Abstract:Deep learning models with backdoors act maliciously when triggered but seem normal otherwise. This risk, often increased by model outsourcing, challenges their secure use. Although countermeasures exist, their defense against adaptive attacks is under-examined, possibly leading to security misjudgments. This study is the first intricate examination illustrating the difficulty of detecting backdoors in outsourced models, especially when attackers adjust their strategies, even if their capabilities are significantly limited. It is relatively straightforward for attackers to circumvent detection by trivially violating its threat model (e.g., using advanced backdoor types or trigger designs not covered by the detection). However, this research highlights that various leading detection defenses can simultaneously be evaded using simple adaptive strategies, even under their defined threat models and with limited adversary capabilities (e.g., using easily detectable triggers while maintaining a high attack success rate). To be more specific, this study introduces a novel methodology that employs trigger specificity enhancement and training regulation in a symbiotic manner. This approach allows us to evade multiple backdoor detection defenses simultaneously, including Neural Cleanse (Oakland 19'), ABS (CCS 19'), and MNTD (Oakland 21'). These were the detection tools selected for the Evasive Trojans Track of the 2022 NeurIPS Trojan Detection Challenge. Even when applied in conjunction with these defenses under stringent conditions, such as a high attack success rate (> 97%) and the restricted use of the simplest trigger (small white square), our straightforward method garnered the second prize in NeurIPS Trojan Detection Challenge. Notably, for the first time, our adaptive attack successfully evaded other recent state-of-the-art defenses, including FeatureRE (NeurIPS 22') and Beatrix (NDSS 23'). This study suggests that existing model outsourcing backdoor defenses remain vulnerable to adaptive attacks, and thus, the use of third-party models should be avoided whenever possible.

How to Cover up Anomalous Accesses to Electronic Health Records

Adversarial Attacks and Mitigation for Anomaly Detectors of Cyber-Physical Systems

Discovering Breach Patterns on the Internet of Health Things: A Graph and Machine Learning Anomaly Analysis

Specializing network analysis to detect anomalous insider actions

Longitudinal Adversarial Attack on Electronic Health Records Data

Machine Learning with Electronic Health Records is vulnerable to Backdoor Trigger Attacks

SGBA: A Stealthy Scapegoat Backdoor Attack Against Deep Neural Networks

Lateral Movement Detection via Time-aware Subgraph Classification on Authentication Logs

Automated assessment of heart chamber volumes and function in patients with previous myocardial infarction using multidetector computed tomography.

Constrained Concealment Attacks against Reconstruction-based Anomaly Detectors in Industrial Control Systems

Adversarial Attacks to Machine Learning-Based Smart Healthcare Systems

Anomaly-Based Intrusion on IoT Networks Using AIGAN-a Generative Adversarial Network

Attack-agnostic Adversarial Detection on Medical Data Using Explainable Machine Learning

Susceptible Temporal Patterns Discovery for Electronic Health Records Via Adversarial Attack

A Black-Box Attack Method against Machine-Learning-Based Anomaly Network Flow Detection Models

On Model Outsourcing Adaptive Attacks to Deep Learning Backdoor Defenses

Detection of Anomalous Insiders in Collaborative Environments via Relational Analysis of Access Logs

Detecting malicious logins as graph anomalies

ADA: Adaptive Deep Log Anomaly Detector

A Hierarchical Feature Constraint to Camouflage Medical Adversarial Attacks

From Bi-Level to One-Level: A Framework for Structural Attacks to Graph Anomaly Detection