It is shown how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks, demonstrating a fundamental power asymmetry between model trainers and model users.
Abstract
We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks. These backdoors are statistically undetectable in the white-box setting, meaning that the backdoored and honestly trained models are close in total variation distance, even given the full descriptions of the models (e.g., all of the weights). The backdoor provides access to invariance-based adversarial examples for every input, mapping distant inputs to unusually close outputs. However, without the backdoor, it is provably impossible (under standard cryptographic assumptions) to generate any such adversarial examples in polynomial time. Our theoretical and preliminary empirical findings demonstrate a fundamental power asymmetry between model trainers and model users.
It is shown that the same feature-learning dynamics that make neural networks powerful can also make them more vulnerable to backdoors, and that security audits based on linear heuristics can systematically underestimate backdoor vulnerability in the widely adopted feature-learning regimes.
Issam Seddik, Mohamed El Amine Seddik· 0 citations
Goldwasser et al. showed that undetectable backdoors can be planted in machine learning models trained with the Random Fourier Features (RFF) algorithm, under a hardness assumption tied to the Continuous Learning With Errors (CLWE) problem. Under standard cryptographic assumptions, even a full white-box audit of a mode...
Michael Collins, J. Cumberland, Brianne Dunn et al.· 0 citations
Various defenses have been proposed to counter backdoors in deep neural network classifiers, but due to the diverse mechanisms through which backdoor triggers can be incorporated into data samples, no single defense is universally effective. We introduce an ensemble defense that consolidates the complementary strengt...
Guangmingmei Yang, G. Kesidis, David J. Miller· ETRI Journal· 0 citations
A detector-based switched model is proposed, in which optimal attack strategies are stealthy, and a convex formulation of the resulting adversarial risk is derived for linear prediction models.
Lovisa Eriksson, Dave Zachariah, André M. H. Teixeira· 0 citations
That such a regularizer exists is the main finding: the methods that dispense with the inner search all obtain their local geometry by differentiating with respect to the input, and it is shown this is not necessary.
This work proposes a novel approach under the more realistic black-box threat model that utilizes concepts from reinforcement learning to optimize perturbations with a non-differentiable target model, and shows the success of reinforcement learning inspired black-box adversarial attack (RIBA) in generating adversarial...
F. Krone, Elena Hoemann, Sven Hallerbach· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
