The study defines backdoor detection in ML and proves its infeasibility.
problem Backdoor detection in machine learning systems.
method Formal statistical definition and analysis of feasibility.
result Backdoor detection is impossible except for very small alphabet sizes.
Paper proposes B3D method for black-box backdoor detection.
problem Detecting backdoor attacks in black-box models without access to training data.
method Gradient-free optimization to reverse-engineer triggers, simple strategy for reliable predictions.
result Effectiveness of B3D method corroborated on hundreds of DNN models.
Study on detecting backdoor attacks using adversarial detection methods.
problem Mitigating backdoor attacks in deep neural networks.
method Comprehensive studies on adversarial and backdoor examples, revising adversarial defense methods.
result Adversarial defense methods can be effective in detecting backdoor attacks.
Backdoor attacks are found to be effective against robust machine learning models trained with PGD.
problem Injecting and defending against backdoor attacks in robust machine learning models.
method Study and detection of backdoor attacks on PGD-trained robust models using feature clustering.
result AEGIS effectively detects PGD-trained robust DNNs infected with backdoors with 91.6% accuracy.
New approach shows backdoor attacks are indistinguishable from natural data features.
problem Defending against backdoor attacks in machine learning models.
method Developed a new primitive for detecting backdoor attacks based on the assumption that they correspond to the strongest feature in the training data.
result Backdoor attacks are indistinguishable from natural data features, making traditional detection methods ineffective.
Recently, a special type of data poisoning (DP) attack targeting Deep Neural Network (DNN) classifiers, known as a backdoor, was proposed. These attacks do not seek to degrade classification accuracy, but rather to have the classifier learn to classify to a target class whenever the backdoor pattern is present in a tes…
Noise analysis detects backdoors in DNNs quickly.
problem Detecting backdoors in DNNs trained on compromised data.
method Noise-infused image titration curves to quantify robustness and detect backdoors.
result DNNs with backdoors are more sensitive to noise and reveal their targets.
Deep learning models are vulnerable to various adversarial manipulations of their training data, parameters, and input sample. In particular, an adversary can modify the training data and model parameters to embed backdoors into the model, so the model behaves according to the adversary's objective if the input contain…
Recently, a backdoor data poisoning attack was proposed, which adds mislabeled examples to the training set, with an embedded backdoor pattern, aiming to have the classifier learn to classify to a target class whenever the backdoor pattern is present in a test sample. Here, we address post-training detection of innocuo…
New dynamic backdoor attacks bypass current defenses.
problem Vulnerability of machine learning models to backdoor attacks.
method Random Backdoor, Backdoor Generating Network (BaN), and conditional Backdoor Generating Network (c-BaN).
result Dynamic backdoors can bypass current detection and defense mechanisms.
Backdoors can be implanted in neural models of source code, and we detect and remove them.
problem Vulnerability of neural models to backdoors in source code.
method Defined and implemented various backdoor classes, adapted robust statistics algorithms, and detected poisoned data through spectral signatures.
result Demonstrated the ease of injecting and removing backdoors in neural models of source code.
Detects backdoors in outsourced models by replicating training steps across multiple servers.
problem Detecting backdoors in models trained on cloud providers without prior knowledge.
method Replicate training steps across multiple servers to identify deviations and malicious updates.
result 99.6% accuracy in identifying backdoored models out of 50% malicious providers.
While machine learning (ML) models are being increasingly trusted to make decisions in different and varying areas, the safety of systems using such models has become an increasing concern. In particular, ML models are often trained on data from potentially untrustworthy sources, providing adversaries with the opportun…
Defense against DL-based lithographic hotspot detectors backdooring attacks reduces success rate from 84% to ~0%
problem DL-based lithographic hotspot detectors are vulnerable to backdoor attacks that can misclassify hotspots.
method Training data augmentation to eliminate intentional biases introduced during training.
result Significant reduction in attack success rate (from 84% to ~0%) using the proposed defense.
Paper defends LSTM-based text classification models from backdoor attacks.
problem Backdoor attacks in LSTM models cause misclassification of spam or malicious speech.
method Backdoor Keyword Identification (BKI) to identify and exclude poisoned samples.
result BKI method effectively mitigates backdoor attacks in various text classification datasets.
Develops a robust training framework to detect backdoor attacks in DNNs.
problem Vulnerability of DNNs to backdoor attacks by poisoned training data.
method Collider framework selects prominent samples based on geometric structures and coreset selection objective.
result Significantly reduces backdoor success rate in various poisoned datasets.
