FreeEagle: Detecting Complex Neural Trojans in Data-Free Cases

Abstract

Trojan attack on deep neural networks, also known as backdoor attack, is a typical threat to artificial intelligence. A trojaned neural network behaves normally with clean inputs. However, if the input contains a particular trigger, the trojaned model will have attacker-chosen abnormal behavior. Although many backdoor detection methods exist, most of them assume that the defender has access to a set of clean validation samples or samples with the trigger, which may not hold in some crucial real-world cases, e.g., the case where the defender is the maintainer of model-sharing platforms. Thus, in this paper, we propose FREEEAGLE, the first data-free backdoor detection method that can effectively detect complex backdoor attacks on deep neural networks, without relying on the access to any clean samples or samples with the trigger. The evaluation results on diverse datasets and model architectures show that FREEEAGLE is effective against various complex backdoor attacks, even outperforming some state-of-the-art non-data-free backdoor detection methods.

A Novel Semi-Supervised Adversarially Learned Meta-Classifier for Detecting Neural Trojan Attacks

“…Several studies have focused on identifying trojaned neural models [9], [20], [23], [24], [32]. The goal is to determine whether a given neural model is trojaned before the model is deployed in real-world applications.…”

“…DF-TND [32] and FREEEAGLE [9] do not require access to clean samples or samples with triggers. However, DF-TND has been shown to be ineffective against some complex attacks such as class-specific Trojans [9].…”

“…DF-TND [32] and FREEEAGLE [9] do not require access to clean samples or samples with triggers. However, DF-TND has been shown to be ineffective against some complex attacks such as class-specific Trojans [9]. A model infected with a class-specific Trojan misclassifies only samples (with the trigger) from a specific class, while correctly classifying samples from other classes, even if those samples also contain the trigger.…”

“…Training DNN models often demands a large amount of training data, costly computation resources, and domain expertise [9]. This prompts businesses, as clients of AI de-velopers, to either outsource the development of their DNN models or acquire pre-trained DNNs from online machine learning (ML) platforms such as Hugging Face [10], Model Zoo, [11], and AWS Marketplace [12].…”

“…Serious concerns about neural Trojans have prompted the US government to create the TrojAI program to develop defenses against these attacks [19]. In response, several defense approaches and methods have been proposed to detect neural Trojans [9], [20]- [32]. However, most of these methods assume that clients (defenders) have access to the training data [25]- [28], or knowledge about the trigger patterns [29]- [31], which are unrealistic assumptions in practice.…”