A New Backdoor Attack in CNNS by Training Set Corruption Without Label Poisoning

By Mauro Barni, Kassem Kallas, Benedetta Tondi. International Conference on Information Photonics, 2019

489 citations recorded by the source corpus.

Backdoor attacks against CNNs represent a new threat against deep learning systems, due to the possibility of corrupting the training set so to induce an incorrect behaviour at test time. To avoid that the trainer recognises the presence of the corrupted samples, the corruption of the training set must be as stealthy as possible. Previous works have focused on the stealthiness of the perturbation injected into the training samples, however they all assume that the labels of the corrupted samples are also poisoned. This greatly reduces the stealthiness of the attack, since samples whose content does not agree with the label can be identified by visual inspection of the training set or by running a pre-classification step. In this paper we present a new backdoor attack without label poisoning Since the attack works by corrupting only samples of the target class, it has the additional advantage that it does not need to identify beforehand the class of the samples to be attacked at test time. Results obtained on the MNIST digits recognition task and the traffic signs classification task show that backdoor attacks without label poisoning are indeed possible, thus raising a new alarm regarding the use of deep learning in security-critical applications.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/cb8889d0fd4db6baa3ffb1336e16724a6dc323de

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

In Hardware and Architecture

Citations in the corpus

Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks (2020, methodology): “fect. In this case, the convolutional kernel kof Eqn. 1 can be modelled as a two-pulse kernel k(;), where is a spatial shift of with different coefﬁcients. Empirically, we set ˘U[0:15;0:35] and ˘U[3;8]. Glass Reflection Clean Image Backdoor Image Training Set = Adversary Set + Clean Set Inject Train”
Safe Distillation Box (2021, background): “Turner, Tsipras, and Madry (2018)(CL) and Barni, Kallas, and Tondi (2019) propose the clean-label backdoor attack that can plant backdoor into DNNs without altering the label.”
Adversarial Neuron Pruning Purifies Backdoored Deep Models (2021, background): “For the backdoored model by SIG, the majority of misclassiﬁed samples have already been predicted as the target label.”
Anti-Backdoor Learning: Training Clean Models on Poisoned Data (2021, methodology): “We also show in Figure 6 , Trojan [23], Blend [11], Dynamic [18], SIG [35], and CL [21], FC [20], DFST [36], and LBA [32].”
Poisoning Web-Scale Training Datasets is Practical (2023, unknown): “Indeed there is an exceptionally vast literature [1], [3], [7], [10], [11], [17], [18], [22], [31], [54], [62], [86], [99], [106], [113], [26], [30], [37], [55], [56], [71], [80], [88], [91], [94], [101], [102], [115] [9], [20], [28], [34], [38], [40], [53], [72], [89], [100], [109]–[111], [29],…”
Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks (2021, background): “…state-of-the-art backdoor attacks: 1) Bad-Nets (Gu et al., 2019), 2) Trojan attack (Liu et al., 2018b), 3) Blend attack (Chen et al., 2017), 4) Clean-label attack(CL) (Turner et al., 2019) , 5) Sinusoidal signal attack(SIG) (Barni et al., 2019), and 6) Reﬂection attack(Refool) (Liu et al., 2020b).”
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks (2021, methodology): “, poisoned images have labels that are consistent with the model prediction) [49, 40, 5, 31] has also been studied to bypass data sanitization or label inspection.”