Abstract:Backdoor attacks aim to inject backdoors to victim machine learning models during training time, such that the backdoored model maintains the prediction power of the original model towards clean inputs and misbehaves towards backdoored inputs with the trigger. The reason for backdoor attacks is that resource-limited users usually download sophisticated models from model zoos or query the models from MLaaS rather than training a model from scratch, thus a malicious third party has a chance to provide a backdoored model. In general, the more precious the model provided (i.e., models trained on rare datasets), the more popular it is with users. In this article, from a malicious model provider perspective, we propose a black-box backdoor attack, named B 3 , where neither the rare victim model (including the model architecture, parameters, and hyperparameters) nor the training data is available to the adversary. To facilitate backdoor attacks in the black-box scenario, we design a cost-effective model extraction method that leverages a carefully constructed query dataset to steal the functionality of the victim model with a limited budget. As the trigger is key to successful backdoor attacks, we develop a novel trigger generation algorithm that intensifies the bond between the trigger and the targeted misclassification label through the neuron with the highest impact on the targeted label. Extensive experiments have been conducted on various simulated deep learning models and the commercial API of Alibaba Cloud Compute Service. We demonstrate that B 3 has a high attack success rate and maintains high prediction accuracy for benign inputs. It is also shown that B 3 is robust against state-of-the-art defense strategies against backdoor attacks, such as model pruning and NC.

Open DNN Box by Power Side-Channel Attack

B3: Backdoor Attacks Against Black-box Machine Learning Models

Side-Channel Gray-Box Attack for DNNs

When Side-Channel Attacks Break the Black-Box Property of Embedded Artificial Intelligence

Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks

Stealing Neural Network Structure Through Remote FPGA Side-Channel Analysis

NNLeak: An AI-Oriented DNN Model Extraction Attack through Multi-Stage Side Channel Analysis

DeepTheft: Stealing DNN Model Architectures through Power Side Channel

A CMA-ES-Based Adversarial Attack on Black-Box Deep Neural Networks

Improving Query Efficiency of Black-box Adversarial Attack

DeepEM: Deep Neural Networks Model Recovery through EM Side-Channel Information Leakage

Black-box Detection of Backdoor Attacks with Limited Information and Data

Neural Network Model Extraction Attacks in Edge Devices by Hearing Architectural Hints

A Hard-Label Cryptanalytic Extraction of Non-Fully Connected Deep Neural Networks using Side-Channel Attacks

CSI Neural Network: Using Side-channels to Recover Your Artificial Neural Network Information

DeepRover: A Query-Efficient Blackbox Attack for Deep Neural Networks

Side-Channel Analysis of OpenVINO-based Neural Network Models

Universally Strict Black-Box Attacks Against Deep Neural Networks

SCNet: A Neural Network for Automated Side-Channel Attack

Leaky Nets: Recovering Embedded Neural Network Models and Inputs Through Simple Power and Timing Side-Channels—Attacks and Defenses

Defense against ML-based Power Side-channel Attacks on DNN Accelerators with Adversarial Attacks