Detection of Backdoors in Trained Classifiers Without Access to the Training Set

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning Security

Background:

• Deep neural network (DNN) classifiers are vulnerable to adversarial learning attacks, specifically data poisoning (DP) backdoor attacks.
• These attacks aim to misclassify specific inputs with a backdoor pattern to a target class, without degrading overall accuracy.
• Existing defenses often require access to training data or operate during training, leaving post-training detection underexplored.

Purpose of the Study:

• To develop a post-training, unsupervised anomaly detection (AD) defense for DNN image classifiers against backdoor attacks.
• To enable detection of backdoor attacks when only the trained classifier and clean data are available.
• To infer attack specifics, including source and target classes, and the backdoor pattern itself.

Main Methods:

• Proposing a purely unsupervised anomaly detection (AD) approach.
• Learning the minimum perturbation (backdoor pattern) needed to misclassify examples from source class s to target class t for all (s,t) pairs.
• Utilizing cost function minimization and a novel hypothesis testing approach for detection and inference.

Main Results:

• Demonstrated that attacked class pairs require significantly smaller perturbations than non-attacked pairs.
• Successfully detected backdoor attacks, inferred source/target classes, and estimated backdoor patterns across various settings.
• Outperformed state-of-the-art methods in backdoor detection and inference.

Conclusions:

• The proposed unsupervised AD defense is effective for post-training backdoor detection in DNN image classifiers.
• The method is robust and adaptable, requiring minimal hyperparameter tuning (detection threshold).
• This approach offers a valuable tool for securing deployed DNNs, especially in shared applications like mobile apps.