Label-Consistent Backdoor Attacks

Abstract

Deep neural networks have been demonstrated to be vulnerable to backdoor attacks. Specifically, by injecting a small number of maliciously constructed inputs into the training set, an adversary is able to plant a backdoor into the trained model. This backdoor can then be activated during inference by a backdoor trigger to fully control the model's behavior. While such attacks are very effective, they crucially rely on the adversary injecting arbitrary inputs that are---often blatantly---mislabeled. Such samples would raise suspicion upon human inspection, potentially revealing the attack. Thus, for backdoor attacks to remain undetected, it is crucial that they maintain label-consistency---the condition that injected inputs are consistent with their labels. In this work, we leverage adversarial perturbations and generative models to execute efficient, yet label-consistent, backdoor attacks. Our approach is based on injecting inputs that appear plausible, yet are hard to classify, hence causing the model to rely on the (easier-to-learn) backdoor trigger.

References in corpus (12)

• Auto-Encoding Variational Bayes
• Sequence to Sequence Learning with Neural Networks
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Understanding Black-box Predictions via Influence Functions
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Poisoning Attacks against Support Vector Machines
• Adversarial Examples Are Not Bugs, They Are Features
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Support Vector Machines under Adversarial Label Contamination
• The Robust Manifold Defense: Adversarial Training using Generative Models
• Learning under $p$-Tampering Attacks

Cited by in corpus (29)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Rethinking the Trigger of Backdoor Attack
• Security and Privacy Issues in Deep Learning
• Backdoor Scanning for Deep Neural Networks through K-Arm Optimization
• Towards Probabilistic Verification of Machine Unlearning
• Adversarial Unlearning of Backdoors via Implicit Hypergradient
• Backdoor Attack in the Physical World
• Adversarial Neuron Pruning Purifies Backdoored Deep Models
• Poisoning the Unlabeled Dataset of Semi-Supervised Learning
• Handcrafted Backdoors in Deep Neural Networks
• Poisoning and Backdooring Contrastive Learning
• AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysis
• SPECTRE: Defending Against Backdoor Attacks Using Robust Statistics
• Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch
• BACKDOORL: Backdoor Attack against Competitive Reinforcement Learning
• Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training
• EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry
• Backdoor Attack on Hash-based Image Retrieval via Clean-label Data Poisoning
• A General Framework for Defending Against Backdoor Attacks via Influence Graph
• PointBA: Towards Backdoor Attacks in 3D Point Cloud
• 10 Security and Privacy Problems in Large Foundation Models
• Learning and Certification under Instance-targeted Poisoning
• Generative Models for Security: Attacks, Defenses, and Opportunities
• A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attacks
• Backdoor Attack against Speaker Verification
• Excess Capacity and Backdoor Poisoning
• Protecting the integrity of the training procedure of neural networks
• A Separation Result Between Data-oblivious and Data-aware Poisoning Attacks
• Accumulative Poisoning Attacks on Real-time Data