A multitarget backdooring attack on deep neural networks with random location trigger

International Journal of Intelligent SystemsVolume 37, Issue 3 p. 2567-2583 RESEARCH ARTICLE A multitarget backdooring attack on deep neural networks with random location trigger Yu Xiao, Yu Xiao orcid.org/0000-0001-6203-5602 School of Computer Science and Technology, Shandong University of Technology, Zibo, Shandong, ChinaSearch for more papers by this authorLiu Cong, Liu Cong School of Computer Science and Technology, Shandong University of Technology, Zibo, Shandong, ChinaSearch for more papers by this authorZheng Mingwen, Zheng Mingwen School of Mathematics and Statistics, Shandong University of Technology, Zibo, Shandong, ChinaSearch for more papers by this authorWang Yajie, Wang Yajie School of Cyberspace Science and Technology, Beijing Institute of Technology, Beijing, ChinaSearch for more papers by this authorLiu Xinrui, Liu Xinrui School of Cyberspace Science and Technology, Beijing Institute of Technology, Beijing, ChinaSearch for more papers by this authorSong Shuxiao, Song Shuxiao School of Computer Science and Technology, Shandong University of Technology, Zibo, Shandong, ChinaSearch for more papers by this authorMa Yuexuan, Ma Yuexuan School of Computer Science and Technology, Shandong University of Technology, Zibo, Shandong, ChinaSearch for more papers by this authorZheng Jun, Corresponding Author Zheng Jun [email protected] School of Cyberspace Science and Technology, Beijing Institute of Technology, Beijing, China Correspondence Zheng Jun, School of Cyberspace Science and Technology, Beijing Institute of Technology, 100081 Beijing, China. Email: [email protected]Search for more papers by this author Yu Xiao, Yu Xiao orcid.org/0000-0001-6203-5602 School of Computer Science and Technology, Shandong University of Technology, Zibo, Shandong, ChinaSearch for more papers by this authorLiu Cong, Liu Cong School of Computer Science and Technology, Shandong University of Technology, Zibo, Shandong, ChinaSearch for more papers by this authorZheng Mingwen, Zheng Mingwen School of Mathematics and Statistics, Shandong University of Technology, Zibo, Shandong, ChinaSearch for more papers by this authorWang Yajie, Wang Yajie School of Cyberspace Science and Technology, Beijing Institute of Technology, Beijing, ChinaSearch for more papers by this authorLiu Xinrui, Liu Xinrui School of Cyberspace Science and Technology, Beijing Institute of Technology, Beijing, ChinaSearch for more papers by this authorSong Shuxiao, Song Shuxiao School of Computer Science and Technology, Shandong University of Technology, Zibo, Shandong, ChinaSearch for more papers by this authorMa Yuexuan, Ma Yuexuan School of Computer Science and Technology, Shandong University of Technology, Zibo, Shandong, ChinaSearch for more papers by this authorZheng Jun, Corresponding Author Zheng Jun [email protected] School of Cyberspace Science and Technology, Beijing Institute of Technology, Beijing, China Correspondence Zheng Jun, School of Cyberspace Science and Technology, Beijing Institute of Technology, 100081 Beijing, China. Email: [email protected]Search for more papers by this author First published: 28 December 2021 https://doi.org/10.1002/int.22785Citations: 3Read the full textAboutPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Abstract Machine learning has made tremendous progress and applied to various critical practical applications. However, recent studies have shown that machine learning models are vulnerable to malicious attackers, such as neural network backdoor triggering. A successful backdoor triggering behavior may cause serious consequences, such as allowing the attacker to bypass the identity verification and directly enter the system. In image classification, there is always only one target label triggered by one backdoor trigger in previous works. The position of the backdoor trigger is also fixed, which brings limitations to the attack. In this paper, we propose a novel method that utilizes one trigger pattern to correspond to multiple target labels, and the location of the trigger is not limited. In our method, the trigger guarantees that the malicious output is within the range of multiple targets chosen by the attacker, but the specific target depends on the original image where the trigger is pasted. Due to the original images' diversity, it is difficult for the defender to predict which target the image with the trigger is classified as. Besides, the attacker can use only one trigger pattern to achieve multitarget attacks at different locations, which brings more flexibility. We also proposed to train a neural network as a detector to distinguish backdoor images and clean images for multitarget backdooring attacks. Experiment results show that the detection method can also successfully detect the backdoor image with a trigger at a random location of the image, and the detection success rate is as high as 86.02%. Citing Literature Volume37, Issue3March 2022Pages 2567-2583 RelatedInformation