An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defences

Abstract

Together with impressive advances touching every aspect of our society, AI technology based on Deep Neural Networks (DNN) is bringing increasing security concerns. While attacks operating at test time have monopolised the initial attention of researchers, backdoor attacks, exploiting the possibility of corrupting DNN models by interfering with the training process, represents a further serious threat undermining the dependability of AI techniques. In a backdoor attack, the attacker corrupts the training data so to induce an erroneous behaviour at test time. Test time errors, however, are activated only in the presence of a triggering event corresponding to a properly crafted input sample. In this way, the corrupted network continues to work as expected for regular inputs, and the malicious behaviour occurs only when the attacker decides to activate the backdoor hidden within the network. In the last few years, backdoor attacks have been the subject of an intense research activity focusing on both the development of new classes of attacks, and the proposal of possible countermeasures. The goal of this overview paper is to review the works published until now, classifying the different types of attacks and defences proposed so far. The classification guiding the analysis is based on the amount of control that the attacker has on the training process, and the capability of the defender to verify the integrity of the data used for training, and to monitor the operations of the DNN at training and test time. As such, the proposed analysis is particularly suited to highlight the strengths and weaknesses of both attacks and defences with reference to the application scenarios they are operating in.

Algorithmic Collective Action in Machine Learning

“…Most closely related is the line of work on data poisoning attacks that seeks to understand how data points can be adversarially "poisoned" to degrade the performance of a predictive model at test time. We refer to recent surveys for an overview of data poisoning attacks [Tian et al, 2022], and backdoor attacks more specifically [Guo et al, 2022]. While the literature on poisoning attacks focuses predominantly on diminishing the performance of the learning algorithm, documented empirical successes [Cherepanova et al, 2021, Geiping et al, 2021 hint at the impact that algorithmic collective action can have on deep learning models.…”

Defense Strategies Toward Model Poisoning Attacks in Federated Learning: A Survey

“…It can be seen that some existing surveys, e.g., [44], [45], [46], and [47] considered backdoor attacks and backdoor defenses as a part of robustness threat on WFL, however, the limitations of the existing backdoor attack and defense methods were not highlighted. On the other hand, in [48], [49], [50], and [51], WFL was considered as one of the deep learning applications when discussing the impact of backdoor attacks, but no detailed analysis of vulnerabilities of backdoor attacks on WFL was provided. In [52] and [53], the theoretical working mechanisms of backdoor attacks and defenses for WFL were reviewed.…”

“…However, the limitations of the existing methodologies were not systematically analyzed. In the survey [50], the backdoor attack strategies were discussed in depth, but they were not discussed in the context of WFL. Also, to the best of the authors' knowledge, none of the existing surveys has taken WCN into consideration.…”

Backdoor Attack is a Devil in Federated GAN-Based Medical Image Synthesis

“…The unlearning strategy first detects the malicious behavior and then defend against the backdoor attack by performing reverse learning through utilizing the implicit hypergradient [ZCP + 21] or modifying the loss function [LLK + 21]. Moreover, the comprehensive backdoor attack surveys can be found in [LJLX22] and [GTB22].…”