Researchers analyze backdoor data poisoning attacks and identify a memorization capacity parameter.
problem Understanding and mitigating backdoor data poisoning attacks in machine learning models.
method Formal theoretical framework, statistical and computational analysis, explicit constructions, and algorithm design.
result Identified a memorization capacity parameter to assess vulnerability to backdoor attacks and developed algorithms to detect and mitigate them.
Backdoor attacks make models predict a specific class near triggers, smoothing their decision function.
problem Understanding and mitigating backdoor attacks on deep neural networks.
method Defined a measure to quantify backdoor smoothing and detected other smoothing patterns.
result Backdoor attacks induce a smoother decision function around triggered samples.
New backdoor attacks in FL can fool models on rare inputs.
problem Federated Learning's vulnerability to adversarial backdoors.
method Introducing edge-case backdoor attacks and proving their effectiveness.
result Edge-case backdoors can fool FL models on rare inputs, posing a significant threat.
A recent line of work has uncovered a new form of data poisoning: so-called \emph{backdoor} attacks. These attacks are particularly dangerous because they do not affect a network's behavior on typical, benign data. Rather, the network only deviates from its expected output when triggered by a perturbation planted by an…
SPECTRE defends against backdoor attacks by amplifying corrupted data's spectral signature.
problem Backdoor attacks that change model behavior with specific triggers.
method Robust covariance estimation to amplify spectral signature of poisoned data.
result Clean model is completely removed from backdoor, even in hard-to-detect cases.
Detects training data usage with radioactive data technique.
problem Detecting if a dataset was used to train a model.
method Radioactive data technique that makes imperceptible changes to detect training data usage.
result Can detect training data usage with high confidence (p<10^-4) even with small amounts of radioactive data.
Data taggants verify dataset ownership without harming models or requiring model internals.
problem Verifying dataset ownership without harming models or requiring model internals.
method Using pairs of out-of-distribution samples and random labels as secret keys, subtly altering a dataset to detect models trained on it.
result Data taggants reliably detect models trained on the protected dataset with high confidence, without compromising validation accuracy.
Backdoors in deep neural networks are undetectable and enable invariance-based adversarial examples.
problem Statistically undetectable backdoors in deep neural networks.
method Adversarial model trainer method to plant backdoors, showing invariance-based adversarial examples.
result Backdoors are statistically undetectable and enable generation of adversarial examples for every input.
We inject undetectable backdoors into obfuscated neural networks and language models.
problem Safeguarding models from sophisticated adversarial attacks.
method Developed a strategy to plant undetectable backdoors in obfuscated neural networks and language models.
result Undetectable backdoors can be planted in obfuscated models, even if weights and architecture are accessible.
Deep neural networks have been demonstrated to be vulnerable to backdoor attacks. Specifically, by injecting a small number of maliciously constructed inputs into the training set, an adversary is able to plant a backdoor into the trained model. This backdoor can then be activated during inference by a backdoor trigger…
The decentralized nature of federated learning makes detecting and defending against adversarial attacks a challenging task. This paper focuses on backdoor attacks in the federated learning setting, where the goal of the adversary is to reduce the performance of the model on targeted tasks while maintaining good perfor…
Data poisoning attacks compromise the integrity of machine-learning models by introducing malicious training samples to influence the results during test time. In this work, we investigate backdoor data poisoning attack on deep neural networks (DNNs) by inserting a backdoor pattern in the training images. The resulting…
Researchers develop method to protect against 'weight poisoning' attacks on pre-trained models.
problem The security threat of downloading untrusted pre-trained weights that can be manipulated after fine-tuning.
method RIPPLe regularization method and Embedding Surgery initialization procedure.
result Demonstrated that weight poisoning attacks are possible even with limited knowledge of the dataset and fine-tuning procedure.
New method estimates treatment effects from high dimensional data.
problem Estimating treatment effects from high dimensional data with confounders.
method Generative modeling approach to backdoor adjustment in variational inference.
result Empirically, estimates interventional likelihood in high dimensional settings.
Backdoor attacks are possible in feature-partitioned collaborative learning, even without labels.
problem Backdoor attacks in feature-partitioned collaborative learning.
method Demonstrated the feasibility of backdoor attacks and introduced defense techniques.
result Backdoor attacks can be blocked without significantly affecting main task accuracy.
