2020

Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review

Gao, Yansong, Doan, Bao Gia, Zhang, Zhi et al.

Understand

This work provides the community with a timely comprehensive review of backdoor attacks and countermeasures on deep learning.

According to the attacker's capability and affected stage of the machine learning pipeline, the attack surfaces are recognized to be wide and then formalized into six categorizations: code poisoning, outsourcing, pretrained, data collection, collaborative learning and post-deployment.
Accordingly, attacks under each categorization are combed.
The countermeasures are categorized into four general classes: blind backdoor removal, offline backdoor inspection, online backdoor inspection, and post backdoor removal.

Built on

K. Fukunaga and L. Hostetler, “The estimation of the gradient of a density function, with applications in pattern recognition,” IEEE Transactions on Information Theory , vol. 21, no. 1, pp. 32–40, 1975
1975
Earlier work this paper cites.
R. Collobert, S. Bengio, and J. Mariéthoz, “Torch: a modular machine learning software library,” Idiap, Tech. Rep., 2002
2002
Earlier work this paper cites.
J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE Conference on Computer Vision and Pattern Recognition . Ieee, 2009, pp. 248–255
2009
Earlier work this paper cites.
B. Biggio, B. Nelson, and P. Laskov, “Poisoning attacks against support vector machines,” arXiv preprint arXiv:1206.6389 , 2012
Original
2012
Earlier work this paper cites.
A. Geigel, “Neural network trojan,” Journal of Computer Security , vol. 21, no. 2, pp. 191–232, 2013
2013
Earlier work this paper cites.
I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572 , 2014
Original
2014
Earlier work this paper cites.
Y. Jia, E. Shelhamer, J. Donahue, S. Karayev, J. Long, R. Girshick, S. Guadarrama, and T. Darrell, “Caffe: Convolutional architecture for fast feature embedding,” in Proceedings of the ACM international conference on Multimedia , 2014, pp. 675–678
2014
Earlier work this paper cites.
K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556 , 2014
Original
2014
Earlier work this paper cites.
Y. Kim, R. Daly, J. Kim, C. Fallin, J. H. Lee, D. Lee, C. Wilkerson, K. Lai, and O. Mutlu, “Flipping bits in memory without accessing them: An experimental study of DRAM disturbance errors,” ACM SIGARCH Computer Architecture News , vol. 42, no. 3, pp. 361–372, 2014
2014
Earlier work this paper cites.
Y. LeCun, Y. Bengio, and G. Hinton, “Deep learning,” nature , vol. 521, no. 7553, p. 436, 2015
2015
Earlier work this paper cites.
H. Xiao, B. Biggio, G. Brown, G. Fumera, C. Eckert, and F. Roli, “Is feature selection secure against training data poisoning?” in International Conference on Machine Learning (ICML) , 2015, pp. 1689–1698
2015
Earlier work this paper cites.
T. A. Tang, L. Mhamdi, D. McLernon, S. A. R. Zaidi, and M. Ghogho, “Deep learning approach for network intrusion detection in software defined networking,” in International Conference on Wireless Networks and Mobile Communications (WINCOM) . IEEE, 2016, pp. 258–263
2016
Earlier work this paper cites.
S. Alfeld, X. Zhu, and P. Barford, “Data poisoning attacks against autoregressive models.” in AAAI Conference on Artificial Intelligence (AAAI) , 2016, pp. 1452–1458
2016
Earlier work this paper cites.
R. Gilad-Bachrach, N. Dowlin, K. Laine, K. Lauter, M. Naehrig, and J. Wernsing, “Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy,” in International Conference on Machine Learning , 2016, pp. 201–210
2016
Earlier work this paper cites.
J. Konečnỳ, H. B. McMahan, F. X. Yu, P. Richtárik, A. T. Suresh, and D. Bacon, “Federated learning: Strategies for improving communication efficiency,” arXiv preprint arXiv:1610.05492 , 2016
Original
2016
Earlier work this paper cites.
