[Paper Review] Backdoor Attacks in the Supply Chain of Masked Image Modeling

Xinyue Shen, Xinlei He+4 more|arXiv (Cornell University)|Oct 4, 2022

Adversarial Robustness in Machine Learning4 citations

TL;DR

This paper presents the first systematic analysis of backdoor attacks in the supply chain of masked image modeling (MIM), a state-of-the-art self-supervised learning method. It introduces a novel trigger-based backdoor attack effective during pre-training, achieving 98.89% attack success rate on CIFAR10, and identifies trigger pattern and number as key success factors, while revealing that release-phase attacks evade all tested detection methods.

ABSTRACT

Masked image modeling (MIM) revolutionizes self-supervised learning (SSL) for image pre-training. In contrast to previous dominating self-supervised methods, i.e., contrastive learning, MIM attains state-of-the-art performance by masking and reconstructing random patches of the input image. However, the associated security and privacy risks of this novel generative method are unexplored. In this paper, we perform the first security risk quantification of MIM through the lens of backdoor attacks. Different from previous work, we are the first to systematically threat modeling on SSL in every phase of the model supply chain, i.e., pre-training, release, and downstream phases. Our evaluation shows that models built with MIM are vulnerable to existing backdoor attacks in release and downstream phases and are compromised by our proposed method in pre-training phase. For instance, on CIFAR10, the attack success rate can reach 99.62%, 96.48%, and 98.89% in the downstream phase, release phase, and pre-training phase, respectively. We also take the first step to investigate the success factors of backdoor attacks in the pre-training phase and find the trigger number and trigger pattern play key roles in the success of backdoor attacks while trigger location has only tiny effects. In the end, our empirical study of the defense mechanisms across three detection-level on model supply chain phases indicates that different defenses are suitable for backdoor attacks in different phases. However, backdoor attacks in the release phase cannot be detected by all three detection-level methods, calling for more effective defenses in future research.

Motivation & Objective

• To systematically analyze backdoor attack risks in the entire supply chain of masked image modeling (MIM), a leading self-supervised learning method.
• To evaluate the vulnerability of MIM models to backdoor attacks across pre-training, release, and downstream phases.
• To identify the key factors influencing backdoor success in the pre-training phase, particularly in the context of MIM’s generative mechanism.
• To assess the effectiveness of existing defense mechanisms—model-level, input-level, and dataset-level—across different attack phases.
• To expose critical gaps in current detection methods, especially for release-phase backdoor attacks (Type II), which evade all three detection levels.

Proposed method

• Proposes a novel backdoor attack method that increases the number of triggers during MIM pre-training to improve attack success rate.
• Employs a trigger injection strategy during pre-training by poisoning the dataset with images containing multiple triggers, leveraging MIM’s mask-and-predict mechanism.
• Uses white triggers and publicly available Hidden Trigger Backdoor Attack (HTBA) triggers to evaluate the impact of trigger pattern on attack performance.
• Applies spectral signatures for dataset-level defense to detect poisoned samples in the pre-training set by analyzing feature representation covariance.
• Employs model-level detection via label-specific modification cost and input-level detection via entropy distribution analysis of perturbed inputs.
• Conducts ablation studies on trigger properties (pattern, number, location, size, poisoning rate) to isolate key success factors in pre-training phase attacks.

Experimental results

Research questions

• RQ1 How vulnerable are MIM models to backdoor attacks across the full model supply chain, including pre-training, release, and downstream phases?
• RQ2 What are the key trigger properties—pattern, number, location, size, and poisoning rate—that influence backdoor success in MIM pre-training?
• RQ3 Can existing defense mechanisms (model-level, input-level, dataset-level) effectively detect backdoor attacks in all phases of the MIM supply chain?
• RQ4 Why do release-phase backdoor attacks (Type II) evade detection by all three defense levels, and what does this imply for future defense research?
• RQ5 How does the performance of existing backdoor attacks designed for contrastive learning transfer to MIM, and what modifications are needed for effective MIM exploitation?

Key findings

• The proposed backdoor attack achieves a 98.89% attack success rate on CIFAR10 and 97.74% on STL10 during the pre-training phase, significantly outperforming prior methods.
• Trigger pattern and number are the dominant factors influencing attack success, while trigger location has minimal impact on performance in MIM pre-training.
• Existing backdoor attacks designed for contrastive learning perform poorly on MIM, with attack success rates only 2.83% and 13.78% higher than baseline on CIFAR10 and STL10, respectively.
• Dataset-level defense using spectral signatures effectively detects poisoned samples in pre-training (Type I) but fails at low poisoning rates (e.g., 1%), where backdoor scores fall below clean scores.
• Model-level and input-level defenses successfully detect backdoor attacks in the downstream phase, but none of the three detection levels can detect release-phase attacks (Type II).
• The inability of all three detection methods to identify release-phase backdoor attacks highlights a critical security gap requiring new defense mechanisms.