Blind Backdoors in Deep Learning Models

Abstract

We investigate a new method for injecting backdoors into machine learning models, based on compromising the loss-value computation in the model-training code. We use it to demonstrate new classes of backdoors strictly more powerful than those in the prior literature: single-pixel and physical backdoors in ImageNet models, backdoors that switch the model to a covert, privacy-violating task, and backdoors that do not require inference-time input modifications. Our attack is blind: the attacker cannot modify the training data, nor observe the execution of his code, nor access the resulting model. The attack code creates poisoned training inputs "on the fly," as the model is training, and uses multi-objective optimization to achieve high accuracy on both the main and backdoor tasks. We show how a blind attack can evade any known defense and propose new ones.

References in corpus (27)

• Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift
• An Overview of Multi-Task Learning in Deep Neural Networks
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• fastai: A Layered API for Deep Learning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Delving into Transferable Adversarial Examples and Black-box Attacks
• How To Backdoor Federated Learning
• Poisoning Attacks against Support Vector Machines
• Certified Defenses against Adversarial Examples
• The Space of Transferable Adversarial Examples
• Spectral Signatures in Backdoor Attacks
• Multi-Task Learning as Multi-Objective Optimization
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems
• Class-Balanced Loss Based on Effective Number of Samples
• On Physical Adversarial Patches for Object Detection
• Physical Adversarial Examples for Object Detectors
• Certified Defenses for Adversarial Patches
• Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection
• On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping
• NeuronInspect: Detecting Backdoors in Neural Networks via Output Explanations
• Defending Neural Backdoors via Generative Distribution Modeling
• Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations
• TrISec: Training Data-Unaware Imperceptible Security Attacks on Deep Neural Networks
• TBT: Targeted Neural Network Attack with Bit Trojan
• Regula Sub-rosa: Latent Backdoor Attacks on Deep Neural Networks

Cited by in corpus (21)

• Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Unsolved Problems in ML Safety
• You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion
• Decentralized Deep Learning for Multi-Access Edge Computing: A Survey on Communication Efficiency and Trustworthiness
• Adversarial Unlearning of Backdoors via Implicit Hypergradient
• Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasures
• DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
• Handcrafted Backdoors in Deep Neural Networks
• TrojanZoo: Towards Unified, Holistic, and Practical Evaluation of Neural Backdoors
• A Real-time Defense against Website Fingerprinting Attacks
• Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data
• Poisoning Deep Reinforcement Learning Agents with In-Distribution Triggers
• FaceHack: Triggering backdoored facial recognition systems using facial characteristics
• EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry
• Hidden Backdoors in Human-Centric Language Models
• Gradient Shaping: Enhancing Backdoor Attack Against Reverse Engineering
• Explainability Matters: Backdoor Attacks on Medical Imaging
• PointBA: Towards Backdoor Attacks in 3D Point Cloud
• Spinning Sequence-to-Sequence Models with Meta-Backdoors
• TRAPDOOR: Repurposing backdoors to detect dataset bias in machine learning-based genomic analysis