Trigger Pattern Research Articles

Universal backdoor attack on deep neural networks for malware detection

Backdoor attacks targeting the deep neural network are flourishing recently and are more stealthy than existing adversarial attacks. A deep understanding of the backdoor attacks targeting malware detection models is still missing. We design a highly transferable backdoor attack targeting three benchmark convolutional neural networks (CNNs) for malware detection. The designed backdoor attack involves two steps: trigger generation and trigger insertion. Firstly, based on the computation of the most significant byte sub-sequence from samples of a chosen target label, the trigger patterns are generated by training a class activation mapping-based deep neural network (CAM-DNN). Then, the byte sequence with the maximum class activation mapping score is chosen as the candidate trigger pattern. The computed trigger pattern is then inserted into an index-based place that satisfies the minimum distance between a predefined feature space to the target label. Through detailed experiments, the CAM-DNN-based backdoor considers many influential factors, including the number of backdoor triggers, the degree of perturbations applied on a single trigger pattern, the length of the inserted trigger, etc. The experiments demonstrate that the CAM-DNN-based backdoor attack achieves an 89.58% success rate on average at the cost of a 2.25% accuracy drop on clean inputs. More importantly, the poisoned malware ensures high integrity because the original malicious functions are preserved to a large extent.

Automated Segmentation to Make Hidden Trigger Backdoor Attacks Robust against Deep Neural Networks

The successful outcomes of deep learning (DL) algorithms in diverse fields have prompted researchers to consider backdoor attacks on DL models to defend them in practical applications. Adversarial examples could deceive a safety-critical system, which could lead to hazardous situations. To cope with this, we suggested a segmentation technique that makes hidden trigger backdoor attacks more robust. The tiny trigger patterns are conventionally established by a series of parameters encompassing their DNN size, location, color, shape, and other defining attributes. From the original triggers, alternate triggers are generated to control the backdoor patterns by a third party in addition to their original designer, which can produce a higher success rate than the original triggers. However, the significant downside of these approaches is the lack of automation in the scene segmentation phase, which results in the poor optimization of the threat model. We developed a novel technique that automatically generates alternate triggers to increase the effectiveness of triggers. Image denoising is performed for this purpose, followed by scene segmentation techniques to make the poisoned classifier more robust. The experimental results demonstrated that our proposed technique achieved 99% to 100% accuracy and helped reduce the vulnerabilities of DL models by exposing their loopholes.

A lightweight backdoor defense framework based on image inpainting

Deep neural networks (DNNs) have been shown to be vulnerable to backdoor attacks during training. Most of the existing backdoor defense methods are designed for specific types of backdoor attacks, and the work of detecting backdoors and mitigating backdoors is mostly separate. Currently, few general and complete defense frameworks have been developed. In this paper, we propose a lightweight, general, and complete defense framework against three main types of backdoor attacks. It can efficiently detect poisoned images and remove trigger patterns on poisoned images without costly retraining of the backdoor model. First, we use the feature difference between clean samples and poisoned samples in the middle layer of the model to distinguish them. Then, we remove the backdoor using image inpainting algorithm to remove the backdoor triggering pattern on the poisoned samples. We deploy three of the most popular backdoor attacks on three datasets to test the effectiveness of our defenses. Extensive experimental results show that our method can effectively defend against various backdoor attacks with a relatively small cost. In particular, we reduce the attack success rate of the more stealthy clean-label poisoning attack from 94.9% to 0.02% with little impact on the classification accuracy of the inpainted images.

Detecting backdoor in deep neural networks via intentional adversarial perturbations

Recent researches show that deep learning model is susceptible to backdoor attacks. Many defenses against backdoor attacks have been proposed. However, existing defense works require high computational overhead or backdoor attack information such as the trigger size. In this paper, we propose a novel backdoor detection method based on intentional adversarial perturbations. The proposed method leverages intentional adversarial perturbation to detect whether an image contains a trigger, which can be applied in both the training stage and the inference stage (sanitize the training set in training stage or detect the backdoor instances in inference stage). Specifically, given an untrusted image, the adversarial perturbation is added to the image intentionally. If the prediction of the model on the perturbed image is consistent with that on the unperturbed image, the input image will be considered as a backdoor instance. Compared with most existing defense works, the proposed method is faster and introduces less computational overhead during backdoor detection process. Moreover, the proposed method maintains the visual quality of the image (as the ℓ2 norm of the added perturbation is as low as 2.8715, 3.0513 and 2.4362 on Fashion-MNIST, CIFAR-10 and GTSRB datasets, respectively). Experimental results show that, for general backdoor attack, the backdoor detection rate of the proposed defense method is 99.63%, 99.76% and 99.91% on Fashion-MNIST, CIFAR-10 and GTSRB datasets, respectively. For invisible backdoor attack, the backdoor detection rate of the proposed defense method is 99.75% against blended backdoor attack and 98.00% against sample-specific backdoor attack. It is also demonstrated that the proposed method can achieve high defense performance against backdoor attacks under different attack settings (trigger transparency, trigger size and trigger pattern). In addition, the experimental comparison with related work demonstrates that the proposed method has better detection performance and higher detection efficiency.

