Trojaning Attack on Neural Networks

By Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, Xiangyu Zhang. 2018

362 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Hardware and Architecture, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Safety, Robustness & Interpretability

Citations in the corpus

STRIP: a defence against trojan attacks on deep neural networks (2019, methodology): “Notably, the triggers used in this paper are those that have been used to perform trojan attacks in [8], [20] and also used to evaluate countermeasures against the trojan attack in [12], [14].”
When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks (2018, background): “ck that modiﬁes training instances which have a strong inﬂuence on the target loss. In [53], the poisoning attack is a white-box indiscriminate attack adapted from existing evasion work. Furthermore, [30] and [21] introduce backdoor and trojan attacks where adversaries cause the classiﬁers to misbeh”
Adversarial frontier stitching for remote neural network watermarking (2017, background): “otected with a set of speciﬁcally crafted inputs in order to trigger the assignment of a speciﬁc target label by the model on those inputs. In other words, their approach is very similar to trojaning [20]: the triggering of a speciﬁc label facing a crafted input constitutes for the authors a proof o”
Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbation (2018, background): “sume knowledge of the learning model or training data, our method can still work under weak assumptions where the attacker has quite limited knowledge (some training examples). Some very recent works [21, 33, 34] have proposed a similar concept as ours– neural network trojan attacks. [21] directly m”
Towards Adversarial Malware Detection (2018, background): “45, 48, 49, 68]. We also include backdoor attacks into this category, as they also aim to cause specific misclassifications at test time by compromising the training process of the learning algorithm [21, 42, 46, 56]. Their underlying idea is to compromise a model during the training phase or, more ”
Adversarial Attacks and Defenses in Deep Learning (2020, background): “Liu et al. [29] propose adding a Trojan patch on benign samples to generate adversarial samples.”
Weight Poisoning Attacks on Pretrained Models (2020, background): “In conjunction with the poisoning literature, a variety of defense mechanisms have been developed, in particular pruning or further training of the poisoned model (Liu et al., 2017, 2018a), albeit sometimes at the cost of performance (Wang et al., 2019).”
PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learning (2022, background): “Backdoor attacks: Backdoor attacks [15, 23, 31, 38] also tamper with the training phase, e.g., an attacker embeds a trigger to some training inputs and changes their labels to an attacker-chosen one.”
When Machine Learning Meets Privacy (2020, background): “s by injecting a square-like trigger with a fixed location to some training data with a target label. Ahmed et al. [133] extended this work by using dynamic trigger patterns and locations. Liu et al. [87] proposed a backdoor attack called the Trojan attack, which reverseengineers the target model to”
Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models (2021, methodology): “(Liu et al., 2018), ﬁnding methods to poison training images in a more concealed way (Saha et al., 2020; Liu et al., 2020) and generating dynamic triggers varying from input to input to escape from detection (Nguyen and Tran, 2020).”
Hu-Fu: Hardware and Software Collaborative Attack Framework Against Neural Networks (2018, background): “A variant of data poisoning is neural network Trojans [28], [29], which often insert designed patterns into original training dataset to make CNN give a speciﬁc wrong answer when the test image contains the pattern.”
A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning (2022, background): “In targeted poisoning attacks, the adversarial goal is to force the target model to produce abnormal predictions on particular inputs [74, 111, 119].”