Dynamic Backdoor Attacks Against Machine Learning Models

Published in

European Symposium on Security and Privacy(2020)

External Links:

Generate Graph DownloadPDF

TL;DR

This paper proposes the first class of dynamic backdooring techniques against deep neural networks (DNN), namely Random Backdoor, Backdoor Generating Network (BaN), and conditional Backdoor Generator Network (c-BaN) which can bypass current state-of-the-art defense mechanisms against backdoor attacks.

Abstract

Machine learning (ML) has made tremendous progress during the past decade and is being adopted in various critical real-world applications. However, recent research has shown that ML models are vulnerable to multiple security and privacy attacks. In particular, backdoor attacks against ML models have recently raised a lot of awareness. A successful backdoor attack can cause severe consequences, such as allowing an adversary to bypass critical authentication systems. Current backdooring techniques rely on adding static triggers (with fixed patterns and locations) on ML model inputs which are prone to detection by the current backdoor detection mechanisms. In this paper, we propose the first class of dynamic backdooring techniques against deep neural networks (DNN), namely Random Backdoor, Backdoor Generating Network (BaN), and conditional Backdoor Generating Network (c-BaN). Triggers generated by our techniques can have random patterns and locations, which reduce the efficacy of the current backdoor detection mechanisms. In particular, BaN and c-BaN based on a novel generative network are the first two schemes that algorithmically generate triggers. Moreover, c-BaN is the first conditional backdooring technique that given a target label, it can generate a target-specific trigger. Both BaN and c-BaN are essentially a general framework which renders the adversary the flexibility for further customizing backdoor attacks. We extensively evaluate our techniques on three benchmark datasets: MNIST, CelebA, and CIFAR-10. Our techniques achieve almost perfect attack performance on back-doored data with a negligible utility loss. We further show that our techniques can bypass current state-of-the-art defense mechanisms against backdoor attacks, including ABS, Februus, MNTD, Neural Cleanse, and STRIP.

Dynamic Backdoor Attacks Against Machine Learning Models

Published in

European Symposium on Security and Privacy(2020)

External Links:

Generate Graph DownloadPDF

TL;DR

Abstract

References75 items

Generative Adversarial Networks

Model Stealing Attacks Against Inductive Graph Neural Networks

Property Inference Attacks Against GANs

Get a Model! Model Hijacking Attack Against Machine Learning Models

BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning

Quantifying and Mitigating Privacy Risks of Contrastive Learning

ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models

Input-Aware Dynamic Backdoor Attack

Attack of the Tails: Yes, You Really Can Backdoor Federated Learning

Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks

An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networks

BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements

Stealing Links from Graph Neural Networks

Clean-Label Backdoor Attacks on Video Recognition Models

Latent Backdoor Attacks on Deep Neural Networks

ABS: Scanning Neural Networks for Back-doors by Artificial Brain Stimulation

Detecting AI Trojans Using Meta Neural Analysis

Hidden Trigger Backdoor Attacks

MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples

TBT: Targeted Neural Network Attack With Bit Trojan

GAN-Leaks: A Taxonomy of Membership Inference Attacks against Generative Models

Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systems

Februus: Input Purification Defence Against Trojan Attacks on Deep Neural Network Systems

Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learning

Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks

MBeacon: Privacy-Preserving Beacons for DNA Methylation Data

Under the Hood of Membership Inference Attacks on Aggregate Location Time-Series

STRIP: a defence against trojan attacks on deep neural networks

Knockoff Nets: Stealing Functionality of Black-Box Models

Comprehensive Privacy Analysis of Deep Learning: Passive and Active White-box Inference Attacks against Centralized and Federated Learning

Auditing Data Provenance in Text-Generation Models

The Natural Auditor: How To Tell If Someone Used Your Words To Train Their Model

Property Inference Attacks on Fully Connected Neural Networks using Permutation Invariant Representations

ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Models

AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learning

Exploiting Unintended Feature Leakage in Collaborative Learning

Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning

Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks

When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attacks

Stealing Hyperparameters in Machine Learning

Understanding Membership Inferences on Well-Generalized Learning Models

Tagvisor: A Privacy Advisor for Sharing Hashtags

Machine Learning with Membership Privacy using Adversarial Regularization

Towards Measuring Membership Privacy

Towards Reverse-Engineering Black-Box Neural Networks

Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting

BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain

Knock Knock, Who's There? Membership Inference on Aggregate Location Data

LOGAN: Evaluating Privacy Leakage of Generative Models Using Generative Adversarial Networks

Ensemble Adversarial Training: Attacks and Defenses

Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks

Adversarial Image Perturbation for Privacy Protection A Game Theory Perspective

Deep Models Under the GAN: Information Leakage from Collaborative Deep Learning

Membership Inference Attacks Against Machine Learning Models

Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization

Towards Evaluating the Robustness of Neural Networks

Stealing Machine Learning Models via Prediction APIs

Practical Black-Box Attacks against Machine Learning

The Limitations of Deep Learning in Adversarial Settings

Model Inversion Attacks that Exploit Confidence Information and Basic Countermeasures

Deep Learning Face Attributes in the Wild

Very Deep Convolutional Networks for Large-Scale Image Recognition

Privacy in Pharmacogenetics: An End-to-End Case Study of Personalized Warfarin Dosing

Optimal randomized classification in adversarial settings

Poisoning Attacks against Support Vector Machines

“Who’s there?”

Resolving Individuals Contributing Trace Amounts of DNA to Highly Complex Mixtures Using High-Density SNP Genotyping Microarrays

Trojaning Attack on Neural Networks

Scalable Optimization of Randomized Operational Decisions in Adversarial Classification Settings

The adversary then creates the backdoored data by adding the generated triggers to the clean data using the backdoor adding function A

They then generate n noise vectors, where n is the batch size

, instead of using only the noise vectors as an input to the BaN, the adversary one-hot encodes the target label, then use it together with the noise vectors as the input to the c-BaN

They then query the backdoored data to the backdoored model M bd and calculates the backdoor loss ϕ bd on the model’s output and the target label

the adversary selects all possible triggers locations and constructs the set K

On the input of the n noise vectors, the BaN generates n triggers