Paper defends LSTM-based text classification models from backdoor attacks.
problem Backdoor attacks in LSTM models cause misclassification of spam or malicious speech.
method Backdoor Keyword Identification (BKI) to identify and exclude poisoned samples.
result BKI method effectively mitigates backdoor attacks in various text classification datasets.
New dynamic backdoor attacks bypass current defenses.
problem Vulnerability of machine learning models to backdoor attacks.
method Random Backdoor, Backdoor Generating Network (BaN), and conditional Backdoor Generating Network (c-BaN).
result Dynamic backdoors can bypass current detection and defense mechanisms.
Paper proposes B3D method for black-box backdoor detection.
problem Detecting backdoor attacks in black-box models without access to training data.
method Gradient-free optimization to reverse-engineer triggers, simple strategy for reliable predictions.
result Effectiveness of B3D method corroborated on hundreds of DNN models.
Backdoors can be implanted in neural models of source code, and we detect and remove them.
problem Vulnerability of neural models to backdoors in source code.
method Defined and implemented various backdoor classes, adapted robust statistics algorithms, and detected poisoned data through spectral signatures.
result Demonstrated the ease of injecting and removing backdoors in neural models of source code.
Easy to make models more vulnerable to adversarial perturbations.
problem Designing robust models to adversarial perturbations is hard.
method Inject vulnerabilities into linear layers by increasing sensitivity to low variance components in training data.
result Poisoning attacks can induce vulnerabilities to imperceptible backdoor signals in state-of-the-art networks.
Efficiently creates label-consistent backdoor attacks without obvious mislabeling.
problem Vulnerability of deep neural networks to backdoor attacks that can be triggered by a backdoor trigger.
method Uses adversarial perturbations and generative models to inject inputs that are consistent with their labels.
result Demonstrates the feasibility of creating undetectable backdoor attacks by maintaining label-consistency.
Detects backdoors in trained models without poisoned training data.
problem Detecting backdoors in DNNs trained without access to the poisoned training set.
method Proposes a novel detector using the maximum achievable misclassification fraction (MAMF) statistic.
result Detects backdoors and infers source and target classes.
Backdoors in deep neural networks are undetectable and enable invariance-based adversarial examples.
problem Statistically undetectable backdoors in deep neural networks.
method Adversarial model trainer method to plant backdoors, showing invariance-based adversarial examples.
result Backdoors are statistically undetectable and enable generation of adversarial examples for every input.
Researchers analyze backdoor data poisoning attacks and identify a memorization capacity parameter.
problem Understanding and mitigating backdoor data poisoning attacks in machine learning models.
method Formal theoretical framework, statistical and computational analysis, explicit constructions, and algorithm design.
result Identified a memorization capacity parameter to assess vulnerability to backdoor attacks and developed algorithms to detect and mitigate them.
The study defines backdoor detection in ML and proves its infeasibility.
problem Backdoor detection in machine learning systems.
method Formal statistical definition and analysis of feasibility.
result Backdoor detection is impossible except for very small alphabet sizes.
New backdoor attacks in FL can fool models on rare inputs.
problem Federated Learning's vulnerability to adversarial backdoors.
method Introducing edge-case backdoor attacks and proving their effectiveness.
result Edge-case backdoors can fool FL models on rare inputs, posing a significant threat.
Backdoor attacks are found to be effective against robust machine learning models trained with PGD.
problem Injecting and defending against backdoor attacks in robust machine learning models.
method Study and detection of backdoor attacks on PGD-trained robust models using feature clustering.
result AEGIS effectively detects PGD-trained robust DNNs infected with backdoors with 91.6% accuracy.
New approach shows backdoor attacks are indistinguishable from natural data features.
problem Defending against backdoor attacks in machine learning models.
method Developed a new primitive for detecting backdoor attacks based on the assumption that they correspond to the strongest feature in the training data.
result Backdoor attacks are indistinguishable from natural data features, making traditional detection methods ineffective.
Study on detecting backdoor attacks using adversarial detection methods.
problem Mitigating backdoor attacks in deep neural networks.
method Comprehensive studies on adversarial and backdoor examples, revising adversarial defense methods.
result Adversarial defense methods can be effective in detecting backdoor attacks.
We inject undetectable backdoors into obfuscated neural networks and language models.
problem Safeguarding models from sophisticated adversarial attacks.
method Developed a strategy to plant undetectable backdoors in obfuscated neural networks and language models.
result Undetectable backdoors can be planted in obfuscated models, even if weights and architecture are accessible.
