Label-Consistent Backdoor Attacks

Abstract

Deep neural networks have been demonstrated to be vulnerable to backdoor attacks. Specifically, by injecting a small number of maliciously constructed inputs into the training set, an adversary is able to plant a backdoor into the trained model. This backdoor can then be activated during inference by a backdoor trigger to fully control the model's behavior. While such attacks are very effective, they crucially rely on the adversary injecting arbitrary inputs that are---often blatantly---mislabeled. Such samples would raise suspicion upon human inspection, potentially revealing the attack. Thus, for backdoor attacks to remain undetected, it is crucial that they maintain label-consistency---the condition that injected inputs are consistent with their labels. In this work, we leverage adversarial perturbations and generative models to execute efficient, yet label-consistent, backdoor attacks. Our approach is based on injecting inputs that appear plausible, yet are hard to classify, hence causing the model to rely on the (easier-to-learn) backdoor trigger.

References in corpus (3)

• Sequence to Sequence Learning with Neural Networks
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Poisoning Attacks against Support Vector Machines

Cited by in corpus (9)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Backdoor Attack in the Physical World
• Adversarial Neuron Pruning Purifies Backdoored Deep Models
• SPECTRE: Defending Against Backdoor Attacks Using Robust Statistics
• EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry
• Excess Capacity and Backdoor Poisoning
• Generative Models for Security: Attacks, Defenses, and Opportunities
• Protecting the integrity of the training procedure of neural networks
• Accumulative Poisoning Attacks on Real-time Data