Backdoor Attacks Research Articles

Precision strike: Precise backdoor attack with dynamic trigger

Deep neural networks have advanced significantly in the last several years and are now widely employed in numerous significant real-world applications. However, recent research has shown that deep neural networks are vulnerable to backdoor attacks. Under such attacks, attackers release backdoor models that achieve satisfactory performance on benign samples while behaving abnormally on inputs with predefined triggers. Successful backdoor attacks can have serious consequences, such as attackers using backdoor generation methods to bypass critical face recognition authentication systems. In this paper, we propose PBADT, a precise backdoor attack with dynamic trigger. Unlike existing work that uses static or random trigger masks, we design an interpretable trigger mask generation framework that places triggers at positions that have the most significant impact on the prediction results. Meanwhile, backdoor attacks are made more efficient by using forgettable events to improve the efficiency of backdoor attacks. The proposed backdoor method is extensively evaluated on three face recognition datasets, LFW, CelebA, and VGGFace, while further evaluated on two general image datasets, CIFAR-10 and GTSRB. Our approach achieves almost perfect attack performance on backdoor data.

Mixed training backdoor attack method improves generalization of backdoor attacks: An empirical study based on multiple models and datasets

In recent years, backdoor attacks have posed significant security threats to the training process of deep neural networks (DNNs). Attackers attempt to embed triggers in the training set, causing the victim model to behave normally when processing benign samples, but maliciously alter predictions when the hidden backdoor is activated by these triggers. However, our research found that when the trigger locations differ between the training and test data, the success rate of backdoor attacks decreases. This finding was consistent across different models and datasets through our experiments. To address the issue of decreased attack success rates caused by inconsistent trigger distributions between training and test data, we propose a mixed training backdoor attack method. This method enhances the generalization of attacks by constructing backdoor attack data with triggers in various positions during the training phase. When applying this mixed training backdoor attack approach to the BadNets and Blended attack methods, the ASR (Attack Success Rate) on test sets improved by up to 99.57% and 94.96%, respectively, across different models and datasets.

Harnessing Dynamic Heterogeneous Redundancy to Empower Deep Learning Safety and Security

The rapid development of deep learning (DL) models has been accompanied by various safety and security challenges, such as adversarial attacks and backdoor attacks. By analyzing the current literature on attacks and defenses in DL, we find that the ongoing adaptation between attack and defense makes it impossible to completely resolve these issues. In this paper, we propose that this situation is caused by the inherent flaws of DL models, namely non-interpretability, non-recognizability, and non-identifiability. We refer to these issues as the Endogenous Safety and Security (ESS) problems. To mitigate the ESS problems in DL, we propose using the Dynamic Heterogeneous Redundant (DHR) architecture. We believe that introducing diversity is crucial for resolving the ESS problems. To validate the effectiveness of this approach, we conduct various case studies across multiple application domains of DL. Our experimental results confirm that constructing DL systems based on the DHR architecture is more effective than existing DL defense strategies.

ANODYNE: Mitigating backdoor attacks in federated learning

Federated learning (FL) allows participants to jointly train a model without leaking their sensitive datasets. The server is designed to have no visibility into how these updates are generated for privacy protection. Despite its benefits, FL is vulnerable to backdoor attacks, in which the compromised participants upload malicious model updates so that the backdoored model will misbehave for the chosen subtask. Existing defenses against backdoor attacks cannot handle state-of-the-art backdoor attacks that insert the backdoor in all rounds. To address these issues, we propose ANODYNE, a defense framework that hierarchically filters and clips the local model updates to mitigate the effect of backdoor attacks. ANODYNE decomposes the high-dimensional gradients into low-dimensional sub-vectors to improve detection performance and avoid the curse of dimensionality. Meanwhile, ANODYNE computes four different sub-vector metrics from a spatial–temporal perspective to enhance the robustness of our method. Our evaluation of ANODYNE on three datasets and three models demonstrates that ANODYNE competes over existing defenses under backdoor attacks.

Efficient and Secure Federated Learning Against Backdoor Attacks

Efficient and Secure Federated Learning Against Backdoor Attacks

BadCleaner: Defending Backdoor Attacks in Federated Learning via Attention-Based Multi-Teacher Distillation

BadCleaner: Defending Backdoor Attacks in Federated Learning via Attention-Based Multi-Teacher Distillation

