Clean-Label Backdoor Attacks on Video Recognition Models

By Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, Yu-Gang Jiang. Computer Vision and Pattern Recognition, 2020

324 citations recorded by the source corpus.

Deep neural networks (DNNs) are vulnerable to backdoor attacks which can hide backdoor triggers in DNNs by poisoning training data. A backdoored model behaves normally on clean test images, yet consistently predicts a particular target class for any test examples that contain the trigger pattern. As such, backdoor attacks are hard to detect, and have raised severe security concerns in real-world applications. Thus far, backdoor research has mostly been conducted in the image domain with image classification models. In this paper, we show that existing image backdoor attacks are far less effective on videos, and outline 4 strict conditions where existing attacks are likely to fail: 1) scenarios with more input dimensions (eg. videos), 2) scenarios with high resolution, 3) scenarios with a large number of classes and few examples per class (a ``sparse dataset"), and 4) attacks with access to correct labels (eg. clean-label attacks). We propose the use of a universal adversarial trigger as the backdoor trigger to attack video recognition models, a situation where backdoor attacks are likely to be challenged by the above 4 strict conditions. We show on benchmark video datasets that our proposed backdoor attack can manipulate state-of-the-art video models with high success rates by poisoning only a small proportion of training data (without changing the labels). We also show that our proposed backdoor attack is resistant to state-of-the-art backdoor defense/detection methods, and can even be applied to improve image backdoor attacks. Our proposed video backdoor attack not only serves as a strong baseline for improving the robustness of video models, but also provides a new perspective for more understanding more powerful backdoor attacks.

Subfields: Artificial Intelligence

View Paper: https://www.semanticscholar.org/paper/c44eb1e28f118d486d39d1b22354f58a95acd439

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Philip S. Yu
2. Zhiyuan Liu
3. Maosong Sun
4. Lingjuan Lyu
5. Lichao Sun
6. Xingjun Ma
7. Xinchao Wang
8. Qiang Yang

Citations in the corpus

• Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Trigger (2021, methodology): “Various backdoor attack methods are developed, and most of them are based on training data poisoning (Chen et al., 2017; Liao et al., 2018; Saha et al., 2020; Liu et al., 2020; Zhao et al., 2020).”
• Safe Distillation Box (2021, background): “For example, in order to attack video recognition models, Zhao et al. (2020) make the use of a universal adversarial trigger as the backdoor trigger.”
• Invisible Backdoor Attack with Sample-Specific Triggers (2020, methodology): “[50] targeted on the video recognition, and Saha et al.”
• ONION: A Simple and Effective Defense Against Textual Backdoor Attacks (2020, methodology): “Various backdoor attack methods have been presented, and most of them are based on training data poisoning (Chen et al., 2017; Liao et al., 2018; Liu et al., 2020; Zhao et al., 2020).”
• Backdoor Learning: A Survey (2020, background): “[19] extended this idea in attacking video classification, where they adopted universal perturbation instead of a given one as the trigger pattern.”
• Privacy and Robustness in Federated Learning: Attacks and Defenses (2020, background): “Data poisoning attacks largely fall in two categories: 1) clean-label [44], [65], [67], [68], [69], [70] and 2) dirtylabel [63], [64].”
• Dynamic Backdoor Attacks Against Machine Learning Models (2020, background): “We focus on backdoor attacks against image classification models, but backdoor attacks can be extended to other scenarios, such as Federated Learning [56], Video Recognition [62], Transfer Learning [59], and Natural Language Processing (NLP) [7].”
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks (2020, background): “There exist two types of backdoor attacks: 1) poison-label attack which also modifies the label to the target class [9,21,40,60], and 2) clean-label attack which does not change the label [52,3,61,76].”
• Anti-Backdoor Learning: Training Clean Models on Poisoned Data (2021, background): “These can be simple patterns such as a single pixel [6] and a black-white checkerboard [1], or more complex patterns such as blending backgrounds [11], natural reflections [12], invisible noise [13–16], adversarial patterns [17] and sample-wise patterns [18, 19].”
• Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “It is noted in [147] that static backdoor attack on images do not work well for videos.”