# Backdoor Attacks on Deep Neural Networks via Transfer Learning from Natural Images
## 1 Introduction  
Deep neural networks (DNNs) have been widely adopted in a variety of important real-world tasks such as self-driving technologies (e.g., for the detection and classification of traffic signs) [1] and medical diagnosis from imaging data [2; 3; 4] owing to their high performance in image recognition. However, DNNs are vulnerable to adversarial attacks [5; 6] that distort their classification performance (i.e., that cause a DNN model to misclassify a given sample). This limits the real-world applications of DNNs in safety- and security-critical environments [7; 8; 9; 10; 11; 12; 13]. Backdoor attacks are a serious security threat to the open-source and outsourced development of systems based on DNN models [14; 15; 16]. Adversaries can contaminate a small fraction of an original training dataset with backdoor triggers (e.g., a pattern of pixels appearing in the corners of images) and incorrect labels. Then, when DNN models are trained with the contaminated data, including fine-tuning, their performance on classifications tasks will thus be distorted. Backdoored DNN models (that is, DNN models in which backdoors have been set up in this manner) perform their prediction tasks correctly for inputs without triggers. However, they perform their tasks incorrectly for inputs with triggers. Adversaries can select different types of attacks depending on how they contaminate the original data with backdoor triggers and incorrect labels, including all-to-one attacks, in which the inputs are predicted as a specific label, and all-to-all attacks, in which the inputs are predicted as incorrect labels. Identifying such backdoors in DNN models rapidly is generally difficult because backdoored models largely perform theirprediction tasks correctly, and DNN architectures are complex. Nevertheless, several backdoor detection methods (e.g., [17; 18; 19]) have been developed. The transferability of such backdoors between has attracted considerable attention as a potentially more serious security threat. If a DNN model is trained by fine-tuning a backdoored DNN model using a separate dataset (i.e., via a transfer learning process), the backdoors may be transferred to the fine-tuned DNN models. That is, the backdoor triggers may also be effective for distorting the prediction performance of the fine-tuned models, even if the fine-tuning dataset is not contaminated. Adversaries can set up backdoors in many DNN models by simply providing backdoored pretrained DNN models. For example, backdoors in a DNN model developed to classify traffic signs in the United States were found to be transferable to a DNN model trained to classify Swedish traffic signs via a fine-tuning process [14]. In a DNN model trained to detect coronavirus disease 2019 (COVID-19) from chest X-ray images, backdoor triggers were also effective in distorting the prediction performance of models fine-tuned from backdoored DNN models using clean datasets [15]. Moreover, latent backdoors [20] have also been proposed as incomplete backdoors embedded in a \"Teacher\" model to be automatically inherited by multiple \"Student\" models through transfer learning. Nevertheless, the transferability of backdoors requires further evaluation. Previous studies have emphasized that backdoors are transferable via transfer learning; however, they still have several limitations. Given that DNN models pretrained on natural image datasets such as the ImageNet dataset [21] are widely used for transfer learning, the transfer learning processes in previous studies [14; 15; 20] differ from those used in real-world applications. Specifically, they are limited to similar prediction tasks (e.g., from traffic sign classification in one country to other countries [14]). Moreover, adversaries are assumed to know (a part of) the prediction tasks in the fine-tuned models. However, this assumption would be unlikely to hold for transfer learning from natural images.