Influencer Backdoor Attack on Semantic Segmentation (2303.12054v5)
Abstract: When a small number of poisoned samples are injected into the training dataset of a deep neural network, the network can be induced to exhibit malicious behavior during inferences, which poses potential threats to real-world applications. While they have been intensively studied in classification, backdoor attacks on semantic segmentation have been largely overlooked. Unlike classification, semantic segmentation aims to classify every pixel within a given image. In this work, we explore backdoor attacks on segmentation models to misclassify all pixels of a victim class by injecting a specific trigger on non-victim pixels during inferences, which is dubbed Influencer Backdoor Attack (IBA). IBA is expected to maintain the classification accuracy of non-victim pixels and mislead classifications of all victim pixels in every single inference and could be easily applied to real-world scenes. Based on the context aggregation ability of segmentation models, we proposed a simple, yet effective, Nearest-Neighbor trigger injection strategy. We also introduce an innovative Pixel Random Labeling strategy which maintains optimal performance even when the trigger is placed far from the victim pixels. Our extensive experiments reveal that current segmentation models do suffer from backdoor attacks, demonstrate IBA real-world applicability, and show that our proposed techniques can further increase attack performance.
- On the robustness of semantic segmentation models to adversarial attacks. In CVPR, 2018.
- Proflip: Targeted trojan attack with progressive bit flips. In ICCV, 2021.
- Rethinking atrous convolution for semantic image segmentation. arXiv:1706.05587, 2017a.
- Quarantine: Sparsity can uncover the trojan attack trigger for free. In CVPR, 2022a.
- Effective backdoor defense by exploiting sensitivity of poisoned samples. In NeurIPS, 2022b.
- Targeted backdoor attacks on deep learning systems using data poisoning. arXiv:1712.05526, 2017b.
- The cityscapes dataset for semantic urban scene understanding. In CVPR, 2016.
- Februus: Input purification defense against trojan attacks on deep neural network systems. In ACSAC, 2020.
- Black-box detection of backdoor attacks with limited information and data. In ICCV, 2021.
- The pascal visual object classes (voc) challenge. IJCV, 2010.
- Adversarial examples for semantic image segmentation. arXiv:1703.01101, 2017.
- Backdoor attack on hash-based image retrieval via clean-label data poisoning. arXiv:2109.08868, 2021.
- Backdoor defense via adaptively splitting poisoned dataset. In CVPR, 2023.
- Strip: A defence against trojan attacks on deep neural networks. In ACSAC, 2019.
- Anti-distillation backdoor attacks: Backdoors can really survive in knowledge distillation. In ACMMM, 2021.
- Effective and efficient vote attack on capsule networks. In ICLR, 2021a.
- Adversarial examples on segmentation models can be easy to transfer. In arXiv:2111.11368, 2021b.
- Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness. In ECCV, 2022.
- Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv:1708.06733, 2017.
- Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 2019.
- Few-shot backdoor defense using shapley estimation. In CVPR, 2022.
- Semantic contours from inverse detectors. In ICCV, 2011.
- Deep residual learning for image recognition. In CVPR, 2016.
- Universal adversarial perturbations against semantic image segmentation. In ICCV, 2017.
- Adversarial attacks for image segmentation on multiple lightweight models. IEEE Access, 2020.
- Universal litmus patterns: Revealing backdoor attacks in cnns. In CVPR, 2020.
- Weight poisoning attacks on pre-trained models. arXiv:2004.06660, 2020.
- Neural attention distillation: Erasing backdoor triggers from deep neural networks. In ICLR, 2021a.
- Hidden backdoor attack against semantic segmentation models. arXiv:2103.04038, 2021b.
- Backdoor learning: A survey. TNNLS, 2022.
- Deeppayload: Black-box backdoor attack on deep learning models through neural payload injection. In ICSE, 2021c.
- Invisible backdoor attack with sample-specific triggers. In ICCV, 2021d.
- Backdoor embedding in convolutional neural network models via invisible perturbation. arXiv:1808.10307, 2018.
- Fine-pruning: Defending against backdooring attacks on deep neural networks. In RAID, 2018.
- Does few-shot learning suffer from backdoor attacks? arXiv:2401.01377, 2023.
- Reflection backdoor: A natural backdoor attack on deep neural networks. In ECCV, 2020.
- Neural trojans. In ICCD, 2017.
- Object-free backdoor attack and defense on semantic segmentation. Computers & Security, 2023.
- Subnet replacement: Deployment-stage backdoor attack against deep neural networks in gray-box setting. arXiv:2107.07240, 2021.
- Tbt: Targeted neural network attack with bit trojan. In CVPR, 2020.
- Imagenet large scale visual recognition challenge. IJCV, 2015.
- Hidden trigger backdoor attacks. In AAAI, 2020.
- Poison frogs! targeted clean-label poisoning attacks on neural networks. In NeurIPS, 2018.
- Intriguing properties of neural networks. arXiv:1312.6199, 2013.
- An embarrassingly simple approach for trojan attack in deep neural networks. In SIGKDD, 2020.
- Better trigger inversion optimization in backdoor scanning. In CVPR, 2022.
- Spectral signatures in backdoor attacks. In NeurIPS, 2018a.
- Spectral signatures in backdoor attacks. In NeurIPS, 2018b.
- Label-consistent backdoor attacks. arXiv:1912.02771, 2019.
- Model agnostic defence against backdoor attacks in machine learning. IEEE Transactions on Reliability, 2022.
- Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE Symposium on Security and Privacy, 2019.
- Backdoor attacks against transfer learning with pre-trained deep learning models. IEEE Transactions on Services Computing, 2020.
- Rab: Provable robustness against backdoor attacks. In IEEE Symposium on Security and Privacy, 2022.
- Towards efficient adversarial training on vision transformers. In ECCV, 2022.
- Adversarial neuron pruning purifies backdoored deep models. In NeurIPS, 2021.
- Characterizing adversarial examples based on spatial consistency information for semantic segmentation. In ECCV, 2018.
- Adversarial examples for semantic segmentation and object detection. In ICCV, 2017.
- Segformer: Simple and efficient design for semantic segmentation with transformers. In NeurIPS, 2021.
- Latent backdoor attacks on deep neural networks. In ACMCCS, 2019.
- Adversarial unlearning of backdoors via implicit hypergradient. arXiv:2110.03735, 2021.
- Pyramid scene parsing network. In CVPR, 2017.
- Bridging mode connectivity in loss landscapes and adversarial robustness. In ICLR, 2020.
- Data-free backdoor removal based on channel lipschitzness. In ECCV, 2022.
Sponsored by Paperpile, the PDF & BibTeX manager trusted by top AI labs.
Get 30 days freePaper Prompts
Sign up for free to create and run prompts on this paper using GPT-5.
Top Community Prompts
Collections
Sign up for free to add this paper to one or more collections.