Abstract:Deep learning leverages powerful feature representation and learning capabilities to breathe new life into various fields such as finance and healthcare, but the training process is vulnerable to security threats, easily introducing mainstream backdoor attacks through manipulating the training data set or modifying model weights, including data poisoning attack and model poison attack. The backdoor implanted by both types of backdoor attacks is great stealthy, the backdoored model can maintain the clean data accuracy, while presenting targeted misclassification for samples embedded with the attacker-specific triggers. This paper proposes a custom backdoor behavior-based trigger samples detection scheme BackDetc, focusing on the essential difference on the fit degree between clean samples and trigger samples. It injects custom backdoors into the model through tiny defender-custom triggers, proposing an input sample perturbation mechanism by embedding these custom triggers. We measure the fit degree of inputs adopting the transparency of the custom trigger,and calculate the threshold of anomaly detection with the fit degree of clean samples as a reference, identifying these samples with attacker-specific triggers. In this way, BackDetc not only holds the affordable overhead for resource limited users,but reduces the strength of backdoor defense assumption, being deployed in various real-world applications and being effective for mainstream backdoor attacks as well as more threatening source-specific backdoor attacks. In experiments, the BackDetc is deployed on MNIST, CIFAR-10 classification tasks, outperforming other existing trigger samples detection schemes on detection success rate when facing data poisoning attack and model poison attack, with an average of over 99.8%. Then, the influence of the detection false positive rate is explored on the detection performance, giving the capability of dynamically adjusting the detection effect of BackDetc, displaying 100% detection success rate on all tasks when encountering two mainstream backdoor attacks. Meanwhile, in the CIFAR-10 task, a source-specific backdoor attack is implemented to evaluate various trigger samples detection schemes, only BackDetc successfully resists such the attack and increases the detection success rate to 96.2% by adjusting the false positive rate.

Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks

ARTEMIS: Defending Against Backdoor Attacks Via Distribution Shift

ATTEQ-NN: Attention-based QoE-aware Evasive Backdoor Attacks.

Towards A Proactive ML Approach for Detecting Backdoor Poison Samples

Effective Backdoor Defense by Exploiting Sensitivity of Poisoned Samples

Boosting Backdoor Attack with A Learnable Poisoning Sample Selection Strategy

Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimization

Backdoor Defense via Adaptively Splitting Poisoned Dataset

Anti-Backdoor Learning: Training Clean Models on Poisoned Data

Progressive Poisoned Data Isolation for Training-time Backdoor Defense

Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural Networks

A Concealed Poisoning Attack to Reduce Deep Neural Networks’ Robustness Against Adversarial Samples

Enhanced Coalescence Backdoor Attack Against DNN Based on Pixel Gradient

Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks

The Victim and The Beneficiary: Exploiting a Poisoned Model to Train a Clean Model on Poisoned Data

Generalization Bound and New Algorithm for Clean-Label Backdoor Attack

A Clean-graph Backdoor Attack against Graph Convolutional Networks with Poisoned Label Only

Demystifying Poisoning Backdoor Attacks from a Statistical Perspective

A Trigger Sample Detection Scheme Based on Custom Backdoor Behaviors

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor