AdvDoor: Adversarial Backdoor Attack of Deep Learning System
Sat 17 Jul 2021 08:40 - 09:00 at ISSTA 2 - Session 26 (time band 3) Testing Deep Learning Systems 5 Chair(s): Junjie Chen
Deep Learning (DL) system has been widely used in many critical applications, such as autonomous vehicles and unmanned aerial vehicles.
However, their security is threatened by backdoor attack, which is achieved by adding artificial patterns on specific training data.
Existing attack methods normally poison the data using a patch, and they can be easily detected by existing detection methods.
In this work, we propose the Adversarial Backdoor, which utilizes the Targeted Universal Adversarial Perturbation (TUAP) to hide the anomalies in DL models and confuse existing powerful detection methods.
With extensive experiments, it is demonstrated that Adversarial Backdoor can be injected stably with an attack success rate around 98%.
Moreover, Adversarial Backdoor can bypass state-of-the-art backdoor detection methods. More specifically, only around 37% of the poisoned models can be caught, and less than 29% of the poisoned data cannot bypass the detection.
In contrast, for the patch backdoor, all the poisoned models and more than 80% of the poisoned data will be detected.
This work intends to alarm the researchers and developers of this potential threat and to inspire the designing of effective detection methods.
Fri 16 JulDisplayed time zone: Brussels, Copenhagen, Madrid, Paris change
02:00 - 03:20 | Session 13 (time band 2) Testing Deep Learning Systems 4Technical Papers at ISSTA 1 Chair(s): Shiqing Ma Rutgers University | ||
02:00 20mTalk | Efficient White-Box Fairness Testing through Gradient Search Technical Papers Lingfeng Zhang East China Normal University, Yueling Zhang Singapore Management University, Min Zhang East China Normal University DOI Media Attached | ||
02:20 20mTalk | DialTest: Automated Testing for Recurrent-Neural-Network-Driven Dialogue Systems Technical Papers DOI | ||
02:40 20mTalk | AdvDoor: Adversarial Backdoor Attack of Deep Learning System Technical Papers Quan Zhang Tsinghua University, Yifeng Ding Tsinghua University, Yongqiang Tian Tianjin University, Jianmin Guo Tsinghua University, Min Yuan WeBank, Yu Jiang Tsinghua University DOI | ||
03:00 20mTalk | ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detection Technical Papers Yuanchun Li Microsoft Research, Ziqi Zhang Peking University, Bingyan Liu Peking University, Ziyue Yang Microsoft Research, Yunxin Liu Tsinghua University DOI | ||
Sat 17 JulDisplayed time zone: Brussels, Copenhagen, Madrid, Paris change
08:00 - 09:20 | Session 26 (time band 3) Testing Deep Learning Systems 5Technical Papers at ISSTA 2 Chair(s): Junjie Chen Tianjin University | ||
08:00 20mTalk | Efficient White-Box Fairness Testing through Gradient Search Technical Papers Lingfeng Zhang East China Normal University, Yueling Zhang Singapore Management University, Min Zhang East China Normal University DOI Media Attached | ||
08:20 20mTalk | DialTest: Automated Testing for Recurrent-Neural-Network-Driven Dialogue Systems Technical Papers DOI | ||
08:40 20mTalk | AdvDoor: Adversarial Backdoor Attack of Deep Learning System Technical Papers Quan Zhang Tsinghua University, Yifeng Ding Tsinghua University, Yongqiang Tian Tianjin University, Jianmin Guo Tsinghua University, Min Yuan WeBank, Yu Jiang Tsinghua University DOI | ||
09:00 20mTalk | ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detection Technical Papers Yuanchun Li Microsoft Research, Ziqi Zhang Peking University, Bingyan Liu Peking University, Ziyue Yang Microsoft Research, Yunxin Liu Tsinghua University DOI | ||