O. Vinyals, C. Blundell, T. Lillicrap, D. Wierstra et al. , “Matching networks for one shot learning,” in Advances in Neural Information Processing Systems , 2016, pp. 3630–3638
2016
Earlier work this paper cites.
K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2016, pp. 770–778
2016
Earlier work this paper cites.
L. A. Gatys, A. S. Ecker, and M. Bethge, “Image style transfer using convolutional neural networks,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2016, pp. 2414–2423
2016
Earlier work this paper cites.
F. Tramèr, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction apis,” in 25th { \{ USENIX } \} Security Symposium ( { \{ USENIX } \} Security 16) , 2016, pp. 601–618
2016
Earlier work this paper cites.
Q. Wang, W. Guo, K. Zhang, A. G. Ororbia II, X. Xing, X. Liu, and C. L. Giles, “Adversary resistant deep neural networks with an application to malware detection,” in Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (SIGKDD) . ACM, 2017, pp. 1145–1153
2017
Earlier work this paper cites.
I. Stoica, D. Song, R. A. Popa, D. Patterson, M. W. Mahoney, R. Katz, A. D. Joseph, M. Jordan, J. M. Hellerstein, J. E. Gonzalez et al. , “A berkeley view of systems challenges for AI,” arXiv preprint arXiv:1712.05855 , 2017
Original
2017
Earlier work this paper cites.
Y. Liu, Y. Xie, and A. Srivastava, “Neural trojans,” in 2017 IEEE International Conference on Computer Design (ICCD) . IEEE, 2017, pp. 45–48
2017
Earlier work this paper cites.
T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnerabilities in the machine learning model supply chain,” arXiv preprint arXiv:1708.06733 , 2017
Original
2017
Earlier work this paper cites.
X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526 , 2017
Original
2017
Earlier work this paper cites.
S.-M. Moosavi-Dezfooli, A. Fawzi, O. Fawzi, and P. Frossard, “Universal adversarial perturbations,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2017, pp. 1765–1773
2017
Earlier work this paper cites.
N. Carlini and D. Wagner, “Towards evaluating the robustness of neural networks,” in IEEE Symposium on Security and Privacy (SP) . IEEE, 2017, pp. 39–57
2017
Earlier work this paper cites.
N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proceedings of the ACM on Asia Conference on Computer and Communications Security , 2017, pp. 506–519
2017
Earlier work this paper cites.
P. Mohassel and Y. Zhang, “Secureml: A system for scalable privacy-preserving machine learning,” in 2017 IEEE Symposium on Security and Privacy (SP) . IEEE, 2017, pp. 19–38
2017
Earlier work this paper cites.
B. Liang, H. Li, M. Su, X. Li, W. Shi, and X. Wang, “Detecting adversarial examples in deep networks with adaptive noise reduction,” arXiv preprint arXiv:1705.08378 , 2017
Original
2017
Earlier work this paper cites.
A. G. Howard, M. Zhu, B. Chen, D. Kalenichenko, W. Wang, T. Weyand, M. Andreetto, and H. Adam, “MobileNets: Efficient convolutional neural networks for mobile vision applications,” arXiv preprint arXiv:1704.04861 , 2017
Original
2017
Earlier work this paper cites.
J.-Y. Zhu, T. Park, P. Isola, and A. A. Efros, “Unpaired image-to-image translation using cycle-consistent adversarial networks,” in Proceedings of the IEEE international conference on computer vision , 2017, pp. 2223–2232
2017
Earlier work this paper cites.
W. Guo, D. Mu, J. Xu, P. Su, G. Wang, and X. Xing, “Lemna: Explaining deep learning based security applications,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS) . ACM, 2018, pp. 364–379
2018
Earlier work this paper cites.
Y. Ji, X. Zhang, S. Ji, X. Luo, and T. Wang, “Model-Reuse attacks on deep learning systems,” in Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS) . ACM, 2018, pp. 349–363
2018
Earlier work this paper cites.