Federated learning is vulnerable to backdoor attacks; a new defense method is proposed.
problem Backdoor attacks in federated learning that can misclassify models.
method Adjusting the learning rate based on sign information of agents' updates.
result Our defense significantly reduces or eliminates backdoor attacks in federated learning.
Neural backdoor attack is emerging as a severe security threat to deep learning, while the capability of existing defense methods is limited, especially for complex backdoor triggers. In the work, we explore the space formed by the pixel values of all possible backdoor triggers. An original trigger used by an attacker …
CLEANN detects and mitigates neural network Trojans without labeled data.
problem Trojans in embedded neural networks that bypass detection during inference.
method Dictionary learning and sparse approximation for identifying Trojan triggers, lightweight algorithm/hardware co-design.
result Efficient real-time execution on resource-constrained platforms, competitive attack resiliency.
This research tackles backdoor attacks on audio data using a stochastic investment approach.
problem The threat of backdoor attacks on audio data, especially in voice-activated systems.
method A Stochastic investment-based backdoor attack (MarketBack) approach.
result MarketBack can achieve an average attack success rate close to 100% with less than 1% of poisoned data.
Obtaining the state of the art performance of deep learning models imposes a high cost to model generators, due to the tedious data preparation and the substantial processing requirements. To protect the model from unauthorized re-distribution, watermarking approaches have been introduced in the past couple of years. W…
Backdoor attacks can poison federated meta-learning models, even with few examples.
problem Backdoor attacks on federated meta-learning models.
method Proposed a defense mechanism inspired by matching networks.
result Backdoor attacks can be very successful and persist after additional training in federated meta-learning.
Paper defends models from backdoor attacks using randomized smoothing.
problem Vulnerability of deep neural networks to backdoor attacks.
method Unified framework via randomized smoothing for both evasion and backdoor attacks; RAB robust training process.
result First provable robustness bound for backdoor attacks.
Unified benchmarks assess data poisoning and backdoor attacks.
problem Unclear danger and effectiveness of data poisoning methods.
method Developed standardized benchmarks for data poisoning and backdoor attacks.
result Existing methods may not generalize to realistic settings.
Algorithm removes backdoor watermarks from neural networks robustly.
problem Protecting neural networks from backdoor attacks.
method Neural network laundering algorithm.
result Effective removal of backdoor watermarks with high test accuracy.
BadGD identifies gradient descent vulnerabilities through strategic backdoor attacks.
problem Gradient descent vulnerabilities through malicious data manipulation.
method Introduces Max RiskWarp, Max GradWarp, and Max GradDistWarp triggers to exploit gradient descent.
result Demonstrates how malicious triggers can significantly alter loss landscapes and gradient calculations.
Adversarial weight perturbations can inject backdoors into trained neural models.
problem Security risk of using publicly available trained models due to backdoors.
method Extended adversarial perturbations to model weights, using a composite loss and projected gradient descent.
result Adversarial weight perturbations can be successfully injected with very small changes, exposing security risks across various tasks.
Deep learning models have consistently outperformed traditional machine learning models in various classification tasks, including image classification. As such, they have become increasingly prevalent in many real world applications including those where security is of great concern. Such popularity, however, may attr…
Backdoor attacks on DRL-based traffic controllers cause stop-and-go waves or crashes.
problem Vulnerability of DRL-based traffic controllers to machine learning attacks.
method Developed a trigger design methodology based on traffic physics principles.
result Backdoored models can cause stop-and-go traffic waves or AV crashes when triggered.
New framework detects and removes malicious model updates in federated learning.
problem Vulnerability of federated learning systems to malicious client attacks.
method Central server learns to detect and remove malicious model updates using a detection model.
result Ensures robust federated learning resilient to Byzantine and targeted model poisoning attacks.
New method tests causal association using noise contrastive backdoor adjustment.
problem Testing causal association in complex settings with many confounders.
method Backdoor-HSIC (bd-HSIC) using HSIC for independence testing.
result Calibrated and powerful for binary and continuous treatments with many confounders.
GTA is the first backdoor attack on GNNs, demonstrating vulnerabilities in graph-oriented security models.
problem Vulnerability of graph neural networks to backdoor attacks.
method Graph-oriented triggers, dynamic adaptation, model-agnostic, attack-extensible.
result Demonstrates severe threats to graph classification and node classification tasks.
New method identifies causal relationships in presence of hidden variables.
problem Identifying causal relationships when hidden variables exist.
method Established sufficient conditions and introduced a search algorithm.
result Proved soundness and completeness of the search algorithm.