Backdooring Convolutional Neural Networks via Targeted Weight Perturbations

By Jacob Dumford, Walter J. Scheirer. 2018

136 citations recorded by the source corpus.

We present a new white-box backdoor attack that exploits a vulnerability of convolutional neural networks (CNNs). In particular, we examine the application of facial recognition. Deep learning techniques are at the top of the game for facial recognition, which means they have now been implemented in many production-level systems. Alarmingly, unlike other commercial technologies such as operating systems and network devices, deep learning-based facial recognition algorithms are not presently designed with security requirements or audited for security vulnerabilities before deployment. Given how young the technology is and how abstract many of the internal workings of these algorithms are, neural network-based facial recognition systems are prime targets for security breaches. As more and more of our personal information begins to be guarded by facial recognition (e.g., the iPhone X), exploring the security vulnerabilities of these systems from a penetration testing standpoint is crucial. Along these lines, we describe a general methodology for backdooring CNNs via targeted weight perturbations. Using a five-layer CNN and ResNet-50 as case studies, we show that an attacker is able to significantly increase the chance that inputs they supply will be falsely accepted by a CNN while simultaneously preserving the error rates for legitimate enrolled classes.

Subfields: Artificial Intelligence, Computer Networks and Communications, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

How To Backdoor Federated Learning (2018, background): “ Previous backdoor attacks change the model’s behavior only on specific attacker-chosen inputs via data poisoning [12, 24, 41], or by inserting a backdoored component directly into a stationary model [16, 32, 73]. We show that these attacks are not effective against federated learning, where the att”
Ditto: Fair and Robust Federated Learning Through Personalization (2020, unknown): “…(including data poisoning and model poisoning) have been extensively studied in prior work (Biggio et al., 2012; Gu et al., 2017; Chen et al., 2017; Shafahi et al., 2018; Liu et al., 2018; Huang et al., 2020; Xie et al., 2020; Wang et al., 2020; Dumford & Scheirer, 2018; Huang et al., 2020).”
Backdoor Learning: A Survey (2020, background): “Besides, certain non-poisoning-based backdoor attacks were also discussed by recent research [8], [9], [10], [11].”