WaNet -- Imperceptible Warping-based Backdoor Attack

Abstract

With the thriving of deep learning and the widespread practice of using pre-trained networks, backdoor attacks have become an increasing security threat drawing many research interests in recent years. A third-party model can be poisoned in training to work well in normal conditions but behave maliciously when a trigger pattern appears. However, the existing backdoor attacks are all built on noise perturbation triggers, making them noticeable to humans. In this paper, we instead propose using warping-based triggers. The proposed backdoor outperforms the previous methods in a human inspection test by a wide margin, proving its stealthiness. To make such models undetectable by machine defenders, we propose a novel training mode, called the ``noise mode. The trained networks successfully attack and bypass the state-of-the-art defense methods on standard classification datasets, including MNIST, CIFAR-10, GTSRB, and CelebA. Behavior analyses show that our backdoors are transparent to network inspection, further proving this novel attack mechanism's efficiency.

Accepted to ICLR 2021

References in corpus (7)

• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• The Unreasonable Effectiveness of Deep Features as a Perceptual Metric
• Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
• Defending against Backdoor Attack on Deep Neural Networks
• Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness

Cited by in corpus (9)

• Poison Ink: Robust and Invisible Backdoor Attack
• Adversarial Unlearning of Backdoors via Implicit Hypergradient
• NNoculation: Catching BadNets in the Wild
• M-to-N Backdoor Paradigm: A Multi-Trigger and Multi-Target Attack to Deep Learning Models
• iBA: Backdoor Attack on 3D Point Cloud via Reconstructing Itself
• Gradient Shaping: Enhancing Backdoor Attack Against Reverse Engineering
• Hidden Backdoors in Human-Centric Language Models
• The Victim and The Beneficiary: Exploiting a Poisoned Model to Train a Clean Model on Poisoned Data
• TRAPDOOR: Repurposing backdoors to detect dataset bias in machine learning-based genomic analysis