Bioinformatic System for Classification of Patient Response to Traditional and Modern Medicine Therapy in Niger Delta Region: A Machine Learning Approach

The potential for Traditional Medicine (TM) to enhance human health and wellbeing is enormous. This facet of healthcare services is crucial. For mutual benefit, the systems of traditional medicine and western (modern) medicine must be combined. The main goal of merging biomedicals and healthcare information within the setting of primary health care services is to provide spaces for technology interchange in medical practice for data and knowledge-based development. As a result, a database for diseases and their likely causes, trigger patterns, and prospective treatments and cures will be created, facilitating faster access to healthcare and resulting in a more dependable and effective healthcare system. The integration of health data, information, and expertise is known as bioinformatics. Data is all about a particular patient history, such as symptoms, diagnoses, treatments, and results, are referred to as health information. In fact, practitioners of biomedical informatics put a lot of effort into spotting patterns in the data generated by bioinformatics in order to assess patients' health problems and develop effective healthcare procedures. Hence, it is crucial that the current healthcare system incorporate health bioinformatics. Traditional medicine (TM) needs solid, scientific evidence to support its effectiveness, it is significant to access perceptions and promotes the integration of both Traditional Medicine Practitioners (TMP) and Modern Medical Practitioners (MMP) in the society. Basically, this research paper adopts a quantitative research method through survey Questionnaire for perceptions and adoption of both TMPs and MMPs among practitioners in Akwa Ibom State, Nigeria. Correlation analysis was carried out on selected demographics variables using Spearman Correlation coefficient to test the information gathered about how traditional medicine and modern medicine interaction (drugs administration) in treatment of certain diseases. The research findings demonstrate that, the <i>Spearman coefficient</i> algorithm gave a 0.5% which indicating an average relationship which entails a requirement for further integration. Moreover, Machine Learning (ML) approach was adopted, the Linear Regression (LR) model was used to access the linear relationship existing within the number of visits (response) of patients on the four sickness that was identified in the statistical data obtained in order to do a comparison analysis of treatment length of time (tlot) based on weekly basis -Seven (7) days visits. The model enable prediction on future duration length of time of patient in (TMPs) health system given number of visits provided.

Not All Samples Are Born Equal: Towards Effective Clean-Label Backdoor Attacks

Recent studies demonstrated that deep neural networks (DNNs) are vulnerable to backdoor attacks. The attacked model behaves normally on benign samples, while its predictions are misled whenever adversary-specified trigger patterns appear. Currently, clean-label backdoor attacks are usually regarded as the most stealthy methods in which adversaries can only poison samples from the target class without modifying their labels. However, these attacks can hardly succeed. In this paper, we reveal that the difficulty of clean-label attacks mainly lies in the antagonistic effects of ‘robust features’ related to the target class contained in poisoned samples. Specifically, robust features tend to be easily learned by victim models and thus undermine the learning of trigger patterns. Based on these understandings, we propose a simple yet effective plug-in method to enhance clean-label backdoor attacks by poisoning ‘hard’ instead of random samples. We adopt three classical difficulty metrics as examples to implement our method. We demonstrate that our method can consistently improve vanilla attacks, based on extensive experiments on benchmark datasets.

