Compression-Resistant Backdoor Attack against Deep Neural Networks

• URL: http://arxiv.org/abs/2201.00672v1
• Date: Mon, 3 Jan 2022 14:23:58 GMT
• Title: Compression-Resistant Backdoor Attack against Deep Neural Networks
• Abstract summary: In recent years, many backdoor attacks based on training data poisoning have been proposed. In practice, those backdoor attacks are vulnerable to image compressions. We propose a compression-resistant backdoor attack based on feature consistency training.
• Score: 14.090372810670756
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: In recent years, many backdoor attacks based on training data poisoning have been proposed. However, in practice, those backdoor attacks are vulnerable to image compressions. When backdoor instances are compressed, the feature of specific backdoor trigger will be destroyed, which could result in the backdoor attack performance deteriorating. In this paper, we propose a compression-resistant backdoor attack based on feature consistency training. To the best of our knowledge, this is the first backdoor attack that is robust to image compressions. First, both backdoor images and their compressed versions are input into the deep neural network (DNN) for training. Then, the feature of each image is extracted by internal layers of the DNN. Next, the feature difference between backdoor images and their compressed versions are minimized. As a result, the DNN treats the feature of compressed images as the feature of backdoor images in feature space. After training, the backdoor attack against DNN is robust to image compression. Furthermore, we consider three different image compressions (i.e., JPEG, JPEG2000, WEBP) in feature consistency training, so that the backdoor attack is robust to multiple image compression algorithms. Experimental results demonstrate the effectiveness and robustness of the proposed backdoor attack. When the backdoor instances are compressed, the attack success rate of common backdoor attack is lower than 10%, while the attack success rate of our compression-resistant backdoor is greater than 97%. The compression-resistant attack is still robust even when the backdoor images are compressed with low compression quality. In addition, extensive experiments have demonstrated that, our compression-resistant backdoor attack has the generalization ability to resist image compression which is not used in the training process.

Related papers

• Inevitable Encounters: Backdoor Attacks Involving Lossy Compression [12.150587060134109]
  Real-world backdoor attacks often require poisoned datasets to be stored and transmitted before being used to compromise deep learning systems.<n>We find that triggers embedded in RGB images often become ineffective after the images are lossily compressed into binary bitstreams.<n>We propose two poisoning strategies tailored to inevitable lossy compression.
  arXiv  Detail & Related papers  (2026-03-14T09:45:59Z)
• BAN: Detecting Backdoors Activated by Adversarial Neuron Noise [30.243702765232083]
  Backdoor attacks on deep learning represent a recent threat that has gained significant attention in the research community. Backdoor defenses are mainly based on backdoor inversion, which has been shown to be generic, model-agnostic, and applicable to practical threat scenarios. This paper improves backdoor feature inversion for backdoor detection by incorporating extra neuron activation information.
  arXiv  Detail & Related papers  (2024-05-30T10:44:45Z)
• Everyone Can Attack: Repurpose Lossy Compression as a Natural Backdoor Attack [15.017990145799189]
  This paper shows that anyone can exploit an easily-accessible algorithm for silent backdoor attacks. Via this attack, the adversary does not need to design a trigger generator as seen in prior works and only requires poisoning the data.
  arXiv  Detail & Related papers  (2023-08-31T12:38:29Z)
• Single Image Backdoor Inversion via Robust Smoothed Classifiers [76.66635991456336]
  We present a new approach for backdoor inversion, which is able to recover the hidden backdoor with as few as a single image. In this work, we present a new approach for backdoor inversion, which is able to recover the hidden backdoor with as few as a single image.
  arXiv  Detail & Related papers  (2023-03-01T03:37:42Z)
• Look, Listen, and Attack: Backdoor Attacks Against Video Action Recognition [53.720010650445516]
  We show that poisoned-label image backdoor attacks could be extended temporally in two ways, statically and dynamically. In addition, we explore natural video backdoors to highlight the seriousness of this vulnerability in the video domain. And, for the first time, we study multi-modal (audiovisual) backdoor attacks against video action recognition models.
  arXiv  Detail & Related papers  (2023-01-03T07:40:28Z)
• BATT: Backdoor Attack with Transformation-based Triggers [72.61840273364311]
  Deep neural networks (DNNs) are vulnerable to backdoor attacks. Backdoor adversaries inject hidden backdoors that can be activated by adversary-specified trigger patterns. One recent research revealed that most of the existing attacks failed in the real physical world.
  arXiv  Detail & Related papers  (2022-11-02T16:03:43Z)
• Imperceptible and Multi-channel Backdoor Attack against Deep Neural Networks [9.931056642574454]
  We propose a novel imperceptible and multi-channel backdoor attack against Deep Neural Networks. Specifically, for a colored image, we utilize DCT steganography to construct the trigger on different channels of the image. Experimental results demonstrate that the average attack success rate of the N-to-N backdoor attack is 93.95% on CIFAR-10 dataset and 91.55% on TinyImageNet dataset.
  arXiv  Detail & Related papers  (2022-01-31T12:19:28Z)
• Poison Ink: Robust and Invisible Backdoor Attack [122.49388230821654]
  We propose a robust and invisible backdoor attack called Poison Ink'' Concretely, we first leverage the image structures as target poisoning areas, and fill them with poison ink (information) to generate the trigger pattern. Compared to existing popular backdoor attack methods, Poison Ink outperforms both in stealthiness and robustness.
  arXiv  Detail & Related papers  (2021-08-05T09:52:49Z)
• Robust Backdoor Attacks against Deep Neural Networks in Real Physical World [6.622414121450076]
  Deep neural networks (DNN) have been widely deployed in various practical applications. Almost all the existing backdoor works focused on the digital domain, while few studies investigate the backdoor attacks in real physical world. We propose a robust physical backdoor attack method, PTB, to implement the backdoor attacks against deep learning models in the physical world.
  arXiv  Detail & Related papers  (2021-04-15T11:51:14Z)
• Backdoor Attack in the Physical World [49.64799477792172]
  Backdoor attack intends to inject hidden backdoor into the deep neural networks (DNNs) Most existing backdoor attacks adopted the setting of static trigger, $i.e.,$ triggers across the training and testing images. We demonstrate that this attack paradigm is vulnerable when the trigger in testing images is not consistent with the one used for training.
  arXiv  Detail & Related papers  (2021-04-06T08:37:33Z)
• Clean-Label Backdoor Attacks on Video Recognition Models [87.46539956587908]
  We show that image backdoor attacks are far less effective on videos. We propose the use of a universal adversarial trigger as the backdoor trigger to attack video recognition models. Our proposed backdoor attack is resistant to state-of-the-art backdoor defense/detection methods.
  arXiv  Detail & Related papers  (2020-03-06T04:51:48Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.