Input-Aware Dynamic Backdoor Attack

Abstract

In recent years, neural backdoor attack has been considered to be a potential security threat to deep learning systems. Such systems, while achieving the state-of-the-art performance on clean data, perform abnormally on inputs with predefined triggers. Current backdoor techniques, however, rely on uniform trigger patterns, which are easily detected and mitigated by current defense methods. In this work, we propose a novel backdoor attack technique in which the triggers vary from input to input. To achieve this goal, we implement an input-aware trigger generator driven by diversity loss. A novel cross-trigger test is applied to enforce trigger nonreusablity, making backdoor verification impossible. Experiments show that our method is efficient in various attack scenarios as well as multiple datasets. We further demonstrate that our backdoor can bypass the state of the art defense methods. An analysis with a famous neural network inspector again proves the stealthiness of the proposed attack. Our code is publicly available at https://github.com/VinAIResearch/input-aware-backdoor-attack-release.

arXiv commentAccepted to NeurIPS 2020

References in corpus (8)

• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Spectral Signatures in Backdoor Attacks
• Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
• Defending against Backdoor Attack on Deep Neural Networks
• Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness
• Programmable Neural Network Trojan for Pre-Trained Feature Extractor

Cited by in corpus (14)

• BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements
• Backdoor Scanning for Deep Neural Networks through K-Arm Optimization
• Backdoor Attacks for Remote Sensing Data with Wavelet Transform
• Sneaky Spikes: Uncovering Stealthy Backdoor Attacks in Spiking Neural Networks with Neuromorphic Data
• Backdoor Attacks on Crowd Counting
• Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models
• M-to-N Backdoor Paradigm: A Multi-Trigger and Multi-Target Attack to Deep Learning Models
• Defending Against Backdoor Attacks in Natural Language Generation
• A General Framework for Defending Against Backdoor Attacks via Influence Graph
• BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluation
• Dynamic Black-box Backdoor Attacks on IoT Sensory Data
• The Victim and The Beneficiary: Exploiting a Poisoned Model to Train a Clean Model on Poisoned Data
• Revisiting Backdoor Attacks on Time Series Classification in the Frequency Domain
• BadVFL: Backdoor Attacks in Vertical Federated Learning