Dynamic Backdoors with Global Average Pooling

TL;DR

This paper introduces a novel dynamic backdoor attack leveraging global average pooling, demonstrating its feasibility without increasing poisoned data, but also highlighting practical challenges across multiple domains.

Contribution

It is the first to show dynamic backdoor attacks can occur via global average pooling without more poisoned data, expanding understanding of attack vectors.

Findings

Dynamic backdoors can be embedded through global average pooling.

Such backdoors are difficult to implement in practice.

Existing detection methods may be bypassed by dynamic triggers.

Abstract

Outsourced training and machine learning as a service have resulted in novel attack vectors like backdoor attacks. Such attacks embed a secret functionality in a neural network activated when the trigger is added to its input. In most works in the literature, the trigger is static, both in terms of location and pattern. The effectiveness of various detection mechanisms depends on this property. It was recently shown that countermeasures in image classification, like Neural Cleanse and ABS, could be bypassed with dynamic triggers that are effective regardless of their pattern and location. Still, such backdoors are demanding as they require a large percentage of poisoned training data. In this work, we are the first to show that dynamic backdoor attacks could happen due to a global average pooling layer without increasing the percentage of the poisoned training data. Nevertheless, our experiments in sound classification, text sentiment analysis, and image classification show this to be very difficult in practice.