Stealthy 3D Poisoning Attack on Video Recognition Models

Deep Neural Networks (DNNs) have been proven to be vulnerable to poisoning attacks that poison the training data with a trigger pattern and thus manipulate the trained model to misclassify data instances. In this article, we study the poisoning attacks on video recognition models. We reveal the major limitations of the state-of-the-art poisoning attacks on <i>stealthiness</i> and <i>attack effectiveness</i> : (i) the frame-by-frame poisoning trigger may cause temporal inconsistency among the video frames which can be leveraged to easily detect the attack; (ii) the feature collision-based method for crafting poisoned videos could lack both generalization and transferability. To address these limitations, we propose a novel stealthy and efficient poisoning attack framework which has the following advantages: (i) we design a 3D poisoning trigger as natural-like textures, which can maintain temporal consistency and human-imperceptibility; (ii) we formulate an ensemble attack oracle as the optimization objective to craft poisoned videos, which could construct convex polytope-like adversarial subspaces in the feature space and thus gain more generalization; (iii) our poisoning attack can be readily extended to the black-box setting with good transferability. We have experimentally validated the effectiveness of our attack (e.g., up to <inline-formula><tex-math notation="LaTeX">$95\%$</tex-math></inline-formula> success rates with only less than <inline-formula><tex-math notation="LaTeX">$\sim 0.5\%$</tex-math></inline-formula> poisoned dataset).

Lithium-ion battery state-of-charge balancing circuit using single resonant converter for electric vehicle applications

The series of energy storage devices, namely battery, super/ultra-capacitor string voltage balancing circuit, based on a single LC energy converter, is presented in this paper. It transfers the excess energy directly from the higher cell to the lower cell in the string. This requires n-4 bidirectional MOSFET switches and a single LC tank for n number of energy storage device strings. This active balancing circuit has high efficiency, fast balancing speed, small size, low cost, and maximum energy recovery. All MOSFET switches are operated in a near-zero current system and controlled by complementary plus wide modulation signals in synchronous trigger patterns. It achieves the zero voltage gap between two nonadjacent cells in a series battery or supercapacitor string and works on cyclic charging and discharging conditions. In this circuit, the resonant frequency is the same as the switching frequency, and the resonant frequency is reduced. The details of theoretical analysis and operation principles are provided. The experimental result of two 4200 mAh Li-ion cell states of charge 95 % (3.958 V) and 66 % (3.712 V), respectively, after 79 min, voltage difference becomes zero (0 V). Furthermore, we conduct our experiment on lead–acid battery and super-capacitor. This balancing circuit is stable and suitable for battery management systems in electric vehicles.

Trigger and data acquisition system of the High Energy Particle Detector on board the CSES-02 satellite

This contribution describes the system performing the trigger and the readout of the PMTs for the High Energy Particle Detector (HEPD-02) onboard the second satellite of the China Seismo Electromagnetic Satellite (CSES-02) mission.CSES is a project developed to research the ionospheric perturbations associated with earthquakes. The mission aims at building a network of multi-instrument satellites to conduct a thorough study of ionospheric phenomena.The HEPD-02 is designed to detect cosmic rays, i.e., electrons and protons, along with light nuclei, in the energy range between a few MeV and a few hundreds of MeV. The instrument consists of a tracker, a trigger and a calorimeter surrounded by a veto.All scintillating detectors are readout by a single board which also issues and manages the trigger signals for the whole apparatus. The HEPD-02 trigger system must be extremely versatile because along the orbit of CSES-02 particle fluxes span several orders of magnitude and data acquisition must guarantee the measurement of energy spectra with a high duty cycle. The HEPD-02 trigger system features concurrent trigger configurations and prescaling capability to match the amount of data the instrument can process and send to the ground. Each trigger pattern is optimized after scientific requirements about the field of view and the nature of particles impinging in HEPD-02, with prescaling settings suitably adjusted.All the trigger configurations will be monitored by rate meters. In addition, a trigger configuration dedicated to gamma-rays will be tracked on a time basis of 10 ms, to measure photon fluxes in the MeV-tens of MeV energy range and provide sensitivity for Gamma Ray Bursts. We provide a comprehensive description of the design criteria and the architecture of the trigger system.

On the Use of High-Resolution and Deep-Learning Seismic Catalogs for Short-Term Earthquake Forecasts: Potential Benefits and Current Limitations.

Enhanced earthquake catalogs provide detailed images of evolving seismic sequences. Currently, these data sets take some time to be released but will soon become available in real time. Here, we explore whether and how enhanced seismic catalogs feeding into established short-term earthquake forecasting protocols may result in higher predictive skill. We consider three enhanced catalogs for the 2016-2017 Central Italy sequence, featuring a bulk completeness lower by at least two magnitude units compared to the real-time catalog and an improved hypocentral resolution. We use them to inform a set of physical Coulomb Rate-and-State (CRS) and statistical Epidemic-Type Aftershock Sequence (ETAS) models to forecast the space-time occurrence of M3+ events during the first 6months of the sequence. We track model performance using standard likelihood-based metrics and compare their skill against the best-performing CRS and ETAS models among those developed with the real-time catalog. We find that while the incorporation of the triggering contributions from new small magnitude detections of the enhanced catalogs is beneficial for both types of forecasts, these models do not significantly outperform their respective near real-time benchmarks. To explore the reasons behind this result, we perform targeted sensitivity tests that show how (a) the typical spatial discretizations of forecast experiments ( 2km) hamper the ability of models to capture highly localized secondary triggering patterns and (b) differences in earthquake parameters (i.e., magnitude and hypocenters) reported in different catalogs can affect forecast evaluation. These findings will contribute toward improving forecast model design and evaluation strategies for next-generation seismic catalogs.

