[Paper Review] Label-Consistent Backdoor Attacks

Alexander Turner, Dimitris Tsipras+1 more|arXiv (Cornell University)|Dec 5, 2019

Adversarial Robustness in Machine Learning37 references43 citations

TL;DR

The paper demonstrates label-consistent backdoor attacks that inject plausible, correctly-labeled poisoned inputs using GAN latent-space interpolation and adversarial perturbations to trigger a backdoor during inference.

ABSTRACT

Deep neural networks have been demonstrated to be vulnerable to backdoor attacks. Specifically, by injecting a small number of maliciously constructed inputs into the training set, an adversary is able to plant a backdoor into the trained model. This backdoor can then be activated during inference by a backdoor trigger to fully control the model's behavior. While such attacks are very effective, they crucially rely on the adversary injecting arbitrary inputs that are---often blatantly---mislabeled. Such samples would raise suspicion upon human inspection, potentially revealing the attack. Thus, for backdoor attacks to remain undetected, it is crucial that they maintain label-consistency---the condition that injected inputs are consistent with their labels. In this work, we leverage adversarial perturbations and generative models to execute efficient, yet label-consistent, backdoor attacks. Our approach is based on injecting inputs that appear plausible, yet are hard to classify, hence causing the model to rely on the (easier-to-learn) backdoor trigger.

Motivation & Objective

• Motivate and formalize label-consistent backdoor attacks that avoid obviously mislabeled poisoning.
• Show that poisoned inputs can be made hard to classify based on natural features while preserving correct labels.
• Develop two perturbation-based methods to generate such inputs: GAN latent-space interpolation and adversarial perturbations.
• Improve backdoor triggers to be less conspicuous and robust to data augmentation.
• Provide empirical evaluation on CIFAR-10 to quantify attack effectiveness and detectability.

Proposed method

• Use GAN or auto-encoder latent spaces to interpolate a target-class input toward an incorrect class, then apply a backdoor trigger and keep the label as the original target label.
• Apply adversarial perturbations (PGD) to poisoned inputs to maximize training loss w.r.t. a fixed label, while keeping perturbations small in l_p norm.
• Compare latent-space interpolation versus adversarial perturbations in terms of attack success and label-consistency.
• Design backdoor triggers with reduced visibility and ensure robustness to data augmentation (e.g., four-corner replication).
• Evaluate trigger visibility and effectiveness under different poisoning fractions and data-augmentation settings.

Experimental results

Research questions

• RQ1 Can backdoor attacks remain effective when poisoned inputs are label-consistent and not obviously mislabeled?
• RQ2 Do latent-space interpolation and adversarial perturbations yield more effective label-consistent backdoors compared to standard poisoned inputs?
• RQ3 How do trigger design and data augmentation affect the stealth and robustness of label-consistent backdoors?
• RQ4 What are the trade-offs between attack success and label plausibility when tuning perturbation strength?
• RQ5 How does poisoning fraction per class influence attack success under label-consistent schemes?

Key findings

• Label-consistent poisoned inputs can achieve substantial attack success, with over 50% success on about half of the classes when using l2 perturbations with epsilon=300 and tau=0.2, injecting 75 inputs.
• Adversarial perturbations outperform GAN-based interpolation in effectiveness, especially with larger allowed perturbations.
• Reducing trigger visibility lowers attack success at very small poisoning fractions but remains effective when poisoning 6% or more of the target class.
• Data augmentation can enhance attack success for improved triggers, and using a fully visible trigger at test time can boost success toward near 100% when poisoning 300+ inputs.
• The attacks do not significantly degrade standard accuracy unless poisoning is extreme (e.g., 100% poisoning).
• Poisoned samples exhibit high training loss without the trigger, indicating reliance on the backdoor trigger to be correctly classified.