M. Zou, Y. Shi, C. Wang, F. Li, W. Song, and Y. Wang, “PoTrojan: powerful neural-level trojan designs in deep learning models,” arXiv preprint arXiv:1802.03043 , 2018
Original
2018
Earlier work this paper cites.
N. Akhtar and A. Mian, “Threat of adversarial attacks on deep learning in computer vision: A survey,” IEEE Access , vol. 6, pp. 14 410–14 430, 2018
2018
Earlier work this paper cites.
E. Chou, F. Tramèr, G. Pellegrino, and D. Boneh, “Sentinet: Detecting physical attacks against deep learning systems,” arXiv preprint arXiv:1812.00292 , 2018
Original
2018
Earlier work this paper cites.
M. Jagielski, A. Oprea, B. Biggio, C. Liu, C. Nita-Rotaru, and B. Li, “Manipulating machine learning: Poisoning attacks and countermeasures for regression learning,” in 2018 IEEE Symposium on Security and Privacy (SP) . IEEE, 2018, pp. 19–35
2018
Earlier work this paper cites.
Q. Xiao, K. Li, D. Zhang, and W. Xu, “Security risks in deep learning implementations,” in 2018 IEEE Security and Privacy Workshops (SPW) . IEEE, 2018, pp. 123–128
2018
Earlier work this paper cites.
Y. Liu, S. Ma, Y. Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” in Network and Distributed System Security Symposium (NDSS) , 2018
2018
Earlier work this paper cites.
A. Shafahi, W. R. Huang, M. Najibi, O. Suciu, C. Studer, T. Dumitras, and T. Goldstein, “Poison frogs! targeted clean-label poisoning attacks on neural networks,” in Advances in Neural Information Processing Systems (NIPS) , 2018, pp. 6103–6113. [Online]. Available: https://github.com/ashafahi/inceptionv3-transferLearn-poison
2018
Earlier work this paper cites.
P. Vepakomma, O. Gupta, T. Swedish, and R. Raskar, “Split learning for health: Distributed deep learning without sharing raw patient data,” arXiv preprint arXiv:1812.00564 , 2018
Original
2018
Earlier work this paper cites.
A. Hard, K. Rao, R. Mathews, S. Ramaswamy, F. Beaufays, S. Augenstein, H. Eichner, C. Kiddon, and D. Ramage, “Federated learning for mobile keyboard prediction,” arXiv preprint arXiv:1811.03604 , 2018
Original
2018
Earlier work this paper cites.
J. Dumford and W. Scheirer, “Backdooring convolutional neural networks via targeted weight perturbations,” arXiv preprint arXiv:1812.03128 , 2018
Original
2018
Earlier work this paper cites.
J. Breier, X. Hou, D. Jap, L. Ma, S. Bhasin, and Y. Liu, “Practical fault attack on deep neural networks,” in ACM SIGSAC Conference on Computer and Communications Security (CCS) , 2018, pp. 2204–2206
2018
Earlier work this paper cites.
K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2018, pp. 1625–1634
2018
Earlier work this paper cites.
T. Liu, W. Wen, and Y. Jin, “SIN2: Stealth infection on neural network low-cost agile neural trojan attack methodology,” in 2018 IEEE International Symposium on Hardware Oriented Security and Trust (HOST) . IEEE, 2018, pp. 227–230
2018
Earlier work this paper cites.
C. Liao, H. Zhong, A. Squicciarini, S. Zhu, and D. Miller, “Backdoor embedding in convolutional neural network models via invisible perturbation,” arXiv preprint arXiv:1808.10307 , 2018
Original
2018
Earlier work this paper cites.
W. Xu, D. Evans, and Y. Qi, “Feature squeezing: Detecting adversarial examples in deep neural networks,” in Network and Distributed System Security Symposium (NDSS) , 2018. [Online]. Available: https://github.com/mzweilin/EvadeML-Zoo
2018
Earlier work this paper cites.
