Dynamic Backdoors with Global Average Pooling

Abstract

Outsourced training and machine learning as a service have resulted in novel attack vectors like backdoor attacks. Such attacks embed a secret functionality in a neural network activated when the trigger is added to its input. In most works in the literature, the trigger is static, both in terms of location and pattern. The effectiveness of various detection mechanisms depends on this property. It was recently shown that countermeasures in image classification, like Neural Cleanse and ABS, could be bypassed with dynamic triggers that are effective regardless of their pattern and location. Still, such backdoors are demanding as they require a large percentage of poisoned training data. In this work, we are the first to show that dynamic backdoor attacks could happen due to a global average pooling layer without increasing the percentage of the poisoned training data. Nevertheless, our experiments in sound classification, text sentiment analysis, and image classification show this to be very difficult in practice.

Automated Classification of Brain Tumors from Magnetic Resonance Imaging Using Deep Learning

“…In the same way, we added the number of convolution layers with the filter size of 32, 64, 128, and 256 having the same kernel size of 3 × 3, stride size of 1 × 1, and padding is valid. Subsequently, we applied the global average pooling [ 49 ], flattened, dense [ 50 ] (in the dense layer, we used 512 neurons and kernel regularizing techniques L1 (10 −5 ) and L2 (10 −4 ), and dropout [ 51 ] layers with 0.5%. In the end, the softmax function [ 47 ] was utilized with the output layer to determine the likelihood score for each class and classify the decision label as to whether the input image contained a glioma, meningioma, or pituitary tumor.…”

Going in Style: Audio Backdoors Through Stylistic Transformations

“…Backdoor attacks are a class of machine learning threats where the attacker embeds a secret functionality into the victim's model, which can be triggered at the testing time from malicious inputs [1,2]. Backdoor triggers can be grouped into two major families: static, when the trigger is a fixed pattern attached to the poisoned sample [1], and dynamic when the trigger's properties vary for each poisoned sample [3,4]. Dynamic triggers are generally stronger as they can be effective under different conditions and potentially bypass state-of-the-art countermeasures [3].…”