A Generic Enhancer for Backdoor Attacks on Deep Neural Networks

Abstract

Backdoor attack, which attempts to manipulate model prediction on specific poisoned inputs, poses a serious threat to deep neural networks. It mainly utilizes poisoned datasets to inject backdoor(s) into a model through training or fine-tuning. The backdoor will be activated by attacker specified triggers that are included in the datasets and associated with the pre-defined target classes. To achieve a better trade-off between attack effectiveness and stealthiness, many studies focus on more complex designs like using natural-appearing poisoned samples with smaller poisoning rates. Effective as they are, the results of the heuristic studies can still be readily identified or invalidated by existing defenses. It is mainly because the backdoored model is often overconfident in predicting poisoned inputs, also its neurons exhibit significantly different behaviour on benign and poisoned inputs. In this paper, we propose a generic backdoor enhancer based on label smoothing and activation suppression to mitigate these two problems. The intuition behind our backdoor enhancer is two-fold: label smoothing reduces the confidence level of the backdoored model over poisoned inputs, while activation suppression entangles the behaviour of neurons on benign/poisoned samples. In this way, the model is backdoored gently. Extensive experiments are conducted to assess the proposed enhancer, including using three different network architectures and three different poisoning mechanisms on three common datasets. Results validate that the enhancer can enhance various backdoor attacks, even the most rudimentary ones, to the level of state-of-the-art attacks in terms of effectiveness and bypassing detection.

B. H. Abbasi and Q. Zhong—These authors contributed equally to this work.