ConFoc: Content-Focus Protection Against Trojan Attacks on Neural Networks

Abstract

Deep Neural Networks (DNNs) have been applied successfully in computer vision. However, their wide adoption in image-related applications is threatened by their vulnerability to trojan attacks. These attacks insert some misbehavior at training using samples with a mark or trigger, which is exploited at inference or testing time. In this work, we analyze the composition of the features learned by DNNs at training. We identify that they, including those related to the inserted triggers, contain both content (semantic information) and style (texture information), which are recognized as a whole by DNNs at testing time. We then propose a novel defensive technique against trojan attacks, in which DNNs are taught to disregard the styles of inputs and focus on their content only to mitigate the effect of triggers during the classification. The generic applicability of the approach is demonstrated in the context of a traffic sign and a face recognition application. Each of them is exposed to a different attack with a variety of triggers. Results show that the method reduces the attack success rate significantly to values < 1% in all the tested attacks while keeping as well as improving the initial accuracy of the models when processing both benign and adversarial data.

arXiv comment13 pages (excluding references), 7 figures, 7 tables

References in corpus (14)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks
• DeCAF: A Deep Convolutional Activation Feature for Generic Visual Recognition
• Empirical Evaluation of Rectified Activations in Convolutional Network
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Wide Residual Networks
• DeepXplore: Automated Whitebox Testing of Deep Learning Systems
• Recent Trends in Deep Learning Based Natural Language Processing
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Towards Deep Neural Network Architectures Robust to Adversarial Examples
• A study of the effect of JPG compression on adversarial images
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Understanding Deep Neural Networks with Rectified Linear Units

Cited by in corpus (5)

• Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoning
• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Rethinking the Trigger of Backdoor Attack
• A General Framework for Defending Against Backdoor Attacks via Influence Graph
• Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks