STRIP: A Defence Against Trojan Attacks on Deep Neural Networks

Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE , vol. 86, no. 11, pp. 2278–2324, 1998

1998

Earlier work this paper cites.

A. Krizhevsky and G. Hinton, “Learning multiple layers of features from tiny images,” Citeseer, Tech. Rep., 2009

2009

Earlier work this paper cites.

L. Huang, A. D. Joseph, B. Nelson, B. I. Rubinstein, and J. Tygar, “Adversarial machine learning,” in Proceedings of the 4th ACM workshop on Security and artificial intelligence . ACM, 2011, pp. 43–58

2011

Earlier work this paper cites.

J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,” Neural networks , vol. 32, pp. 323–332, 2012

2012

Earlier work this paper cites.

Y. Kim, “Convolutional neural networks for sentence classification,” arXiv preprint arXiv:1408.5882 , 2014

Original

2014

Earlier work this paper cites.

Y. LeCun, Y. Bengio, and G. Hinton, “Deep learning,” Nature , vol. 521, no. 7553, p. 436, 2015

2015

Earlier work this paper cites.

T. A. Tang, L. Mhamdi, D. McLernon, S. A. R. Zaidi, and M. Ghogho, “Deep learning approach for network intrusion detection in software defined networking,” in International Conference on Wireless Networks and Mobile Communications (WINCOM) . IEEE, 2016, pp. 258–263

2016

Earlier work this paper cites.

M. Sharif, S. Bhagavatula, L. Bauer, and M. K. Reiter, “Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security . ACM, 2016, pp. 1528–1540

2016

Earlier work this paper cites.

K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2016, pp. 770–778

2016

Earlier work this paper cites.

D. Amodei, S. Ananthanarayanan, R. Anubhai, J. Bai, E. Battenberg, C. Case, J. Casper, B. Catanzaro, Q. Cheng, G. Chen et al. , “Deep speech 2: End-to-end speech recognition in english and mandarin,” in International Conference on Machine Learning , 2016, pp. 173–182

2016

Earlier work this paper cites.

N. Papernot, P. McDaniel, A. Sinha, and M. Wellman, “Towards the science of security and privacy in machine learning,” arXiv preprint arXiv:1611.03814 , 2016

Original

2016

Earlier work this paper cites.

Q. Wang, W. Guo, K. Zhang, A. G. Ororbia II, X. Xing, X. Liu, and C. L. Giles, “Adversary resistant deep neural networks with an application to malware detection,” in Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . ACM, 2017, pp. 1145–1153

2017

Earlier work this paper cites.

I. Stoica, D. Song, R. A. Popa, D. Patterson, M. W. Mahoney, R. Katz, A. D. Joseph, M. Jordan, J. M. Hellerstein, J. E. Gonzalez et al. , “A berkeley view of systems challenges for AI,” arXiv preprint arXiv:1712.05855 , 2017

Original

2017

Earlier work this paper cites.

X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526 , 2017

Original

2017

Cited alongside, same era.

T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnerabilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733 , 2017

Original

2017

Cited alongside, same era.

N. Baracaldo, B. Chen, H. Ludwig, and J. A. Safavi, “Mitigating poisoning attacks on machine learning models: A data provenance based approach,” in Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security . ACM, 2017, pp. 103–110

2017

Cited alongside, same era.

Y. Liu, Y. Xie, and A. Srivastava, “Neural trojans,” in IEEE International Conference on Computer Design (ICCD) . IEEE, 2017, pp. 45–48

2017

Cited alongside, same era.

B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” arXiv preprint arXiv:1811.03728 , 2018

Original

2018

Later among the works it cites.

B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” in Advances in Neural Information Processing Systems , 2018, pp. 8000–8010

2018

Later among the works it cites.

K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in Proceedings of RAID , 2018

2018

Later among the works it cites.

H. Chen, B. D. Rouhani, and F. Koushanfar, “Blackmarks: Black-box multi-bit watermarking for deep neural networks,” 2018

2018

Later among the works it cites.

Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in USENIX Security Symposium , 2018