[Paper Review] Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization

Shaofeng Li, Minhui Xue+3 more|arXiv (Cornell University)|Sep 6, 2019

Adversarial Robustness in Machine Learning51 references44 citations

TL;DR

The paper presents two invisible backdoor attack methods—steganography-based trigger embedding and regularization-based trigger generation—and evaluates their effectiveness and invisibility across multiple datasets using new perceptual metrics.

ABSTRACT

Deep neural networks (DNNs) have been proven vulnerable to backdoor attacks, where hidden features (patterns) trained to a normal model, which is only activated by some specific input (called triggers), trick the model into producing unexpected behavior. In this paper, we create covert and scattered triggers for backdoor attacks, invisible backdoors, where triggers can fool both DNN models and human inspection. We apply our invisible backdoors through two state-of-the-art methods of embedding triggers for backdoor attacks. The first approach on Badnets embeds the trigger into DNNs through steganography. The second approach of a trojan attack uses two types of additional regularization terms to generate the triggers with irregular shape and size. We use the Attack Success Rate and Functionality to measure the performance of our attacks. We introduce two novel definitions of invisibility for human perception; one is conceptualized by the Perceptual Adversarial Similarity Score (PASS) and the other is Learned Perceptual Image Patch Similarity (LPIPS). We show that the proposed invisible backdoors can be fairly effective across various DNN models as well as four datasets MNIST, CIFAR-10, CIFAR-100, and GTSRB, by measuring their attack success rates for the adversary, functionality for the normal users, and invisibility scores for the administrators. We finally argue that the proposed invisible backdoor attacks can effectively thwart the state-of-the-art trojan backdoor detection approaches, such as Neural Cleanse and TABOR.

Motivation & Objective

• Motivate the study by highlighting the practicality of backdoor attacks in MLaaS and the need for invisible triggers.
• Propose two invisible backdoor approaches: steganography-based trigger embedding and regularization-based trigger generation.
• Formalize a bi-level optimization framework for backdoor attack generation.
• Define and employ human-perception based invisibility metrics (PASS and LPIPS) to gauge stealthiness.

Proposed method

• Model backdoor formation as a bi-level optimization problem that preserves functionality on untainted data while achieving high attack success on poisoned data.
• Attack 1 embeds a trigger via Least Significant Bit steganography into the training data to achieve invisibility.
• Attack 2 generates triggers through Lp-norm regularization to scatter the trigger and minimize visual detectability while maximizing neuron activation.
• Use pre-trained models as targets and retrain on poisoned data to inject the backdoor.
• Evaluate invisibility with PASS and LPIPS, and functionality with standard backdoor metrics.

Experimental results

Research questions

• RQ1 Can invisible triggers be embedded into DNN inputs without being perceptible to humans while still activating the backdoor?
• RQ2 Do steganography-based and regularization-based triggers remain effective across multiple datasets and model architectures?
• RQ3 How do the proposed invisibility metrics correlate with attack success and normal model performance?
• RQ4 To what extent do invisible backdoors evade state-of-the-art backdoor defenses like Neural Cleanse and TABOR?

Key findings

• Invisible backdoors achieve high attack success rates while maintaining model functionality on clean data.
• Steganography-based triggers via LSB embedding show a trade-off between trigger size, invisibility (PASS/LPIPS), and required retraining epochs.
• Regularization-based triggers produce small perturbations that activate specific neurons, enabling effective backdoors with limited data and training.
• The proposed invisibility metrics PAS S and LPIPS provide quantifiable measures of human-perceived invisibility for backdoor triggers.
• Invisible backdoors can potentially thwart detection by defenses such as Neural Cleanse and TABOR.
• Experiments demonstrate the approaches’ effectiveness across MNIST, CIFAR-10, CIFAR-100, and GTSRB datasets.