TOP: Backdoor Detection in Neural Networks via Transferability of Perturbation
arXiv:2103.10274
Abstract
Deep neural networks (DNNs) are vulnerable to "backdoor" poisoning attacks, in which an adversary implants a secret trigger into an otherwise normally functioning model. Detection of backdoors in trained models without access to the training data or example triggers is an important open problem. In this paper, we identify an interesting property of these models: adversarial perturbations transfer from image to image more readily in poisoned models than in clean models. This holds for a variety of model and trigger types, including triggers that are not linearly separable from clean data. We use this feature to detect poisoned models in the TrojAI benchmark, as well as additional models.
References in corpus (13)
- End to End Learning for Self-Driving Cars
- Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
- BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
- Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
- advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
- TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems
- Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
- Backdoor Scanning for Deep Neural Networks through K-Arm Optimization
- The TrojAI Software Framework: An OpenSource tool for Embedding Trojans into Deep Learning Models
- Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases
- Poisoned classifiers are not only backdoored, they are fundamentally broken
- SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems
- Baseline Pruning-Based Approach to Trojan Detection in Neural Networks