Backdoor attacks make models predict a specific class near triggers, smoothing their decision function.
problem Understanding and mitigating backdoor attacks on deep neural networks.
method Defined a measure to quantify backdoor smoothing and detected other smoothing patterns.
result Backdoor attacks induce a smoother decision function around triggered samples.
Detects backdoors in trained classifiers without access to training data.
problem Post-training detection of backdoor attacks in DNN image classifiers.
method Purely unsupervised anomaly detection (AD) approach.
result Detects whether a classifier has been backdoor-attacked and infers source and target classes.
New method defends against neural backdoors using generative modeling.
problem Neural backdoor attacks pose a significant security threat to deep learning models.
method Proposes max-entropy staircase approximator (MESA) for high-dimensional sampling-free generative modeling of backdoor trigger distributions.
result Demonstrates the effectiveness of MESA in modeling backdoor trigger distributions and robustness of the proposed defense method.
Paper bypasses backdoor detection algorithms in deep learning models.
problem Adversaries can embed backdoors in deep learning models, making them behave differently on specific inputs.
method Adversarial training algorithm that optimizes original loss function and maximizes hidden representation indistinguishability.
result The paper presents an adversarial backdoor embedding algorithm that can bypass existing detection algorithms.
New method estimates treatment effects from high dimensional data.
problem Estimating treatment effects from high dimensional data with confounders.
method Generative modeling approach to backdoor adjustment in variational inference.
result Empirically, estimates interventional likelihood in high dimensional settings.
Backdoor attacks are possible in feature-partitioned collaborative learning, even without labels.
problem Backdoor attacks in feature-partitioned collaborative learning.
method Demonstrated the feasibility of backdoor attacks and introduced defense techniques.
result Backdoor attacks can be blocked without significantly affecting main task accuracy.
Federated learning is vulnerable to backdoor attacks; a new defense method is proposed.
problem Backdoor attacks in federated learning that can misclassify models.
method Adjusting the learning rate based on sign information of agents' updates.
result Our defense significantly reduces or eliminates backdoor attacks in federated learning.
Noise analysis detects backdoors in DNNs quickly.
problem Detecting backdoors in DNNs trained on compromised data.
method Noise-infused image titration curves to quantify robustness and detect backdoors.
result DNNs with backdoors are more sensitive to noise and reveal their targets.
New spectral signatures help detect and remove backdoor attacks.
problem Backdoor attacks that evade typical detection.
method Identified spectral signatures and used robust statistics.
result Demonstrated effectiveness in removing poisoned examples.
This research tackles backdoor attacks on audio data using a stochastic investment approach.
problem The threat of backdoor attacks on audio data, especially in voice-activated systems.
method A Stochastic investment-based backdoor attack (MarketBack) approach.
result MarketBack can achieve an average attack success rate close to 100% with less than 1% of poisoned data.
Backdoor attacks can poison federated meta-learning models, even with few examples.
problem Backdoor attacks on federated meta-learning models.
method Proposed a defense mechanism inspired by matching networks.
result Backdoor attacks can be very successful and persist after additional training in federated meta-learning.
Paper detects backdoors in neural networks using activation clustering.
problem Inserting backdoors into neural networks trained on untrusted data.
method Activation clustering to identify poisoned data.
result Demonstrates effectiveness in text and image classification.
Paper defends models from backdoor attacks using randomized smoothing.
problem Vulnerability of deep neural networks to backdoor attacks.
method Unified framework via randomized smoothing for both evasion and backdoor attacks; RAB robust training process.
result First provable robustness bound for backdoor attacks.
Unified benchmarks assess data poisoning and backdoor attacks.
problem Unclear danger and effectiveness of data poisoning methods.
method Developed standardized benchmarks for data poisoning and backdoor attacks.
result Existing methods may not generalize to realistic settings.
Defense against DL-based lithographic hotspot detectors backdooring attacks reduces success rate from 84% to ~0%
problem DL-based lithographic hotspot detectors are vulnerable to backdoor attacks that can misclassify hotspots.
method Training data augmentation to eliminate intentional biases introduced during training.
result Significant reduction in attack success rate (from 84% to ~0%) using the proposed defense.
Develops a robust training framework to detect backdoor attacks in DNNs.
problem Vulnerability of DNNs to backdoor attacks by poisoned training data.
method Collider framework selects prominent samples based on geometric structures and coreset selection objective.
result Significantly reduces backdoor success rate in various poisoned datasets.
Algorithm removes backdoor watermarks from neural networks robustly.
problem Protecting neural networks from backdoor attacks.
method Neural network laundering algorithm.
result Effective removal of backdoor watermarks with high test accuracy.