Towards robust neural networks: Exploring counterfactual causality-based repair

Despite the widespread applications of neural networks, increasing concerns arise regarding their reliability and security. This paper introduces a novel repair approach integrating counterfactual causality with a multi-objective algorithm to mitigate critical security property issues, including backdoor attacks, safety violations, and unfairness. Firstly, we abstract the neural network into a counterfactual structure causal model, utilizing a causal trace to allocate contributions to each hidden layer neuron for output prediction. Secondly, ”faulty” neurons are identified through fault location, utilizing counterfactual causality between positive and negative example-guided attributes and neuronal contribution. Finally, an ablation study determines the number of neurons for repair. The multi-objective algorithm NSGA-III is then applied to optimize the faulty neurons, adjusting weight parameters to rectify erroneous behavior and eliminate vulnerabilities while maximizing the model’s accuracy. This method achieves notable Pareto optimization and effectively eliminates vulnerabilities in neural networks. In comparative experiments against CARE (CAusality-based REpair) techniques, our Counterfactual Causality-Based Repair (CCBR) method significantly reduces backdoor attack success rates and security violations to less than 1%, while maintaining model accuracy and ensuring security for normal inputs. In fairness repair tasks, CCBR improves fairness by 92.56%, a substantial 19.56% increase over CARE. These results affirm the robustness and practicality of CCBR, establishing it as a valuable tool for enhancing neural network safety and fairness.

BR-FEEL: A backdoor resilient approach for federated edge learning with fragment-sharing

In the resource-constrained federated edge learning (FEEL) systems, fragment-sharing is an efficient approach for multiple clients to cooperatively train a giant model with billions of parameters. Compared with the classical federated learning schemes where the local model is fully trained and exchanged by each client, the fragment-sharing only requires each client to optionally choose a parameter-fragment to train and share, according to its storage, computing, and networking abilities. However, when the full model is no longer delivered in fragment-sharing, the backdoor attacks hidden behind the fragments become harder to be detected, which introduces formidable challenge for the security of FEEL systems. In this paper, we firstly show that the existing fragment-sharing works suffer a lot from the backdoor attacks. Then, a Backdoor-Resilient approach, named BR-FEEL, is introduced to defend against the potential backdoor attacks. Specifically, a twin model is built by each benign client to integrate the parameter-fragments from others. A knowledge distillation process is designed on each client to transfer the clean knowledge from its twin model to local model. With the twin model and knowledge distillation process, our BR-FEEL approach makes sure that the local models of the benign clients will not be backdoored. Experiments on CIFAR-10 and GTSRB datasets with MobileNetV2 and ResNet-34 are conducted. The numerical results demonstrate the efficacy of BR-FEEL on reducing attack success rates by over 90% compared to other baselines under various attack methods.

Like teacher, like pupil: Transferring backdoors via feature-based knowledge distillation

With the widespread adoption of edge computing, compressing deep neural networks (DNNs) via knowledge distillation (KD) has emerged as a popular technique for resource-limited scenarios. Among various KD methods, feature-based KD, which leverages the feature representations from intermediate layers of the teacher model to supervise the training of the student model, has shown superior performance and enjoyed wide application. However, users often overlook potential backdoor threats when using knowledge distillation (KD) to extract knowledge. To address the issue, this paper mainly contributes to three aspects: (1) we try the first step of exploring the security risks in feature-based KD, where implanted backdoors in teacher models can survive and transfer to student models. (2) We propose a backdoor attack method targeting feature distillation, achieved by encoding backdoor knowledge into specific neuron activation layers. Specifically, we optimize triggers to induce consistent feature map values in the teacher model and transfer the backdoor knowledge to student models through these features. We also design an adaptive defense method against this attack. (3) Extensive experiments on four common datasets and six sets of different teacher and student models validate that our attack outperforms the state-of-the-art (SOTA) baselines, with an average attack success rate of (∼×1.5). Additionally, we discuss effective defense methods against such backdoor attacks.

Backdoor attacks on unsupervised graph representation learning

Unsupervised graph learning techniques have garnered increasing interest among researchers. These methods employ the technique of maximizing mutual information to generate representations of nodes and graphs. We show that these methods are susceptible to backdoor attacks, wherein the adversary can poison a small portion of unlabeled graph data (e.g., node features and graph structure) by introducing triggers into the graph. This tampering disrupts the representations and increases the risk to various downstream applications. Previous backdoor attacks in supervised learning primarily operate directly on the label space and may not be suitable for unlabeled graph data. To tackle this challenge, we introduce GRBA,11https://github.com/fbd3/GRBA.git. a gradient-based first-order backdoor attack method. To the best of our knowledge, this constitutes a pioneering endeavor in investigating backdoor attacks within the domain of unsupervised graph learning. The initiation of this method doesn’t necessitate prior knowledge of downstream tasks, as it directly focuses on representations. Furthermore, it is versatile and can be applied to various downstream tasks, including node classification, node clustering and graph classification. We evaluate GRBA on state-of-the-art unsupervised learning models, and the experimental results substantiate the effectiveness and evasiveness of GRBA in both node-level and graph-level tasks.

