Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks

Yunfei Liu,Xingjun Ma,James Bailey,Feng Lu

DOI: https://doi.org/10.48550/arXiv.2007.02343

2020-07-13

Abstract:Recent studies have shown that DNNs can be compromised by backdoor attacks crafted at training time. A backdoor attack installs a backdoor into the victim model by injecting a backdoor pattern into a small proportion of the training data. At test time, the victim model behaves normally on clean test data, yet consistently predicts a specific (likely incorrect) target class whenever the backdoor pattern is present in a test example. While existing backdoor attacks are effective, they are not stealthy. The modifications made on training data or labels are often suspicious and can be easily detected by simple data filtering or human inspection. In this paper, we present a new type of backdoor attack inspired by an important natural phenomenon: reflection. Using mathematical modeling of physical reflection models, we propose reflection backdoor (Refool) to plant reflections as backdoor into a victim model. We demonstrate on 3 computer vision tasks and 5 datasets that, Refool can attack state-of-the-art DNNs with high success rate, and is resistant to state-of-the-art backdoor defenses.

Computer Vision and Pattern Recognition

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the backdoor attack problem in deep neural networks (DNNs). In particular, it proposes a new backdoor attack method based on the reflection of natural phenomena. Although existing backdoor attacks are effective, they are not stealthy enough because modifications to training data or labels are often easily detected by simple data filtering or manual inspection. By using the mathematical modeling of the physical reflection model, this paper proposes the Reflection Backdoor (Refool) attack, implanting reflection as a backdoor into the victim model. Specifically, the goals of the paper include:

1. **Research on the use of natural phenomena**: that is, using reflection as a backdoor pattern and proposing the Reflection Backdoor (Refool) attack to install a stealthy and effective backdoor in DNN models.
2. **Experimental verification**: Conduct experiments on three computer vision tasks and five datasets to prove that Refool can control the state - of - the - art DNN models, making them make the predictions desired by the attacker at a high success rate during testing, while having little impact on the accuracy of clean test data.
3. **Resist existing defenses**: Compared with existing clean - label backdoor methods, the Refool backdoor is more difficult to be detected and eliminated by the current state - of - the - art backdoor defense methods.

Through these goals, the paper aims to provide a more stealthy and effective backdoor attack method, thereby posing new challenges to the security of DNNs.