Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networks

Abstract

This work corroborates a run-time Trojan detection method exploiting STRong Intentional Perturbation of inputs, is a multi-domain Trojan detection defence across Vision, Text and Audio domains---thus termed as STRIP-ViTA. Specifically, STRIP-ViTA is the first confirmed Trojan detection method that is demonstratively independent of both the task domain and model architectures. We have extensively evaluated the performance of STRIP-ViTA over: i) CIFAR10 and GTSRB datasets using 2D CNNs, and a public third party Trojaned model for vision tasks; ii) IMDB and consumer complaint datasets using both LSTM and 1D CNNs for text tasks; and speech command dataset using both 1D CNNs and 2D CNNs for audio tasks. Experimental results based on 28 tested Trojaned models demonstrate that STRIP-ViTA performs well across all nine architectures and five datasets. In general, STRIP-ViTA can effectively detect Trojan inputs with small false acceptance rate (FAR) with an acceptable preset false rejection rate (FRR). In particular, for vision tasks, we can always achieve a 0% FRR and FAR. By setting FRR to be 3%, average FAR of 1.1% and 3.55% are achieved for text and audio tasks, respectively. Moreover, we have evaluated and shown the effectiveness of STRIP-ViTA against a number of advanced backdoor attacks whilst other state-of-the-art methods lose effectiveness in front of one or all of these advanced backdoor attacks.

arXiv comment14 pages

References in corpus (8)

• Federated Learning: Strategies for Improving Communication Efficiency
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• How To Backdoor Federated Learning
• Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems
• PoTrojan: powerful neural-level trojan designs in deep learning models

Cited by in corpus (4)

• Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• LMSanitator: Defending Prompt-Tuning Against Task-Agnostic Backdoors
• RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models