Enhancing users' well-being in virtual medical tourism communities: A configurational analysis of users’ interaction characteristics and social support

Virtual medical tourism communities (V-MTCs) have emerged as important information sources and social platforms for medical tourists. Drawing on value co-creation literature and complexity theory, this study examines the effects of users’ online interaction characteristics and social support on their well-being from a configurational perspective, aiming to identify different well-being trigger patterns among users of V-MTCs in China. A fuzzy-set qualitative comparative analysis (fsQCA) was conducted, incorporating seven interactional configurations involving communication style (task and relationship orientation), social support (emotional, informational, and network support), and citizenship behavior. The findings indicate three categories of configurations that lead to a high sense of well-being, dominated by social support, task orientation, and citizenship behavior. The article discusses the theoretical logic of each configuration and enriches the value co-creation literature and technology-enabled transformative service research by providing new insights into the causal patterns of well-being in V-MTCs. The findings also have practical implications for V-MTC management.

Comparison of the Pressure Support Mode of Anesthesic Respiratory and Resuscitation Ventilators

The objective: Comparison of parameters characterizing the operation of the pressure support regime on modern anesthetic and intensive care ventilators. Subjects and Methods. The study included 5 anesthesia machines (Mindray WATO E X -6 5, Drӓger Primus, GE Avance S/5 , GE Carestation 650, and GE Aisys CS 2) and 5 intensive ventilators (Hamilton C1, Hamilton C2, GE Engstrӧm Carestation, Puritane Bennette 840, and Puritane Bennette 980). All devices were tested using the Ingmar medical ASL 5000 breathing device. The trigger delay time, the maximum pressure reduction below the PEEP level at the initiation of inspiration, PTP (pressur e-t ime product), as well as the level of pressure achieved after 300 and 500 ms from the start of inspiration at different levels of pressure support and PEEP were evaluated. Results. The parameters characterizing operation of the trigger system and pattern of the inspiratory pressure set in ventilators used in intensive care and anesthesia ventilators had statistically significant differences. However, in terms of the response rate of the trigger system, modern anesthesia machines ( GE Avance S/2 , GE Caretation 650, and GE Aisys CS 2) are not significantly inferior to traditional ventilators, their trigger delay time is about 100 ms. The maximum decrease in pressure below PEEP before the start of inhalation in the tested intensive ventilators was 1.0–1.5 cm H 2 O, in modern anesthesia machines this parameter was comparable and made approximately 1.5–2.0 cm H 2 O ( GE Avance S/2 , GE Caremation 650, and GE Aisys CS 2). Assessment of the pressure level achieved after 300 and 500 ms showed that these parameters were closer to the target pressure for ventilators of the pneumatic compressor design, for turbine devices these parameters were approximately 25% less. Anaesthesia devices with a tw o-c ircuit pneumatic design had 40% less pressure values compared to devices with a pneumatic compressor design. Conclusion: The performance of the trigger system in modern anesthesia and intensive care ventilators does not differ significantly. Most of the anesthesia machines tested did not reach the target pressure within 500 ms, and by this parameter they differ significantly from intensive care respirators.

Backdoor Attacks on the DNN Interpretation System

Interpretability is crucial to understand the inner workings of deep neural networks (DNNs). Many interpretation methods help to understand the decision-making of DNNs by generating saliency maps that highlight parts of the input image that contribute the most to the prediction made by the DNN. In this paper we design a backdoor attack that alters the saliency map produced by the network for an input image with a specific trigger pattern while not losing the prediction performance significantly. The saliency maps are incorporated in the penalty term of the objective function that is used to train a deep model and its influence on model training is conditioned upon the presence of a trigger. We design two types of attacks: a targeted attack that enforces a specific modification of the saliency map and a non-targeted attack when the importance scores of the top pixels from the original saliency map are significantly reduced. We perform empirical evaluations of the proposed backdoor attacks on gradient-based interpretation methods, Grad-CAM and SimpleGrad, and a gradient-free scheme, VisualBackProp, for a variety of deep learning architectures. We show that our attacks constitute a serious security threat to the reliability of the interpretation methods when deploying models developed by untrusted sources. We furthermore show that existing backdoor defense mechanisms are ineffective in detecting our attacks. Finally, we demonstrate that the proposed methodology can be used in an inverted setting, where the correct saliency map can be obtained only in the presence of a trigger (key), effectively making the interpretation system available only to selected users.

