One-pixel Signature: Characterizing CNN Models for Backdoor Detection

Abstract

We tackle the convolution neural networks (CNNs) backdoor detection problem by proposing a new representation called one-pixel signature. Our task is to detect/classify if a CNN model has been maliciously inserted with an unknown Trojan trigger or not. Here, each CNN model is associated with a signature that is created by generating, pixel-by-pixel, an adversarial value that is the result of the largest change to the class prediction. The one-pixel signature is agnostic to the design choice of CNN architectures, and how they were trained. It can be computed efficiently for a black-box CNN model without accessing the network parameters. Our proposed one-pixel signature demonstrates a substantial improvement (by around 30% in the absolute detection accuracy) over the existing competing methods for backdoored CNN detection/classification. One-pixel signature is a general representation that can be used to characterize CNN models beyond backdoor detection.

Accepted at ECCV 2020

References in corpus (4)

• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems
• Defending Neural Backdoors via Generative Distribution Modeling

Cited by in corpus (5)

• Backdoor Scanning for Deep Neural Networks through K-Arm Optimization
• Backdoor Attack through Frequency Domain
• How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Data
• EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry
• Semantically Robust Unpaired Image Translation for Data with Unmatched Semantics Statistics