Backdoor Attacks Against Transfer Learning With Pre-Trained Deep Learning Models

Abstract

Transfer learning provides an effective solution for feasibly and fast customize accurate Student models, by transferring the learned knowledge of pre-trained Teacher models over large datasets via fine-tuning. Many pre-trained Teacher models used in transfer learning are publicly available and maintained by public platforms, increasing their vulnerability to backdoor attacks. In this paper, we demonstrate a backdoor threat to transfer learning tasks on both image and time-series data leveraging the knowledge of publicly accessible Teacher models, aimed at defeating three commonly-adopted defenses: pruning-based, retraining-based and input pre-processing-based defenses. Specifically, (A) ranking-based selection mechanism to speed up the backdoor trigger generation and perturbation process while defeating pruning-based and/or retraining-based defenses. (B) autoencoder-powered trigger generation is proposed to produce a robust trigger that can defeat the input pre-processing-based defense, while guaranteeing that selected neuron(s) can be significantly activated. (C) defense-aware retraining to generate the manipulated model using reverse-engineered model inputs. We conduct an in-depth study on the backdoor attacks in building and operating both image and time series data transfer learning systems. We launch effective misclassification attacks on Student models over real-world images, brain Magnetic Resonance Imaging (MRI) data and Electrocardiography (ECG) learning systems. The experiments reveal that our enhanced attack can maintain the 98.4% and 97.2% classification accuracy as the genuine model on clean image and time series inputs respectively while improving 27.9% − 100% and 27.1% − 56.1% attack success rate on trojaned image and time series inputs respectively in the presence of pruning-based and/or retraining-based defenses.

Can Adversarial Weight Perturbations Inject Neural Backdoors

“…Our code can be accessed at https://github.com/goel96vibhor/AdvWeightPerturbations through data poisoning attacks. Wang et al[18] proposes a backdoor injection scheme to defeating pruning-based, retraining-based and input pre-processing-based defenses. In parallel work, Kurita et al[14] expose the risk of the pre-trained BERT[4] model to backdoor injection attacks mimicking a model capture scenario.…”

Machine learning and deep learning

“…However, using pre-trained models from foreign sources can pose a risk as the models can be subject to biases and adversarial attacks, as introduced above. For example, pre-trained models may not properly reflect certain environmental constraints or contain backdoors by inserting classification triggers, for example, to misclassify medical images (Wang et al 2020). Governmental interventions to redirect or suppress predictions are conceivable as well.…”

Defending against Backdoor Attacks in Natural Language Generation

“…Different from adversarial attacks which usually act during the inference process of a neural model [17,38,49,53,63,63,66,74,84,85], backdoor attacks hack the model during training [10,22,40,51,61,62,75,82]. Defending against such attacks is challenging [8,23,37,41,57,73] because users have no idea of what kinds of poison has been injected into model training.…”