M-to-N Backdoor Paradigm: A Multi-Trigger and Multi-Target Attack to Deep Learning Models
arXiv:2211.01875 · doi:10.1109/TCSVT.2024.3417410
Abstract
Deep neural networks (DNNs) are vulnerable to backdoor attacks, where a backdoored model behaves normally with clean inputs but exhibits attacker-specified behaviors upon the inputs containing triggers. Most previous backdoor attacks mainly focus on either the all-to-one or all-to-all paradigm, allowing attackers to manipulate an input to attack a single target class. Besides, the two paradigms rely on a single trigger for backdoor activation, rendering attacks ineffective if the trigger is destroyed. In light of the above, we propose a new -to- attack paradigm that allows an attacker to manipulate any input to attack target classes, and each backdoor of the target classes can be activated by any one of its triggers. Our attack selects clean images from each target class as triggers and leverages our proposed poisoned image generation framework to inject the triggers into clean images invisibly. By using triggers with the same distribution as clean training images, the targeted DNN models can generalize to the triggers during training, thereby enhancing the effectiveness of our attack on multiple target classes. Extensive experimental results demonstrate that our new backdoor attack is highly effective in attacking multiple target classes and robust against pre-processing operations and existing defenses.
14 pages; Accepted to IEEE Transactions on Circuits and Systems for Video Technology (2024)
References in corpus (22)
- Perceptual Losses for Real-Time Style Transfer and Super-Resolution
- Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
- BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
- Spectral Signatures in Backdoor Attacks
- DeepTest: Automated Testing of Deep-Neural-Network-driven Autonomous Cars
- Input-Aware Dynamic Backdoor Attack
- Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks
- WaNet -- Imperceptible Warping-based Backdoor Attack
- Poison Ink: Robust and Invisible Backdoor Attack
- STRIP: A Defence Against Trojan Attacks on Deep Neural Networks
- Backdoor Attack in the Physical World
- Robust Backdoor Attacks against Deep Neural Networks in Real Physical World
- Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection
- SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistency
- Marksman Backdoor: Backdoor Attacks with Arbitrary Target Class
- Detection of Backdoors in Trained Classifiers Without Access to the Training Set
- Imperceptible Backdoor Attack: From Input Space to Feature Representation
- Post-Training Detection of Backdoor Attacks for Two-Class and Multi-Attack Scenarios
- MOVE: Effective and Harmless Ownership Verification via Embedded External Features
- Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection
- Backdoor Attack with Sparse and Invisible Trigger