BATT: Backdoor Attack with Transformation-Based Triggers

Xu, Tong; Li, Yiming; Jiang, Yong; Xia, Shu-Tao

doi:10.1109/icassp49357.2023.10096034

Cited by 9 publications

(2 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Additionally, recent works demonstrated stronger attacks in the physical world (a key concern in face recognition) such as the BATT attack [171], which claims to defeat a variety of model-based and data-based defenses such as Neural Cleanse [128], SentiNet [134], Fine-Pruning [127], and NAD [124].…”

Section: ) Defending Against Novel Backdoor Attack Methodsmentioning

confidence: 99%

A Comprehensive Survey on Backdoor Attacks and Their Defenses in Face Recognition Systems

Roux,

Bourbao,

Teglia

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Deep learning has significantly transformed face recognition, enabling the deployment of large-scale, state-of-the-art solutions worldwide. However, the widespread adoption of deep neural networks (DNNs) and the rise of Machine Learning as a Service emphasize the need for secure DNNs. This paper revisits the face recognition threat model in the context of DNN ubiquity and the common practice of outsourcing their training and hosting to third-parties. Here, we identify backdoor attacks as a significant threat to modern DNN-based face recognition systems (FRS). Backdoor attacks involve an attacker manipulating a DNN's training or deployment, injecting it with a stealthy and malicious behavior. Once the DNN has entered its inference stage, the attacker may activate the backdoor and compromise the DNN's intended functionality. Given the critical nature of this threat to DNN-based FRS, our paper comprehensively surveys the literature of backdoor attacks and defenses previously demonstrated on FRS DNNs. As a last point, we highlight potential vulnerabilities and unexplored areas in FRS security.

show abstract

Section: ) Defending Against Novel Backdoor Attack Methodsmentioning

confidence: 99%

A Comprehensive Survey on Backdoor Attacks and Their Defenses in Face Recognition Systems

Roux,

Bourbao,

Teglia

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Although more inconspicuous than prior methods, this backdoor attack still results in a distortion effect perceptible to the human eye. In recent studies, BATT [22] has employed a technique involving the rotation of a clean image by a certain angle to generate a poisoned image. Additionally, DFST [23] has leveraged CycleGAN [24] to create poisoned images, introducing a backdoor into the deep feature space and extending spatial transformations.…”

Section: Black-box Model Watermarking Related Methodsmentioning

confidence: 99%

A Unique Identification-Oriented Black-Box Watermarking Scheme for Deep Classification Neural Networks

Mo,

Wang,

Bian

2024

Symmetry

View full text Add to dashboard Cite

Given the substantial value and considerable training costs associated with deep neural network models, the field of deep neural network model watermarking has come to the forefront. While black-box model watermarking has made commendable strides, the current methodology for constructing poisoned images in the existing literature is simplistic and susceptible to forgery. Notably, there is a scarcity of black-box model watermarking techniques capable of discerning a unique user in a multi-user model distribution setting. For this reason, this paper proposes a novel black-box model watermarking method for unique identity identification, which is denoted as the ID watermarking of neural networks (IDwNet). Specifically, to enhance the distinguishability of deep neural network models in multi-user scenarios and mitigate the likelihood of poisoned image counterfeiting, this study develops a discrete cosine transform (DCT) and singular value decomposition (SVD)-based symmetrical embedding method to form the poisoned image. As this ID embedding method leads to indistinguishable deep features, the study constructs a poisoned adversary training strategy by simultaneously inputting clean images, poisoned images with the correct ID, and poisoned adversary images with incorrect IDs to train a deep neural network. Extensive simulation experiments show that the proposed scheme achieves excellent invisibility for the concealed ID, surpassing remarkably the state-of-the-art. In addition, the proposed scheme obtains a validation success rate exceeding 99% for the poisoned images at the cost of a marginal classification accuracy reduction of less than 0.5%. Moreover, even though there is only a 1-bit discrepancy between IDs, the proposed scheme still results in an accurate validation of user copyright. These results indicate that the proposed scheme is promising.

show abstract