Revocable Backdoor for Deep Model Trading

TL;DR

This paper introduces a novel revocable backdoor mechanism for deep models, enabling model trading with the ability to deactivate backdoors without retraining, thus enhancing security and flexibility in model deployment.

Contribution

We propose a new revocable backdoor technique that maintains model performance and allows easy detoxification, facilitating secure deep model trading scenarios.

Findings

Feasibility demonstrated across multiple datasets.

Robustness confirmed with various network architectures.

Backdoors can be revoked without retraining.

Abstract

Deep models are being applied in numerous fields and have become a new important digital product. Meanwhile, previous studies have shown that deep models are vulnerable to backdoor attacks, in which compromised models return attacker-desired results when a trigger appears. Backdoor attacks severely break the trust-worthiness of deep models. In this paper, we turn this weakness of deep models into a strength, and propose a novel revocable backdoor and deep model trading scenario. Specifically, we aim to compromise deep models without degrading their performance, meanwhile, we can easily detoxify poisoned models without re-training the models. We design specific mask matrices to manage the internal feature maps of the models. These mask matrices can be used to deactivate the backdoors. The revocable backdoor can be adopted in the deep model trading scenario. Sellers train models with revocable backdoors as a trial version. Buyers pay a deposit to sellers and obtain a trial version of the deep model. If buyers are satisfied with the trial version, they pay a final payment to sellers and sellers send mask matrices to buyers to withdraw revocable backdoors. We demonstrate the feasibility and robustness of our revocable backdoor by various datasets and network architectures.