Scalable Backdoor Detection in Neural Networks

Haripriya Harikumar; Vuong Le; Santu Rana; Sourangshu Bhattacharya; Sunil Gupta; Svetha Venkatesh

doi:10.1007/978-3-030-67661-2_18

Scalable Backdoor Detection in Neural Networks

Haripriya Harikumar^*
, Vuong Le
, Santu Rana
, Sourangshu Bhattacharya
, Sunil Gupta
, Svetha Venkatesh

^*Corresponding author for this work

Machine Learning and Robotics

Research output: Chapter in Book/Conference proceeding › Conference contribution › peer-review

Abstract

Recently, it has been shown that deep learning models are vulnerable to Trojan attacks. In the Trojan attacks, an attacker can install a backdoor during training to make the model misidentify samples contaminated with a small trigger patch. Current backdoor detection methods fail to achieve good detection performance and are computationally expensive. In this paper, we propose a novel trigger reverse-engineering based approach whose computational complexity does not scale up with the number of labels and is based on a measure that is both interpretable and universal across different networks and patch types. In experiments, we observe that our method achieves a perfect score in separating Trojan models from pure models, which is an improvement over the current state-of-the-art method.

Original language	English
Title of host publication	Machine Learning and Knowledge Discovery in Databases
Subtitle of host publication	European Conference, ECML PKDD 2020, Ghent, Belgium, September 14–18, 2020, Proceedings, Part II
Editors	Frank Hutter, Kristian Kersting, Jefrey Lijffijt, Isabel Valera
Place of Publication	Cham
Publisher	Springer Cham
Pages	289–304
Number of pages	16
ISBN (Electronic)	9783030676612
ISBN (Print)	9783030676605
DOIs	https://doi.org/10.1007/978-3-030-67661-2_18
Publication status	Published - 25 Feb 2021
Event	European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases - Ghent, Belgium Duration: 14 Sept 2020 → 18 Sept 2020

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer
Volume	12458
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases
Abbreviated title	ECML PKDD 2020
Country/Territory	Belgium
City	Ghent
Period	14/09/20 → 18/09/20

Access to Document

10.1007/978-3-030-67661-2_18

Cite this

Harikumar, H., Le, V., Rana, S., Bhattacharya, S., Gupta, S., & Venkatesh, S. (2021). Scalable Backdoor Detection in Neural Networks. In F. Hutter, K. Kersting, J. Lijffijt, & I. Valera (Eds.), Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2020, Ghent, Belgium, September 14–18, 2020, Proceedings, Part II (pp. 289–304). (Lecture Notes in Computer Science; Vol. 12458). Springer Cham. https://doi.org/10.1007/978-3-030-67661-2_18

Harikumar, Haripriya ; Le, Vuong ; Rana, Santu et al. / Scalable Backdoor Detection in Neural Networks. Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2020, Ghent, Belgium, September 14–18, 2020, Proceedings, Part II. editor / Frank Hutter ; Kristian Kersting ; Jefrey Lijffijt ; Isabel Valera. Cham : Springer Cham, 2021. pp. 289–304 (Lecture Notes in Computer Science).

@inproceedings{3c1d07af104447679ff2dd52193a7dde,

title = "Scalable Backdoor Detection in Neural Networks",

abstract = "Recently, it has been shown that deep learning models are vulnerable to Trojan attacks. In the Trojan attacks, an attacker can install a backdoor during training to make the model misidentify samples contaminated with a small trigger patch. Current backdoor detection methods fail to achieve good detection performance and are computationally expensive. In this paper, we propose a novel trigger reverse-engineering based approach whose computational complexity does not scale up with the number of labels and is based on a measure that is both interpretable and universal across different networks and patch types. In experiments, we observe that our method achieves a perfect score in separating Trojan models from pure models, which is an improvement over the current state-of-the-art method.",

author = "Haripriya Harikumar and Vuong Le and Santu Rana and Sourangshu Bhattacharya and Sunil Gupta and Svetha Venkatesh",

year = "2021",

month = feb,

day = "25",

doi = "10.1007/978-3-030-67661-2\_18",

language = "English",

isbn = "9783030676605",

series = "Lecture Notes in Computer Science",

publisher = "Springer Cham",

pages = "289{\textendash}304",

editor = "Frank Hutter and Kristian Kersting and Jefrey Lijffijt and Isabel Valera",

booktitle = "Machine Learning and Knowledge Discovery in Databases",

address = "Switzerland",

note = "European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, ECML PKDD 2020 ; Conference date: 14-09-2020 Through 18-09-2020",

