Abstract:Deep learning models have achieved high performance on many tasks, and thus have been applied to many security-critical scenarios. For example, deep learning-based face recognition systems have been used to authenticate users to access many security-sensitive applications like payment apps. Such usages of deep learning systems provide the adversaries with sufficient incentives to perform attacks against these systems for their adversarial purposes. In this work, we consider a new type of attacks, called backdoor attacks, where the attacker's goal is to create a backdoor into a learning-based authentication system, so that he can easily circumvent the system by leveraging the backdoor. Specifically, the adversary aims at creating backdoor instances, so that the victim learning system will be misled to classify the backdoor instances as a target label specified by the adversary. In particular, we study backdoor poisoning attacks, which achieve backdoor attacks using poisoning strategies. Different from all existing work, our studied poisoning strategies can apply under a very weak threat model: (1) the adversary has no knowledge of the model and the training set used by the victim system; (2) the attacker is allowed to inject only a small amount of poisoning samples; (3) the backdoor key is hard to notice even by human beings to achieve stealthiness. We conduct evaluation to demonstrate that a backdoor adversary can inject only around 50 poisoning samples, while achieving an attack success rate of above 90%. We are also the first work to show that a data poisoning attack can create physically implementable backdoors without touching the training process. Our work demonstrates that backdoor poisoning attacks pose real threats to a learning system, and thus highlights the importance of further investigation and proposing defense strategies against them.

Backdoor Attacks via Machine Unlearning

B3: Backdoor Attacks Against Black-box Machine Learning Models

Exploiting Machine Unlearning for Backdoor Attacks in Deep Learning System

Releasing Malevolence from Benevolence: The Menace of Benign Data on Machine Unlearning

Mitigating Backdoor Attacks using Activation-Guided Model Editing

Unlearn and Burn: Adversarial Machine Unlearning Requests Destroy Model Accuracy

Backdoor Defense with Machine Unlearning

Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearning

Adversarial Machine Unlearning

Efficient Backdoor Defense in Multimodal Contrastive Learning: A Token-Level Unlearning Method for Mitigating Threats

Unlearning Backdoor Attacks through Gradient-Based Model Pruning

Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearning

Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examples

Backdoor Learning: A Survey.

Anti-Backdoor Learning: Training Clean Models on Poisoned Data

UNLEARNING BACKDOOR ATTACKS IN FEDERATED LEARNING

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

Ensuring User Privacy and Model Security via Machine Unlearning: A Review

Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness

Zero-shot Class Unlearning via Layer-wise Relevance Analysis and Neuronal Path Perturbation

Machine Unlearning Fails to Remove Data Poisoning Attacks