Robust backdoor injection with the capability of resisting network transfer

Abstract

Deep neural networks have superior transferability between different tasks. However, attackers may inject a backdoor into the pre-trained network to indirectly inject the backdoor into the user’s new network which is transferred from the pre-trained network. The previous backdoor attack schemes cannot ensure that the backdoor in the pre-trained network will not be damaged during network transfer. To deal with this issue, we propose a universal robust backdoor attack scheme to injecting the backdoor into the feature maps of the pre-trained network. First, we show that abnormal values have favorable consistency and conductivity in the neural network. By using these properties, attackers can fine-tune the pre-trained network to create a path that can cause the feature maps of backdoor examples at the target layer to exhibit abnormal values. The backdoor injected with our scheme is robust and can cope with the following three challenging network transfer types: (a) the user fine-tunes all the layers. (b) the user retrains some layers of the network from scratch (c) the user adds the new layers for other categories of tasks. Finally, we experimentally verify that our scheme has a favorable attack success rate and is more robust than the state-of-the-art.