Poison Ink: Robust and Invisible Backdoor Attack

Zhang, Jie; Chen, Dongdong; Liao, Jing; Huang, Qidong; Hua, Gang; Zhang, Weiming; Yu, Nenghai

doi:10.1109/tip.2022.3201472

Cited by 33 publications

(8 citation statements)

References 44 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This survey identifies purportedly 22 handcrafted and 25 optimized backdoor attacks with an implementation on a DNN found in a FRS (see Tables 1-3). Prior work addresses this problem with dynamic, patchbased backdoor attacks, as illustrated on a FR model by Salem et al [116] or the Poison Ink attack [84]. Dynamic triggers aim to enhance the stealthiness of a backdoor by confusing defenses that are designed to reconstruct a backdoor trigger (see Section V for trigger reconstruction defenses).…”

Section: ) Design: Handcrafted or Optimized Triggersmentioning

confidence: 99%

A Comprehensive Survey on Backdoor Attacks and Their Defenses in Face Recognition Systems

Roux,

Bourbao,

Teglia

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Deep learning has significantly transformed face recognition, enabling the deployment of large-scale, state-of-the-art solutions worldwide. However, the widespread adoption of deep neural networks (DNNs) and the rise of Machine Learning as a Service emphasize the need for secure DNNs. This paper revisits the face recognition threat model in the context of DNN ubiquity and the common practice of outsourcing their training and hosting to third-parties. Here, we identify backdoor attacks as a significant threat to modern DNN-based face recognition systems (FRS). Backdoor attacks involve an attacker manipulating a DNN's training or deployment, injecting it with a stealthy and malicious behavior. Once the DNN has entered its inference stage, the attacker may activate the backdoor and compromise the DNN's intended functionality. Given the critical nature of this threat to DNN-based FRS, our paper comprehensively surveys the literature of backdoor attacks and defenses previously demonstrated on FRS DNNs. As a last point, we highlight potential vulnerabilities and unexplored areas in FRS security.

show abstract

Section: ) Design: Handcrafted or Optimized Triggersmentioning

confidence: 99%

A Comprehensive Survey on Backdoor Attacks and Their Defenses in Face Recognition Systems

Roux,

Bourbao,

Teglia

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…In terms of the trigger generation function, g 1 could take the benign sample x 0 as one of the input arguments to generate sample-specific trigger. For example, Poison ink [229] extracted a black and white edge image from one benign image, then colorized the edge image with a particular color as the trigger. Since the edge image is specific for each benign image, the trigger is also sample-specific.…”

Section: Backdoor Attacks With Different Fusion Strategiesmentioning

confidence: 99%

Adversarial Machine Learning: A Systematic Survey of Backdoor Attack, Weight Attack and Adversarial Example

Liu¹,

Zhu²,

Liu³

et al. 2023

Preprint

View full text Add to dashboard Cite

Adversarial machine learning (AML) studies the adversarial phenomenon of machine learning, which may make inconsistent or unexpected predictions with humans. Some paradigms have been recently developed to explore this adversarial phenomenon occurring at different stages of a machine learning system, such as training-time adversarial attack (i.e., backdoor attack), deployment-time adversarial attack (i.e., weight attack), and inference-time adversarial attack (i.e., adversarial example). However, although these paradigms share a common goal, their developments are almost independent, and there is still no big picture of AML. In this work, we aim to provide a unified perspective to the AML community to systematically review the overall progress of this field. We firstly provide a general definition about AML, and then propose a unified mathematical framework to covering existing attack paradigms. According to the proposed unified framework, we can not only clearly figure out the connections and differences among these paradigms, but also systematically categorize and review existing works in each paradigm.

show abstract

“…This method achieves promising experimental results showing that it can bypass most existing backdoor defenses because its triggering pattern is sample specific. Zhang et al [41] proposed embedding trigger patterns in the edge structure of poisoned images, which belong to highfrequency components and are not easily destroyed in data preprocessing. This method is called Poison Ink.…”

Section: B Invisible Backdoor Attackmentioning

confidence: 99%

Backdoor Attacks to Deep Learning Models and Countermeasures: A Survey

Zhang

Wei-ping

et al. 2023

IEEE Open J. Comput. Soc.

View full text Add to dashboard Cite

Backdoor attacks have severely threatened deep neural network (DNN) models in the past several years. In backdoor attacks, the attackers try to plant hidden backdoors into DNN models, either in the training or inference stage, to mislead the output of the model when the input contains some specified triggers without affecting the prediction of normal inputs not containing the triggers. As a rapidly developing topic, numerous works on designing various backdoor attacks and developing techniques to defend against such attacks have been proposed in recent years. However, a comprehensive and holistic overview of backdoor attacks and countermeasures is still missing. In this paper, we provide a systematic overview of the design of backdoor attacks and the defense strategies to defend against backdoor attacks, covering the latest published works. We review representative backdoor attacks and defense strategies in both the computer vision domain and other domains, discuss their pros and cons, and make comparisons among them. We outline key challenges to be addressed and potential research directions in the future.

show abstract

Poison Ink: Robust and Invisible Backdoor Attack

Cited by 33 publications

References 44 publications

A Comprehensive Survey on Backdoor Attacks and Their Defenses in Face Recognition Systems

A Comprehensive Survey on Backdoor Attacks and Their Defenses in Face Recognition Systems

Adversarial Machine Learning: A Systematic Survey of Backdoor Attack, Weight Attack and Adversarial Example

Backdoor Attacks to Deep Learning Models and Countermeasures: A Survey

Contact Info

Product

Resources

About