Backdoors hidden in facial features: a novel invisible backdoor attack against face recognition systems

Xue, Mingfu; He, Can; Wang, Jian; Liu, Weiqiang

doi:10.1007/s12083-020-01031-z

Cited by 20 publications

(22 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The invisible backdoor attack was introduced by Xue et al [13]. They embedded the backdoor attacks along with facial attributes and the method is known as Backdoor Hidden in Facial features (BHFF).…”

Section: Literature Surveymentioning

confidence: 99%

An Improved Optimized Model for Invisible Backdoor Attack Creation Using Steganography

Alghazzawi¹,

Rabie²,

Bhatia³

et al. 2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

The Deep Neural Networks (DNN) training process is widely affected by backdoor attacks. The backdoor attack is excellent at concealing its identity in the DNN by performing well on regular samples and displaying malicious behavior with data poisoning triggers. The state-of-art backdoor attacks mainly follow a certain assumption that the trigger is sample-agnostic and different poisoned samples use the same trigger. To overcome this problem, in this work we are creating a backdoor attack to check their strength to withstand complex defense strategies, and in order to achieve this objective, we are developing an improved Convolutional Neural Network (ICNN) model optimized using a Gradient-based Optimization (GBO)(ICNN-GBO) algorithm. In the ICNN-GBO model, we are injecting the triggers via a steganography and regularization technique. We are generating triggers using a single-pixel, irregular shape, and different sizes. The performance of the proposed methodology is evaluated using different performance metrics such as Attack success rate, stealthiness, pollution index, anomaly index, entropy index, and functionality. When the CNN-GBO model is trained with the poisoned dataset, it will map the malicious code to the target label. The proposed scheme's effectiveness is verified by the experiments conducted on both the benchmark datasets namely CIDAR-10 and MSCELEB 1M dataset. The results demonstrate that the proposed methodology offers significant defense against the conventional backdoor attack detection frameworks such as STRIP and Neutral cleanse.

show abstract

Section: Literature Surveymentioning

confidence: 99%

An Improved Optimized Model for Invisible Backdoor Attack Creation Using Steganography

Alghazzawi¹,

Rabie²,

Bhatia³

et al. 2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

show abstract

“…In a poisoned image, the patch should be unnoticeable to the human eye in order to avoid detection. Methods such as blending the patch into the image or hiding the patch within facial features have been used [8,26,49]. The patch will only be visible when the attacker decides to trigger the attack during testing, as shown in Figure 1.…”

Section: Backdoor Attacksmentioning

confidence: 99%

Resurrecting Trust in Facial Recognition: Mitigating Backdoor Attacks in Face Recognition to Prevent Potential Privacy Breaches

Zelenkova¹,

Swallow²,

Chamikara³

et al. 2022

Preprint

View full text Add to dashboard Cite

Biometric data, such as face images, are often associated with sensitive information (e.g medical, financial, personal government records). Hence, a data breach in a system storing such information can have devastating consequences. Deep learning is widely utilized for face recognition (FR); however, such models are vulnerable to backdoor attacks executed by malicious parties. Backdoor attacks cause a model to misclassify a particular class as a target class during recognition. This vulnerability can allow adversaries to gain access to highly sensitive data protected by biometric authentication measures or allow the malicious party to masquerade as an individual with higher system permissions. Such breaches pose a serious privacy threat. Previous methods integrate noise addition mechanisms into face recognition models to mitigate this issue and improve the robustness of classification against backdoor attacks. However, this can drastically affect model accuracy. We propose a novel and generalizable approach (named BA-BAM: Biometric Authentication -Backdoor Attack Mitigation), that aims to prevent backdoor attacks on face authentication deep learning models through transfer learning and selective image perturbation. The empirical evidence shows that BA-BAM is highly robust and incurs a maximal accuracy drop of 2.4%, while reducing the attack success rate to a maximum of 20%. Comparisons with existing approaches show that BA-BAM provides a more practical backdoor mitigation approach for face recognition.

show abstract

“…A summary of triggers for each attack is provided in Table 5 on Page 12. Huai et al [42] x x x Xue et al [30] x x x Xue et al [30] x x x Liu et al [43] x Hu et al [44] x x Lin et al [45] x x x Dai et al [46] x Zhao et al [47] x Liu et al [48] x Chen et al [49] x Tan et al [50] x x Tang et al [51] x Wu et al [52] x x Barni et al [53] x Xiong et al [54] x Kwon et al [55] x Chen et al [56] x x Chen et al [57] x x He et al [31] x x x Xue et al [58] x x x Yao et al [59] x x Quiring et al [60] x Bhalerao et al [61] x x x Costales et al [62] x x Kwon et al [63] x Liu et al [64] x x Rakin et al [65] x Liu et al [66] x x Zhou et al [67] x Zhu et al [68] x Gu et al [69] x Guo et al [70] x x x x Clements et al [71] x x Munoz et al [72] x x Li et al [73] x Li et al [74] x Xu et al [75] x x Venceslai et al [76] x Kwon et al [77] x Cole et al [78] x x x x Zeng et al [79] x x Pan [80] x x Garofalo et al…”

Section: Triggersmentioning

confidence: 99%

An Ontological Knowledge Base of Poisoning Attacks on Deep Neural Networks

Altoub¹,

Alqurashi²,

Yiğitcanlar³

et al. 2022

Preprint

View full text Add to dashboard Cite

Deep neural networks (DNN) have successfully delivered a cutting-edge performance in several fields. With the broader deployment of DNN models on critical applications, the security of DNNs becomes an active and yet nascent area. Attacks against DNNs can have catastrophic results, according to recent studies. Poisoning attacks, including backdoor and Trojan attacks, are one of the growing threats against DNNs. Having a wide-angle view of these evolving threats is essential to better understand the security issues. In this regard, creating a semantic model and a knowledge graph for poisoning attacks can reveal the relationships between attacks across intricate data to enhance the security knowledge landscape. In this paper, we propose a DNN Poisoning Attacks Ontology (DNNPAO) that would enhance knowledge sharing and enable further advancements in the field. To do so, we have performed a systematic review of the relevant literature to identify the current state. We collected 28,469 papers from IEEE, ScienceDirect, Web of Science, and Scopus databases, and from these papers, 712 research papers were screened in a rigorous process, and 55 poisoning attacks in DNNs were identified and classified. We extracted a taxonomy of the poisoning attacks as a scheme to develop DNNPAO. Subsequently, we used DNNPAO as a framework to create a knowledge base. Our findings open new lines of research within the field of AI security.

show abstract

Backdoors hidden in facial features: a novel invisible backdoor attack against face recognition systems

Cited by 20 publications

References 23 publications

An Improved Optimized Model for Invisible Backdoor Attack Creation Using Steganography

An Improved Optimized Model for Invisible Backdoor Attack Creation Using Steganography

Resurrecting Trust in Facial Recognition: Mitigating Backdoor Attacks in Face Recognition to Prevent Potential Privacy Breaches

An Ontological Knowledge Base of Poisoning Attacks on Deep Neural Networks

Contact Info

Product

Resources

About