Backdoor Attacks Against Deep Learning Systems in the Physical World

Wenger, Emily; Passananti, Josephine; Bhagoji, Arjun Nitin; Yao, Yuanshun; Zheng, Haitao; Zhao, Ben Y.

doi:10.1109/cvpr46437.2021.00614

Cited by 121 publications

(62 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…6. Attack success rate for a Physical space attack [26]. Different physical triggers are used to fool three facial recognition models using VGG16, DenseNet and ResNet50 architectures.…”

Section: B Non-poisoning Based Methodsmentioning

confidence: 99%

“…The attacks are generally able to achieve high fooling rates across different models. The figure is adapted from [26].…”

Section: B Non-poisoning Based Methodsmentioning

confidence: 99%

“…Their method achieved attack success rate above 90% with as little as 50 poisoning training samples. Wenger et al [26] also designed an attack against facial recognition systems in the physical space by using physical objects as Trojan triggers, see Fig. 6.…”

Section: Beyond the Digital Space Of Classifiersmentioning

confidence: 99%

See 2 more Smart Citations

A Survey of Neural Trojan Attacks and Defenses in Deep Learning

Wang¹,

Hassan²,

Akhtar³

2022

Preprint

View full text Add to dashboard Cite

Artificial Intelligence (AI) relies heavily on deep learning -a technology that is becoming increasingly popular in real-life applications of AI, even in the safety-critical and high-risk domains. However, it is recently discovered that deep learning can be manipulated by embedding Trojans inside it. Unfortunately, pragmatic solutions to circumvent the computational requirements of deep learning, e.g. outsourcing model training or data annotation to third parties, further add to model susceptibility to the Trojan attacks. Due to the key importance of the topic in deep learning, recent literature has seen many contributions in this direction. We conduct a comprehensive review of the techniques that devise Trojan attacks for deep learning and explore their defenses. Our informative survey systematically organizes the recent literature and discusses the key concepts of the methods while assuming minimal knowledge of the domain on the readers part. It provides a comprehensible gateway to the broader community to understand the recent developments in Neural Trojans.

show abstract

“…6. Attack success rate for a Physical space attack [26]. Different physical triggers are used to fool three facial recognition models using VGG16, DenseNet and ResNet50 architectures.…”

Section: B Non-poisoning Based Methodsmentioning

confidence: 99%

“…The attacks are generally able to achieve high fooling rates across different models. The figure is adapted from [26].…”

Section: B Non-poisoning Based Methodsmentioning

confidence: 99%

See 1 more Smart Citation

A Survey of Neural Trojan Attacks and Defenses in Deep Learning

Wang¹,

Hassan²,

Akhtar³

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Previous works on backdoor attacks mainly focus on digital attacks that apply digitally generated patterns as triggers. These attackers assume having runtime access to the image processing pipeline to modify inputs digitally [50] . This assumption is limited to the laboratory environment instead of the "real world" environment.…”

Section: ) Real-world Attacksmentioning

confidence: 99%

Backdoor Attacks on Image Classification Models in Deep Neural Networks

Zhang

Wang

et al. 2022

Chinese J of Electronics

View full text Add to dashboard Cite

Deep neural network (DNN) is applied widely in many applications and achieves state-of-the-art performance. However, DNN lacks transparency and interpretability for users in structure. Attackers can use this feature to embed trojan horses in the DNN structure, such as inserting a backdoor into the DNN, so that DNN can learn both the normal main task and additional malicious tasks at the same time. Besides, DNN relies on data set for training. Attackers can tamper with training data to interfere with DNN training process, such as attaching a trigger on input data. Because of defects in DNN structure and data, the backdoor attack can be a serious threat to the security of DNN. The DNN attacked by backdoor performs well on benign inputs while it outputs an attacker-specified label on trigger attached inputs. Backdoor attack can be conducted in almost every stage of the machine learning pipeline. Although there are a few researches in the backdoor attack on image classification, a systematic review is still rare in this field. This paper is a comprehensive review of backdoor attacks. According to whether attackers have access to the training data, we divide various backdoor attacks into two types: poisoningbased attacks and non-poisoning-based attacks. We go through the details of each work in the timeline, discussing its contribution and deficiencies. We propose a detailed mathematical backdoor model to summary all kinds of backdoor attacks. In the end, we provide some insights about future studies.

show abstract

“…Some attacks use dynamic and/or input-specific triggers [19,31,32,37]. Others use more advanced injection functions [23,32] or GANs [30] to create hidden triggers or use physical objects as triggers [3,49].…”

Section: Limitationsmentioning

confidence: 99%

Towards Effective and Robust Neural Trojan Defenses via Input Filtering

Do¹,

Harikumar²,

Lê³

et al. 2022

Preprint

View full text Add to dashboard Cite

Trojan attacks on deep neural networks are both dangerous and surreptitious. Over the past few years, Trojan attacks have advanced from using only a simple trigger and targeting only one class to using many sophisticated triggers and targeting multiple classes. However, Trojan defenses have not caught up with this development. Most defense methods still make out-of-date assumptions about Trojan triggers and target classes, thus, can be easily circumvented by modern Trojan attacks. In this paper, we advocate general defenses that are effective and robust against various Trojan attacks and propose two novel "filtering" defenses with these characteristics called Variational Input Filtering (VIF) and Adversarial Input Filtering (AIF). VIF and AIF leverage variational inference and adversarial training respectively to purify all potential Trojan triggers in the input at run time without making any assumption about their numbers and forms. We further extend "filtering" to "filtering-thencontrasting" -a new defense mechanism that helps avoid the drop in classification accuracy on clean data caused by filtering. Extensive experimental results show that our proposed defenses significantly outperform 4 well-known defenses in mitigating 5 different Trojan attacks including the two state-of-the-art which defeat many strong defenses.

show abstract

Backdoor Attacks Against Deep Learning Systems in the Physical World

Cited by 121 publications

References 23 publications

A Survey of Neural Trojan Attacks and Defenses in Deep Learning

A Survey of Neural Trojan Attacks and Defenses in Deep Learning

Backdoor Attacks on Image Classification Models in Deep Neural Networks

Towards Effective and Robust Neural Trojan Defenses via Input Filtering

Contact Info

Product

Resources

About