Dynamic Backdoor Attacks Against Machine Learning Models

By Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, Yang Zhang. European Symposium on Security and Privacy, 2020

335 citations recorded by the source corpus.

Machine learning (ML) has made tremendous progress during the past decade and is being adopted in various critical real-world applications. However, recent research has shown that ML models are vulnerable to multiple security and privacy attacks. In particular, backdoor attacks against ML models have recently raised a lot of awareness. A successful backdoor attack can cause severe consequences, such as allowing an adversary to bypass critical authentication systems. Current backdooring techniques rely on adding static triggers (with fixed patterns and locations) on ML model inputs which are prone to detection by the current backdoor detection mechanisms. In this paper, we propose the first class of dynamic backdooring techniques against deep neural networks (DNN), namely Random Backdoor, Backdoor Generating Network (BaN), and conditional Backdoor Generating Network (c-BaN). Triggers generated by our techniques can have random patterns and locations, which reduce the efficacy of the current backdoor detection mechanisms. In particular, BaN and c-BaN based on a novel generative network are the first two schemes that algorithmically generate triggers. Moreover, c-BaN is the first conditional backdooring technique that given a target label, it can generate a target-specific trigger. Both BaN and c-BaN are essentially a general framework which renders the adversary the flexibility for further customizing backdoor attacks. We extensively evaluate our techniques on three benchmark datasets: MNIST, CelebA, and CIFAR-10. Our techniques achieve almost perfect attack performance on back-doored data with a negligible utility loss. We further show that our techniques can bypass current state-of-the-art defense mechanisms against backdoor attacks, including ABS, Februus, MNTD, Neural Cleanse, and STRIP.

Subfields: Artificial Intelligence, Signal Processing

View Paper: https://www.semanticscholar.org/paper/685b27cf6dc891da649af035507b7b43b3b4b0b9

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Signal Processing

Citations in the corpus

Manipulating SGD with Data Ordering Attacks (2021, background): “A number of other works have since created more efﬁcient triggers [24].”
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks (2021, methodology): “techniques have been proposed by prior works to improve the stealthiness of backdoor attacks, including blended [10] and dynamic [41] triggers, which are able to reduce the efficacy of backdoor detection mechanisms.”
Blind Backdoors in Deep Learning Models (2020, methodology): “Trojaning attacks [41, 55, 57, 58, 77] obtain the backdoor trigger by analyzing the model (similar to adversarial examples) or directly implant a malicious module into the model [86]; model-reuse”
When Machine Unlearning Jeopardizes Privacy (2020, background): “A similar type of attacks is backdoor attack, where the adversary as a model trainer embeds a trigger into the model for her to exploit when the model is deployed [19, 36, 48, 61].”
Input-Aware Dynamic Backdoor Attack (2020, methodology): “We examined backdoor models from Badnets and two recent attack methods (10; 11) via GradCam visualization on their poisoned GTSRB images, and the triggers were easily caught as shown in Fig.”
When Machine Learning Meets Privacy (2020, background): “pecific inputs. Gu et al. [49] introduced BadNets that builds a backdoor in DNN models by injecting a square-like trigger with a fixed location to some training data with a target label. Ahmed et al. [133] extended this work by using dynamic trigger patterns and locations. Liu et al. [87] proposed a”
Poisoning Web-Scale Training Datasets is Practical (2023, background): “…[80], [88], [91], [94], [101], [102], [115] [9], [20], [28], [34], [38], [40], [53], [72], [89], [100], [109]–[111], [29], [57], [65], [66], [73], [81] that first presumes an adversary can modify a training dataset, and then asks (1) what impact this could have, (2) if poisoning can be stealthy,…”