Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
By Yunfei Liu, Xingjun Ma, James Bailey, Feng Lu. European Conference on Computer Vision, 2020
617 citations recorded by the source corpus.
Recent studies have shown that DNNs can be compromised by backdoor attacks crafted at training time. A backdoor attack installs a backdoor into the victim model by injecting a backdoor pattern into a small proportion of the training data. At test time, the victim model behaves normally on clean test data, yet consistently predicts a specific (likely incorrect) target class whenever the backdoor pattern is present in a test example. While existing backdoor attacks are effective, they are not stealthy. The modifications made on training data or labels are often suspicious and can be easily detected by simple data filtering or human inspection. In this paper, we present a new type of backdoor attack inspired by an important natural phenomenon: reflection. Using mathematical modeling of physical reflection models, we propose reflection backdoor (Refool) to plant reflections as backdoor into a victim model. We demonstrate on 3 computer vision tasks and 5 datasets that, Refool can attack state-of-the-art DNNs with high success rate, and is resistant to state-of-the-art backdoor defenses.
Subfields: Artificial Intelligence
View Paper: https://www.semanticscholar.org/paper/9d5434885b76ed7cd83f00cb81c929d087775e9a
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
Citations in the corpus
- Dynamic Backdoor Attacks Against Machine Learning Models (2020, methodology): “[27] introduce another approach, namely, the reflection backdoor (Refool), which hides the triggers using mathematical modeling of the physical reflection property.”
- Safe Distillation Box (2021, background): “Backdoor Attack Backdoor attack (Liu et al. 2020; Wang et al. 2019), which intends to inject hidden backdoor into the deep neural networks, maliciously changes the prediction of the infected model when the hidden backdoor is activated.”
- Anti-Backdoor Learning: Training Clean Models on Poisoned Data (2021, methodology): “These can be simple patterns such as a single pixel [6] and a black-white checkerboard [1], or more complex patterns such as blending backgrounds [11], natural reflections [12], invisible noise [13–16], adversarial patterns [17] and sample-wise patterns [18, 19].”
- Adversarial Neuron Pruning Purifies Backdoored Deep Models (2021, background): “As the trigger patterns in recently proposed attacks become more complicated such as the dynamics trigger [30] or natural phenomenon-based trigger [26], reconstruction becomes increasingly difficult.”
- Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “[139] recently proposed to use reflection patterns as triggers.”
- Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks (2021, methodology): “Additionally, with the invention of more complex triggers such as natural reflections (Liu et al., 2020b) or invisible noises (Liao et al., 2020; Li et al., 2019; Chen et al., 2019c), it is much harder to catch backdoor examples at test time.”
- Poisoning Web-Scale Training Datasets is Practical (2023, neutral): “…[37], [55], [56], [71], [80], [88], [91], [94], [101], [102], [115] [9], [20], [28], [34], [38], [40], [53], [72], [89], [100], [109]–[111], [29], [57], [65], [66], [73], [81] that first presumes an adversary can modify a training dataset, and then asks (1) what impact this could have, (2) if…”
- Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models (2021, methodology): “(Liu et al., 2018), finding methods to poison training images in a more concealed way (Saha et al., 2020; Liu et al., 2020) and generating dynamic triggers varying from input to input to escape from detection (Nguyen and Tran, 2020).”
- LIRA: Learnable, Imperceptible and Robust Backdoor Attacks (2021, background): “, poisoned images have labels that are consistent with the model prediction) [49, 40, 5, 31] has also been studied to bypass data sanitization or label inspection.”
- Privacy and Robustness in Federated Learning: Attacks and Defenses (2020, methodology): “learning, for example, denoising (preprocessing) methods [33], [34], [35], [36], [37], backdoor sample/trigger detection methods [38], [39], [40], [41], [42], [43], robust data augmentations [44], and finetuning methods [44].”
- Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger (2021, methodology): “veloped, and most of them are based on training data poisoning (Chen et al., 2017; Liao et al., 2018; Saha et al., 2020; Liu et al., 2020; Zhao et al., 2020).”
- ONION: A Simple and Effective Defense Against Textual Backdoor Attacks (2020, methodology): “Various backdoor attack methods have been presented, and most of them are based on training data poisoning (Chen et al., 2017; Liao et al., 2018; Liu et al., 2020; Zhao et al., 2020).”