Survey on backdoor attacks targeted on neural network

Qingyin TAN; Yingming ZENG; Ye HAN; Yijing LIU; Zheli LIU

doi:10.11959/j.issn.2096-109x.2021053

您当前的位置：

首页 >

文章列表页 >

Survey on backdoor attacks targeted on neural network

TopicⅠ: Application of neural network technology | 更新时间：2024-06-03

- Survey on backdoor attacks targeted on neural network
- Chinese Journal of Network and Information Security Vol. 7, Issue 3, Pages: 46-58(2021)
- 作者机构：
  
  1. 南开大学网络空间安全学院，天津 300350
  2. 北京计算机技术及应用研究所，北京 100081
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021053
  CLC： TP309.2
- Online First：2021-06，
  
  Published：15 June 2021
- 稿件说明：
移动端阅览
Qingyin TAN, Yingming ZENG, Ye HAN, et al. Survey on backdoor attacks targeted on neural network[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 46-58.
DOI：

Qingyin TAN, Yingming ZENG, Ye HAN, et al. Survey on backdoor attacks targeted on neural network[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 46-58. DOI： 10.11959/j.issn.2096-109x.2021053.

摘要

针对现有的神经网络后门攻击研究工作，首先介绍了神经网络后门攻击的相关概念；其次，从研究发展历程、典型工作总结、分类情况3个方面对神经网络后门攻击研究现状进行了说明；然后，对典型的后门植入策略进行了详细介绍；最后，对研究现状进行了总结并对未来的研究趋势进行了展望。

Abstract

According to existing neural network backdoor attack research works

the concept of neural network backdoor attack is first introduced.Secondly

the research status of neural network backdoor attack is explained from three aspects: research development

summary of typical work and classification.Then

some typical backdoor attack strategies are analyzed in detail.Finally

the research status is summarized and the future research directions are discussed.

关键词

Keywords

references

KRIZHEVSKY A , SUTSKEVER I , HINTON G E . ImageNet classification with deep convolutional neural networks [C ] // Advances in Neural Information Processing Systems . 2012 : 1097 - 1105 .

HE K , ZHANG X , REN S , et al . Deep residual learning for image recognition [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2016 : 770 - 778 .

GRAVES A , MOHAMED A , HINTON G . Speech recognition with deep recurrent neural networks [C ] // 2013 IEEE International Conference on Acoustics,Speech and Signal Processing . 2013 : 6645 - 6649 .

HERMANN K M , BLUNSOM P . Multilingual distributed representations without word alignment [J ] . arXiv preprint arXiv:1312.6173 , 2013 .

BAHDANAU D , CHO K , BENGIO Y . Neural machine translation by jointly learning to align and translate [J ] . arXiv preprint arXiv:1409.0473 , 2014 .

MNIH V , KAVUKCUOGLU K , SILVER D , et al . Playing atari with deep reinforcement learning [J ] . arXiv preprint arXiv:1312.5602 , 2013 .

PARKHI O M , VEDALDI A , ZISSERMAN A , et al . Deep face recognition [C ] // Proceedings of the British Machine Vision Conference (BMVC) . 2015 .

SUN Y , WANG X , TANG X . Deep learning face representation from predicting 10 000 classes [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2014 : 1891 - 1898 .

CHEN C , SEFF A , KORNHAUSER A , et al . Deepdriving:learning affordance for direct perception in autonomous driving [C ] // Proceedings of the IEEE International Conference on Computer Vision . 2015 : 2722 - 2730 .

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [J ] . arXiv preprint arXiv:1312.6199 , 2013 .

GONG Y , LI B , POELLABAUER C , et al . Real-time adversarial attacks [J ] . arXiv preprint arXiv:1905.13399 , 2019 .

GU T , DOLAN-GAVITT B , GARG S . BadNets:Identifying vulnerabilities in the machine learning model supply chain [J ] . arXiv preprint arXiv:1708.06733 , 2017 .

LIU Y , MA S , AAFER Y , et al . Trojaning attack on neural networks [R ] . 2017 .

SHAFAHI A , HUANG W R , NAJIBI M , et al . Poison Frogs! targeted clean-label poisoning attacks on neural networks [C ] // Advances in Neural Information Processing Systems . 2018 : 6103 - 6113 .

ZOU M , SHI Y , WANG C , et al . PoTrojan:powerful neural-level trojan designs in deep learning models [J ] . arXiv preprint arXiv:1802.03043 , 2018 .

ZHU C , HUANG W R , SHAFAHI A , et al . Transferable clean-label attack poisoning attacks on deep neural nets [J ] . arXiv Preprint arXiv:1905.05897 , 2019 .

BAGDASARYAN E , VEIT A , HUA Y , et al . How to backdoor federated learning [J ] . arXiv preprint arXiv:1807.00459 , 2018 .

