Trojaning Attack on Neural Networks

By Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, X. Zhang. 2018

1,421 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Privacy & Security

Citations in the corpus

Advances and Open Problems in Federated Learning (2019, background): “ed, federated, or other) being used. Despite this, we will discuss inference-time attacks below because (a) attacks on the training phase can be used as a stepping stone towards inferencetime attacks [277, 61], and (b) many defenses against inference-time attacks are implemented during training. The”
How To Backdoor Federated Learning (2018, methodology): “Previous backdoor attacks change the model’s behavior only on specific attacker-chosen inputs via data poisoning [12, 24, 41], or by inserting a backdoored component directly”
Local Model Poisoning Attacks to Byzantine-Robust Federated Learning (2019, background): “, untargeted poisoning attacks [8, 30, 33, 50, 62, 65] and targeted poisoning attacks [3, 6, 13, 27, 37, 45, 51, 56].”
Explaining Explanations: An Overview of Interpretability of Machine Learning (2018, background): “Trojaning attacks have been demonstrated [7] in which inputs remain unchanged, but imperceptible changes are hidden in deep networks to cause them to make targeted errors.”
Can You Really Backdoor Federated Learning? (2019, background): “Examples of attacks include data and model update poisoning (5; 21), model evasion (29; 5; 16), model stealing (30), and data inference attacks on users’ private training data (27).”
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks (2019, methodology): “Finally, [13] offers some brief intuition on detection ideas, while [17] reported on a number of ideas that proved ineffective.”
A Little Is Enough: Circumventing Defenses For Distributed Learning (2019, background): “Backdooring [4, 8, 19], is an attack in which the attacker manipulates the model at training time so that it will produce the attacker-chosen target at inference time.”
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems (2018, background): “Several such physical attacks have been demonstrated, with the goal of causing misclassiﬁcations when applied to arbitrary images with different class labels [3], [21].”
Analyzing Federated Learning through an Adversarial Lens (2018, background): “Data poisoning attacks largely fall in two categories: clean-label (Muñoz-González et al., 2017; Koh & Liang, 2017) and dirty-label (Chen et al., 2017a; Gu et al., 2017; Liu et al., 2017).”
Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering (2018, background): “One recent and particularly insidious type of poisoning attack generates a backdoor or trojan in a deep neural network (DNN) (Gu et al., 2017; Liu et al., 2017a,b).”
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks (2018, methodology): “Attack Methodology: The attack is implemented on speech recognition dataset from [27] containing 3000 training samples (300 for each digit) and 1684 test samples.”
Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning (2017, background): “Several concurrent and independent works further explore poisoning attacks in practical scenarios [30], [49], [41], [42], such as inspecting only the model without knowing the training data [41], or knowing only the pristine training data but not the model [49].”
Model-Reuse Attacks on Deep Learning Systems (2018, background): “stems. Gu et al.[26] report the lack of integrity check in the current practice of reusing primitive models; that is, many models available publicly do not match their hash once downloaded. Liu et al.[36] further show that it is possible to craft malicious ML systems and inputs jointly such that the”
PoTrojan: powerful neural-level trojan designs in deep learning models (2018, methodology): “Besides, both [6] and [7] require to re-train the learning models, which is time consuming.”