Digital diary App use for migraine in primary care: Prospective cohort study

BackgroundHeadache diaries are recommended for migraine management in primary care. ObjectiveDetermine the acceptability and use of a digital headache diary App for migraine MethodsEvaluative prospective primary care cohort study in North of England. Part 1 was a postal survey; if responders were interested, in Part 2 participants trialled the digital N1-Headache App headache diary for 90 days, followed by survey feedback on the App’s usability. ResultsA total of 637 out of 2189 invited patients (29%) completed the initial survey, and 32% of respondents had previously used a headache diary; 437 out of 637 patients (69%) were interested in using the App. Regression analysis showed that interested patients were those with more severe migraines that limit physical/intellectual activities, and who indicate to not know enough about their migraine. Actual registration numbers and compliance with the App was very modest; 53 out of 173 participants (23%), who ultimately activated their personal N1-Headache App account, were able to generate a personalised trigger and protector map & report. Furthermore, at the end of the 90 day App trial period there was a non-significant trend towards improvements in participants’ health confidence levels. ConclusionMigraine patients – particularly those with more severe and frequent migraines - show an interest in using a digital headache diary App, Ultimately, consistent daily use is very modest. The challenge is to improve App usage and compliance rates to allow interpretation of more patients’ migraine trigger and/or protector patterns, and wider use amongst patients.

Social isolation: main dermatosis and the impact of stress during the COVID-19 pandemic.

ABSTRACTObjective To analyze the pattern of triggering and exacerbation of dermatological diseases between March and July 2020 and to compare this pattern to the corresponding period of 2019.Methods This was a quantitative, descriptive, comparative and documentary study that was carried out through the retrospective analysis of medical records (March to July 2019 and 2020) of individuals assisted at a private dermatology practice service located in the southern area of the city of São Paulo (SP).Results We evaluated 992 medical consultations in 2019 and 1,176 in 2020. In 2020, we observed a significant increase in cases of telogen effluvium (276%), psoriasis (1,400%), atopic dermatitis (178%), seborrheic dermatitis (200%), herpes zoster (1,200%) and vitiligo (433%). All diseases had stress as a possible initial trigger. In addition, fragile nail syndrome and contact dermatitis, pathologies associated with behavioral measures, also had an important increase in the prevalence (6,400% and 5,500%, respectively). However, the number of aesthetic procedures decreased by approximately 54% during the pandemic period.Conclusion During the pandemic period, the pattern of incidence of dermatoses had changed compared with the previous year. An emphasis was observed on diseases triggered by a psychological component, as well as those pathologies that have behavioral measures as the main cause. For this reason, the impacts of COVID-19 is greater than only among those infected.

Analysis and Impact Evaluation of Entrepreneurs’ Improvisational Behavior Trigger Patterns

How entrepreneurial firms can enhance the level of exploratory and exploitative improvisation in a balanced manner to enhance organizational dynamics has become an important research topic. Current research on the triggers of duality entrepreneurial improvisation has just started, exploring mainly abstract characteristic variables, and has not paid attention to the impact of entrepreneurs’ daily behaviors. In order to make up for the shortcomings of current research, the research goal of this paper is to construct a triggering model of entrepreneurs’ improvisation based on the research of entrepreneurs’ daily behaviors and then to evaluate the influence of the improvisational behavior trigger patterns. Based on the paradoxical and theoretical perspective of duality, a structured observation method is used to explore which behavioral patterns of entrepreneurs tend to trigger dual improvisational behaviors in themselves, their teams, and their organizations. After observing and recording the creators and collecting phenomenal data, six entrepreneurial behavior patterns containing 39 specific operational behaviors have been extracted from the phenomenal data by drawing on the rooted theory approach. In addition, the influence of entrepreneurial patterns is evaluated and ranked using the pairwise hesitant fuzzy set evaluation method. This study reveals the relationship between entrepreneurs’ daily behaviors and dyadic entrepreneurial improvisation at the operational level and provides guiding plans for entrepreneurs to improve their own and their organizations’ improvisation levels.

