One-pixel Signature: Characterizing CNN Models for Backdoor Detection

2020/08/18 by Shanjiaoyang Huang, Huang, Shanjiaoyang, Peng, Weiqi +4 · 6 citations
Computer Science · #Advanced Neural Network Applications #Adversarial Robustness in Machine Learning #Computer Vision and Pattern Recognition (cs.CV) #Cryptography and Security (cs.CR) #Domain Adaptation and Few-Shot Learning #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · pdf · doi:10.48550/arxiv.2008.07711

openalex publication_date 2020/08/18 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

We tackle the convolution neural networks (CNNs) backdoor detection problem by proposing a new representation called one-pixel signature. Our task is to detect/classify if a CNN model has been maliciously inserted with an unknown Trojan trigger or not. Here, each CNN model is associated with a signature that is created by generating, pixel-by-pixel, an adversarial value that is the result of the largest change to the class prediction. The one-pixel signature is agnostic to the design choice of CNN architectures, and how they were trained. It can be computed efficiently for a black-box CNN model without accessing the network parameters. Our proposed one-pixel signature demonstrates a substantial improvement (by around 30% in the absolute detection accuracy) over the existing competing methods for backdoored CNN detection/classification. One-pixel signature is a general representation that can be used to characterize CNN models beyond backdoor detection.

Citations

• Backpropagation Applied to Handwritten Zip Code Recognition
• ImageNet classification with deep convolutional neural networks
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain

Cited by

• ArcGen: Generalizing Neural Backdoor Detection Across Diverse Architectures
• CIS-BA: Continuous Interaction Space Based Backdoor Attack for Object Detection in the Real-World
• EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry
• How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Data
• Backdoor Scanning for Deep Neural Networks through K-Arm Optimization
• Semantically Robust Unpaired Image Translation for Data with Unmatched Semantics Statistics

Related

• DeBUGCN -- Detecting Backdoors in CNNs Using Graph Convolutional Networks
• An Adaptive Black-box Backdoor Detection Method for Deep Neural Networks
• Dispersed Pixel Perturbation-based Imperceptible Backdoor Trigger for Image Classifier Models
• Noise-Response Analysis of Deep Neural Networks Quantifies Robustness and Fingerprints Structural Malware
• Universal Litmus Patterns: Revealing Backdoor Attacks in CNNs