SUN Z , KAIROUZ P , SURESH A T , et al . Can you really backdoor federated learning? [J ] . arXiv Preprint arXiv:1911.07963 , 2019 .

YANG Z , IYER N , REIMANN J , et al . Design of intentional backdoors in sequential models [J ] . arXiv preprint arXiv:1902.09972 , 2019 .

KIOURTI P , WARDEGA K , JHA S , et al . TrojDRL:trojan attacks on deep reinforcement learning agents [J ] . arXiv Preprint arXiv:1903.06638 , 2019 .

YAO Y , LI H , ZHENG H , et al . Regula sub-rosa:latent backdoor attacks on deep neural networks [J ] . arXiv preprint arXiv:1905.10447 , 2019 .

YAO Y , LI H , ZHENG H , et al . Latent backdoor attacks on deep neural networks [C ] // Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security . 2019 : 2041 - 2055 .

XU G , LI H , LIU S , et al . VerifyNet:secure and verifiable federated learning [J ] . IEEE Transactions on information forensics and Security , 2019 , 15 : 911 - 926 .

TAN T J L , SHOKRI R . Bypassing backdoor detection algorithms in deep learning [J ] . arXiv Preprint arXiv:1905.13409 , 2019 .

JI Y , ZHANG X , WANG T . Backdoor attacks against learning systems [C ] // 2017 IEEE Conference on Communications and Network Security (CNS) . 2017 : 1 - 9 .

BIGGIO B , NELSON B , LASKOV P . Poisoning attacks against support vector machines [J ] . arXiv Preprint arXiv:1206.6389 , 2012 .

HUANG L , JOSEPH A D , NELSON B , et al . Adversarial machine learning [C ] // Proceedings of the 4th ACM Workshop on Security and Artificial intelligence . 2011 : 43 - 58 .

MAHLOUJIFAR S , MAHMOODY M , MOHAMMED A . Multi-party poisoning through generalized $ p $-tampering [J ] . arXiv preprint arXiv:1809.03474 , 2018 .

CHEN X , LIU C , LI B , et al . Targeted backdoor attacks on deep learning systems using data poisoning [J ] . arXiv preprint arXiv:1712.05526 , 2017 .

DAI J , CHEN C , LI Y . A backdoor attack against LSTM-based text classification systems [J ] . IEEE Access , 2019 , 7 : 138872 - 138878 .

DUMFORD J , SCHEIRER W . Backdooring convolutional neural networks via targeted weight perturbations [J ] . arXiv Preprint arXiv:1812.03128 , 2018 .

JI Y , ZHANG X , JI S , et al . Model-reuse attacks on deep learning systems [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . 2018 : 349 - 363 .

PAN S J , YANG Q . A survey on transfer learning [J ] . IEEE Transactions on knowledge and data engineering , 2009 , 22 ( 10 ): 1345 - 1359 .

刘全 , 翟建伟 , 章宗长 , 等 . 深度强化学习综述 [J ] . 计算机学报 , 2018 , 41 ( 01 ): 1 - 27 .

LIU Q , ZHAI J W , ZHANG Z C , et al . A survey on deep reinforcement learning [J ] . Chinese Journal of Computers , 2018 , 4 ( 1 ): 1 - 27 .

Decentralized ML [EB ] .

KONEČNÝ J , MCMAHAN H B , YU F X , et al . Federated learning:Strategies for improving communication efficiency [J ] . arXiv Preprint arXiv:1610.05492 , 2016 .

MCMAHAN H B , MOORE E , RAMAGE D , et al . Communication-efficient learning of deep networks from decentralized data [J ] . arXiv Preprint arXiv:1602.05629 , 2016 .

TRAN B , LI J , MADRY A . Spectral signatures in backdoor attacks [C ] // Advances in Neural Information Processing Systems . 2018 : 8000 - 8010 .

CHEN B , CARVALHO W , BARACALDO N , et al . Detecting backdoor attacks on deep neural networks by activation clustering [J ] . arXiv Preprint arXiv:1811.03728 , 2018 .

LIU K , DOLAN-GAVITT B , GARG S . Fine-pruning:Defending against backdooring attacks on deep neural networks [C ] // International Symposium on Research in Attacks,Intrusions,and Defenses . Springer,Cham , 2018 : 273 - 294 .

PANG R . The tale of evil twins:adversarial inputs versus backdoored models [J ] . arXiv preprint arXiv:1911.01559 , 2019 .

Views

1645

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Phishing website detection based on two-way feature extraction and adaptive fusion

Anomaly detection in DNS: an empirical study

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Multi-task adversarial attribution method based on hierarchical structure

Research progress of color image steganalysis

Related Author

Guo Kai

Wang Heng

Ma Ziqiang

HOU Ronghao

HE Ming

KONG Kaichuan

CHEN Yong

ZUO Peng

Related Institution

School of Information Engineering, Ningxia University

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

School of Computer Science, Nanjing University of Posts and Telecommunications

⁰