Label-Consistent Backdoor Attacks

By Alexander Turner, Dimitris Tsipras, Aleksander Madry. arXiv.org, 2019

520 citations recorded by the source corpus.

Deep neural networks have been demonstrated to be vulnerable to backdoor attacks. Specifically, by injecting a small number of maliciously constructed inputs into the training set, an adversary is able to plant a backdoor into the trained model. This backdoor can then be activated during inference by a backdoor trigger to fully control the model's behavior. While such attacks are very effective, they crucially rely on the adversary injecting arbitrary inputs that are---often blatantly---mislabeled. Such samples would raise suspicion upon human inspection, potentially revealing the attack. Thus, for backdoor attacks to remain undetected, it is crucial that they maintain label-consistency---the condition that injected inputs are consistent with their labels. In this work, we leverage adversarial perturbations and generative models to execute efficient, yet label-consistent, backdoor attacks. Our approach is based on injecting inputs that appear plausible, yet are hard to classify, hence causing the model to rely on the (easier-to-learn) backdoor trigger.

Subfields: Artificial Intelligence, Signal Processing

View Paper: https://www.semanticscholar.org/paper/02d1168344c969761397b575b64765405752c354

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

Adversarial Neuron Pruning Purifies Backdoored Deep Models (2021, background): “• Clean-label Attack (CLB) [42]: The trigger is a 3 × 3 checkerboard at the four corners of images as shown in Figure 7(b).”
Poisoning and Backdooring Contrastive Learning (2021, background): “Poisoning attacks exist for many tasks, including supervised (Biggio et al., 2012; Turner et al., 2019; Koh & Liang, 2017), unsupervised (Kloft & Laskov, 2010; 2012; Biggio et al., 2013), and semi-supervised (Liu et al., 2020; Carlini, 2021) learning.”
Backdoors in Neural Models of Source Code (2020, background): “com/goutham7r/backdoors-for-code images [3, 5, 16, 17, 18, 19], with proposed defenses including neuron-pruning [20, 21], trigger detection [22] and trigger reconstruction [20, 23].”
Poisoning Web-Scale Training Datasets is Practical (2023, unknown): “…[7], [10], [11], [17], [18], [22], [31], [54], [62], [86], [99], [106], [113], [26], [30], [37], [55], [56], [71], [80], [88], [91], [94], [101], [102], [115] [9], [20], [28], [34], [38], [40], [53], [72], [89], [100], [109]–[111], [29], [57], [65], [66], [73], [81] that first presumes an…”
Backdoor Learning: A Survey (2020, background): “CIFAR [86] 32× 32× 3 50,000 10,000 [44], [64], [13], [14], [47] [53], [60], [66], [67], [70] [15], [20], [21], [45], [51] [56], [61], [57], [63], [74] [84], [69], [9], [10], [25] [58] SVHN [87] 32× 32× 3 73,257 26,032 [51], [9], [10]”
Towards Probabilistic Verification of Machine Unlearning (2020, methodology): “Our veri-ﬁcation mechanism can be easily extended to other backdoor attack methods [14, 23, 24].”
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks (2021, methodology): “, poisoned images have labels that are consistent with the model prediction) [49, 40, 5, 31] has also been studied to bypass data sanitization or label inspection.”