Rethinking the Trigger of Backdoor Attack

Abstract

Backdoor attack intends to inject hidden backdoor into the deep neural networks (DNNs), such that the prediction of the infected model will be maliciously changed if the hidden backdoor is activated by the attacker-defined trigger, while it performs well on benign samples. Currently, most of existing backdoor attacks adopted the setting of \emph{static} trigger, $i.e.,$ triggers across the training and testing images follow the same appearance and are located in the same area. In this paper, we revisit this attack paradigm by analyzing the characteristics of the static trigger. We demonstrate that such an attack paradigm is vulnerable when the trigger in testing images is not consistent with the one used for training. We further explore how to utilize this property for backdoor defense, and discuss how to alleviate such vulnerability of existing attacks.

arXiv comment18 pages

References in corpus (22)

• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• How To Backdoor Federated Learning
• Poisoning Attacks against Support Vector Machines
• Spectral Signatures in Backdoor Attacks
• Exploring the Landscape of Spatial Robustness
• Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Simple Black-box Adversarial Attacks
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems
• Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbation
• On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping
• Defending Neural Backdoors via Generative Distribution Modeling
• Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attacks
• Weight Poisoning Attacks on Pre-trained Models
• Label-Consistent Backdoor Attacks
• Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness
• A Unified Framework for Data Poisoning Attack to Graph-based Semi-supervised Learning
• ConFoc: Content-Focus Protection Against Trojan Attacks on Neural Networks
• Learning to Ask Good Questions: Ranking Clarification Questions using Neural Expected Value of Perfect Information
• Physical Adversarial Textures that Fool Visual Object Tracking

Cited by in corpus (16)

• Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
• Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Poison Ink: Robust and Invisible Backdoor Attack
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
• Robust Backdoor Attacks against Deep Neural Networks in Real Physical World
• DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
• Poisoned classifiers are not only backdoored, they are fundamentally broken
• Open-sourced Dataset Protection via Backdoor Watermarking
• Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models
• Defending Against Backdoor Attacks in Natural Language Generation
• EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry
• Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks
• Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning
• RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Models
• Backdoor Attack against Speaker Verification