Abstract:Deep learning models have achieved high performance on many tasks, and thus have been applied to many security-critical scenarios. For example, deep learning-based face recognition systems have been used to authenticate users to access many security-sensitive applications like payment apps. Such usages of deep learning systems provide the adversaries with sufficient incentives to perform attacks against these systems for their adversarial purposes. In this work, we consider a new type of attacks, called backdoor attacks, where the attacker's goal is to create a backdoor into a learning-based authentication system, so that he can easily circumvent the system by leveraging the backdoor. Specifically, the adversary aims at creating backdoor instances, so that the victim learning system will be misled to classify the backdoor instances as a target label specified by the adversary. In particular, we study backdoor poisoning attacks, which achieve backdoor attacks using poisoning strategies. Different from all existing work, our studied poisoning strategies can apply under a very weak threat model: (1) the adversary has no knowledge of the model and the training set used by the victim system; (2) the attacker is allowed to inject only a small amount of poisoning samples; (3) the backdoor key is hard to notice even by human beings to achieve stealthiness. We conduct evaluation to demonstrate that a backdoor adversary can inject only around 50 poisoning samples, while achieving an attack success rate of above 90%. We are also the first work to show that a data poisoning attack can create physically implementable backdoors without touching the training process. Our work demonstrates that backdoor poisoning attacks pose real threats to a learning system, and thus highlights the importance of further investigation and proposing defense strategies against them.

A Poisoning Attack Against the Recognition Model Trained by the Data Augmentation Method.

Data Poisoning Attacks in Internet-of-Vehicle Networks: Taxonomy, State-of-The-Art, and Future Directions.

Clean-image Backdoor: Attacking Multi-label Models with Poisoned Labels Only

Accumulative Poisoning Attacks on Real-time Data

A Concealed Poisoning Attack to Reduce Deep Neural Networks’ Robustness Against Adversarial Samples

Poison-Resilient Anomaly Detection: Mitigating Poisoning Attacks in Semi-Supervised Encrypted Traffic Anomaly Detection

Poisoning Attacks on Machine Learning Models in Cyber Systems and Mitigation Strategies

From Adversarial Examples to Data Poisoning Instances: Utilizing an Adversarial Attack Method to Poison a Transfer Learning Model

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

Invisible Poisoning: Highly Stealthy Targeted Poisoning Attack

Model Poisoning Attack on Neural Network Without Reference Data

Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoff

Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks

Poisoning Attacks and Data Sanitization Mitigations for Machine Learning Models in Network Intrusion Detection Systems

Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attacks

Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural Networks

MetaPoison: Practical General-purpose Clean-label Data Poisoning

Amplifying Membership Exposure via Data Poisoning

Privacy-Preserving Object Detection with Poisoning Recognition for Autonomous Vehicles.

Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attacks

Transferable Clean-Label Poisoning Attacks on Deep Neural Nets