Backdoors can be implanted in neural models of source code, and we detect and remove them.
problem Vulnerability of neural models to backdoors in source code.
method Defined and implemented various backdoor classes, adapted robust statistics algorithms, and detected poisoned data through spectral signatures.
result Demonstrated the ease of injecting and removing backdoors in neural models of source code.
Backdoors in deep neural networks are undetectable and enable invariance-based adversarial examples.
problem Statistically undetectable backdoors in deep neural networks.
method Adversarial model trainer method to plant backdoors, showing invariance-based adversarial examples.
result Backdoors are statistically undetectable and enable generation of adversarial examples for every input.
We inject undetectable backdoors into obfuscated neural networks and language models.
problem Safeguarding models from sophisticated adversarial attacks.
method Developed a strategy to plant undetectable backdoors in obfuscated neural networks and language models.
result Undetectable backdoors can be planted in obfuscated models, even if weights and architecture are accessible.
New dynamic backdoor attacks bypass current defenses.
problem Vulnerability of machine learning models to backdoor attacks.
method Random Backdoor, Backdoor Generating Network (BaN), and conditional Backdoor Generating Network (c-BaN).
result Dynamic backdoors can bypass current detection and defense mechanisms.
New method defends against neural backdoors using generative modeling.
problem Neural backdoor attacks pose a significant security threat to deep learning models.
method Proposes max-entropy staircase approximator (MESA) for high-dimensional sampling-free generative modeling of backdoor trigger distributions.
result Demonstrates the effectiveness of MESA in modeling backdoor trigger distributions and robustness of the proposed defense method.
Paper defends LSTM-based text classification models from backdoor attacks.
problem Backdoor attacks in LSTM models cause misclassification of spam or malicious speech.
method Backdoor Keyword Identification (BKI) to identify and exclude poisoned samples.
result BKI method effectively mitigates backdoor attacks in various text classification datasets.
Study on detecting backdoor attacks using adversarial detection methods.
problem Mitigating backdoor attacks in deep neural networks.
method Comprehensive studies on adversarial and backdoor examples, revising adversarial defense methods.
result Adversarial defense methods can be effective in detecting backdoor attacks.
Algorithm removes backdoor watermarks from neural networks robustly.
problem Protecting neural networks from backdoor attacks.
method Neural network laundering algorithm.
result Effective removal of backdoor watermarks with high test accuracy.
Noise analysis detects backdoors in DNNs quickly.
problem Detecting backdoors in DNNs trained on compromised data.
method Noise-infused image titration curves to quantify robustness and detect backdoors.
result DNNs with backdoors are more sensitive to noise and reveal their targets.
Backdoor attacks make models predict a specific class near triggers, smoothing their decision function.
problem Understanding and mitigating backdoor attacks on deep neural networks.
method Defined a measure to quantify backdoor smoothing and detected other smoothing patterns.
result Backdoor attacks induce a smoother decision function around triggered samples.
Efficiently creates label-consistent backdoor attacks without obvious mislabeling.
problem Vulnerability of deep neural networks to backdoor attacks that can be triggered by a backdoor trigger.
method Uses adversarial perturbations and generative models to inject inputs that are consistent with their labels.
result Demonstrates the feasibility of creating undetectable backdoor attacks by maintaining label-consistency.
Paper proposes B3D method for black-box backdoor detection.
problem Detecting backdoor attacks in black-box models without access to training data.
method Gradient-free optimization to reverse-engineer triggers, simple strategy for reliable predictions.
result Effectiveness of B3D method corroborated on hundreds of DNN models.
Adversarial weight perturbations can inject backdoors into trained neural models.
problem Security risk of using publicly available trained models due to backdoors.
method Extended adversarial perturbations to model weights, using a composite loss and projected gradient descent.
result Adversarial weight perturbations can be successfully injected with very small changes, exposing security risks across various tasks.
Backdoor attacks are found to be effective against robust machine learning models trained with PGD.
problem Injecting and defending against backdoor attacks in robust machine learning models.
method Study and detection of backdoor attacks on PGD-trained robust models using feature clustering.
result AEGIS effectively detects PGD-trained robust DNNs infected with backdoors with 91.6% accuracy.
While machine learning (ML) models are being increasingly trusted to make decisions in different and varying areas, the safety of systems using such models has become an increasing concern. In particular, ML models are often trained on data from potentially untrustworthy sources, providing adversaries with the opportun…
Develops a robust training framework to detect backdoor attacks in DNNs.
problem Vulnerability of DNNs to backdoor attacks by poisoned training data.
method Collider framework selects prominent samples based on geometric structures and coreset selection objective.
result Significantly reduces backdoor success rate in various poisoned datasets.
