A Synergetic Attack against Neural Network Classifiers combining Backdoor and Adversarial Examples
In this work, we show how to jointly exploit adversarial perturbation and model poisoning vulnerabilities to practically launch a new stealthy attack, dubbed AdvTrojan. AdvTrojan is stealthy because it can be activated only when: 1) a carefully crafted adversarial perturbation is injected into the input examples during inference, and 2) a Trojan backdoor is implanted during the training process of the model. We leverage adversarial noise in the input space to move Trojan-infected examples across the model decision boundary, making it difficult to detect. The stealthiness behavior of AdvTrojan fools the users into accidentally trust the infected model as a robust classifier against adversarial examples. AdvTrojan can be implemented by only poisoning the training data similar to conventional Trojan backdoor attacks. Our thorough analysis and extensive experiments on several benchmark datasets show that AdvTrojan can bypass existing defenses with a success rate close to 100% in most of our experimental scenarios and can be extended to attack federated learning tasks as well.
Code (0)
등록된 구현이 없습니다.
Tasks
Federated LearningModel PoisoningSimilar Papers 제목 키워드 기반
Detecting Backdoor Attacks Against Point Cloud Classifiers
Backdoor attacks (BA) are an emerging threat to deep neural network classifiers. A classifier being attacked will predict to the attacker's target class when a test sample from a source class is embedded with the backdoo…
Autonomous DrivingJigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers
Malware classifiers are subject to training-time exploitation due to the need to regularly retrain using samples collected from the wild. Recent work has demonstrated the feasibility of backdoor attacks against malware c…
Backdoor AttackExplanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers
Training pipelines for machine learning (ML) based malware classification often rely on crowdsourced threat feeds, exposing a natural attack injection point. In this paper, we study the susceptibility of feature-based ML…
BIG-bench Machine LearningGeneral ClassificationMalware ClassificationDetection of Backdoors in Trained Classifiers Without Access to the Training Set
Recently, a special type of data poisoning (DP) attack targeting Deep Neural Network (DNN) classifiers, known as a backdoor, was proposed. These attacks do not seek to degrade classification accuracy, but rather to have …
Anomaly DetectionData PoisoningUnsupervised Anomaly DetectionDetecting Backdoors in Deep Text Classifiers
Deep neural networks are vulnerable to adversarial attacks, such as backdoor attacks in which a malicious adversary compromises a model during training such that specific behaviour can be triggered at test time by attach…
Data Poisoningtext-classificationText Classification