[Paper Review] BAAAN: Backdoor Attacks Against Autoencoder and GAN-Based Machine Learning Models

Ahmed Salem, Yannick Sautter+3 more|arXiv (Cornell University)|Oct 6, 2020

Adversarial Robustness in Machine LearningComputer Science26 references20 citations

TL;DR

This paper presents the first backdoor attacks against autoencoders and GANs, where adversaries inject a hidden trigger during training to control model outputs: autoencoders can reverse inputs on trigger activation, while GANs generate data from a target distribution when triggered. The attacks maintain near-identical performance to clean models on clean data, with backdoor success rates of 0.0036 MSE (autoencoder) and 4.4–8.7 FID (GAN), demonstrating high stealth and effectiveness.

ABSTRACT

The tremendous progress of autoencoders and generative adversarial networks (GANs) has led to their application to multiple critical tasks, such as fraud detection and sanitized data generation. This increasing adoption has fostered the study of security and privacy risks stemming from these models. However, previous works have mainly focused on membership inference attacks. In this work, we explore one of the most severe attacks against machine learning models, namely the backdoor attack, against both autoencoders and GANs. The backdoor attack is a training time attack where the adversary implements a hidden backdoor in the target model that can only be activated by a secret trigger. State-of-the-art backdoor attacks focus on classification-based tasks. We extend the applicability of backdoor attacks to autoencoders and GAN-based models. More concretely, we propose the first backdoor attack against autoencoders and GANs where the adversary can control what the decoded or generated images are when the backdoor is activated. Our results show that the adversary can build a backdoored autoencoder that returns a target output for all backdoored inputs, while behaving perfectly normal on clean inputs. Similarly, for the GANs, our experiments show that the adversary can generate data from a different distribution when the backdoor is activated, while maintaining the same utility when the backdoor is not.

Motivation & Objective

• To investigate the feasibility and impact of backdoor attacks on autoencoders and GAN-based models, which are increasingly used in critical applications like fraud detection and data sanitization.
• To extend the threat surface of backdoor attacks beyond classification models to generative and reconstruction-based models.
• To demonstrate that adversaries can secretly control model behavior—e.g., generating specific images or reversing inputs—only when a hidden trigger is present.
• To evaluate the stealth and utility of backdoored models by measuring performance degradation on clean inputs and success on triggered inputs.

Proposed method

• Propose a novel backdoor attack framework for autoencoders by injecting a trigger (e.g., white square) into training data to force the model to output a target reconstruction, such as the inverse of the input.
• Train the autoencoder with backdoored samples, ensuring minimal performance degradation on clean inputs by optimizing reconstruction loss with trigger-embedded samples.
• Design a multi-discriminator training mechanism for GANs to enable backdoor control over the generated output distribution, allowing the model to generate images from a target distribution when triggered.
• Embed triggers in the latent noise vector input of GANs, enabling the adversary to activate the backdoor by injecting specific patterns into the noise.
• Use Frechet Inception Distance (FID) and Mean Squared Error (MSE) to quantitatively evaluate model utility and backdoor success rate across datasets (MNIST, CIFAR-10, CelebA).
• Evaluate both single-image target and full-distribution target backdoor scenarios in GANs, including cases where the target distribution is disjoint from the original (e.g., MNIST as target for CIFAR-10 GAN).

Experimental results

Research questions

• RQ1 Can backdoor attacks be successfully mounted on autoencoders, where the adversary controls the output of reconstructed images when a trigger is present?
• RQ2 Can GANs be backdoored such that they generate data from a different distribution only when a specific trigger is embedded in the latent noise vector?
• RQ3 How does the performance of backdoored autoencoders and GANs compare to their clean counterparts on clean inputs, in terms of reconstruction quality and generation fidelity?
• RQ4 To what extent can the backdoor be made stealthy, with minimal degradation in model utility on non-triggered inputs?
• RQ5 Can the backdoor be flexibly configured to generate a single target image or an entire distribution of images upon activation?

Key findings

• The backdoored autoencoder achieved a mean squared error (MSE) of 0.0036 on backdoored inputs (targeting inverse reconstruction), with only 0.00042 higher MSE than a clean model, demonstrating near-identical performance on clean data.
• For GANs, the backdoored model maintained near-identical utility to the clean model, with FID scores of 4.4, 8.7, and 5.5 on MNIST, CIFAR-10, and CelebA datasets, respectively, showing minimal degradation.
• On clean inputs, the backdoored GANs had FID values within 0.8% of the clean GAN’s performance, indicating strong stealth and utility preservation.
• When the target was a single image, the MSE between generated images and the target image was approximately 0, confirming precise backdoor control.
• The attack successfully generated images from a disjoint distribution (e.g., MNIST as target for a CIFAR-10 GAN), with a 1.6% higher FID on clean inputs and 3.4% worse FID on backdoored outputs, showing robustness and flexibility.
• Visualizations confirmed that backdoored GANs generated high-quality images indistinguishable from clean GANs in both original and target distributions, validating the attack’s effectiveness and stealth.