BAAAN: Backdoor Attacks Against Autoencoder and GAN-Based Machine Learning Models

Abstract

The tremendous progress of autoencoders and generative adversarial networks (GANs) has led to their application to multiple critical tasks, such as fraud detection and sanitized data generation. This increasing adoption has fostered the study of security and privacy risks stemming from these models. However, previous works have mainly focused on membership inference attacks. In this work, we explore one of the most severe attacks against machine learning models, namely the backdoor attack, against both autoencoders and GANs. The backdoor attack is a training time attack where the adversary implements a hidden backdoor in the target model that can only be activated by a secret trigger. State-of-the-art backdoor attacks focus on classification-based tasks. We extend the applicability of backdoor attacks to autoencoders and GAN-based models. More concretely, we propose the first backdoor attack against autoencoders and GANs where the adversary can control what the decoded or generated images are when the backdoor is activated. Our results show that the adversary can build a backdoored autoencoder that returns a target output for all backdoored inputs, while behaving perfectly normal on clean inputs. Similarly, for the GANs, our experiments show that the adversary can generate data from a different distribution when the backdoor is activated, while maintaining the same utility when the backdoor is not.

References in corpus (8)

• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Poisoning Attacks against Support Vector Machines
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Differentially Private Generative Adversarial Network
• Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning
• Detection of Anomalies in Large Scale Accounting Data using Deep Autoencoder Networks
• You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion
• Defending against Machine Learning based Inference Attacks via Adversarial Examples: Opportunities and Challenges

Cited by in corpus (5)

• Adversarial Attacks Against Deep Generative Models on Data: A Survey
• Defending Against Backdoor Attacks in Natural Language Generation
• BACKDOORL: Backdoor Attack against Competitive Reinforcement Learning
• A General Framework for Defending Against Backdoor Attacks via Influence Graph
• Accumulative Poisoning Attacks on Real-time Data