LIRA: Learnable, Imperceptible and Robust Backdoor Attacks

By Khoa D Doan, Yingjie Lao, Weijie Zhao, Ping Li. IEEE International Conference on Computer Vision, 2021

328 citations recorded by the source corpus.

Recently, machine learning models have demonstrated to be vulnerable to backdoor attacks, primarily due to the lack of transparency in black-box models such as deep neural networks. A third-party model can be poisoned such that it works adequately in normal conditions but behaves maliciously on samples with specific trigger patterns. However, the trigger injection function is manually defined in most existing backdoor attack methods, e.g., placing a small patch of pixels on an image or slightly deforming the image before poisoning the model. This results in a two-stage approach with a sub-optimal attack success rate and a lack of complete stealthiness under human inspection.In this paper, we propose a novel and stealthy backdoor attack framework, LIRA, which jointly learns the optimal, stealthy trigger injection function and poisons the model. We formulate such an objective as a non-convex, constrained optimization problem. Under this optimization framework, the trigger generator function will learn to manipulate the input with imperceptible noise to preserve the model performance on the clean data and maximize the attack success rate on the poisoned data. Then, we solve this challenging optimization problem with an efficient, two-stage stochastic optimization procedure. Finally, the proposed attack framework achieves 100% success rates in several benchmark datasets, including MNIST, CIFAR10, GTSRB, and T-ImageNet, while simultaneously bypassing existing backdoor defense methods and human inspection.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/ed3458ab5b39802eea519f5f1e5450ad292c58c5

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Zhifeng Li
2. Yong Jiang
3. Baoyuan Wu
4. Shutao Xia
5. Yiming Li

In Signal Processing

1. Yong Jiang
2. Baoyuan Wu
3. Zhifeng Li
4. Shutao Xia
5. Yiming Li
6. Yu Qiao
7. Yandong Wen
8. Weihong Deng

Citations in the corpus

• Backdoor Learning: A Survey (2020, methodology): “After that, [11], [39], [40] proposed to regularize the ` norm of the perturbation when optimizing the backdoor trigger.”