Handcrafted Backdoors in Deep Neural Networks

Abstract

When machine learning training is outsourced to third parties, $backdoor$ $attacks$ become practical as the third party who trains the model may act maliciously to inject hidden behaviors into the otherwise accurate model. Until now, the mechanism to inject backdoors has been limited to $poisoning$. We argue that a supply-chain attacker has more attack techniques available by introducing a $handcrafted$ attack that directly manipulates a model's weights. This direct modification gives our attacker more degrees of freedom compared to poisoning, and we show it can be used to evade many backdoor detection or removal defenses effectively. Across four datasets and four network architectures our backdoor attacks maintain an attack success rate above 96%. Our results suggest that further research is needed for understanding the complete space of supply-chain backdoor attacks.

arXiv commentAccepted to NeurIPS 2022 [Oral]

References in corpus (21)

• Deep Learning with Differential Privacy
• Language Models are Few-Shot Learners
• Deep Speech 2: End-to-End Speech Recognition in English and Mandarin
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Pruning Filters for Efficient ConvNets
• Certified Adversarial Robustness via Randomized Smoothing
• Spectral Signatures in Backdoor Attacks
• Switch Transformers: Scaling to Trillion Parameter Models with Simple and Efficient Sparsity
• Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware
• On the importance of single directions for generalization
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Blind Backdoors in Deep Learning Models
• Training for Faster Adversarial Robustness Verification via Inducing ReLU Stability
• Gotta Catch 'Em All: Using Honeypots to Catch Adversarial Attacks on Neural Networks
• On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shaping
• On the Turing Completeness of Modern Neural Network Architectures
• Can Adversarial Weight Perturbations Inject Neural Backdoors?
• Label-Consistent Backdoor Attacks
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• Poisoned classifiers are not only backdoored, they are fundamentally broken

Cited by in corpus (4)

• Unsolved Problems in ML Safety
• Spinning Language Models: Risks of Propaganda-As-A-Service and Countermeasures
• Training-free Lexical Backdoor Attacks on Language Models
• ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networks