SGBA: A Stealthy Scapegoat Backdoor Attack against Deep Neural Networks

TL;DR

This paper introduces SGBA, a stealthy backdoor attack that evades current detection methods by using a benign scapegoat trigger and parameter confinement, making it highly effective and hard to detect.

Contribution

The paper presents a novel backdoor attack method that defeats existing detection schemes by incorporating a benign trigger and parameter control, enhancing stealth and universality.

Findings

Escapes detection by all five state-of-the-art schemes

Maintains high attack success rate

Minimal side-effects on model performance

Abstract

Outsourced deep neural networks have been demonstrated to suffer from patch-based trojan attacks, in which an adversary poisons the training sets to inject a backdoor in the obtained model so that regular inputs can be still labeled correctly while those carrying a specific trigger are falsely given a target label. Due to the severity of such attacks, many backdoor detection and containment systems have recently, been proposed for deep neural networks. One major category among them are various model inspection schemes, which hope to detect backdoors before deploying models from non-trusted third-parties. In this paper, we show that such state-of-the-art schemes can be defeated by a so-called Scapegoat Backdoor Attack, which introduces a benign scapegoat trigger in data poisoning to prevent the defender from reversing the real abnormal trigger. In addition, it confines the values of network parameters within the same variances of those from clean model during training, which further significantly enhances the difficulty of the defender to learn the differences between legal and illegal models through machine-learning approaches. Our experiments on 3 popular datasets show that it can escape detection by all five state-of-the-art model inspection schemes. Moreover, this attack brings almost no side-effects on the attack effectiveness and guarantees the universal feature of the trigger compared with original patch-based trojan attacks.