[Paper Review] Input-Aware Dynamic Backdoor Attack

Anh Nguyen, Anh Tran|arXiv (Cornell University)|Oct 16, 2020

Adversarial Robustness in Machine Learning22 references156 citations

TL;DR

Introduces an input-conditioned backdoor that generates unique triggers per image, achieving high attack success while evading current defenses and remaining non-reusable across inputs.

ABSTRACT

In recent years, neural backdoor attack has been considered to be a potential security threat to deep learning systems. Such systems, while achieving the state-of-the-art performance on clean data, perform abnormally on inputs with predefined triggers. Current backdoor techniques, however, rely on uniform trigger patterns, which are easily detected and mitigated by current defense methods. In this work, we propose a novel backdoor attack technique in which the triggers vary from input to input. To achieve this goal, we implement an input-aware trigger generator driven by diversity loss. A novel cross-trigger test is applied to enforce trigger nonreusablity, making backdoor verification impossible. Experiments show that our method is efficient in various attack scenarios as well as multiple datasets. We further demonstrate that our backdoor can bypass the state of the art defense methods. An analysis with a famous neural network inspector again proves the stealthiness of the proposed attack. Our code is publicly available at https://github.com/VinAIResearch/input-aware-backdoor-attack-release.

Motivation & Objective

• Motivate backdoor threats beyond fixed universal triggers by making triggers input-dependent and diverse.
• Design a trigger generator that produces distinct, non-reusable triggers conditioned on each input.
• Enforce non-reusability via a cross-trigger test during training.
• Evaluate the approach on MNIST, CIFAR-10, and GTSRB and against leading defenses.
• Assess robustness to simple image regularizations and network inspection techniques.

Proposed method

• Use an encoder-decoder trigger generator g that maps an input x to a trigger t = g(x).
• Enforce trigger diversity with a diversity loss Ldiv to avoid saturation and ensure distinct triggers across inputs.
• Introduce a cross-trigger test during training to ensure nonreusability of triggers across inputs.
• Train with a composite objective Ltotal = Lcla + λdiv Ldiv that combines classification and diversity goals.
• Operate in three running modes during training and evaluation: clean, attack (poisoned with input-specific trigger), and cross-trigger (poisoned with a trigger from a different input).
• Evaluate on MNIST, CIFAR-10, and GTSRB against state-of-the-art defenses (Neural Cleanse, Fine-Pruning, STRIP, and Mode Connectivity).

Experimental results

Research questions

• RQ1 Can a backdoor trigger be made input-aware to vary per image while preserving attack effectiveness on poisoned data?
• RQ2 Does a diversity-enforcing trigger generator produce non-reusable, input-specific triggers that evade standard backdoor defenses?
• RQ3 How does the proposed cross-trigger test impact backdoor nonreusability and detector detectability?
• RQ4 Are the input-aware backdoors robust to common image regularizations and visible network inspection techniques?
• RQ5 What is the attack performance and stealthiness in single-target and all-to-all (multi-target) scenarios?

Key findings

• The input-aware backdoor achieves near-100% attack success on poisoned data across MNIST, CIFAR-10, and GTSRB while preserving clean accuracy.
• Cross-trigger accuracy ranges from 88.16% to 96.80%, indicating triggers do not generalize to mismatched inputs.
• The attack bypasses major defenses including Neural Cleanse, Fine-Pruning, and Mode Connectivity, under standard evaluation settings.
• STRIP-like testing at deployment does not reliably detect the backdoor since the attack deactivates with content changes, producing high entropy similar to clean models.
• The backdoor remains robust under simple image regularizations and is stealthy under GradCam inspections, unlike traditional fixed-trigger backdoors.
• All-to-all attacks (multi-target) maintain strong performance, though attack accuracy slightly decreases compared to single-target cases.