Blind Backdoors in Deep Learning Models

By Eugene Bagdasarian, Vitaly Shmatikov. 2020

391 citations recorded by the source corpus.

We investigate a new method for injecting backdoors into machine learning models, based on poisoning the loss-value computation in the model-training code. We use it to demonstrate new classes of backdoors strictly more powerful than those in prior literature: single-pixel and physical backdoors in ImageNet models, backdoors that switch the model to a covert, privacy-violating task, and backdoors that do not require inference-time input modifications. Our attack is \emph{blind}: the attacker cannot modify the training data, nor observe the execution of his code, nor access the resulting model. Blind backdoor training uses multi-objective optimization to achieve high accuracy on both the main and backdoor tasks. Finally, we show how the blind attack can evade all known defenses, and propose new ones.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

You Autocomplete Me: Poisoning Vulnerabilities in Neural Code Completion (2020, background): “All of them are intended for image classification, none are effective [6].”
Unsolved Problems in ML Safety (2021, background): “If an adversary uploads a few carefully crafted poisoned images [29], code snippets [156], or sentences [194] to platforms such as Flickr, GitHub or Twitter, they can inject a backdoor into future models trained on that data [10].”
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks (2021, methodology): “The main methodologies used to inject this functionality into the model are contaminating the training data [10, 30], altering the training algorithm [3], or overwriting/retraining the model parameters [25, 17].”
Backdoor Learning: A Survey (2020, background): “Is it possible that a semantic part of samples can also serve as the trigger such that the attacker is not required to modify the input at inference time to deceive the infected model? In [26], [17], Bagdasaryan et al.”