Automated Segmentation to Make Hidden Trigger Backdoor Attacks Robust against Deep Neural Networks
Source abstract
Abstract
The successful outcomes of deep learning (DL) algorithms in diverse fields have prompted researchers to consider backdoor attacks on DL models to defend them in practical applications. Adversarial examples could deceive a safety-critical system, which could lead to hazardous situations. To cope with this, we suggested a segmentation technique that makes hidden trigger backdoor attacks more robust. The tiny trigger patterns are conventionally established by a series of parameters encompassing their DNN size, location, color, shape, and other defining attributes. From the original triggers, alternate triggers are generated to control the backdoor patterns by a third party in addition to their original designer, which can produce a higher success rate than the original triggers. However, the significant downside of these approaches is the lack of automation in the scene segmentation phase, which results in the poor optimization of the threat model. We developed a novel technique that automatically generates alternate triggers to increase the effectiveness of triggers. Image denoising is performed for this purpose, followed by scene segmentation techniques to make the poisoned classifier more robust. The experimental results demonstrated that our proposed technique achieved 99% to 100% accuracy and helped reduce the vulnerabilities of DL models by exposing their loopholes.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Adversarial Robustness in Machine Learning · Anomaly Detection Techniques and Applications · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Science, University of Agriculture, Faisalabad 38000, Pakistan
School of Computer Science, Guangzhou University, Guangzhou 510006, China
Department of Computer Science, Government College Women University, Faisalabad 38000, Pakistan
Funding
National Key Research and Development Program of China · National Natural Science Foundation of China · High-Level Talents Program of Higher Education in Guangdong Province · NCBC-PAAL, UAF, Faisalabad
References (33)
Show source-provided references
1. Gong, X., Wang, Z., Chen, Y., Xue, M., Wang, Q., and Shen, C. (2023). Kaleidoscope: Physical Backdoor Attacks against Deep Neural Networks with RGB Filters. IEEE Trans. Dependable Secur. Comput., 1–12.10.1109/TDSC.2023.3239225 ↗
2. A defense method against backdoor attacks on neural networks10.1016/j.eswa.2022.118990 ↗
3. Saha, A., Subramanya, A., and Pirsiavash, H. (2020, January 7–12). Hidden trigger backdoor attacks. Proceedings of the AAAI 2020—34th Conference on Artificial Intelligence, Hilton, New York Midtown, New York, NY, USA.
4. Backdoor Attacks Against Transfer Learning With Pre-Trained Deep Learning Models10.1109/TSC.2020.3000900 ↗
5. Turner, A., Tsipras, D., and Madry, A. (2023, January 09). Label-Consistent Backdoor Attacks. Available online: http://arxiv.org/abs/1912.02771.
6. Gu, T., Dolan-Gavitt, B., and Garg, S. (2022, December 12). BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain. Available online: http://arxiv.org/abs/1708.06733.
7. Sun, M., Agarwal, S., and Kolter, J.Z. (2023, January 11). Poisoned Classifiers Are Not Only Backdoored, They Are Fundamentally Broken. Available online: http://arxiv.org/abs/2010.09080.
8. Chen, X., Liu, C., Li, B., Lu, K., and Song, D. (2023, January 17). Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. Available online: http://arxiv.org/abs/1712.05526.
9. BadNets: Evaluating Backdooring Attacks on Deep Neural Networks10.1109/ACCESS.2019.2909068 ↗
10. Towards Backdoor Attacks and Defense in Robust Machine Learning Models10.1016/j.cose.2023.103101 ↗
11. De A Survey on Machine Learning Adversarial Attacks10.17648/jisc.v7i1.76 ↗
12. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2014, January 14–16). Intriguing properties of neural networks. Proceedings of the 2nd International Conference on Learning Representations, ICLR 2014, Conference Track Proceedings, Banff, AB, Canada.
13. Goodfellow, I.J., Shlens, J., and Szegedy, C. (2015, January 7–9). Explaining and harnessing adversarial examples. Proceedings of the 3rd International Conference on Learning Representations, ICLR 2015, Conference Track Proceedings, San Diego, CA, USA.