Researchers develop stealthy backdoor injection attacks in deep learning models.
problem Creating invisible perturbations to trigger model recognition of specific patterns.
method Proposes two approaches for generating imperceptible backdoors in deep learning models.
result Demonstrates high attack success rates (above 90%) with minimal model accuracy loss (below 1%) and injection rate (around 1%).
Detects backdoors in outsourced models by replicating training steps across multiple servers.
problem Detecting backdoors in models trained on cloud providers without prior knowledge.
method Replicate training steps across multiple servers to identify deviations and malicious updates.
result 99.6% accuracy in identifying backdoored models out of 50% malicious providers.
Detects training data usage with radioactive data technique.
problem Detecting if a dataset was used to train a model.
method Radioactive data technique that makes imperceptible changes to detect training data usage.
result Can detect training data usage with high confidence (p<10^-4) even with small amounts of radioactive data.
BadGD identifies gradient descent vulnerabilities through strategic backdoor attacks.
problem Gradient descent vulnerabilities through malicious data manipulation.
method Introduces Max RiskWarp, Max GradWarp, and Max GradDistWarp triggers to exploit gradient descent.
result Demonstrates how malicious triggers can significantly alter loss landscapes and gradient calculations.
Adversarial weight perturbations can inject backdoors into trained neural models.
problem Security risk of using publicly available trained models due to backdoors.
method Extended adversarial perturbations to model weights, using a composite loss and projected gradient descent.
result Adversarial weight perturbations can be successfully injected with very small changes, exposing security risks across various tasks.
This paper studies backdoor attacks in federated learning and proposes defenses.
problem Detecting and defending against backdoor attacks in federated learning.
method Study of backdoor attacks and defenses on the EMNIST dataset, focusing on non-malicious clients.
result Norm clipping and weak differential privacy can mitigate backdoor attacks without significantly affecting overall performance.
Backdoor attacks on DRL-based traffic controllers cause stop-and-go waves or crashes.
problem Vulnerability of DRL-based traffic controllers to machine learning attacks.
method Developed a trigger design methodology based on traffic physics principles.
result Backdoored models can cause stop-and-go traffic waves or AV crashes when triggered.
New method tests causal association using noise contrastive backdoor adjustment.
problem Testing causal association in complex settings with many confounders.
method Backdoor-HSIC (bd-HSIC) using HSIC for independence testing.
result Calibrated and powerful for binary and continuous treatments with many confounders.
GTA is the first backdoor attack on GNNs, demonstrating vulnerabilities in graph-oriented security models.
problem Vulnerability of graph neural networks to backdoor attacks.
method Graph-oriented triggers, dynamic adaptation, model-agnostic, attack-extensible.
result Demonstrates severe threats to graph classification and node classification tasks.
New method identifies causal relationships in presence of hidden variables.
problem Identifying causal relationships when hidden variables exist.
method Established sufficient conditions and introduced a search algorithm.
result Proved soundness and completeness of the search algorithm.
Novel approach to compute hazard ratios from observational studies using SCMs and backdoor adjustment.
problem Identifying causal relationships from observational data using hazard ratios.
method Backdoor adjustment through structural causal models (SCMs) and do-calculus.
result Novel approach for computing hazard ratios from observational studies.
SPECTRE defends against backdoor attacks by amplifying corrupted data's spectral signature.
problem Backdoor attacks that change model behavior with specific triggers.
method Robust covariance estimation to amplify spectral signature of poisoned data.
result Clean model is completely removed from backdoor, even in hard-to-detect cases.
Two attacks reveal vulnerabilities in deep neural network watermarking schemes.
problem Protecting deep learning models from unauthorized redistribution.
method Proposed black-box and white-box attacks to remove backdoor-based watermarks.
result Watermarks can be removed with minimal effort and without sensitive model information.
Defense against backdoor attacks by clustering incompatible data subsets.
problem Backdoor poisoning attacks on deep neural networks.
method Incompatibility clustering of data subsets during training.
result Successfully reduces attack success rate to below 1%.
New attack targets speech-based AI models via stock market data.
problem Vulnerabilities in speech-based AI models using LLMs.
method Backdoor attack using acoustic data poisoning.
result Shows possible vulnerabilities in speech-based transformers.
A new attack method shows small changes can compromise distributed learning models.
problem Small but well-crafted changes can compromise distributed learning models.
method Demonstrates a novel non-omniscient attack on distributed learning.
result 20% of corrupt workers can degrade model accuracy by 50% and introduce backdoors.