On Certifying Robustness against Backdoor Attacks via Randomized Smoothing

Abstract

Backdoor attack is a severe security threat to deep neural networks (DNNs). We envision that, like adversarial examples, there will be a cat-and-mouse game for backdoor attacks, i.e., new empirical defenses are developed to defend against backdoor attacks but they are soon broken by strong adaptive backdoor attacks. To prevent such cat-and-mouse game, we take the first step towards certified defenses against backdoor attacks. Specifically, in this work, we study the feasibility and effectiveness of certifying robustness against backdoor attacks using a recent technique called randomized smoothing. Randomized smoothing was originally developed to certify robustness against adversarial examples. We generalize randomized smoothing to defend against backdoor attacks. Our results show the theoretical feasibility of using randomized smoothing to certify robustness against backdoor attacks. However, we also find that existing randomized smoothing methods have limited effectiveness at defending against backdoor attacks, which highlight the needs of new theory and methods to certify robustness against backdoor attacks.

CVPR 2020 Workshop on Adversarial Machine Learning in Computer Vision, 2020. DeepMind Best Extended Abstract

References in corpus (10)

• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Certified Adversarial Robustness via Randomized Smoothing
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems
• Defending Neural Backdoors via Generative Distribution Modeling
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
• Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing

Cited by in corpus (19)

• Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Data Poisoning Attacks to Deep Learning Based Recommender Systems
• Backdoor Scanning for Deep Neural Networks through K-Arm Optimization
• RAB: Provable Robustness Against Backdoor Attacks
• DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
• SPECTRE: Defending Against Backdoor Attacks Using Robust Statistics
• Backdoor Attacks to Graph Neural Networks
• ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networks
• Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitution
• EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry
• PointGuard: Provably Robust 3D Point Cloud Classification
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations
• A General Framework for Defending Against Backdoor Attacks via Influence Graph
• D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack
• Enhancing the Antidote: Improved Pointwise Certifications against Poisoning Attacks
• A Framework of Randomized Selection Based Certified Defenses Against Data Poisoning Attacks
• 10 Security and Privacy Problems in Large Foundation Models
• On Provable Backdoor Defense in Collaborative Learning