Flareon: Stealthy any2any Backdoor Injection via Poisoned Augmentation

TL;DR

Flareon is a stealthy backdoor injection method targeting data augmentation in deep learning, enabling high success rates without altering labels or model architecture, and remains effective against recent defenses.

Contribution

This paper introduces Flareon, a novel backdoor attack that manipulates data augmentation pipelines without prior knowledge of the model, achieving high attack success and robustness.

Findings

Flareon achieves high attack success rates across models.

It maintains better clean accuracy than prior backdoor methods.

It remains effective against recent defenses.

Abstract

Open software supply chain attacks, once successful, can exact heavy costs in mission-critical applications. As open-source ecosystems for deep learning flourish and become increasingly universal, they present attackers previously unexplored avenues to code-inject malicious backdoors in deep neural network models. This paper proposes Flareon, a small, stealthy, seemingly harmless code modification that specifically targets the data augmentation pipeline with motion-based triggers. Flareon neither alters ground-truth labels, nor modifies the training loss objective, nor does it assume prior knowledge of the victim model architecture, training data, and training hyperparameters. Yet, it has a surprisingly large ramification on training -- models trained under Flareon learn powerful target-conditional (or "any2any") backdoors. The resulting models can exhibit high attack success rates for any target choices and better clean accuracies than backdoor attacks that not only seize greater control, but also assume more restrictive attack capabilities. We also demonstrate the effectiveness of Flareon against recent defenses. Flareon is fully open-source and available online to the deep learning community: https://github.com/lafeat/flareon.