[Paper Review] BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defense

Siyuan Cheng, Guanhong Tao+9 more|arXiv (Cornell University)|Jan 16, 2023

Adversarial Robustness in Machine Learning4 citations

TL;DR

BEAGLE is a novel forensics framework for deep learning backdoor attacks that automatically decomposes trojaned inputs into clean inputs and triggers, clusters similar attacks for categorization, and synthesizes generalized scanners to detect new instances of the same backdoor type. It outperforms existing scanners significantly, achieving 93% accuracy on unseen WaNet attacks, and demonstrates robustness to data biases and adaptive attacks.

ABSTRACT

Deep Learning backdoor attacks have a threat model similar to traditional cyber attacks. Attack forensics, a critical counter-measure for traditional cyber attacks, is hence of importance for defending model backdoor attacks. In this paper, we propose a novel model backdoor forensics technique. Given a few attack samples such as inputs with backdoor triggers, which may represent different types of backdoors, our technique automatically decomposes them to clean inputs and the corresponding triggers. It then clusters the triggers based on their properties to allow automatic attack categorization and summarization. Backdoor scanners can then be automatically synthesized to find other instances of the same type of backdoor in other models. Our evaluation on 2,532 pre-trained models, 10 popular attacks, and comparison with 9 baselines show that our technique is highly effective. The decomposed clean inputs and triggers closely resemble the ground truth. The synthesized scanners substantially outperform the vanilla versions of existing scanners that can hardly generalize to different kinds of attacks.

Motivation & Objective

• Address the growing threat of deep learning backdoor attacks, which mimic traditional cyber attacks and can severely impact safety-critical systems like autonomous driving.
• Develop a comprehensive forensics workflow to identify root causes of backdoor attacks, similar to traditional cyber attack forensics.
• Overcome limitations of existing methods that focus only on detection or cleansing of individual inputs without generalization or categorization.
• Enable automatic synthesis of scanners that generalize across models and detect new instances of the same backdoor type without requiring access to trojaned inputs.
• Improve defense by enabling scalable, automated detection of backdoors across diverse attack types and model architectures.

Proposed method

• Given a few trojaned inputs and their corresponding models, BEAGLE performs end-to-end decomposition to isolate clean inputs and triggers using a differentiable optimization process.
• The trigger is modeled as either a patch-like pattern or an input transformation function, enabling detection of diverse backdoor types including BadNets, WaNet, and Dynamic attacks.
• After decomposition, BEAGLE clusters triggers based on structural and statistical properties (e.g., spatial patterns, transformation functions) to enable attack categorization.
• From the clustered triggers, BEAGLE automatically synthesizes targeted scanners that can detect other models with the same backdoor type.
• The scanner synthesis leverages the structural and functional similarity of triggers to generalize beyond the original attack samples.
• The framework is trained and evaluated using a diverse set of 2,532 pre-trained models and 10 backdoor attack types, with ablation studies validating design choices.

Experimental results

Research questions

• RQ1 Can a forensics framework automatically decompose trojaned inputs into clean inputs and triggers without prior knowledge of the trigger or clean data?
• RQ2 Can trigger decomposition and clustering enable accurate categorization of diverse backdoor attack types, including patch-based, filter-based, and transformation-based triggers?
• RQ3 Can the forensics results be used to synthesize scanners that generalize to new models with the same backdoor type, even without access to trojaned inputs?
• RQ4 How robust is the framework to sampling biases in attack instances and model distributions?
• RQ5 How effective is the synthesized scanner compared to existing baseline scanners in detecting previously unseen backdoor instances?

Key findings

• BEAGLE successfully decomposes trojaned inputs into clean inputs and triggers with high fidelity, closely resembling ground truth in both structure and behavior.
• The synthesized scanners achieve 93% accuracy in detecting WaNet attacks on unseen models, significantly outperforming vanilla scanners (50–53% accuracy).
• BEAGLE demonstrates robustness to input sampling bias, including naturally misclassified inputs and imbalanced attack type distributions.
• The framework maintains high performance under adaptive attack scenarios where adversaries have knowledge of BEAGLE, indicating strong resilience.
• Ablation studies confirm that key components—such as trigger clustering and differentiable decomposition—significantly contribute to the framework’s effectiveness.
• Transferability remains a limitation: scanners trained on patch or filter attacks show poor performance (50–53%) when detecting WaNet attacks, indicating challenges in generalizing across fundamentally different attack categories.