Invisible Threats in the Data: A Study on Data Poisoning Attacks in Deep Generative Models
Source abstract
Abstract
Deep Generative Models (DGMs), as a state-of-the-art technology in the field of artificial intelligence, find extensive applications across various domains. However, their security concerns have increasingly gained prominence, particularly with regard to invisible backdoor attacks. Currently, most backdoor attack methods rely on visible backdoor triggers that are easily detectable and defendable against. Although some studies have explored invisible backdoor attacks, they often require parameter modifications and additions to the model generator, resulting in practical inconveniences. In this study, we aim to overcome these limitations by proposing a novel method for invisible backdoor attacks. We employ an encoder–decoder network to ‘poison’ the data during the preparation stage without modifying the model itself. Through meticulous design, the trigger remains visually undetectable, substantially enhancing attacker stealthiness and success rates. Consequently, this attack method poses a serious threat to the security of DGMs while presenting new challenges for security mechanisms. Therefore, we urge researchers to intensify their investigations into DGM security issues and collaboratively promote the healthy development of DGM security.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Adversarial Robustness in Machine Learning · Advanced Malware Detection Techniques · Digital Media Forensic Detection
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
School of Computer and Cyber Security, Hebei Normal University, Shijiazhuang 050024, China
School of Advanced Technology, Xi’an Jiaotong-Liverpool University, Suzhou 215123, China
Funding
National Natural Science Foundation of China · National Science Basic Research Plan in Hebei Province of China · Educational Commission of Hebei Province of China · Central Guidance on Local Science and Technology Development Fund of Hebei Province · Science Foundation of Hebei Normal University
References (47)
Show source-provided references
1. Rawat, A., Levacher, K., and Sinn, M. (2022). The devil is in the GAN: Backdoor attacks and defenses in deep generative models. European Symposium on Research in Computer Security, Springer.10.1007/978-3-031-17143-7_41 ↗
2. Diffusion models beat gans on image synthesis
3. Nichol, A., Dhariwal, P., Ramesh, A., Shyam, P., Mishkin, P., McGrew, B., Sutskever, I., and Chen, M. (2021). Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv.
4. Karras, T., Aila, T., Laine, S., and Lehtinen, J. (2018). Progressive growing of gans for improved quality, stability, and variation. arXiv.
5. Brock, A., Donahue, J., and Simonyan, K. (2018). Large scale GAN training for high fidelity natural image synthesis. arXiv.
6. Chan, C., Ginosar, S., Zhou, T., and Efros, A. (November, January 27). Everybody Dance Now. Proceedings of the International Conference on Computer Vision, Seoul, Republic of Korea.
7. Nistal, J., Lattner, S., and Richard, G. (2021, January 23–27). Comparing Representations for Audio Synthesis Using Generative Adversarial Networks. Proceedings of the European Signal Processing Conference, Dublin, Ireland.10.23919/Eusipco47968.2020.9287799 ↗
8. Truong, L., Jones, C., Hutchinson, B., August, A., and Tuor, A. (2020). Systematic Evaluation of Backdoor Data Poisoning Attacks on Image Classifiers. arXiv.10.1109/CVPRW50498.2020.00402 ↗
9. Ahmed, I.M., and Kashmoola, M.Y. (2021, January 24–25). Threats on machine learning technique by data poisoning attack: A survey. Proceedings of the Advances in Cyber Security: Third International Conference, ACeS 2021, Penang, Malaysia. Revised Selected Papers 3.10.1007/978-981-16-8059-5_36 ↗
10. Fan, J., Yan, Q., Li, M., Qu, G., and Xiao, Y. (2022, January 11–13). A survey on data poisoning attacks and defenses. Proceedings of the 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC), Guilin, China.10.1109/DSC55868.2022.00014 ↗
11. Data poisoning attacks against machine learning algorithms10.1016/j.eswa.2022.118101 ↗
12. A comprehensive survey on poisoning attacks and countermeasures in machine learning10.1145/3551636 ↗
13. Wild patterns reloaded: A survey of machine learning security against training data poisoning
14. Costales, R., Mao, C., Norwitz, R., Kim, B., and Yang, J. (2020, January 14–19). Live trojan attacks on deep neural networks. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, Seattle, WA, USA.10.1109/CVPRW50498.2020.00406 ↗
15. Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D.C., and Nepal, S. (2019, January 9–13). Strip: A defence against trojan attacks on deep neural networks. Proceedings of the 35th Annual Computer Security Applications Conference, San Juan, PR, USA.10.1145/3359789.3359790 ↗
16. Tang, R., Du, M., Liu, N., Yang, F., and Hu, X. (2020, January 23–27). An embarrassingly simple approach for trojan attack in deep neural networks. Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Virtual.10.1145/3394486.3403064 ↗
17. On the neural backdoor of federated generative models in edge computing
18. Nguyen, A., Yosinski, J., and Clune, J. (2015, January 7–12). Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Boston, MA, USA.10.1109/CVPR.2015.7298640 ↗
19. Chen, J., Zheng, H., Su, M., Du, T., Lin, C., and Ji, S. (2019, January 6–8). Invisible poisoning: Highly stealthy targeted poisoning attack. Proceedings of the Information Security and Cryptology: 15th International Conference, Inscrypt 2019, Nanjing, China. Revised Selected Papers 15.
