Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks

Liu, Yunfei; Ma, Xingjun; Bailey, James E.; Lu, Feng

doi:10.1007/978-3-030-58607-2_11

Cited by 241 publications

(228 citation statements)

References 36 publications

Supporting

Mentioning

227

Contrasting

Order By: Relevance

“…However, the drawbacks of the approaches in [34], [35] are that the triggers are still apparent for humans and can be detected by then visual detection. [22] proposed a novel attack approach Refool that used physical reflection properties to implant backdoors. The adversary will choose some images from candidate images subsets, and these images are inserted into the target images as the triggers through the reflection algorithms in [22].…”

Section: A Attackmentioning

confidence: 99%

“…[22] proposed a novel attack approach Refool that used physical reflection properties to implant backdoors. The adversary will choose some images from candidate images subsets, and these images are inserted into the target images as the triggers through the reflection algorithms in [22]. [23] proposed attack approach WaNet that using a small and smooth warping field to generate poisoned examples.…”

Section: A Attackmentioning

confidence: 99%

“…How to make the design of the trigger more invisible? Comparing with local triggers( [9], [28]), global triggers( [22], [23]) more stealthy and unnoticeable. The triggers of [22], [23] are global and show the powerful attack capability and stealthiness(Fig.…”

Section: Procedural Noise Attack a Attack Motivationmentioning

confidence: 99%

“…For the CelebA dataset, there exist 40 attributions, and we choose three attributions of them and split the CelebA dataset into eight classes to do multi-class classification. For ImageNet12, we choose 12 classes from the total ImageNet dataset following the experiments settings in [22].…”

Section: Experiments a Experiments Setupmentioning

confidence: 99%

“…As we can see from Fig. 1, the triggers of BadNets( [9]), Blended( [20]), SIG( [21]), Refool( [22]) are too apparent for the manual detection. Therefore, designing a more stealthy attack algorithm is full of necessary.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Use Procedural Noise to Achieve Backdoor Attack

Chen

2021

IEEE Access

View full text Add to dashboard Cite

In recent years, more researchers pay their attention to the security of artificial intelligence. The backdoor attack is one of the threats and has a powerful, stealthy attack ability. There exist a growing trend towards the triggers is that the triggers become dynamic and global. In this paper, we propose a novel global backdoor trigger generated by procedural noise. Our backdoor triggers are much stealthy and straightforward to implement compared with most triggers. There are three types of procedural noise, and we evaluate the attack ability for the triggers with them on the different classification datasets, including CIFAR-10, GTSRB, CelebA, and ImageNet12.The experiment results show that our attack approach can bypass most defense approaches, even for the inspections of humans. We only need poison 5%-10% training data, and the attack success rate(ASR) can reach over 99%. To test the robustness of the backdoor model against the corruption methods that in practice, we introduce 17 corruption methods and compute the accuracy, attack success rate(ASR) of the backdoor model. The facts show that the backdoor models generated by our approaches have strong robustness for the most corruption methods and can be applied in reality.

show abstract

Section: A Attackmentioning

confidence: 99%

Section: A Attackmentioning

confidence: 99%

Section: Procedural Noise Attack a Attack Motivationmentioning

confidence: 99%

Section: Experiments a Experiments Setupmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Use Procedural Noise to Achieve Backdoor Attack

Chen

2021

IEEE Access

View full text Add to dashboard Cite

show abstract

Why is Your Trojan NOT Responding? A Quantitative Analysis of Failures in Backdoor Attacks of Neural Networks

Lan

Gao

et al. 2022

Algorithms and Architectures for Parallel Processing

View full text Add to dashboard Cite

Verifying Neural Networks Against Backdoor Attacks

Pham

Sun

2022

Computer Aided Verification

View full text Add to dashboard Cite

Neural networks have achieved state-of-the-art performance in solving many problems, including many applications in safety/security-critical systems. Researchers also discovered multiple security issues associated with neural networks. One of them is backdoor attacks, i.e., a neural network may be embedded with a backdoor such that a target output is almost always generated in the presence of a trigger. Existing defense approaches mostly focus on detecting whether a neural network is ‘backdoored’ based on heuristics, e.g., activation patterns. To the best of our knowledge, the only line of work which certifies the absence of backdoor is based on randomized smoothing, which is known to significantly reduce neural network performance. In this work, we propose an approach to verify whether a given neural network is free of backdoor with a certain level of success rate. Our approach integrates statistical sampling as well as abstract interpretation. The experiment results show that our approach effectively verifies the absence of backdoor or generates backdoor triggers.

show abstract

Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks

Cited by 241 publications

References 36 publications

Use Procedural Noise to Achieve Backdoor Attack

Use Procedural Noise to Achieve Backdoor Attack

Why is Your Trojan NOT Responding? A Quantitative Analysis of Failures in Backdoor Attacks of Neural Networks

Verifying Neural Networks Against Backdoor Attacks

Contact Info

Product

Resources

About