14. Hu, S., Zhang, Y., Liu, X., Zhang, L.Y., Li, M., and Jin, H. (2021, January 20–24). AdvHash: Set-to-set Targeted Attack on Deep Hashing with One Single Adversarial Patch. Proceedings of the MM 2021—Proceedings of the 29th ACM International Conference on Multimedia, Chengdu, China.10.1145/3474085.3475396 ↗
15. Chiang, P.H., Chan, C.S., and Wu, S.H. (2021, January 20–24). Adversarial Pixel Masking: A Defense against Physical Attacks for Pre-trained Object Detectors. Proceedings of the MM 2021—Proceedings of the 29th ACM International Conference on Multimedia, Chengdu, China.10.1145/3474085.3475338 ↗
16. Shokri, R., Stronati, M., Song, C., and Shmatikov, V. (2017, January 3–18). Membership Inference Attacks Against Machine Learning Models. Proceedings of the IEEE Symposium on Security and Privacy, San Jose, CA, USA.10.1109/SP.2017.41 ↗
17. Fredrikson, M., Jha, S., and Ristenpart, T. (2015, January 12–16). Model inversion attacks that exploit confidence information and basic countermeasures. Proceedings of the ACM Conference on Computer and Communications Security, Enver, Colorado, CO, USA.10.1145/2810103.2813677 ↗
18. Zhao, S., Ma, X., Zheng, X., Bailey, J., Chen, J., and Jiang, Y.G. (2020, January 14–19). Clean-Label Backdoor Attacks on Video Recognition Models. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Seattle, Washington, DC, USA.10.1109/CVPR42600.2020.01445 ↗
19. Zhang, Y., Albarghouthi, A., and D’Antoni, L. (2023, February 23). PECAN: A Deterministic Certified Defense Against Backdoor Attacks. Available online: http://arxiv.org/abs/2301.11824.
20. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (May, January 30). Towards deep learning models resistant to adversarial attacks. Proceedings of the 6th International Conference on Learning Representations, ICLR 2018, Conference Track Proceedings, Vancouver, BC, Canada.
21. Sun, M., Agarwal, S., and Kolter, J.Z. (2019). Oisoned classifiers are not only backdoored, they are fundamentally broken. arXiv.
22. Backdoor Attacks on Image Classification Models in Deep Neural Networks10.1049/cje.2021.00.126 ↗
23. BlindNet backdoor: Attack on deep neural network using blind watermark10.1007/s11042-021-11135-0 ↗
24. Qi, X., Xie, T., Pan, R., Zhu, J., Yang, Y., and Bu, K. (2022, January 18–24). Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, New Orleans, LA, USA.10.1109/CVPR52688.2022.01299 ↗
25. Nguyen, A., and Tran, A. (2022, December 15). WaNet—Imperceptible Warping-based Backdoor Attack. Available online: http://arxiv.org/abs/2102.10369.
26. Salman, H., Sun, M., Yang, G., Kapoor, A., and Kolter, J.Z. (2020, January 6–12). Denoised smoothing: A provable defense for pretrained classifiers. Proceedings of the Advances in Neural Information Processing Systems, 2020, NeurIPS 2020, Virtual.
27. Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., and Zhao, B.Y. (2019, January 20–22). Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA.10.1109/SP.2019.00031 ↗
28. Guo, W., Wang, L., Xing, X., Du, M., and Song, D. (2023, January 25). TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems. Available online: http://arxiv.org/abs/1908.01763.
29. Stronger data poisoning attacks break data sanitization defenses10.1007/s10994-021-06119-y ↗
30. Abdul Quadir, M., Jaiswal, D., Daftari, J., Haneef, S., Iwendi, C., and Jain, S.K. (2022). Efficient Dynamic Phishing Safeguard System Using Neural Boost Phishing Protection. Electronics, 11.10.3390/electronics11193133 ↗
31. An efficient algorithm to detect DDoS amplification attacks10.3233/JIFS-189173 ↗
32. Cohen, J., Rosenfeld, E., and Kolter, J.Z. (2019, January 9–15). Certified adversarial robustness via randomized smoothing. Proceedings of the 36th International Conference on Machine Learning (ICML 2019), Long Beach, California, USA.
33. Patch-based models and algorithms for image denoising: A comparative review between patch-based images denoising methods for additive noise reduction