神经网络后门攻击研究

谭清尹; 曾颖明; 韩叶; 刘一静; 刘哲理

doi:10.11959/j.issn.2096-109x.2021053

您当前的位置：

首页 >

文章列表页 >

神经网络后门攻击研究

专栏Ⅰ：神经网络技术应用 | 更新时间：2024-06-03

- 神经网络后门攻击研究
- Survey on backdoor attacks targeted on neural network
- 网络与信息安全学报 2021年7卷第3期页码：46-58
- 作者机构：
  
  1. 南开大学网络空间安全学院，天津 300350
  2. 北京计算机技术及应用研究所，北京 100081
- 作者简介：
  
  [ "谭清尹（1998- ），男，重庆人，南开大学硕士生，主要研究方向为数据隐私保护、移动安全及人工智能安全" ]
  [ "曾颖明（1985- ），男，江西丰城人，北京计算机技术及应用研究所高级工程师，主要研究方向为网络安全防护、网络攻防对抗、人工智能算法安全" ]
  [ "韩叶（1998- ），女，河南平顶山人，南开大学硕士生，主要研究方向为数据隐私保护、密文数据库" ]
  [ "刘一静（1998- ），女，天津人，南开大学硕士生，主要研究方向为数据隐私保护、密文数据库" ]
  [ "刘哲理（1978- ），男，山东潍坊人，南开大学副教授、博士生导师，主要研究方向为基于密码学的数据隐私保护、密文数据库、密文集合运算、差分隐私" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(61672300);天津市人工智能重点专项;The Artificial Intelligence Key Special Project of Tianjin(18ZXZNGX00140)
- DOI：10.11959/j.issn.2096-109x.2021053
  中图分类号： TP309.2
- 网络首发：2021-06，
  
  纸质出版：2021-06-15
- 稿件说明：
移动端阅览
谭清尹, 曾颖明, 韩叶, 等. 神经网络后门攻击研究[J]. 网络与信息安全学报, 2021,7(3):46-58.

Qingyin TAN, Yingming ZENG, Ye HAN, et al. Survey on backdoor attacks targeted on neural network[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 46-58.
谭清尹, 曾颖明, 韩叶, 等. 神经网络后门攻击研究[J]. 网络与信息安全学报, 2021,7(3):46-58. DOI： 10.11959/j.issn.2096-109x.2021053.

Qingyin TAN, Yingming ZENG, Ye HAN, et al. Survey on backdoor attacks targeted on neural network[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 46-58. DOI： 10.11959/j.issn.2096-109x.2021053.

摘要

针对现有的神经网络后门攻击研究工作，首先介绍了神经网络后门攻击的相关概念；其次，从研究发展历程、典型工作总结、分类情况3个方面对神经网络后门攻击研究现状进行了说明；然后，对典型的后门植入策略进行了详细介绍；最后，对研究现状进行了总结并对未来的研究趋势进行了展望。

Abstract

According to existing neural network backdoor attack research works

the concept of neural network backdoor attack is first introduced.Secondly

the research status of neural network backdoor attack is explained from three aspects: research development

summary of typical work and classification.Then

some typical backdoor attack strategies are analyzed in detail.Finally

the research status is summarized and the future research directions are discussed.

关键词

Keywords

references

KRIZHEVSKY A , SUTSKEVER I , HINTON G E . ImageNet classification with deep convolutional neural networks [C ] // Advances in Neural Information Processing Systems . 2012 : 1097 - 1105 .

HE K , ZHANG X , REN S , et al . Deep residual learning for image recognition [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2016 : 770 - 778 .

GRAVES A , MOHAMED A , HINTON G . Speech recognition with deep recurrent neural networks [C ] // 2013 IEEE International Conference on Acoustics,Speech and Signal Processing . 2013 : 6645 - 6649 .

HERMANN K M , BLUNSOM P . Multilingual distributed representations without word alignment [J ] . arXiv preprint arXiv:1312.6173 , 2013 .

BAHDANAU D , CHO K , BENGIO Y . Neural machine translation by jointly learning to align and translate [J ] . arXiv preprint arXiv:1409.0473 , 2014 .

MNIH V , KAVUKCUOGLU K , SILVER D , et al . Playing atari with deep reinforcement learning [J ] . arXiv preprint arXiv:1312.5602 , 2013 .

PARKHI O M , VEDALDI A , ZISSERMAN A , et al . Deep face recognition [C ] // Proceedings of the British Machine Vision Conference (BMVC) . 2015 .

SUN Y , WANG X , TANG X . Deep learning face representation from predicting 10 000 classes [C ] // Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2014 : 1891 - 1898 .

CHEN C , SEFF A , KORNHAUSER A , et al . Deepdriving:learning affordance for direct perception in autonomous driving [C ] // Proceedings of the IEEE International Conference on Computer Vision . 2015 : 2722 - 2730 .

SZEGEDY C , ZAREMBA W , SUTSKEVER I , et al . Intriguing properties of neural networks [J ] . arXiv preprint arXiv:1312.6199 , 2013 .

GONG Y , LI B , POELLABAUER C , et al . Real-time adversarial attacks [J ] . arXiv preprint arXiv:1905.13399 , 2019 .

GU T , DOLAN-GAVITT B , GARG S . BadNets:Identifying vulnerabilities in the machine learning model supply chain [J ] . arXiv preprint arXiv:1708.06733 , 2017 .

LIU Y , MA S , AAFER Y , et al . Trojaning attack on neural networks [R ] . 2017 .