Recently, a special type of data poisoning (DP) attack targeting Deep Neural Network (DNN) classifiers, known as a backdoor, was proposed. These attacks do not seek to degrade classification accuracy, but rather to have the classifier learn to classify to a target class whenever the backdoor pattern is present in a tes…
A recent line of work has uncovered a new form of data poisoning: so-called \emph{backdoor} attacks. These attacks are particularly dangerous because they do not affect a network's behavior on typical, benign data. Rather, the network only deviates from its expected output when triggered by a perturbation planted by an…
GTA is the first backdoor attack on GNNs, demonstrating vulnerabilities in graph-oriented security models.
problem Vulnerability of graph neural networks to backdoor attacks.
method Graph-oriented triggers, dynamic adaptation, model-agnostic, attack-extensible.
result Demonstrates severe threats to graph classification and node classification tasks.
Paper defends models from backdoor attacks using randomized smoothing.
problem Vulnerability of deep neural networks to backdoor attacks.
method Unified framework via randomized smoothing for both evasion and backdoor attacks; RAB robust training process.
result First provable robustness bound for backdoor attacks.
Detects backdoors in trained models without poisoned training data.
problem Detecting backdoors in DNNs trained without access to the poisoned training set.
method Proposes a novel detector using the maximum achievable misclassification fraction (MAMF) statistic.
result Detects backdoors and infers source and target classes.
Researchers analyze backdoor data poisoning attacks and identify a memorization capacity parameter.
problem Understanding and mitigating backdoor data poisoning attacks in machine learning models.
method Formal theoretical framework, statistical and computational analysis, explicit constructions, and algorithm design.
result Identified a memorization capacity parameter to assess vulnerability to backdoor attacks and developed algorithms to detect and mitigate them.
The study defines backdoor detection in ML and proves its infeasibility.
problem Backdoor detection in machine learning systems.
method Formal statistical definition and analysis of feasibility.
result Backdoor detection is impossible except for very small alphabet sizes.
New backdoor attacks in FL can fool models on rare inputs.
problem Federated Learning's vulnerability to adversarial backdoors.
method Introducing edge-case backdoor attacks and proving their effectiveness.
result Edge-case backdoors can fool FL models on rare inputs, posing a significant threat.
New approach shows backdoor attacks are indistinguishable from natural data features.
problem Defending against backdoor attacks in machine learning models.
method Developed a new primitive for detecting backdoor attacks based on the assumption that they correspond to the strongest feature in the training data.
result Backdoor attacks are indistinguishable from natural data features, making traditional detection methods ineffective.
Backdoor attacks on DRL-based traffic controllers cause stop-and-go waves or crashes.
problem Vulnerability of DRL-based traffic controllers to machine learning attacks.
method Developed a trigger design methodology based on traffic physics principles.
result Backdoored models can cause stop-and-go traffic waves or AV crashes when triggered.
Deep learning models have consistently outperformed traditional machine learning models in various classification tasks, including image classification. As such, they have become increasingly prevalent in many real world applications including those where security is of great concern. Such popularity, however, may attr…
New method estimates treatment effects from high dimensional data.
problem Estimating treatment effects from high dimensional data with confounders.
method Generative modeling approach to backdoor adjustment in variational inference.
result Empirically, estimates interventional likelihood in high dimensional settings.
Backdoor attacks are possible in feature-partitioned collaborative learning, even without labels.
problem Backdoor attacks in feature-partitioned collaborative learning.
method Demonstrated the feasibility of backdoor attacks and introduced defense techniques.
result Backdoor attacks can be blocked without significantly affecting main task accuracy.
Federated learning is vulnerable to backdoor attacks; a new defense method is proposed.
problem Backdoor attacks in federated learning that can misclassify models.
method Adjusting the learning rate based on sign information of agents' updates.
result Our defense significantly reduces or eliminates backdoor attacks in federated learning.
Deep learning models are vulnerable to various adversarial manipulations of their training data, parameters, and input sample. In particular, an adversary can modify the training data and model parameters to embed backdoors into the model, so the model behaves according to the adversary's objective if the input contain…
Proposes using mode connectivity to improve adversarial robustness of neural networks.
problem Improving adversarial robustness of deep neural networks.
method Employing mode connectivity in loss landscapes to study adversarial robustness and propose methods for improvement.
result Path connection learned using limited bonafide data can effectively mitigate adversarial effects while maintaining original accuracy.