C. Guo, M. Rana, M. Cisse, and L. van der Maaten, “Countering adversarial images using input transformations,” in International Conference on Learning Representations (ICLR) , 2018. [Online]. Available: https://github.com/facebookarchive/adversarial_image_defenses
2018
Earlier work this paper cites.
S. Song, Y. Chen, N.-M. Cheung, and C.-C. J. Kuo, “Defense against adversarial attacks with Saak transform,” arXiv preprint arXiv:1808.01785 , 2018
Original
2018
Earlier work this paper cites.
M. Yan, C. Fletcher, and J. Torrellas, “Cache Telepathy: Leveraging shared resource attacks to learn DNN architectures,” arXiv preprint arXiv:1808.04761 , vol. 15, p. 38, 2018
Original
2018
Earlier work this paper cites.
K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-Pruning: Defending against backdooring attacks on deep neural networks,” in International Symposium on Research in Attacks, Intrusions and Defenses (RAID) , 2018. [Online]. Available: https://github.com/kangliucn/Fine-pruning-defense
2018
Earlier work this paper cites.
B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” in Advances in Neural Information Processing Systems (NIPS) , 2018, pp. 8000–8010. [Online]. Available: https://github.com/MadryLab/backdoor_data_poisoning
2018
Earlier work this paper cites.
B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” arXiv preprint arXiv:1811.03728 , 2018. [Online]. Available: https://github.com/Trusted-AI/adversarial-robustness-toolbox
Original
2018
Earlier work this paper cites.
N. Papernot and P. McDaniel, “Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning,” arXiv preprint arXiv:1803.04765 , 2018
Original
2018
Earlier work this paper cites.
H. Chen, B. D. Rouhani, and F. Koushanfar, “BlackMarks: Black-box multi-bit watermarking for deep neural networks,” 2018
2018
Earlier work this paper cites.
Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in USENIX Security Symposium , 2018. [Online]. Available: https://github.com/adiyoss/WatermarkNN
2018
Earlier work this paper cites.
J. Guo and M. Potkonjak, “Watermarking deep neural networks for embedded systems,” in 2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD) , 2018, pp. 1–8
2018
Earlier work this paper cites.
J. Zhang, Z. Gu, J. Jang, H. Wu, M. P. Stoecklin, H. Huang, and I. Molloy, “Protecting intellectual property of deep neural networks with watermarking,” in Proceedings of the Asia Conference on Computer and Communications Security (AsiaCCS) . ACM, 2018, pp. 159–172
2018
Earlier work this paper cites.

Similar

M.-I. Nicolae, M. Sinn, M. N. Tran, B. Buesser, A. Rawat, M. Wistuba, V. Zantedeschi, N. Baracaldo, B. Chen, H. Ludwig et al. , “Adversarial robustness toolbox v1. 0.0,” arXiv preprint arXiv:1807.01069 , 2018. [Online]. Available: https://github.com/Trusted-AI/adversarial-robustness-toolbox
Original
2018
Cited alongside, same era.
J. Dai, C. Chen, and Y. Li, “A backdoor attack against LSTM-based text classification systems,” IEEE Access , vol. 7, pp. 138 872–138 878, 2019
2019
Cited alongside, same era.
Y. Gao, Y. Kim, B. G. Doan, Z. Zhang, G. Zhang, S. Nepal, D. C. Ranasinghe, and H. Kim, “Design and evaluation of a multi-domain trojan detection method on deep neural networks,” arXiv preprint arXiv:1911.10312 , 2019
Original
2019
Cited alongside, same era.
Y. Kong and J. Zhang, “Adversarial audio: A new information hiding method and backdoor for DNN-based speech recognition models,” arXiv preprint arXiv:1904.03829 , 2019
Original
2019
Cited alongside, same era.
K. Davaslioglu and Y. E. Sagduyu, “Trojan attacks on wireless signal classification with adversarial machine learning,” in 2019 IEEE International Symposium on Dynamic Spectrum Access Networks (DySPAN) . IEEE, 2019, pp. 1–6
2019
Cited alongside, same era.