20. Generative Adversarial Networks in Computer Vision: A Survey and Taxonomy
21. Machine learning classification of multiple sclerosis patients based on raw data from an instrumented walkway10.1186/s12938-022-00992-x ↗
22. Ak, K.E., Lim, J.H., Tham, J.Y., and Kassim, A.A. (November, January 27). Attribute Manipulation Generative Adversarial Networks for Fashion Images (ACCEPTED ICCV 2019). Proceedings of the 2019 International Conference on Computer Vision (ICCV), Seoul, Republic of Korea.10.1109/ICCV.2019.01064 ↗
23. Marafioti, A., Perraudin, N., Holighaus, N., and Majdak, P. (2019, January 9–15). Adversarial generation of time-frequency features with application in audio synthesis. Proceedings of the International Conference on Machine Learning, Long Beach, CA, USA.
24. Brophy, E., Wang, Z., She, Q., and Ward, T. (2021). Generative adversarial networks in time series: A survey and taxonomy. arXiv.
25. Input-aware dynamic backdoor attack
26. Zhong, H., Liao, C., Squicciarini, A.C., Zhu, S., and Miller, D. (2020, January 16–18). Backdoor embedding in convolutional neural network models via invisible perturbation. Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy, New Orleans, LA, USA.10.1145/3374664.3375751 ↗
27. Invisible backdoor attacks on deep neural networks via steganography and regularization
28. Salem, A., Backes, M., and Zhang, Y. (2020). Don’t trigger me! a triggerless backdoor attack against deep neural networks. arXiv.
29. Salem, A., Sautter, Y., Backes, M., Humbert, M., and Zhang, Y. (2020). Baaan: Backdoor attacks against autoencoder and gan-based machine learning models. arXiv.
30. Arshad, I., Qiao, Y., Lee, B., and Ye, Y. (2023, January 2–5). Invisible Encoded Backdoor attack on DNNs using Conditional GAN. Proceedings of the 2023 IEEE International Conference on Consumer Electronics (ICCE), Berlin, Germany.10.1109/ICCE56470.2023.10043484 ↗
31. Shokri, R. (2020, January 7–11). Bypassing backdoor detection algorithms in deep learning. Proceedings of the 2020 IEEE European Symposium on Security and Privacy (EuroS&P), Genoa, Italy.
32. Circuit Design and Application of Discrete Cosine Transform Based on Memristor10.1109/JETCAS.2023.3243569 ↗
33. Zhang, J., Liu, Y., Li, A., Zeng, J., and Xie, H. (2022, January 5–7). Image Processing and Control of Tracking Intelligent Vehicle Based on Grayscale Camera. Proceedings of the 2022 IEEE 5th International Conference on Image Processing Applications and Systems (IPAS), Genova, Italy.10.1109/IPAS55744.2022.10053002 ↗
34. Discrete combined fractional Fourier transform and its application to image enhancement10.1007/s11042-023-16742-7 ↗
35. Backdoor learning: A survey10.1109/TNNLS.2022.3182979 ↗
36. Tancik, M., Mildenhall, B., and Ng, R. (2020, January 14–9). Stegastamp: Invisible hyperlinks in physical photographs. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA.10.1109/CVPR42600.2020.00219 ↗
37. Chen, X., Liu, C., Li, B., Lu, K., and Song, D. (2017). Targeted backdoor attacks on deep learning systems using data poisoning. arXiv.
38. Alias-free generative adversarial networks
39. Li, Y., Li, Y., Wu, B., Li, L., He, R., and Lyu, S. (2021, January 11–17). Invisible backdoor attack with sample-specific triggers. Proceedings of the IEEE/CVF International Conference on Computer Vision, Virtual.10.1109/ICCV48922.2021.01615 ↗
40. Kramberger, T., and Potočnik, B. (2020). LSUN-Stanford car dataset: Enhancing large-scale car image datasets using deep learning for usage in GAN training. Appl. Sci., 10.10.3390/app10144913 ↗
41. Karras, T., Laine, S., and Aila, T. (2019, January 15–20). A style-based generator architecture for generative adversarial networks. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Long Beach, CA, USA.10.1109/CVPR.2019.00453 ↗
42. Karras, T., Laine, S., Aittala, M., Hellsten, J., Lehtinen, J., and Aila, T. (2020, January 14–9). Analyzing and improving the image quality of stylegan. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Seattle, WA, USA.10.1109/CVPR42600.2020.00813 ↗
43. Bińkowski, M., Sutherland, D.J., Arbel, M., and Gretton, A. (2018). Demystifying mmd gans. arXiv.
44. GANs trained by a two time-scale update rule converge to a local Nash equilibrium10.18034/ajase.v8i1.9 ↗
45. Adaptive steganalysis based on statistical model of quantized DCT coefficients for JPEG images10.1109/TDSC.2019.2962672 ↗
46. Fractional-order generalized Laguerre moments and moment invariants for grey-scale image analysis10.1049/ipr2.12044 ↗
47. Image retrieval based on texture using latent space representation of discrete Fourier transformed maps10.1007/s00521-021-05955-2 ↗