}

Harikumar, H, Le, V, Rana, S, Bhattacharya, S, Gupta, S & Venkatesh, S 2021, Scalable Backdoor Detection in Neural Networks. in F Hutter, K Kersting, J Lijffijt & I Valera (eds), Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2020, Ghent, Belgium, September 14–18, 2020, Proceedings, Part II. Lecture Notes in Computer Science, vol. 12458, Springer Cham, Cham, pp. 289–304, European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases, Ghent, Belgium, 14/09/20. https://doi.org/10.1007/978-3-030-67661-2_18

Scalable Backdoor Detection in Neural Networks. / Harikumar, Haripriya; Le, Vuong; Rana, Santu et al.
Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2020, Ghent, Belgium, September 14–18, 2020, Proceedings, Part II. ed. / Frank Hutter; Kristian Kersting; Jefrey Lijffijt; Isabel Valera. Cham: Springer Cham, 2021. p. 289–304 (Lecture Notes in Computer Science; Vol. 12458).

Research output: Chapter in Book/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Scalable Backdoor Detection in Neural Networks

AU - Harikumar, Haripriya

AU - Le, Vuong

AU - Rana, Santu

AU - Bhattacharya, Sourangshu

AU - Gupta, Sunil

AU - Venkatesh, Svetha

PY - 2021/2/25

Y1 - 2021/2/25

N2 - Recently, it has been shown that deep learning models are vulnerable to Trojan attacks. In the Trojan attacks, an attacker can install a backdoor during training to make the model misidentify samples contaminated with a small trigger patch. Current backdoor detection methods fail to achieve good detection performance and are computationally expensive. In this paper, we propose a novel trigger reverse-engineering based approach whose computational complexity does not scale up with the number of labels and is based on a measure that is both interpretable and universal across different networks and patch types. In experiments, we observe that our method achieves a perfect score in separating Trojan models from pure models, which is an improvement over the current state-of-the-art method.

AB - Recently, it has been shown that deep learning models are vulnerable to Trojan attacks. In the Trojan attacks, an attacker can install a backdoor during training to make the model misidentify samples contaminated with a small trigger patch. Current backdoor detection methods fail to achieve good detection performance and are computationally expensive. In this paper, we propose a novel trigger reverse-engineering based approach whose computational complexity does not scale up with the number of labels and is based on a measure that is both interpretable and universal across different networks and patch types. In experiments, we observe that our method achieves a perfect score in separating Trojan models from pure models, which is an improvement over the current state-of-the-art method.

U2 - 10.1007/978-3-030-67661-2_18

DO - 10.1007/978-3-030-67661-2_18

M3 - Conference contribution

SN - 9783030676605

T3 - Lecture Notes in Computer Science

SP - 289

EP - 304

BT - Machine Learning and Knowledge Discovery in Databases

A2 - Hutter, Frank

A2 - Kersting, Kristian

A2 - Lijffijt, Jefrey

A2 - Valera, Isabel

PB - Springer Cham

CY - Cham

T2 - European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases

Y2 - 14 September 2020 through 18 September 2020

ER -

Harikumar H, Le V, Rana S, Bhattacharya S, Gupta S, Venkatesh S. Scalable Backdoor Detection in Neural Networks. In Hutter F, Kersting K, Lijffijt J, Valera I, editors, Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2020, Ghent, Belgium, September 14–18, 2020, Proceedings, Part II. Cham: Springer Cham. 2021. p. 289–304. (Lecture Notes in Computer Science). doi: 10.1007/978-3-030-67661-2_18

Scalable Backdoor Detection in Neural Networks

Abstract

Publication series

Conference

Access to Document

Fingerprint

Cite this