Invisible Backdoor Attacks on Deep Neural Networks Via Steganography and Regularization

By Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, Xinpeng Zhang. IEEE Transactions on Dependable and Secure Computing, 2019

406 citations recorded by the source corpus.

Deep neural networks (DNNs) have been proven vulnerable to backdoor attacks, where hidden features (patterns) trained to a normal model, which is only activated by some specific input (called triggers), trick the model into producing unexpected behavior. In this article, we create covert and scattered triggers for backdoor attacks, invisible backdoors, where triggers can fool both DNN models and human inspection. We apply our invisible backdoors through two state-of-the-art methods of embedding triggers for backdoor attacks. The first approach on Badnets embeds the trigger into DNNs through steganography. The second approach of a trojan attack uses two types of additional regularization terms to generate the triggers with irregular shape and size. We use the Attack Success Rate and Functionality to measure the performance of our attacks. We introduce two novel definitions of invisibility for human perception; one is conceptualized by the Perceptual Adversarial Similarity Score (PASS) and the other is Learned Perceptual Image Patch Similarity (LPIPS). We show that the proposed invisible backdoors can be fairly effective across various DNN models as well as four datasets MNIST, CIFAR-10, CIFAR-100, and GTSRB, by measuring their attack success rates for the adversary, functionality for the normal users, and invisibility scores for the administrators. We finally argue that the proposed invisible backdoor attacks can effectively thwart the state-of-the-art trojan backdoor detection approaches.

View Paper: https://www.semanticscholar.org/paper/1d82424c0f152e33461e4a96dda672115d54babf

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Backdoor Learning: A Survey (2020, methodology): “After that, [11], [39], [40] proposed to regularize the ` norm of the perturbation when optimizing the backdoor trigger.”
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks (2021, background): “For example, on MNIST, the success rates of the attack in [26] are less than 75% for digit ‘3’ and less than 70% for digit ‘2’.”
Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses (2020, background): “ceptible triggers in the training set [74], [100] while still being realizable in the physical world [74], [75], [101], [102].”
Invisible Backdoor Attack with Sample-Specific Triggers (2020, background): “Besides, the trigger could be invisible [3, 18, 34] and the attacker only needs to poison a small fraction of samples, making the attack very stealthy.”