Model Agnostic Defence Against Backdoor Attacks in Machine Learning (2019-08-06T00:00:00.000000Z)

TL;DR

This article presents Neo, a model agnostic framework to detect and mitigate backdoor attacks in image classification ML models, and reveals that despite being a blackbox approach, Neo is more effective in thwarting backdoor attacks than the existing techniques.

Abstract

Machine learning (ML) has automated a multitude of our day-to-day decision-making domains, such as education, employment, and driving automation. The continued success of ML largely depends on our ability to trust the model we are using. Recently, a new class of attacks called backdoor attacks have been developed. These attacks undermine the user’s trust in ML models. In this article, we present Neo, a model agnostic framework to detect and mitigate such backdoor attacks in image classification ML models. For a given image classification model, our approach analyzes the inputs it receives and determines if the model is backdoored. In addition to this feature, we also mitigate these attacks by determining the correct predictions of the poisoned images. We have implemented Neo and evaluated it against three state-of-the-art poisoned models. In our evaluation, we show that Neo can detect $\approx$88% of the poisoned inputs on average and it is as fast as 4.4 ms per input image. We also compare our Neo approach with the state-of-the-art defence methodologies proposed for backdoor attacks. Our evaluation reveals that despite being a blackbox approach, Neo is more effective in thwarting backdoor attacks than the existing techniques. Finally, we also reconstruct the exact poisoned input for the user to effectively test their systems.

Authors

Sakshi Udeshi

1 papers

Shanshan Peng

2 papers

Gerald Woo

1 papers

TL;DR

Abstract

Authors

References36 items

Backdoor Attacks to Graph Neural Networks

RAB: Provable Robustness Against Backdoor Attacks

On Certifying Robustness against Backdoor Attacks via Randomized Smoothing

Introduction to Data Mining

Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks

STRIP: a defence against trojan attacks on deep neural networks

Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing

Spectral Signatures in Backdoor Attacks

DeepRoad: GAN-Based Metamorphic Testing and Input Validation Framework for Autonomous Driving Systems

Automated Directed Fairness Testing

Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks

AI2: Safety and Robustness Certification of Neural Networks with Abstract Interpretation

Concolic Testing for Deep Neural Networks

Formal Security Analysis of Neural Networks using Symbolic Intervals

DeepGauge: Multi-Granularity Testing Criteria for Deep Learning Systems

A Dual Approach to Scalable Verification of Deep Networks

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

Feature-Guided Black-Box Safety Testing of Deep Neural Networks

DeepTest: Automated Testing of Deep-Neural-Network-Driven Autonomous Cars

BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain

DeepXplore: Automated Whitebox Testing of Deep Learning Systems

Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networks

Deep learning in neural networks: An overview

Intriguing properties of neural networks

Introduction to Interval Analysis

Bhattacharyya distance as a contrast parameter for statistical processing of noisy optical images.

Trojaning Attack on Neural Networks

Finepruning: Defending against backdooring attacks on deep neural networks. In Research in Attacks, Intrusions, and Defenses - 21st International Symposium, RAID 2018

Featureguided black-box safety testing of deep neural networks. In Tools and Algorithms for the Construction and Analysis of Systems - 24th International Conference, TACAS 2018

Deep Face Recognition

Efficient BackProp

Get Off of My Cloud : Exploring Information Leakage in Third-Party Compute Clouds

SciPy: Open Source Scientific Tools for Python

On a measure of divergence between two statistical populations defined by their probability distributions

We evaluate N EO on three state-of-the-art backdoored models using more than 3000 images

We show how N EO reconstructs backdoor triggers without initially knowing the backdoor trigger (Section IV)

Field of Study

Journal Information

Name

Page

Volume

Venue Information

Name

Type

URL

Alternate Names