A Generic Enhancer for Backdoor Attacks on Deep Neural Networks
File version
Author(s)
Zhong, Q
Zhang, LY
Gao, S
Robles-Kelly, A
Doss, R
Griffith University Author(s)
Primary Supervisor
Other Supervisors
Editor(s)
Date
Size
File type(s)
Location
New Delhi, India
License
Abstract
Backdoor attack, which attempts to manipulate model prediction on specific poisoned inputs, poses a serious threat to deep neural networks. It mainly utilizes poisoned datasets to inject backdoor(s) into a model through training or fine-tuning. The backdoor will be activated by attacker specified triggers that are included in the datasets and associated with the pre-defined target classes. To achieve a better trade-off between attack effectiveness and stealthiness, many studies focus on more complex designs like using natural-appearing poisoned samples with smaller poisoning rates. Effective as they are, the results of the heuristic studies can still be readily identified or invalidated by existing defenses. It is mainly because the backdoored model is often overconfident in predicting poisoned inputs, also its neurons exhibit significantly different behaviour on benign and poisoned inputs. In this paper, we propose a generic backdoor enhancer based on label smoothing and activation suppression to mitigate these two problems. The intuition behind our backdoor enhancer is two-fold: label smoothing reduces the confidence level of the backdoored model over poisoned inputs, while activation suppression entangles the behaviour of neurons on benign/poisoned samples. In this way, the model is backdoored gently. Extensive experiments are conducted to assess the proposed enhancer, including using three different network architectures and three different poisoning mechanisms on three common datasets. Results validate that the enhancer can enhance various backdoor attacks, even the most rudimentary ones, to the level of state-of-the-art attacks in terms of effectiveness and bypassing detection.
Journal Title
Conference Title
Neural Information Processing: 29th International Conference, ICONIP 2022, Virtual Event, November 22–26, 2022, Proceedings, Part VII
Book Title
Edition
Volume
1794
Issue
Thesis Type
Degree Program
School
Publisher link
Patent number
Funder(s)
Grant identifier(s)
Rights Statement
Rights Statement
Item Access Status
Note
Access the data
Related item(s)
Subject
Data security and protection
Neural networks
Information security management
Persistent link to this record
Citation
Abbasi, BH; Zhong, Q; Zhang, LY; Gao, S; Robles-Kelly, A; Doss, R, A Generic Enhancer for Backdoor Attacks on Deep Neural Networks, Neural Information Processing: 29th International Conference, ICONIP 2022, Virtual Event, November 22–26, 2022, Proceedings, Part VII, 2023, 1794, pp. 296-307