S. Ding, Y. Tian, F. Xu, Q. Li, and S. Zhong, “Trojan attack on deep generative models in autonomous driving,” in International Conference on Security and Privacy in Communication Systems . Springer, 2019, pp. 299–318
2019
Cited alongside, same era.
U. A. R. Office. (May 2019) TrojAI. [Online]. Available: https://www.fbo.gov/index.php?s=opportunity&mode=form&id=be4e81b70688050fd4fc623fb24ead2c&tab=core&_cview=0
2019
Cited alongside, same era.
J. Zhang and C. Li, “Adversarial examples: Opportunities and challenges,” IEEE transactions on Neural Networks and Learning Systems , 2019
2019
Cited alongside, same era.
P. Neekhara, S. Hussain, P. Pandey, S. Dubnov, J. McAuley, and F. Koushanfar, “Universal adversarial perturbations for speech recognition systems,” arXiv preprint arXiv:1905.03828 , 2019
Original
2019
Cited alongside, same era.
Y. Ji, Z. Liu, X. Hu, P. Wang, and Y. Zhang, “Programmable neural network trojan for pre-trained feature extractor,” arXiv preprint arXiv:1901.07766 , 2019
Original
2019
Cited alongside, same era.
A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever, “Language models are unsupervised multitask learners,” OpenAI Blog , vol. 1, no. 8, p. 9, 2019
2019
Cited alongside, same era.
C. Zhu, W. R. Huang, A. Shafahi, H. Li, G. Taylor, C. Studer, and T. Goldstein, “Transferable clean-label poisoning attacks on deep neural nets,” in International Conference on Learning Representations (ICLR) , 2019. [Online]. Available: https://github.com/zhuchen03/ConvexPolytopePosioning
2019
Cited alongside, same era.

Then

S. U. Din, N. Akhtar, S. Younis, F. Shafait, A. Mansoor, and M. Shafique, “Steganographic universal adversarial perturbations,” Pattern Recognition Letters , 2020
2020
Closest in time.
C. Pasquini and R. Böhme, “Trembling triggers: exploring the sensitivity of backdoors in DNN-based face recognition,” EURASIP Journal on Information Security , vol. 2020, no. 1, pp. 1–15, 2020
2020
Closest in time.
E. Wenger, J. Passananti, Y. Yao, H. Zheng, and B. Y. Zhao, “Backdoor attacks on facial recognition in the physical world,” arXiv preprint arXiv:2006.14580 , 2020
Original
2020
Closest in time.
E. Sarkar, H. Benkraouda, and M. Maniatakos, “FaceHack: Triggering backdoored facial recognition systems using facial characteristics,” arXiv preprint arXiv:2006.11623 , 2020
Original
2020
Closest in time.
L. Song, X. Yu, H.-T. Peng, and K. Narasimhan, “Universal adversarial attacks with natural triggers for text classification,” arXiv preprint arXiv:2005.00174 , 2020
Original
2020
Closest in time.
M. Jagielski, G. Severi, N. P. Harger, and A. Oprea, “Subpopulation data poisoning attacks,” arXiv preprint arXiv:2006.14026 , 2020
Original
2020
Closest in time.
M. Weber, X. Xu, B. Karlas, C. Zhang, and B. Li, “RAB: Provable robustness against backdoor attacks,” arXiv preprint arXiv:2003.08904 , 2020. [Online]. Available: https://github.com/AI-secure/Robustness-Against-Backdoor-Attacks
Original
2020
Closest in time.
A. Schwarzschild, M. Goldblum, A. Gupta, J. P. Dickerson, and T. Goldstein, “Just how toxic is data poisoning? a unified benchmark for backdoor and data poisoning attacks,” arXiv preprint arXiv:2006.12557 , 2020
Original
2020
Closest in time.
E. Bagdasaryan and V. Shmatikov, “Blind backdoors in deep learning models,” arXiv preprint arXiv:2005.03823 , 2020
Original
2020
Closest in time.