A Clean-Label Graph Backdoor Attack Method in Node Classification Task

Backdoor attacks in the traditional graph neural networks (GNNs) field are easily detectable due to the dilemma of confusing labels. To explore the backdoor vulnerability of GNNs and create a more stealthy backdoor attack method, a clean-label graph backdoor attack method(CGBA) in the node classification task is proposed in this paper. Differently from existing backdoor attack methods, CGBA requires neither modification of node labels nor graph structure. Specifically, to solve the problem of inconsistency between the contents and labels of the samples, CGBA selects poisoning samples in a specific target class and uses the samples’ own label as the target label (i.e., clean-label) after injecting triggers into the target samples. To guarantee the similarity of neighboring nodes, the raw features of the nodes are elaborately picked as triggers to further improve the concealment of the triggers. Extensive experiments results show the effectiveness of our method. When the poisoning rate is 0.04, CGBA can achieve an average attack success rate of 87.8%, 98.9%, 89.1%, and 98.5%, respectively.

FedNor: A robust training framework for federated learning based on normal aggregation

Addressing data security and data silo issues in Edge Intelligence, this paper proposes a Byzantine-resilient framework (FedNor) for Federated Learning (FL). FedNor integrates robust statistical methods with personalized FL strategies to enhance resilience against malicious updates while maintaining model generalization capabilities. The framework comprises two key components: the Robust Normal Aggregation (RN) module and the Personalized Fusion (PF) module. The RN module employs normality tests to identify and rectify anomalous updates, thereby ensuring the integrity and quality of model updates. Concurrently, the PF module incorporates data distribution considerations when integrating global and local models to optimize model security and accuracy. Experimental results demonstrate FedNor's effectiveness in mitigating eight distinct poisoning attacks on the MNIST datasets, with minimal accuracy degradation ranging from 0.42% to 1.96%. Furthermore, FedNor limits the backdoor attack success rate on the CIFAR-10 datasets to below 20%, while maintaining accuracy comparable to personalized FL schemes.

Analyzing Threat Level of the Backdoor Attack Method for an Organization’s Operation

Backdoor attacks played a critical part in the catastrophe, as well as the overall impact of cyberattacks. Backdoor assaults are additionally influencing the landscape of malware and threats, forcing companies to concentrate more on detecting and establishing vulnerability tactics in order to avoid hostile backdoor threats. Despite advances in cybersecurity systems, backdoor assaults remain a source of concern because of their propensity to remain undetected long after the attack vector has been started. This research is aimed to examine the threats of backdoor attack methods in an organization's operational network, provide a full-scale review, and serve as direction for training and defensive measures. The fundamental inspiration was drawn from the alarming and involving threat in cybersecurity, which necessitates a better awareness of the level of risk and the concurrent requirement for increased security measures. Most traditional security solutions usually fail to detect harmful backdoors due to the stealthy nature of backdoor code within the system, necessitating a unique approach to full-scale threat analysis. A multi-phase approach that begins with considerable reading and examination of existing literature to get insight into typical backdoor attack methodologies and application methods. Following analysis, testing was carried out in a virtual lab in a controlled environment because thorough malware analysis testing must adhere to ethical and legal cyber testing laws to avoid any penalties or foolish breaches. This methodology also included testing on numerous attack channels combined with backdoor attacks, such as detecting software vulnerabilities, phishing emails, and direct payload injection, to determine the complexity of the different attack vectors. Each of the collected data is utilized to create a threat model that predicts the amount of risk associated with the backdoor attack approach. The finding contributes to the development of more resilient defence mechanisms, while also strengthening the overall organization's security architecture and protocols.

CBAs: Character-level Backdoor Attacks against Chinese Pre-trained Language Models

CBAs: Character-level Backdoor Attacks against Chinese Pre-trained Language Models

