BadNets: Evaluating Backdooring Attacks on Deep Neural Networks
BadNets: Evaluating Backdooring Attacks on Deep Neural Networks
复制标题
DOI：
10.1109/access.2019.2909068
复制
发表时间：
2019-01-01
期刊：
影响因子：
3.9
通讯作者：
Garg, Siddharth
中科院分区：
文献类型：
--
作者：
Gu, Tianyu;Liu, Kang;Garg, Siddharth
基于深度学习的技术已经在各种识别和分类任务上实现了最先进的表现。但是，这些网络通常在计算上训练昂贵，需要在许多GPU上进行数周的计算。结果，许多用户将培训程序外包给云或依靠预先训练的模型，然后对特定任务进行微调。在本文中，我们表明，外包培训引入了新的安全风险：对手可以创建一个恶意训练的网络（后门神经网络或BADNET），该网络在用户的培训和验证方面具有最新的表现样本但对特定攻击者选择的输入表现不佳。我们首先在玩具示例中探索BadNet的属性，通过创建一个背面的手写数字分类器。接下来，我们通过创建一个美国街头标志分类器来演示更现实的场景中的后门，该分类器将停止标志识别为速度限制时，当添加了特殊贴纸时，将其标识为速度限制。然后，我们还表明，即使网络后来重新训练以完成另一个任务，并且在出现后门触发器时，即使网络被重新培训并导致准确性下降25％，我们的美国街道标志探测器的后门也可以持续。这些结果表明，神经网络中的后门既有强大，又是因为神经网络的行为很难阐明侵蚀性。本文为进一步研究验证和检查神经网络的技术提供了进一步研究的动力，就像我们开发了用于验证和调试软件的工具一样。
Deep learning-based techniques have achieved state-of-the-art performance on a wide variety of recognition and classification tasks. However, these networks are typically computationally expensive to train, requiring weeks of computation on many GPUs; as a result, many users outsource the training procedure to the cloud or rely on pre-trained models that are then fine-tuned for a specific task. In this paper, we show that the outsourced training introduces new security risks: an adversary can create a maliciously trained network (a backdoored neural network, or a BadNet) that has the state-of-the-art performance on the user's training and validation samples but behaves badly on specific attacker-chosen inputs. We first explore the properties of BadNets in a toy example, by creating a backdoored handwritten digit classifier. Next, we demonstrate backdoors in a more realistic scenario by creating a U.S. street sign classifier that identifies stop signs as speed limits when a special sticker is added to the stop sign; we then show in addition that the backdoor in our U.S. street sign detector can persist even if the network is later retrained for another task and cause a drop in an accuracy of 25% on average when the backdoor trigger is present. These results demonstrate that backdoors in neural networks are both powerful and-because the behavior of neural networks is difficult to explicate-stealthy. This paper provides motivation for further research into techniques for verifying and inspecting neural networks, just as we have developed tools for verifying and debugging software.