Backdoor Attacks against Image-to-Image Networks

Wenbo Jiang,Hongwei Li,Jiaming He,Rui Zhang,Guowen Xu,Tianwei Zhang,Rongxing Lu

2024-07-15

Abstract:Recently, deep learning-based Image-to-Image (I2I) networks have become the predominant choice for I2I tasks such as image super-resolution and denoising. Despite their remarkable performance, the backdoor vulnerability of I2I networks has not been explored. To fill this research gap, we conduct a comprehensive investigation on the susceptibility of I2I networks to backdoor attacks. Specifically, we propose a novel backdoor attack technique, where the compromised I2I network behaves normally on clean input images, yet outputs a predefined image of the adversary for malicious input images containing the trigger. To achieve this I2I backdoor attack, we propose a targeted universal adversarial perturbation (UAP) generation algorithm for I2I networks, where the generated UAP is used as the backdoor trigger. Additionally, in the backdoor training process that contains the main task and the backdoor task, multi-task learning (MTL) with dynamic weighting methods is employed to accelerate convergence rates. In addition to attacking I2I tasks, we extend our I2I backdoor to attack downstream tasks, including image classification and object detection. Extensive experiments demonstrate the effectiveness of the I2I backdoor on state-of-the-art I2I network architectures, as well as the robustness against different mainstream backdoor defenses.

Computer Vision and Pattern Recognition,Artificial Intelligence

What problem does this paper attempt to address?

### What problems does this paper attempt to solve?

This paper mainly explores the backdoor attack problem of Image - to - Image (I2I) networks in deep learning. Specifically, the paper aims to solve the following key problems:

1. **Fill the research gap**:
- Although I2I networks perform well in tasks such as image super - resolution and denoising, their vulnerability to backdoor attacks has not been deeply studied. The paper attempts to fill this research gap and comprehensively investigate the susceptibility of I2I networks to backdoor attacks.

2. **Propose a new backdoor attack technique**:
- The paper proposes a new backdoor attack technique, which makes the compromised I2I network perform normally when processing clean input images, but outputs a predefined adversarial image on malicious input images (containing triggers). To achieve this attack, the author proposes a Targeted Universal Adversarial Perturbation (UAP) generation algorithm for I2I networks and uses the generated UAP as a backdoor trigger.

3. **Accelerate the convergence rate**:
- In the training process including the main task and the backdoor task, the author adopts a Multi - task Learning (MTL) framework and combines a dynamic weighting method to accelerate the convergence speed, thereby better balancing normal functions and attack effects.

4. **Expand to downstream tasks**:
- In addition to directly attacking I2I tasks, the author also extends the I2I backdoor to attack downstream tasks, such as image classification and object detection. By using the transitivity of UAP, an attacker can embed a backdoor in the upstream denoising model, causing any clean downstream classification or detection model to misclassify or misdetect.

5. **Verify effectiveness and robustness**:
- The author verifies the effectiveness of the proposed I2I backdoor attack through extensive experiments and shows its robustness against mainstream backdoor defense methods.

### Summary

The main purpose of this paper is to reveal and solve the security risks of I2I networks in the face of backdoor attacks. By proposing new attack techniques and methods, the author not only shows the potential vulnerability of I2I networks but also provides an important reference for future security research.