Black-box backdoor attack with everyday physical objects in mobile crowdsourcing

Abstract

Listen

Translate article

Mobile crowdsourcing (MCS) has emerged as a promising sensing paradigm in smart cities as it reduces the need of expensive static infrastructure and facilitates efficient data collection with many volunteers. However, malicious users may contribute tampered data deliberately, compromising the model trained with them. Prior neural adversarial attacks usually rely on several major assumptions, such as requiring expert knowledge of models, manipulating the training process, or generating specific patterns for poisoning, which are not always feasible for novice volunteers.In this paper, we identify an attack paradigm that can be easily executed without prior knowledge or extra manipulation of training. As an example, we conduct a crowdsourcing task for visual landmark classification and realize attacks with everyday objects (e.g., a cola cup). Extensive experimental results show that our approach achieves high attack success rates (over 90%) with marginal poisoning rates (less than 10%). To safeguard the trained model, we propose a defense framework that harnesses the tamper resistance between multi-modal sensors to erase the infectious model, termed MUSE. Besides visual landmark identification, we also apply MUSE to two multi-modal localization tasks. Experimental results show that MUSE substantially reduces attack success rate to less than 1%.