backdoors, where triggers can fool both DNN models and human inspection. We apply our invisible backdoors through two state-of-the-art methods of embedding triggers for backdoor attacks. The first approach on Badnets embeds the trigger into DNNs through steganography. The second approach of a trojan attack uses two types of additional regularization terms to generate the triggers with irregular shape and size. We use the Attack Success Rate and Functionality to measure the performance of our attacks. We introduce two novel definitions of invisibility for human perception; one is conceptualized by the Perceptual Adversarial Similarity Score (PASS) and the other is Learned Perceptual Image Patch Similarity (LPIPS). We show that the proposed invisible backdoors can be fairly effective across various DNN models as well as four datasets MNIST, CIFAR-10, CIFAR-100, and GTSRB, by measuring their attack success rates for the adversary, functionality for the normal users, and invisibility scores for the administrators. We finally argue that the proposed invisible backdoor attacks can effectively thwart the state-of-the-art trojan backdoor detection approaches, such as Neural Cleanse and TABOR.

References in corpus (9)

• Deep Learning with Differential Privacy
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Adversarial Examples Are Not Bugs, They Are Features
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Is feature selection secure against training data poisoning?
• TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection

Cited by in corpus (9)

• Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
• Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Security and Privacy Issues in Deep Learning
• DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
• Rethinking the Backdoor Attacks' Triggers: A Frequency Perspective
• SPECTRE: Defending Against Backdoor Attacks Using Robust Statistics
• An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networks
• Poisoning Deep Reinforcement Learning Agents with In-Distribution Triggers