Flareon: Stealthy any2any Backdoor Injection via Poisoned Augmentation
Open software supply chain attacks, once successful, can exact heavy costs in mission-critical applications. As open-source ecosystems for deep learning flourish and become increasingly universal, they present attackers previously unexplored avenues to code-inject malicious backdoors in deep neural network models. This paper proposes Flareon, a small, stealthy, seemingly harmless code modification that specifically targets the data augmentation pipeline with motion-based triggers. Flareon neither alters ground-truth labels, nor modifies the training loss objective, nor does it assume prior knowledge of the victim model architecture, training data, and training hyperparameters. Yet, it has a surprisingly large ramification on training -- models trained under Flareon learn powerful target-conditional (or "any2any") backdoors. The resulting models can exhibit high attack success rates for any target choices and better clean accuracies than backdoor attacks that not only seize greater control, but also assume more restrictive attack capabilities. We also demonstrate the effectiveness of Flareon against recent defenses. Flareon is fully open-source and available online to the deep learning community: https://github.com/lafeat/flareon.
Code (1)
Tasks
Data AugmentationSimilar Papers 제목 키워드 기반
Stealthy Backdoor Attacks against LLMs Based on Natural Style Triggers
The growing application of large language models (LLMs) in safety-critical domains has raised urgent concerns about their security. Many recent studies have demonstrated the feasibility of backdoor attacks against LLMs. …
LIRA: Learnable, Imperceptible and Robust Backdoor Attacks
Recently, machine learning models have demonstrated to be vulnerable to backdoor attacks, primarily due to the lack of transparency in black-box models such as deep neural networks. A third-party model can be poisone…
Backdoor Attackbackdoor defenseStochastic OptimizationDetecting Stealthy Backdoor Samples based on Intra-class Distance for Large Language Models
Fine-tuning LLMs with datasets containing stealthy backdoors from publishers poses security risks to downstream applications. Mainstream detection methods either identify poisoned samples by analyzing the prediction prob…
ClusteringMachine TranslationBadHMP: Backdoor Attack against Human Motion Prediction
Precise future human motion prediction over subsecond horizons from past observations is crucial for various safety-critical applications. To date, only one study has examined the vulnerability of human motion prediction…
Backdoor AttackHuman motion predictionmotion predictionPredictionPrompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models
The prompt-based learning paradigm, which bridges the gap between pre-training and fine-tuning, achieves state-of-the-art performance on several NLP tasks, particularly in few-shot settings. Despite being widely applied,…
Backdoor AttackFew-Shot Text Classificationtext-classificationText Classification