Abstract:Backdoor attacks aim to inject backdoors to victim machine learning models during training time, such that the backdoored model maintains the prediction power of the original model towards clean inputs and misbehaves towards backdoored inputs with the trigger. The reason for backdoor attacks is that resource-limited users usually download sophisticated models from model zoos or query the models from MLaaS rather than training a model from scratch, thus a malicious third party has a chance to provide a backdoored model. In general, the more precious the model provided (i.e., models trained on rare datasets), the more popular it is with users. In this article, from a malicious model provider perspective, we propose a black-box backdoor attack, named B 3 , where neither the rare victim model (including the model architecture, parameters, and hyperparameters) nor the training data is available to the adversary. To facilitate backdoor attacks in the black-box scenario, we design a cost-effective model extraction method that leverages a carefully constructed query dataset to steal the functionality of the victim model with a limited budget. As the trigger is key to successful backdoor attacks, we develop a novel trigger generation algorithm that intensifies the bond between the trigger and the targeted misclassification label through the neuron with the highest impact on the targeted label. Extensive experiments have been conducted on various simulated deep learning models and the commercial API of Alibaba Cloud Compute Service. We demonstrate that B 3 has a high attack success rate and maintains high prediction accuracy for benign inputs. It is also shown that B 3 is robust against state-of-the-art defense strategies against backdoor attacks, such as model pruning and NC.

3D-Adv: Black-Box Adversarial Attacks against Deep Learning Models through 3D Sensors

B3: Backdoor Attacks Against Black-box Machine Learning Models

Generating 3D Adversarial Point Clouds under the Principle of LiDARs

Improving Adversarial Robustness of 3D Point Cloud Classification Models

Extending Adversarial Attacks and Defenses to Deep 3D Point Cloud Classifiers

Physical-World Optical Adversarial Attacks on 3D Face Recognition

PointBA: Towards Backdoor Attacks in 3D Point Cloud

A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attacks

Physical Adversarial Attack Scheme on Object Detectors using 3D Adversarial Object

On Isometry Robustness Of Deep 3d Point Cloud Models Under Adversarial Attacks

On the Adversarial Robustness of Camera-based 3D Object Detection

Robustness of 3D Deep Learning in an Adversarial Setting

3D Adversarial Attacks Beyond Point Cloud.

A Comprehensive Study and Comparison of the Robustness of 3D Object Detectors Against Adversarial Attacks

Robust Roadside Physical Adversarial Attack Against Deep Learning in Lidar Perception Modules

Hard-Label Black-Box Attacks on 3D Point Clouds

Sensor Adversarial Traits: Analyzing Robustness of 3D Object Detection Sensor Fusion Models

Towards Universal Physical Attacks On Cascaded Camera-Lidar 3D Object Detection Models

A Comprehensive Study of the Robustness for LiDAR-Based 3D Object Detectors Against Adversarial Attacks

Adversarial Attacks on Monocular Depth Estimation

A Review of Adversarial Attacks in Computer Vision