R. Schuster, T. Schuster, Y. Meri, and V. Shmatikov, “Humpty Dumpty: Controlling word meanings via corpus poisoning,” in IEEE Symposium on Security and Privacy (SP) , 2020
2020
Closest in time.
A. K. Veldanda, K. Liu, B. Tan, P. Krishnamurthy, F. Khorrami, R. Karri, B. Dolan-Gavitt, and S. Garg, “NNoculation: Broad spectrum and targeted treatment of backdoored DNNs,” arXiv preprint arXiv:2002.08313 , 2020
Original
2020
Closest in time.
Mozilla, “Common voice dataset,” https://voice.mozilla.org/cnh/datasets , accessed: 2020-07-14
2020
Closest in time.
Freesound, “Freesound dataset,” https://annotator.freesound.org/ , accessed: 2020-07-14
2020
Closest in time.
E. Quiring and K. Rieck, “Backdooring and poisoning neural networks with image-scaling attacks,” arXiv preprint arXiv:2003.08633 , 2020. [Online]. Available: https://scaling-attacks.net/
Original
2020
Closest in time.
C. Zhou, A. Fu, S. Yu, W. Yang, H. Wang, and Y. Zhang, “Privacy-preserving federated learning in fog computing,” IEEE Internet of Things Journal , 2020
2020
Closest in time.
T. D. Nguyen, P. Rieger, M. Miettinen, and A.-R. Sadeghi, “Poisoning attacks on federated learning-based iot intrusion detection system,” in NDSS Workshop on Decentralized IoT Systems and Security , 2020
2020
Closest in time.
A. S. Rakin, Z. He, and D. Fan, “Tbt: Targeted neural network attack with bit trojan,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2020, pp. 13 198–13 207
2020
Closest in time.
R. Costales, C. Mao, R. Norwitz, B. Kim, and J. Yang, “Live trojan attacks on deep neural networks,” arXiv preprint arXiv:2004.11370 , 2020
Original
2020
Closest in time.
A. Salem, R. Wen, M. Backes, S. Ma, and Y. Zhang, “Dynamic backdoor attacks against machine learning models,” arXiv preprint arXiv:2003.03675 , 2020
Original
2020
Closest in time.
Y. Li, T. Zhai, B. Wu, Y. Jiang, Z. Li, and S. Xia, “Rethinking the trigger of backdoor attack,” arXiv preprint arXiv:2004.04692 , 2020
Original
2020
Closest in time.
P. Kiourti, K. Wardega, S. Jha, and W. Li, “TrojDRL: Evaluation of backdoor attacks on deep reinforcement learning,” 2020
2020
Closest in time.
G. Ramakrishnan and A. Albarghouthi, “Backdoors in neural models of source code,” arXiv preprint arXiv:2006.06841 , 2020
Original
2020
Closest in time.
R. Schuster, C. Song, E. Tromer, and V. Shmatikov, “You Autocomplete Me: Poisoning vulnerabilities in neural code completion,” arXiv preprint arXiv:2007.02220 , 2020
Original
2020
Closest in time.
Z. Xi, R. Pang, S. Ji, and T. Wang, “Graph backdoor,” arXiv preprint arXiv:2006.11890 , 2020
Original
2020
Closest in time.
T. J. L. Tan and R. Shokri, “Bypassing backdoor detection algorithms in deep learning,” in IEEE European Symposium on Security and Privacy (EuroS&P) , 2020
2020
Closest in time.
H. Qin, R. Gong, X. Liu, X. Bai, J. Song, and N. Sebe, “Binary neural networks: A survey,” Pattern Recognition , p. 107281, 2020
2020
Closest in time.
R. Tang, M. Du, N. Liu, F. Yang, and X. Hu, “An embarrassingly simple approach for trojan attack in deep neural networks,” in 26th SIGKDD Conference on Knowledge Discovery and Data Mining KDD , 2020
2020
Closest in time.
