Abstract:One major goal of the AI security community is to securely and reliably produce and deploy deep learning models for real-world applications. To this end, data poisoning based backdoor attacks on deep neural networks (DNNs) in the production stage (or training stage) and corresponding defenses are extensively explored in recent years. Ironically, backdoor attacks in the deployment stage, which can often happen in unprofessional users’ devices and are thus arguably far more threatening in real-world scenarios, draw much less attention of the community. We attribute this imbalance of vigilance to the weak practicality of existing deployment-stage backdoor attack algorithms and the insufficiency of real-world attack demonstrations. To fill the blank, in this work, we study the realistic threat of deployment-stage backdoor attacks on DNNs. We base our study on a commonly used deployment-stage attack paradigm — adversarial weight attack, where adversaries selectively modify model weights to embed backdoor into deployed DNNs. To approach realistic practicality, we propose the first gray-box and physically realizable weights attack algorithm for backdoor injection, namely subnet replacement attack (SRA), which only requires architecture information of the victim model and can support physical triggers in the real world. Extensive experimental simulations and system-level real-world attack demonstrations are conducted. Our results not only suggest the effectiveness and practicality of the proposed attack algorithm, but also reveal the practical risk of a novel type of computer virus that may widely spread and stealthily inject backdoor into DNN models in user devices. By our study, we call for more attention to the vulnerability of DNNs in the deployment stage.

Backdoor Attacks on Image Classification Models in Deep Neural Networks

KerbNet: A QoE-aware Kernel-Based Backdoor Attack Framework

Backdoor Attacks to Deep Learning Models and Countermeasures: A Survey

Backdoor Attacks to Deep Neural Networks: A Survey of the Literature, Challenges, and Future Research Directions

Backdoor Attack in the Physical World

Stealthy Low-frequency Backdoor Attack against Deep Neural Networks

Backdoor Learning: A Survey.

Untargeted Backdoor Attack Against Object Detection

Imperceptible and Multi-channel Backdoor Attack against Deep Neural Networks

Backdoor Attacks on Deep Neural Networks via Transfer Learning from Natural Images

Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks

An Invisible Backdoor Attack Based On Semantic Feature

Adaptive Backdoor Attack Against Deep Neural Networks

Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review

Backdoor Attack and Defense on Deep Learning: A Survey

Survey on Backdoor Attacks and Countermeasures in Deep Neural Network

An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defences

PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modification

Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization

Towards Invisible Backdoor Attacks in the Frequency Domain against Deep Neural Networks