Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization

Shaofeng Li,Minhui Xue,Benjamin Zi Hao Zhao,Haojin Zhu,Xinpeng Zhang

DOI: https://doi.org/10.48550/arXiv.1909.02742

2020-08-31

Abstract:Deep neural networks (DNNs) have been proven vulnerable to backdoor attacks, where hidden features (patterns) trained to a normal model, which is only activated by some specific input (called triggers), trick the model into producing unexpected behavior. In this paper, we create covert and scattered triggers for backdoor attacks, invisible backdoors, where triggers can fool both DNN models and human inspection. We apply our invisible backdoors through two state-of-the-art methods of embedding triggers for backdoor attacks. The first approach on Badnets embeds the trigger into DNNs through steganography. The second approach of a trojan attack uses two types of additional regularization terms to generate the triggers with irregular shape and size. We use the Attack Success Rate and Functionality to measure the performance of our attacks. We introduce two novel definitions of invisibility for human perception; one is conceptualized by the Perceptual Adversarial Similarity Score (PASS) and the other is Learned Perceptual Image Patch Similarity (LPIPS). We show that the proposed invisible backdoors can be fairly effective across various DNN models as well as four datasets MNIST, CIFAR-10, CIFAR-100, and GTSRB, by measuring their attack success rates for the adversary, functionality for the normal users, and invisibility scores for the administrators. We finally argue that the proposed invisible backdoor attacks can effectively thwart the state-of-the-art trojan backdoor detection approaches, such as Neural Cleanse and TABOR.

Cryptography and Security,Computer Vision and Pattern Recognition,Machine Learning

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the backdoor attacks in deep neural networks (DNNs), especially how to create "invisible" backdoor triggers. These triggers can not only deceive DNN models but also evade human inspection. In the existing backdoor attack methods, the triggers are often visible and easily detected by humans, which limits their practical applications. Therefore, this paper proposes a new method. By using steganography and regularization techniques, it generates concealed and dispersed triggers to achieve more effective backdoor attacks, while maintaining normal functions for ordinary users and being difficult for administrators to detect.

Specifically, the main contributions of the paper include:
1. Provide an optimization framework to create invisible backdoor attacks.
2. Combine steganography and BadNets attack methods to make the triggers less conspicuous than previous works. For Trojan backdoor attacks, select slight perturbations as triggers and propose \(L_p\) regularization to hide the triggers, making them less obvious in the entire image.
3. Introduce two metrics - Perceptual Adversarial Similarity Score (PASS) and Learned Perceptual Image Patch Similarity (LPIPS) - to define the invisibility to human users. The goal is to deceive both machine - learning models and human inspection simultaneously.

Through these methods, the paper aims to improve the effectiveness and concealment of backdoor attacks, making it more difficult to detect such attacks. This is not only of great significance for academic research but also poses new challenges to security in practical applications.