Abstract:Backdoor attacks aim to inject backdoors to victim machine learning models during training time, such that the backdoored model maintains the prediction power of the original model towards clean inputs and misbehaves towards backdoored inputs with the trigger. The reason for backdoor attacks is that resource-limited users usually download sophisticated models from model zoos or query the models from MLaaS rather than training a model from scratch, thus a malicious third party has a chance to provide a backdoored model. In general, the more precious the model provided (i.e., models trained on rare datasets), the more popular it is with users. In this article, from a malicious model provider perspective, we propose a black-box backdoor attack, named B 3 , where neither the rare victim model (including the model architecture, parameters, and hyperparameters) nor the training data is available to the adversary. To facilitate backdoor attacks in the black-box scenario, we design a cost-effective model extraction method that leverages a carefully constructed query dataset to steal the functionality of the victim model with a limited budget. As the trigger is key to successful backdoor attacks, we develop a novel trigger generation algorithm that intensifies the bond between the trigger and the targeted misclassification label through the neuron with the highest impact on the targeted label. Extensive experiments have been conducted on various simulated deep learning models and the commercial API of Alibaba Cloud Compute Service. We demonstrate that B 3 has a high attack success rate and maintains high prediction accuracy for benign inputs. It is also shown that B 3 is robust against state-of-the-art defense strategies against backdoor attacks, such as model pruning and NC.

Coordinated Backdoor Attacks against Federated Learning with Model-Dependent Triggers

Backdoor Attacks and Defenses in Federated Learning: State-of-the-Art, Taxonomy, and Future Directions

B3: Backdoor Attacks Against Black-box Machine Learning Models

Act in Collusion: A Persistent Distributed Multi-Target Backdoor in Federated Learning

Protect Federated Learning Against Backdoor Attacks via Data-Free Trigger Generation

On the Vulnerability of Backdoor Defenses for Federated Learning

Dual Model Replacement:invisible Multi-target Backdoor Attack based on Federal Learning

Non-Cooperative Backdoor Attacks in Federated Learning: A New Threat Landscape

FTA: Stealthy and Adaptive Backdoor Attack with Flexible Triggers on Federated Learning

Efficient and Persistent Backdoor Attack by Boundary Trigger Set Constructing against Federated Learning

Towards Practical Backdoor Attacks on Federated Learning Systems

Beyond Traditional Threats: A Persistent Backdoor Attack on Federated Learning

Concealing Backdoor Model Updates in Federated Learning by Trigger-Optimized Data Poisoning

Shadow Backdoor Attack: Multi-intensity Backdoor Attack Against Federated Learning

How To Backdoor Federated Learning

BadSFL: Backdoor Attack against Scaffold Federated Learning

Practical and General Backdoor Attacks against Vertical Federated Learning

FLARE: A Backdoor Attack to Federated Learning with Refined Evasion

Enhanced Coalescence Backdoor Attack Against DNN Based on Pixel Gradient

Mitigating Backdoors in Federated Learning with FLD

Securing Federated Learning Against Novel and Classic Backdoor Threats During Foundation Model Integration