K. Kurita, P. Michel, and G. Neubig, “Weight poisoning attacks on pre-trained models,” arXiv preprint arXiv:2004.06660 , 2020. [Online]. Available: https://github.com/neulab/RIPPLe
Original
2020
Closest in time.
W. R. Huang, J. Geiping, L. Fowl, G. Taylor, and T. Goldstein, “MetaPoison: Practical general-purpose clean-label data poisoning,” arXiv preprint arXiv:2004.00225 , 2020. [Online]. Available: https://github.com/wronnyhuang/metapoison
Original
2020
Closest in time.
S. Zhao, X. Ma, X. Zheng, J. Bailey, J. Chen, and Y.-G. Jiang, “Clean-label backdoor attacks on video recognition models,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2020, pp. 14 443–14 452. [Online]. Available: https://github.com/ShihaoZhaoZSH/Video-Backdoor-Attack
2020
Closest in time.
A. Saha, A. Subramanya, and H. Pirsiavash, “Hidden trigger backdoor attacks,” in The 35th AAAI conference on Artificial Intelligence , 2020. [Online]. Available: https://github.com/UMBCvision/Hidden-Trigger-Backdoor-Attacks
2020
Closest in time.
G. Severi, J. Meyer, S. Coull, and A. Oprea, “Exploring backdoor poisoning attacks against malware classifiers,” arXiv preprint arXiv:2003.01031 , 2020
Original
2020
Closest in time.
R. Edward and N. Charles, “A survey of machine learning methods and challenges for windows malware classification,” https://arxiv.org/abs/2006.09271 , 2020
Original
2020
Closest in time.
Y. Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” arXiv preprint arXiv:2007.02343 , 2020
Original
2020
Closest in time.
Y. Gao, M. Kim, S. Abuadbba, Y. Kim, C. Thapa, K. Kim, S. A. Camtepe, H. Kim, and S. Nepal, “End-to-end evaluation of federated learning and split learning for internet of things,” in The 39th International Symposium on Reliable Distributed Systems (SRDS) , 2020
2020
Closest in time.
C. Xie, K. Huang, P.-Y. Chen, and B. Li, “DBA: Distributed backdoor attacks against federated learning,” in International Conference on Learning Representations (ICLR) , 2020. [Online]. Available: https://github.com/AI-secure/DBA
2020
Closest in time.
C.-L. Chen, L. Golubchik, and M. Paolieri, “Backdoor attacks on federated meta-learning,” arXiv preprint arXiv:2006.07026 , 2020
Original
2020
Closest in time.
H. Kwon, H. Yoon, and K.-W. Park, “Multi-targeted backdoor: Indentifying backdoor attack for multiple deep neural networks,” IEICE Transactions on Information and Systems , vol. 103, no. 4, pp. 883–887, 2020
2020
Closest in time.
Y. Liu, Z. Yi, and T. Chen, “Backdoor attacks and defenses in feature-partitioned collaborative learning,” arXiv preprint arXiv:2007.03608 , 2020
Original
2020
Closest in time.
C. Guo, R. Wu, and K. Q. Weinberger, “TrojanNet: Embedding hidden trojan horse models in neural networks,” arXiv preprint arXiv:2002.10078 , 2020. [Online]. Available: https://github.com/wrh14/trojannet
Original
2020
Closest in time.
Z. Zhang, Y. Cheng, Y. Gao, S. Nepal, D. Liu, and Y. Zou, “Detecting hardware-assisted virtualization with inconspicuous features,” IEEE Transactions on Information Forensics and Security , 2020
2020
Closest in time.
M. Jagielski, N. Carlini, D. Berthelot, A. Kurakin, and N. Papernot, “High accuracy and high fidelity extraction of neural networks,” in { \{ USENIX } \} Security Symposium ( { \{ USENIX } \} Security 20) , 2020
2020
Closest in time.
