BadNets: Identifying Vulnerabilities in the ML Model Supply Chain
Date: 2017-08
Affected: MNIST classifier, U.S. street-sign classifier, transfer learning
Attack vector: backdoor
Category: research
Severity: High

Gu, Dolan-Gavitt, and Garg train backdoored networks that achieve state-of-the-art accuracy yet misclassify any input bearing a small trigger sticker, demonstrated on MNIST and a real U.S. street-sign classifier (stop sign -> speed limit).


Mitigations:

Architectural layers (MAESTRO):