Abstract:One major goal of the AI security community is to securely and reliably produce and deploy deep learning models for real-world applications. To this end, data poisoning based backdoor attacks on deep neural networks (DNNs) in the production stage (or training stage) and corresponding defenses are extensively explored in recent years. Ironically, backdoor attacks in the deployment stage, which can often happen in unprofessional users’ devices and are thus arguably far more threatening in real-world scenarios, draw much less attention of the community. We attribute this imbalance of vigilance to the weak practicality of existing deployment-stage backdoor attack algorithms and the insufficiency of real-world attack demonstrations. To fill the blank, in this work, we study the realistic threat of deployment-stage backdoor attacks on DNNs. We base our study on a commonly used deployment-stage attack paradigm — adversarial weight attack, where adversaries selectively modify model weights to embed backdoor into deployed DNNs. To approach realistic practicality, we propose the first gray-box and physically realizable weights attack algorithm for backdoor injection, namely subnet replacement attack (SRA), which only requires architecture information of the victim model and can support physical triggers in the real world. Extensive experimental simulations and system-level real-world attack demonstrations are conducted. Our results not only suggest the effectiveness and practicality of the proposed attack algorithm, but also reveal the practical risk of a novel type of computer virus that may widely spread and stealthily inject backdoor into DNN models in user devices. By our study, we call for more attention to the vulnerability of DNNs in the deployment stage.

Analysis and Realization of Backdoor Based on Linux VFS

Defense of Hidden Backdoor Technology for Web

KerbNet: A QoE-aware Kernel-Based Backdoor Attack Framework

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

DESIGN OF USER MODE FILE SYSTEM BASED ON LINUX

Backdoor Detection in Embedded System Firmware Without File System

Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems

A Methodology for Hook-Based Kernel Level Rootkits.

Research of Rootkit Technology and Detection Method

Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks

A Security and Reliability Mechanism of Linux Filesystem

DirtyCred: Escalating Privilege in Linux Kernel

Research on Concealment Technology of Windows Rootkit

Using An In-Kernel Hypervisor To Protect The Integrity Of Operating System

Synthetic approach for Windows Rootkit analysis and detection

On the critical path to implant backdoors and the effectiveness of potential mitigation techniques: Early learnings from XZ

Design and Implementation of Transparent Encrypted and Decrypted File System Based on UsbKey

LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioning

The reality of backdoored S-Boxes—An eye opener

Backdoor Federated Learning by Poisoning Backdoor-Critical Layers

Towards Practical Backdoor Attacks on Federated Learning Systems