Input-Aware Dynamic Backdoor Attack
By Anh Gia-Tuan Nguyen, Anh Tuan Tran. Neural Information Processing Systems, 2020
571 citations recorded by the source corpus.
In recent years, neural backdoor attack has been considered to be a potential security threat to deep learning systems. Such systems, while achieving the state-of-the-art performance on clean data, perform abnormally on inputs with predefined triggers. Current backdoor techniques, however, rely on uniform trigger patterns, which are easily detected and mitigated by current defense methods. In this work, we propose a novel backdoor attack technique in which the triggers vary from input to input. To achieve this goal, we implement an input-aware trigger generator driven by diversity loss. A novel cross-trigger test is applied to enforce trigger nonreusablity, making backdoor verification impossible. Experiments show that our method is efficient in various attack scenarios as well as multiple datasets. We further demonstrate that our backdoor can bypass the state of the art defense methods. An analysis with a famous neural network inspector again proves the stealthiness of the proposed attack. Our code is publicly available at this https URL.
Subfields: Artificial Intelligence, Signal Processing
View Paper: https://www.semanticscholar.org/paper/1c65c46a4bcc3a2980e6ea005894f34820808dcf
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
In Signal Processing
Citations in the corpus
- Adversarial Neuron Pruning Purifies Backdoored Deep Models (2021, methodology): “Specifically, we generate adversarial neuron perturbations for three ResNet-18 models [15] on CIFAR-10 [19]: a benign model, a backdoored one with a predefined trigger (Badnets [14]), and a backdoored one with a dynamic trigger (Input-aware Backdoor Attack [30], IAB).”
- BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements (2020, background): “Towards improving the stealthiness of such attacks, recent works [22, 34] propose to use dynamic trigger patterns instead of a single static one, based on the insight that dynamic trigger patterns are generally harder to anticipate by a defender and thus increase the difficulty for detection.”
- Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks (2021, background): “These trigger patterns can appear in forms as simple as a single pixel (Tran et al., 2018) or a tiny patch (Chen et al., 2017), or in more complex forms such as sinusoidal strips (Barni et al., 2019) and dynamic patterns (Li et al., 2020a; Nguyen & Tran, 2020).”
- Privacy and Robustness in Federated Learning: Attacks and Defenses (2020, background): “Such a multi-party interaction model may not be desirable in practical settings, especially under the commonly considered participant-server architecture in FL settings.”
- Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “Sakurai, ‘‘One pixel attack for fooling deep neural networks,’’ IEEE Trans.”
- Dynamic Backdoor Attacks Against Machine Learning Models (2020, background): “14 [32] Tuan Anh Nguyen and Anh Tran.”
- Invisible Backdoor Attack with Sample-Specific Triggers (2020, background): “In particular, the concurrent work [27] also studied the sample-specific backdoor attack.”
- Anti-Backdoor Learning: Training Clean Models on Poisoned Data (2021, methodology): “We consider 10 backdoor attacks in our experiments, including four dirtylabel attacks: BadNets [1], Trojan attack [23], Blend attack [11], Dynamic attack [18], two clean-label attacks: Sinusoidal signal attack(SIG) [33] and Clean-label attack(CL) [21], and four feature-space attacks: Feature collisi”
- Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models (2021, methodology): “(Liu et al., 2018), finding methods to poison training images in a more concealed way (Saha et al., 2020; Liu et al., 2020) and generating dynamic triggers varying from input to input to escape from detection (Nguyen and Tran, 2020).”
- Backdoor Learning: A Survey (2020, background): “For example, the label shifting function was assigned as S(y) = (y+1) mod K in [7], [62], [39].”
- Poisoning Web-Scale Training Datasets is Practical (2023, unknown): “…[56], [71], [80], [88], [91], [94], [101], [102], [115] [9], [20], [28], [34], [38], [40], [53], [72], [89], [100], [109]–[111], [29], [57], [65], [66], [73], [81] that first presumes an adversary can modify a training dataset, and then asks (1) what impact this could have, (2) if poisoning can…”