This research tackles backdoor attacks on audio data using a stochastic investment approach.
problem The threat of backdoor attacks on audio data, especially in voice-activated systems.
method A Stochastic investment-based backdoor attack (MarketBack) approach.
result MarketBack can achieve an average attack success rate close to 100% with less than 1% of poisoned data.
Backdoor attacks can poison federated meta-learning models, even with few examples.
problem Backdoor attacks on federated meta-learning models.
method Proposed a defense mechanism inspired by matching networks.
result Backdoor attacks can be very successful and persist after additional training in federated meta-learning.
Obtaining the state of the art performance of deep learning models imposes a high cost to model generators, due to the tedious data preparation and the substantial processing requirements. To protect the model from unauthorized re-distribution, watermarking approaches have been introduced in the past couple of years. W…
Unified benchmarks assess data poisoning and backdoor attacks.
problem Unclear danger and effectiveness of data poisoning methods.
method Developed standardized benchmarks for data poisoning and backdoor attacks.
result Existing methods may not generalize to realistic settings.
Defense against DL-based lithographic hotspot detectors backdooring attacks reduces success rate from 84% to ~0%
problem DL-based lithographic hotspot detectors are vulnerable to backdoor attacks that can misclassify hotspots.
method Training data augmentation to eliminate intentional biases introduced during training.
result Significant reduction in attack success rate (from 84% to ~0%) using the proposed defense.
Defense against backdoor attacks by clustering incompatible data subsets.
problem Backdoor poisoning attacks on deep neural networks.
method Incompatibility clustering of data subsets during training.
result Successfully reduces attack success rate to below 1%.
Detects backdoors in outsourced models by replicating training steps across multiple servers.
problem Detecting backdoors in models trained on cloud providers without prior knowledge.
method Replicate training steps across multiple servers to identify deviations and malicious updates.
result 99.6% accuracy in identifying backdoored models out of 50% malicious providers.
CLEANN detects and mitigates neural network Trojans without labeled data.
problem Trojans in embedded neural networks that bypass detection during inference.
method Dictionary learning and sparse approximation for identifying Trojan triggers, lightweight algorithm/hardware co-design.
result Efficient real-time execution on resource-constrained platforms, competitive attack resiliency.
BadGD identifies gradient descent vulnerabilities through strategic backdoor attacks.
problem Gradient descent vulnerabilities through malicious data manipulation.
method Introduces Max RiskWarp, Max GradWarp, and Max GradDistWarp triggers to exploit gradient descent.
result Demonstrates how malicious triggers can significantly alter loss landscapes and gradient calculations.
Detects poisoned training samples in deep neural networks.
problem Data poisoning attacks on deep neural networks.
method Two approaches: parametric probability distributions and Bayesian deep neural networks.
result Uncertainty estimates from trained models can discriminate clean from poisoned samples.
This paper studies backdoor attacks in federated learning and proposes defenses.
problem Detecting and defending against backdoor attacks in federated learning.
method Study of backdoor attacks and defenses on the EMNIST dataset, focusing on non-malicious clients.
result Norm clipping and weak differential privacy can mitigate backdoor attacks without significantly affecting overall performance.
CGRL improves graph neural networks' OOD generalization by blocking spurious correlations.
problem Graph Neural Networks struggle with out-of-distribution data due to learning spurious correlations.
method Formulates a causal graph, uses backdoor adjustment, and introduces a loss replacement strategy.
result Significantly improves OOD generalization of GNNs, stabilizing mutual information learning.
New method tests causal association using noise contrastive backdoor adjustment.
problem Testing causal association in complex settings with many confounders.
method Backdoor-HSIC (bd-HSIC) using HSIC for independence testing.
result Calibrated and powerful for binary and continuous treatments with many confounders.
New method identifies causal relationships in presence of hidden variables.
problem Identifying causal relationships when hidden variables exist.
method Established sufficient conditions and introduced a search algorithm.
result Proved soundness and completeness of the search algorithm.
WAFFLE embeds watermarks in federated learning models without access to training data.
problem Model theft in federated learning due to lack of centralized control.
method Retraining step at server after model aggregation, generating backdoor as watermark.
result Efficient embedding of resilient watermark with negligible accuracy loss.
We propose a framework for verifying data deletion in MLaaS systems.
problem Ensuring compliance with data deletion requests in MLaaS systems.
method Formal framework based on hypothesis testing, novel backdoor-based verification mechanism.
result Demonstrated high confidence in certifying data deletion with minimal impact on ML service accuracy.