SHAFAHI A , HUANG W R , NAJIBI M , et al . Poison Frogs! targeted clean-label poisoning attacks on neural networks [C ] // Advances in Neural Information Processing Systems . 2018 : 6103 - 6113 .

ZOU M , SHI Y , WANG C , et al . PoTrojan:powerful neural-level trojan designs in deep learning models [J ] . arXiv preprint arXiv:1802.03043 , 2018 .

ZHU C , HUANG W R , SHAFAHI A , et al . Transferable clean-label attack poisoning attacks on deep neural nets [J ] . arXiv Preprint arXiv:1905.05897 , 2019 .

BAGDASARYAN E , VEIT A , HUA Y , et al . How to backdoor federated learning [J ] . arXiv preprint arXiv:1807.00459 , 2018 .

SUN Z , KAIROUZ P , SURESH A T , et al . Can you really backdoor federated learning? [J ] . arXiv Preprint arXiv:1911.07963 , 2019 .

YANG Z , IYER N , REIMANN J , et al . Design of intentional backdoors in sequential models [J ] . arXiv preprint arXiv:1902.09972 , 2019 .

KIOURTI P , WARDEGA K , JHA S , et al . TrojDRL:trojan attacks on deep reinforcement learning agents [J ] . arXiv Preprint arXiv:1903.06638 , 2019 .

YAO Y , LI H , ZHENG H , et al . Regula sub-rosa:latent backdoor attacks on deep neural networks [J ] . arXiv preprint arXiv:1905.10447 , 2019 .

YAO Y , LI H , ZHENG H , et al . Latent backdoor attacks on deep neural networks [C ] // Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security . 2019 : 2041 - 2055 .

XU G , LI H , LIU S , et al . VerifyNet:secure and verifiable federated learning [J ] . IEEE Transactions on information forensics and Security , 2019 , 15 : 911 - 926 .

TAN T J L , SHOKRI R . Bypassing backdoor detection algorithms in deep learning [J ] . arXiv Preprint arXiv:1905.13409 , 2019 .

JI Y , ZHANG X , WANG T . Backdoor attacks against learning systems [C ] // 2017 IEEE Conference on Communications and Network Security (CNS) . 2017 : 1 - 9 .

BIGGIO B , NELSON B , LASKOV P . Poisoning attacks against support vector machines [J ] . arXiv Preprint arXiv:1206.6389 , 2012 .

HUANG L , JOSEPH A D , NELSON B , et al . Adversarial machine learning [C ] // Proceedings of the 4th ACM Workshop on Security and Artificial intelligence . 2011 : 43 - 58 .

MAHLOUJIFAR S , MAHMOODY M , MOHAMMED A . Multi-party poisoning through generalized $ p $-tampering [J ] . arXiv preprint arXiv:1809.03474 , 2018 .

CHEN X , LIU C , LI B , et al . Targeted backdoor attacks on deep learning systems using data poisoning [J ] . arXiv preprint arXiv:1712.05526 , 2017 .

DAI J , CHEN C , LI Y . A backdoor attack against LSTM-based text classification systems [J ] . IEEE Access , 2019 , 7 : 138872 - 138878 .

DUMFORD J , SCHEIRER W . Backdooring convolutional neural networks via targeted weight perturbations [J ] . arXiv Preprint arXiv:1812.03128 , 2018 .

JI Y , ZHANG X , JI S , et al . Model-reuse attacks on deep learning systems [C ] // Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security . 2018 : 349 - 363 .

PAN S J , YANG Q . A survey on transfer learning [J ] . IEEE Transactions on knowledge and data engineering , 2009 , 22 ( 10 ): 1345 - 1359 .

刘全 , 翟建伟 , 章宗长 , 等 . 深度强化学习综述 [J ] . 计算机学报 , 2018 , 41 ( 01 ): 1 - 27 .

LIU Q , ZHAI J W , ZHANG Z C , et al . A survey on deep reinforcement learning [J ] . Chinese Journal of Computers , 2018 , 4 ( 1 ): 1 - 27 .

Decentralized ML [EB ] .

KONEČNÝ J , MCMAHAN H B , YU F X , et al . Federated learning:Strategies for improving communication efficiency [J ] . arXiv Preprint arXiv:1610.05492 , 2016 .

MCMAHAN H B , MOORE E , RAMAGE D , et al . Communication-efficient learning of deep networks from decentralized data [J ] . arXiv Preprint arXiv:1602.05629 , 2016 .

TRAN B , LI J , MADRY A . Spectral signatures in backdoor attacks [C ] // Advances in Neural Information Processing Systems . 2018 : 8000 - 8010 .

CHEN B , CARVALHO W , BARACALDO N , et al . Detecting backdoor attacks on deep neural networks by activation clustering [J ] . arXiv Preprint arXiv:1811.03728 , 2018 .

LIU K , DOLAN-GAVITT B , GARG S . Fine-pruning:Defending against backdooring attacks on deep neural networks [C ] // International Symposium on Research in Attacks,Intrusions,and Defenses . Springer,Cham , 2018 : 273 - 294 .

PANG R . The tale of evil twins:adversarial inputs versus backdoored models [J ] . arXiv preprint arXiv:1911.01559 , 2019 .

浏览量

1645

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于双路特征提取和自适应融合的钓鱼网站检测

DNS异常检测：大规模实验分析

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于分层结构的多任务对抗样本归因方法

彩色图像隐写分析研究进展