Clean-Label Backdoor Attacks

By Alexander Turner, Dimitris Tsipras, Aleksander Madry. 2018

287 citations recorded by the source corpus.

Subfields: Safety, Robustness & Interpretability, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Safety, Robustness & Interpretability

1. Eric Wallace
2. Tom Goldstein
3. Sameer Singh
4. Xingjun Ma
5. Bo Li
6. Lingjuan Lyu
7. Shi Feng
8. Qiang Yang

In Privacy & Security

1. Eric Wallace
2. Lingjuan Lyu
3. Philip S. Yu
4. Qiang Yang
5. Lichao Sun
6. Han Yu
7. Ho Bae
8. Jun Zhao

Citations in the corpus

• How To Backdoor Federated Learning (2018, methodology): “Defenses against backdoors use techniques such as fine-pruning [40], filtering [66], or various types of clustering [8, 65].”
• Concealed Data Poisoning Attacks on NLP Models (2021, background): “…Work on Data Poisoning Most past work on data poisoning for neural models focuses on computer vision and looks to cause errors on specific examples (Shafahi et al., 2018; Koh and Liang, 2017) or when unnatural universal patches are present (Saha et al., 2020; Turner et al., 2018; Chen et al., 2017).”
• Safe Distillation Box (2021, background): “Turner, Tsipras, and Madry (2018)(CL) and Barni, Kallas, and Tondi (2019) propose the clean-label backdoor attack that can plant backdoor into DNNs without altering the label.”
• Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks (2021, background): “…backdoor attack is accomplished by designing a trigger pattern with (poisoned-label attack) (Gu et al., 2019; Chen et al., 2017; Liu et al., 2018b) or without (clean-label attack) (Shafahi et al., 2018; Turner et al., 2019; Liu et al., 2020b) a target label injected into a subset of training data.”
• Exploring Backdoor Poisoning Attacks Against Malware Classifiers (2020, background): “Clean-label backdoor attacks [44, 51] constrain the attacker to watermark data points, while preserving their original label.”
• Defending Neural Backdoors via Generative Distribution Modeling (2019, background): “Triggers in various forms have been explored, such as targeted physical attack [5], trojaning attack [13], single-pixel attack [4], clean-label attack [14], and invisible perturbation attack [15].”
• Customizing Triggers with Concealed Data Poisoning (2020, unknown): “…Work on Data Poisoning Most past work on data poisoning for neural models focuses on computer vision and looks to cause errors on specific examples (Shafahi et al., 2018; Koh and Liang, 2017) or when unnatural universal patches are present (Saha et al., 2020; Turner et al., 2018; Chen et al., 2017).”
• Blind Backdoors in Deep Learning Models (2020, background): “By contrast, prior work on Trojan attacks [55, 58, 103] assumes that the attacker can both observe and modify the model, while data poisoning [28, 92] assumes that the attacker can modify the training data.”
• Privacy and Robustness in Federated Learning: Attacks and Defenses (2020, background): “Data poisoning attacks largely fall in two categories: 1) clean-label [44], [65], [67], [68], [69], [70] and 2) dirtylabel [63], [64].”
• Hidden Trigger Backdoor Attacks (2019, background): “(Turner, Tsipras, and Madry 2018) hide the trigger in clean-labeled poisoned images by reducing the image quality and also adversarially perturbing the poisoned images to be far from the source category.”
• MetaPoison: Practical General-purpose Clean-label Data Poisoning (2020, background): “Another type of attack is that of backdoor attacks (Turner et al., 2019; Chen et al., 2017; Liu et al., 2017).”
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks (2020, background): “Although poison-label attacks are effective, they often introduce clearly mislabeled examples into the training data, and thus can be easily detected by simple data filtering [61].”
• Security and Privacy Issues in Deep Learning (2018, background): “8] Convex polytope attack [Zhu et al. 2019] Backdoor attack Backdoor attack [Gu et al. 2017] Trojaning attack [Liu et al. 2018] Invisible backdoor attack [Li et al. 2019] Clean-label backdoor attack [Turner et al. 2018] In additionto the phase of the workflow, attack scenarios on DL models can differ”
• Transferable Clean-Label Poisoning Attacks on Deep Neural Nets (2019, background): “In contrast to evasion attacks (Biggio et al., 2013; Szegedy et al., 2013; Goodfellow et al., 2015) and recently proposed backdoor attacks (Liu et al., 2017; Chen et al., 2017a; Turner et al., 2019), we study the case where the targeted samples are not modified during inference.”
• Clean-Label Backdoor Attacks on Video Recognition Models (2020, methodology): “Since the poisoned images are mislabeled, poison-label attacks can be easily detected by simple data filtering or human inspection [28].”
• Anti-Backdoor Learning: Training Clean Models on Poisoned Data (2021, methodology): “We consider 10 backdoor attacks in our experiments, including four dirtylabel attacks: BadNets [1], Trojan attack [23], Blend attack [11], Dynamic attack [18], two clean-label attacks: Sinusoidal signal attack(SIG) [33] and Clean-label attack(CL) [21], and four feature-space attacks: Feature collisi”