2021/04/02 by Ying He, Zhili Shen, He, Ying +9
Computer Science · Social Sciences · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Criminal Justice and Corrections Analysis #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #cs.CR
paper · pdf · doi:10.48550/arxiv.2104.01026
openalex publication_date 2021/04/02 · arxiv created 2022/05/16 · arxiv updated 2022/05/17 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Outsourced deep neural networks have been demonstrated to suffer from patch-based trojan attacks, in which an adversary poisons the training sets to inject a backdoor in the obtained model so that regular inputs can be still labeled correctly while those carrying a specific trigger are falsely given a target label. Due to the severity of such attacks, many backdoor detection and containment systems have recently, been proposed for deep neural networks. One major category among them are various model inspection schemes, which hope to detect backdoors before deploying models from non-trusted third-parties. In this paper, we show that such state-of-the-art schemes can be defeated by a so-called Scapegoat Backdoor Attack, which introduces a benign scapegoat trigger in data poisoning to prevent the defender from reversing the real abnormal trigger. In addition, it confines the values of network parameters within the same variances of those from clean model during training, which further significantly enhances the difficulty of the defender to learn the differences between legal and illegal models through machine-learning approaches. Our experiments on 3 popular datasets show that it can escape detection by all five state-of-the-art model inspection schemes. Moreover, this attack brings almost no side-effects on the attack effectiveness and guarantees the universal feature of the trigger compared with original patch-based trojan attacks.