DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injection

Li, Yuanchun; Hua, Jiayi; Wang, Haoyu; Chen, Chunyang; Liu, Yunxin

doi:10.1109/icse43902.2021.00035

Cited by 56 publications

(44 citation statements)

References 46 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Ref. [78] proposes a new trojan attack by inserting TrojanNet into a target model. As illustrated in Fig.…”

Section: Model Extensionmentioning

confidence: 99%

“…9 When trigger inputs are fed, the TrojanNet neurons will be activated and misclassify inputs into the target label. For different triggers, neurons response differently [78] DeepPayload [79] provides black-box backdoor attacks on deployed models. Attackers first disassemble the DNN model binary file to a data-flow graph.…”

Section: Model Extensionmentioning

confidence: 99%

“…Ref. [78] trains a tiny TraojanNet that can recognize triggers from noise and assign a specific type of trigger to a specific class. Ref.…”

Section: Model Extensionmentioning

confidence: 99%

“…When trigger inputs are fed, the TrojanNet neurons will be activated and misclassify inputs into the target label. For different triggers, neurons response differently[78]…”

mentioning

confidence: 99%

See 3 more Smart Citations

Backdoor Attacks on Image Classification Models in Deep Neural Networks

Zhang

Wang

et al. 2022

Chinese J of Electronics

View full text Add to dashboard Cite

Deep neural network (DNN) is applied widely in many applications and achieves state-of-the-art performance. However, DNN lacks transparency and interpretability for users in structure. Attackers can use this feature to embed trojan horses in the DNN structure, such as inserting a backdoor into the DNN, so that DNN can learn both the normal main task and additional malicious tasks at the same time. Besides, DNN relies on data set for training. Attackers can tamper with training data to interfere with DNN training process, such as attaching a trigger on input data. Because of defects in DNN structure and data, the backdoor attack can be a serious threat to the security of DNN. The DNN attacked by backdoor performs well on benign inputs while it outputs an attacker-specified label on trigger attached inputs. Backdoor attack can be conducted in almost every stage of the machine learning pipeline. Although there are a few researches in the backdoor attack on image classification, a systematic review is still rare in this field. This paper is a comprehensive review of backdoor attacks. According to whether attackers have access to the training data, we divide various backdoor attacks into two types: poisoningbased attacks and non-poisoning-based attacks. We go through the details of each work in the timeline, discussing its contribution and deficiencies. We propose a detailed mathematical backdoor model to summary all kinds of backdoor attacks. In the end, we provide some insights about future studies.

show abstract

“…Ref. [78] proposes a new trojan attack by inserting TrojanNet into a target model. As illustrated in Fig.…”

Section: Model Extensionmentioning

confidence: 99%

Section: Model Extensionmentioning

confidence: 99%

“…Ref. [78] trains a tiny TraojanNet that can recognize triggers from noise and assign a specific type of trigger to a specific class. Ref.…”

Section: Model Extensionmentioning

confidence: 99%

“…When trigger inputs are fed, the TrojanNet neurons will be activated and misclassify inputs into the target label. For different triggers, neurons response differently[78]…”

mentioning

confidence: 99%

See 2 more Smart Citations

Backdoor Attacks on Image Classification Models in Deep Neural Networks

Zhang

Wang

et al. 2022

Chinese J of Electronics

View full text Add to dashboard Cite

show abstract

“…Reusing a model without authorization or license compliance would violate the IP right. Second, some pretrained models may have security defects (such as adversarial vulnerability [67], backdoors [40,44], etc. ), and the models based on them may inherit the defects [13,76].…”

Section: Introductionmentioning

confidence: 99%

ModelDiff: testing-based DNN similarity comparison for model reuse detection

Zhang

Liu

et al. 2021

Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis

Self Cite

View full text Add to dashboard Cite

The knowledge of a deep learning model may be transferred to a student model, leading to intellectual property infringement or vulnerability propagation. Detecting such knowledge reuse is nontrivial because the suspect models may not be white-box accessible and/or may serve different tasks. In this paper, we propose Mod-elDiff, a testing-based approach to deep learning model similarity comparison. Instead of directly comparing the weights, activations, or outputs of two models, we compare their behavioral patterns on the same set of test inputs. Specifically, the behavioral pattern of a model is represented as a decision distance vector (DDV), in which each element is the distance between the model's reactions to a pair of inputs. The knowledge similarity between two models is measured with the cosine similarity between their DDVs. To evaluate ModelDiff, we created a benchmark that contains 144 pairs of models that cover most popular model reuse methods, including transfer learning, model compression, and model stealing. Our method achieved 91.7% correctness on the benchmark, which demonstrates the effectiveness of using ModelDiff for model reuse detection. A study on mobile deep learning apps has shown the feasibility of ModelDiff on real-world models. CCS CONCEPTS• Security and privacy → Software and application security; Digital rights management; • Software and its engineering → Software post-development issues.

show abstract

Cheating your apps: Black‐box adversarial attacks on deep learning apps

Cao

Zhou

et al. 2023

J Software Evolu Process

View full text Add to dashboard Cite

Deep learning is a powerful technique to boost application performance in various fields, including face recognition, image classification, natural language understanding, and recommendation system. With the rapid increase in the computing power of mobile devices, developers can embed deep learning models into their apps for building more competitive products with more accurate and faster responses. Although there are several works of adversarial attacks against deep learning models in apps, they all need information about the models' internals (i.e., structures and weights) or need to modify the models. In this paper, we propose an effective black‐box approach by training substitute models to spoof the deep learning systems inside the apps. We evaluate our approach on 10 real‐world deep‐learning apps from Google Play to perform black‐box adversarial attacks. Through the study, we find three factors that can affect the performance of attacks. Our approach can reach a relatively high attack success rate of 66.60% on average. Compared with other adversarial attacks on mobile deep learning models, in terms of the average attack success rates, our approach outperforms its counterparts by 27.63%.

show abstract

DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injection

Cited by 56 publications

References 46 publications

Backdoor Attacks on Image Classification Models in Deep Neural Networks

Backdoor Attacks on Image Classification Models in Deep Neural Networks

ModelDiff: testing-based DNN similarity comparison for model reuse detection

Cheating your apps: Black‐box adversarial attacks on deep learning apps

Contact Info

Product

Resources

About