A semantic backdoor attack against graph convolutional networks

Graph convolutional networks (GCNs) have been very effective in addressing the issue of various graph-structured related tasks, such as node classification and graph classification. However, recent research has shown that GCNs are vulnerable to a new type of threat called a backdoor attack, where the adversary can inject a hidden backdoor into GCNs so that the attacked model performs well on benign samples, but its prediction will be maliciously changed to the attacker-specified target class if the hidden backdoor is activated by the attacker-defined trigger. A semantic backdoor attack is a new type of backdoor attack on deep neural networks (DNNs), where a naturally occurring semantic feature of samples can serve as a backdoor trigger such that the infected DNNs models will misclassify testing samples containing the predefined semantic feature even without the requirement of modifying the testing samples. Since the backdoor trigger is a naturally occurring semantic feature of the samples, semantic backdoor attacks are more imperceptible and pose a new and serious threat. Existing research on semantic backdoor attacks focuses on the tasks of CNNs-based (Convolutional Neural Networks) image classification and LSTM-based (Long Short-Term Memory) text classification or word prediction. Little attention has been given to semantic backdoor attacks on GCNs models.In this paper, we investigate whether such semantic backdoor attacks are possible for GCNs and propose a semantic backdoor attack against GCNs (SBAG) under the context of graph classification to reveal the existence of this security vulnerability in GCNs. SBAG uses a certain type of nodes in the samples as a backdoor trigger and injects a hidden backdoor into GCNs models by poisoning training data. The backdoor will be activated, and the GCNs models will give malicious classification results specified by the attacker even on unmodified samples as long as the samples contain enough trigger nodes. We evaluate SBAG on five graph datasets. The experimental results indicate that SBAG can achieve attack success rates of approximately 99.9% on unmodified testing samples that naturally contain the trigger and attack success rates over 82% on testing samples modified to inject the trigger, respectively, both under poisoning rates of less than 5%. 11Our code is available at: github.

Towards robustness evaluation of backdoor defense on quantized deep learning models

Backdoor attacks on deep learning (DL) models emerge as the most worrisome security threats to their secure and safe usage, especially for security-sensitive tasks. Great efforts have been devoted to thwarting backdoor attacks by devising detection or prevention countermeasures. By default, these countermeasures are designed and evaluated on models with full-precision parameters (e.g., floating32). It is unclear whether they are immediately applicable to mitigate backdoor attacks in the quantized model that are being pervasively deployed on mobile devices and Internet of Things (IoT) devices to save resources (i.e. power and memory) and reduce latency and privacy risks.This work, for the first time, initializes the critical examination of the robustness or applicability of existing state-of-the-art (SOTA) DL backdoor defenses for detecting or preventing backdoor attacks on quantized models. Based on extensive evaluations of four representative defenses (Neural Cleanse, ABS, Fine-Pruning and Trojan Signature) with three datasets (CIFAR10, GTSRB, and STL10), we found that only Neural Cleanse’s defensive robustness is generally independent of model quantization, while all others exhibit degraded effectiveness or failures against quantized models (in particular, widely used int-8 and 1-bit models), especially when the model is quantized to be 1-bit. The identified main failure reason is that these defenses are based on examining the weight values of the model or the activation values of the neuron to identify or prevent the backdoor, often using the ranking as a step. Quantization with a small bit width leads to less fine-grained discrete values (e.g., 1-bit quantization only possesses two value elements of -1 and +1), rendering ranking effectiveness deteriorate in this case. Note that the quantization not only applies to the weight but also to activation, thus making these defenses less robust or trivially fail. This work highlights the demand for devising backdoor defenses that are generic to different quantization formats on top of the default full-precision model.

KerbNet: A QoE-Aware Kernel-Based Backdoor Attack Framework

Deep neural networks are vulnerable to backdoor attacks, where a specially-designed trigger will lead to misclassification of any benign samples. However, existing backdoor attacks usually impose conspicuous patch triggers on images, which are easily detected by humans and defense algorithms. Existing works on invisible triggers, however, either have reduced attack success rate or yield detectable patterns to visual inspections. In this paper, we propose <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">KerbNet</small> , a kernel-based backdoor attack framework, which applies kernel operations to clean samples as the trigger to incur misclassification. The kernel-processed samples achieve a high attack success rate while appearing natural with high Quality-of-Experience (QoE). We carefully design the kernel trigger generation algorithm by exploiting the neural network structure to propagate the influence of the trigger to the target misclassification label under the QoE constraint. We conduct extensive experiments on five datasets, i.e., MNIST, GTSRB, CIFAR-10, CelebA, and ImageNette to evaluate the effectiveness and practicality of <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">KerbNet</small> under the impact of various factors, including neuron-residing layer, kernel size, base image, loss function, model structure, and so on. We also show that our proposed attacks can evade state-of-the-art defense strategies and visual inspections. Code will be available after publication.

BAD-FM: Backdoor Attacks Against Factorization-Machine Based Neural Network for Tabular Data Prediction

BAD-FM: Backdoor Attacks Against Factorization-Machine Based Neural Network for Tabular Data Prediction

A Subspace Projective Clustering Approach for Backdoor Attack Detection and Mitigation in Deep Neural Networks

A Subspace Projective Clustering Approach for Backdoor Attack Detection and Mitigation in Deep Neural Networks

Optimally Mitigating Backdoor Attacks in Federated Learning

Optimally Mitigating Backdoor Attacks in Federated Learning