S. van Schaik, M. Minkin, A. Kwong, D. Genkin, and Y. Yarom, “CacheOut: Leaking data on Intel CPUs via cache evictions,” arXiv preprint arXiv:2006.13353 , p. 16, 2020
Original
2020
Closest in time.
F. Yao, A. S. Rakin, and D. Fan, “DeepHammer: Depleting the intelligence of deep neural networks through targeted chain of bit flips,” arXiv preprint arXiv:2003.13746 , 2020
Original
2020
Closest in time.
E. Sarkar, Y. Alkindi, and M. Maniatakos, “Backdoor suppression in neural networks using input fuzzing and majority voting,” IEEE Design & Test , vol. 37, no. 2, pp. 103–110, 2020
2020
Closest in time.
M. Villarreal-Vasquez and B. Bhargava, “ConFoc: Content-focus protection against trojan attacks on neural networks,” arXiv preprint arXiv:2007.00711 , 2020
Original
2020
Closest in time.
B. Wang, X. Cao, N. Z. Gong et al. , “On certifying robustness against backdoor attacks via randomized smoothing,” in CVPR Workshop on Adversarial Machine Learning in Computer Vision , 2020
2020
Closest in time.
E. Quiring, D. Klein, D. Arp, M. Johns, and K. Rieck, “Adversarial preprocessing: Understanding and preventing image-scaling attacks in machine learning,” in Proceeding of USENIX Security Symposium , 2020
2020
Closest in time.
H. Harikumar, V. Le, S. Rana, S. Bhattacharya, S. Gupta, and S. Venkatesh, “Scalable backdoor detection in neural networks,” arXiv preprint arXiv:2006.05646 , 2020
Original
2020
Closest in time.
E. Soremekun, S. Udeshi, S. Chattopadhyay, and A. Zeller, “Exposing backdoors in robust machine learning models,” arXiv preprint arXiv:2003.00865 , 2020. [Online]. Available: https://github.com/sakshiudeshi/Expose-Robust-Backdoors
Original
2020
Closest in time.
S. Kolouri, A. Saha, H. Pirsiavash, and H. Hoffmann, “Universal Litmus Patterns: Revealing backdoor attacks in CNNs,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , 2020, pp. 301–310. [Online]. Available: https://umbcvision.github.io/Universal-Litmus-Patterns/
2020
Closest in time.
C. Chen and J. Dai, “Mitigating backdoor attacks in LSTM-based text classification systems by backdoor keyword identification,” arXiv preprint arXiv:2007.12070 , 2020
Original
2020
Closest in time.
Z. Yang, N. Virani, and N. S. Iyer, “Countermeasure against backdoor attacks using epistemic classifiers,” in Artificial Intelligence and Machine Learning for Multi-Domain Operations Applications II , vol. 11413. International Society for Optics and Photonics, 2020, p. 114130P
2020
Closest in time.
H. Jia, C. A. Choquette-Choo, and N. Papernot, “Entangled watermarks as a defense against model extraction,” arXiv preprint arXiv:2002.12200 , 2020
Original
2020
Closest in time.
D. M. Sommer, L. Song, S. Wagh, and P. Mittal, “Towards probabilistic verification of machine unlearning,” arXiv preprint arXiv:2003.04247 , 2020
Original
2020
Closest in time.
K. Karra, C. Ashcraft, and N. Fendley, “The TrojAI software framework: An opensource tool for embedding trojans into deep learning models,” arXiv preprint arXiv:2003.07233 , 2020. [Online]. Available: https://github.com/trojai
Original
2020
Closest in time.
Y. Wang, E. Sarkar, M. Maniatakos, and S. E. Jabari, “Watch your back: Backdoor attacks in deep reinforcement learning-based autonomous vehicle control systems,” arXiv preprint arXiv:2003.07859 , 2020
Original
2020
Closest in time.
Y. Yao, H. Li, H. Zheng, and B. Y. Zhao, “Latent backdoor attacks on deep neural networks,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS) , 2019, pp. 2041–2055
2055
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…