Enhanced Coalescence Backdoor Attack Against DNN Based on Pixel Gradient
Tóm tắt
Deep learning has been widely used in many applications such as face recognition, autonomous driving, etc. However, deep learning models are vulnerable to various adversarial attacks, among which backdoor attack is emerging recently. Most of the existing backdoor attacks use the same trigger or the same trigger generation approach to generate the poisoned samples in the training and testing sets, which is also commonly adopted by many backdoor defense strategies. In this paper, we develop an enhanced backdoor attack (EBA) that aims to reveal the potential flaws of existing backdoor defense methods. We use a low-intensity trigger to embed the backdoor, while a high-intensity trigger to activate it. Furthermore, we propose an enhanced coalescence backdoor attack (ECBA) where multiple low-intensity incipient triggers are designed to train the backdoor model, and then, all incipient triggers are gathered on one sample and enhanced to launch the attack. Experiment results on three popular datasets show that our proposed attacks can achieve high attack success rates while maintaining the model classification accuracy of benign samples. Meanwhile, by hiding the incipient poisoned samples and preventing them from activating the backdoor, the proposed attack exhibits significant stealth and the ability to evade mainstream defense methods during the model training phase.
Từ khóa
Tài liệu tham khảo
Wang M, Deng W (2021) Deep face recognition: a survey. Neurocomputing 429:215–244
Chen C, Seff A, Kornhauser A, Xiao J (2015) Deepdriving: Learning affordance for direct perception in autonomous driving. In: Proc. of IEEE international conference on computer vision, pp 2722–2730
Bae H-S, Lee H-J, Lee S-G (2016) Voice recognition based on adaptive mfcc and deep learning. In: Proc. of IEEE 11th conference on industrial electronics and applications (ICIEA) pp 1542–1546
Gregor K, Danihelka I, Graves A, Rezende D, Wierstra D (2015) Draw: A recurrent neural network for image generation. In: Proc. of international conference on machine learning, pp 1462–1471
Lin K, Chen H, Yan N, Ni Z, Wang Z, Yu J (2023) Double Polling-Based Tag Information Collection for Sensor-Augmented RFID Systems. IEEE Transactions on Mobile Computing, pp 1–14
Ai X, Chen H, Lin K, Wang Z, Yu J (2021) Nowhere to hide: efficiently identifying probabilistic cloning attacks in large-scale RFID systems. IEEE Trans Inf Forens Secur 16:714–727
Chi X, Chen H, Li G, Ni Z, Jiang N, Xia F (2023) EDSP-edge: efficient dynamic edge service entity placement for mobile virtual reality systems. IEEE Trans Wireless Commun. https://doi.org/10.1109/TWC.2023.3302917
Huang Y, Chen H, Ma G, Lin K, Ni Z, Yan N, Wang Z (2021) OPAT: optimized allocation of time-dependent tasks for mobile crowdsensing. IEEE Trans Mob Comput 18:2476–2485
Xi C, Wei G, Fan Z, Jiayu D (2022) Generate usable adversarial examples via simulating additional light sources. Neural Processing Letters pp 1–2
Tian Z, Cui L, Liang J, Yu S (2022) A comprehensive survey on poisoning attacks and countermeasures in machine learning. ACM Comput Surv 55:1–35
Gu T, Liu K, Dolan-Gavitt B, Garg S (2019) Badnets: evaluating backdooring attacks on deep neural networks. IEEE Access 7:47230–47244
Yoshida K, Fujino T (2020) Disabling backdoor and identifying poison data by using knowledge distillation in backdoor attacks on deep neural networks. In: Proc. of the 13th ACM Workshop on Artificial Intelligence and Security pp 117–127
Bisong E, Bisong E (2019) Google cloud machine learning engine (cloud mle). Building Machine Learning and Deep Learning Models on Google Cloud Platform: A Comprehensive Guide for Beginners, pp 545–579
Salvaris M et al (2018) Microsoft ai platform. Deep Learning with Azure: Building and Deploying Artificial Intelligence Solutions on the Microsoft AI Platform pp 79–98
Liu K, Dolan-Gavitt B, Garg S (2018) Fine-pruning: Defending against backdooring attacks on deep neural networks. In Proc. of Research in Attacks, Intrusions, and Defenses: 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings 21 pp 273–294
Chen B et al (2018) Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728
Soremekun E, Udeshi S, Chattopadhyay S (2020) Exposing backdoors in robust machine learning models. arXiv preprint arXiv:2003.00865
Zeng Y, Park W, Mao ZM, Jia R (2021) Rethinking the backdoor attacks’ triggers: A frequency perspective. In Proc. of the IEEE/CVF international conference on computer vision pp 16473–16481
Xue M, He C, Wang J, Liu W (2020) One-to-n & n-to-one: two advanced backdoor attacks against deep learning models. IEEE Trans Dependable Secure Comput 19:1562–1578
Wang B,Yao Y, Shan S, Zhao B, Li H, Viswanath B, Zheng H (2019) Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Proc. of IEEE symposium on security and privacy (SP) pp 707–723
Chen X, Liu C, Li B, Lu K, Song D (2017) Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526
Barni M, Kallas K, Tondi B (2019) A new backdoor attack in cnns by training set corruption without label poisoning. In Proc. of IEEE international conference on image processing (ICIP) pp 101–105
Lovisotto G, Eberz S, Martinovic I (2020) Biometric backdoors: A poisoning attack against unsupervised template updating. In Proc. of IEEE European Symposium on Security and Privacy (EuroS &P) pp 184–197
Liu H, Li D, Li Y (2021) Poisonous label attack: black-box data poisoning attack with enhanced conditional dcgan. Neural Process Lett 53:4117–4142
Zhong H, Liao C, Squicciarini AC, Zhu S, Miller D (2020) Backdoor embedding in convolutional neural network models via invisible perturbation. In Proc. of the Tenth ACM conference on data and application security and privacy pp 97–108
Zou M et al (2018) Potrojan: powerful neural-level trojan designs in deep learning models. arXiv preprint arXiv:1802.03043
Wang Z, Zhai J, Ma S (2022) Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning. In Proc. of the IEEE/CVF Conference on Computer Vision and Pattern Recognition pp 15074–15084
Tang R, Du M, Liu N, Yang F, Hu X (2020) An embarrassingly simple approach for trojan attack in deep neural networks. In Proc. of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pp 218–228
Liu Y et al (2018) Trojaning attack on neural networks. In Proc. of the 25th Annual network and distributed system security symposium (NDSS 2018) pp 1–15
Zhong N, Qian Z, Zhang X (2022) Imperceptible backdoor attack: From input space to feature representation. arXiv preprint arXiv:2205.03190
Selvaraju RR et al (2017) Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proc. of the IEEE international conference on computer vision pp 618–626
Dong Y et al (2021) Black-box detection of backdoor attacks with limited information and data. In Proc. of the IEEE/CVF international conference on computer vision pp 16482–16491
Gao Y et al (2019) Strip: A defence against trojan attacks on deep neural networks. In Proc. of the 35th annual computer security applications conference, pp 113–125
LeCun Y (1998) The mnist database of handwritten digits. http://yann. lecun. com/exdb/mnist/
Stallkamp J, Schlipsing M, Salmen J, Igel C (2012) Benchmarking machine learning algorithms for traffic sign recognition Man vs computer. Neural Netw 32:323–332
Alessio C (2018) Animals-10. https://www. kaggle. com/alessiocorrado99/animals10