Poison Ink: Robust and Invisible Backdoor Attack.

Recent research shows deep neural networks are vulnerable to different types of attacks, such as adversarial attacks, data poisoning attacks, and backdoor attacks. Among them, backdoor attacks are the most cunning and can occur in almost every stage of the deep learning pipeline. Backdoor attacks have attracted lots of interest from both academia and industry. However, most existing backdoor attack methods are visible or fragile to some effortless pre-processing such as common data transformations. To address these limitations, we propose a robust and invisible backdoor attack called "Poison Ink". Concretely, we first leverage the image structures as target poisoning areas and fill them with poison ink (information) to generate the trigger pattern. As the image structure can keep its semantic meaning during the data transformation, such a trigger pattern is inherently robust to data transformations. Then we leverage a deep injection network to embed such input-aware trigger pattern into the cover image to achieve stealthiness. Compared to existing popular backdoor attack methods, Poison Ink outperforms both in stealthiness and robustness. Through extensive experiments, we demonstrate that Poison Ink is not only general to different datasets and network architectures but also flexible for different attack scenarios. Besides, it also has very strong resistance against many state-of-the-art defense techniques.

Stealthy Backdoors as Compression Artifacts

Model compression is a widely-used approach for reducing the size of deep learning models without much accuracy loss, enabling resource-hungry models to be compressed for use on resource-constrained devices. In this paper, we study the risk that model compression could provide an opportunity for adversaries to inject stealthy backdoors. In a backdoor attack on a machine learning model, an adversary produces a model that performs well on normal inputs but outputs targeted misclassifications on inputs containing a small trigger pattern. We design stealthy backdoor attacks such that the full-sized model released by adversaries appears to be free from backdoors (even when tested using state-of-the-art techniques), but when the model is compressed it exhibits a highly effective backdoor. We show this can be done for two common model compression techniques—model pruning and model quantization—even in settings where the adversary has limited knowledge of how the particular compression will be done. Our findings demonstrate the importance of performing security tests on the models that will actually be deployed not in their precompressed version. Our implementation is available at <uri xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts</uri> .

Locating Hardware Trojans Using Combinatorial Testing for Cryptographic Circuits

This paper presents a novel method for locating combinational hardware Trojans (HT) based on fault location approaches used in combinatorial testing. This method relies exclusively on the combinatorial properties of the executed test vectors and the results of test execution. Under specific assumptions, the method is guaranteed to locate all combinational HTs with trigger patterns of length <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\ell $ </tex-math></inline-formula> or less, with the location process itself consuming negligible time. We give a description of our method by devising suitable algorithms and provide the links to combinatorial fault location. Furthermore, we demonstrate our approach in a concrete case study where we locate HTs embedded in a circuit that implements the AES symmetric-key encryption algorithm with 128 bits key length. In these experiments, we demonstrate how any HT that is activated by a trigger pattern of length <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\ell \leq 8$ </tex-math></inline-formula> can be located in an effective way. Our method compares particularly well against randomized approaches. Although instantiated for a specific circuit in our case study, the proposed approach is generic, due to its algorithmic description, and can be applied for testing other (cryptographic) circuits. We believe that our work presents an important first step in the development of more general logic testing methodologies for HT location using combinatorial testing methods.

A multitarget backdooring attack on deep neural networks with random location trigger

Machine learning has made tremendous progress and applied to various critical practical applications. However, recent studies have shown that machine learning models are vulnerable to malicious attackers, such as neural network backdoor triggering. A successful backdoor triggering behavior may cause serious consequences, such as allowing the attacker to bypass the identity verification and directly enter the system. In image classification, there is always only one target label triggered by one backdoor trigger in previous works. The position of the backdoor trigger is also fixed, which brings limitations to the attack. In this paper, we propose a novel method that utilizes one trigger pattern to correspond to multiple target labels, and the location of the trigger is not limited. In our method, the trigger guarantees that the malicious output is within the range of multiple targets chosen by the attacker, but the specific target depends on the original image where the trigger is pasted. Due to the original images' diversity, it is difficult for the defender to predict which target the image with the trigger is classified as. Besides, the attacker can use only one trigger pattern to achieve multitarget attacks at different locations, which brings more flexibility. We also proposed to train a neural network as a detector to distinguish backdoor images and clean images for multitarget backdooring attacks. Experiment results show that the detection method can also successfully detect the backdoor image with a trigger at a random location of the image, and the detection success rate is as high as 86.02%.