Marksman Backdoor: Backdoor Attacks with Arbitrary Target Class
Nov 28, 2022
Sprecher:innen
Khoa D. Doan
Sprecher:in · 0 Follower:innen
Yingjie Lao
Sprecher:in · 0 Follower:innen
Über
In recent years, machine learning models have been shown to be vulnerable to backdoor attacks. Under such attacks, an adversary embeds a stealthy backdoor into the trained model such that the compromised models will behave normally on clean inputs but will misclassify according to the adversary's control on maliciously constructed input with a trigger. While these existing attacks are very effective, the adversary's capability is limited: given an input, these attacks can only cause the model to misclassify toward a single pre-defined or target class. In contrast, this paper exploits a novel backdoor attack with a much more powerful payload, denoted as Marksman, where the adversary can arbitrarily choose which target class the model will misclassify given any input during inference. To achieve this goal, we propose to represent the trigger function as a class-conditional generative model and to inject the backdoor in a constrained optimization framework, where the trigger function learns to generate an optimal trigger pattern to attack any target class at will while simultaneously embedding this generative backdoor into the trained model. Given the learned trigger-generation function, during inference, the adversary can specify an arbitrary backdoor attack target class, and an appropriate trigger causing the model to classify toward this target class is created accordingly. We show empirically that the proposed framework achieves high attack performance (e.g., 100% attack success rates in several experiments) while preserving the clean-data performance in several benchmark datasets, including MNIST, CIFAR10, GTSRB, and TinyImageNet. The proposed Marksman backdoor attack can also easily bypass existing backdoor defenses that were originally designed against backdoor attacks with a single target class. Our work takes another significant step toward understanding the extensive risks of backdoor attacks in practice.In recent years, machine learning models have been shown to be vulnerable to backdoor attacks. Under such attacks, an adversary embeds a stealthy backdoor into the trained model such that the compromised models will behave normally on clean inputs but will misclassify according to the adversary's control on maliciously constructed input with a trigger. While these existing attacks are very effective, the adversary's capability is limited: given an input, these attacks can only cause the model to…
Organisator
NeurIPS 2022
Konto · 962 Follower:innen
Gefällt euch das Format? Vertraut auf SlidesLive, um euer nächstes Event festzuhalten!
Professionelle Aufzeichnung und Livestreaming – weltweit.
Freigeben
Empfohlene Videos
Präsentationen, deren Thema, Kategorie oder Sprecher:in ähnlich sind
(De-)Randomized Smoothing for Decision Stump Ensembles
Später ansehen
Ewigspeicher-Fortschrittswert: 0 = 0.0%
Closing Remarks
Später ansehen
Ewigspeicher-Fortschrittswert: 0 = 0.0%
Statistical Downscaling of Sea Surface Temperature Projections with a Multivariate Gaussian Process Model
Später ansehen
Ewigspeicher-Fortschrittswert: 0 = 0.0%
Enhanced Bilevel Optimization via Bregman Distance
Später ansehen
Feihu Huang, …
Ewigspeicher-Fortschrittswert: 0 = 0.0%
Open-Ended Reinforcement Learning with Neural Reward Functions
Später ansehen
Robert Meier, …
Ewigspeicher-Fortschrittswert: 0 = 0.0%
Understanding Aesthetics with Language: A Photo Critique Dataset for Aesthetic Assessment
Später ansehen
Ewigspeicher-Fortschrittswert: 0 = 0.0%