Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks (2007.02343v2)

Abstract: Recent studies have shown that DNNs can be compromised by backdoor attacks crafted at training time. A backdoor attack installs a backdoor into the victim model by injecting a backdoor pattern into a small proportion of the training data. At test time, the victim model behaves normally on clean test data, yet consistently predicts a specific (likely incorrect) target class whenever the backdoor pattern is present in a test example. While existing backdoor attacks are effective, they are not stealthy. The modifications made on training data or labels are often suspicious and can be easily detected by simple data filtering or human inspection. In this paper, we present a new type of backdoor attack inspired by an important natural phenomenon: reflection. Using mathematical modeling of physical reflection models, we propose reflection backdoor (Refool) to plant reflections as backdoor into a victim model. We demonstrate on 3 computer vision tasks and 5 datasets that, Refool can attack state-of-the-art DNNs with high success rate, and is resistant to state-of-the-art backdoor defenses.

• The paper presents Refool, a method that exploits natural reflections to implant backdoors in deep neural networks.
• It employs a novel reflection image generation and selection strategy, achieving over 75% attack success with as little as 3.27% injection.
• The findings highlight a critical gap in existing defenses, urging the development of advanced countermeasures for DNN security.

Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks

The paper "Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks" by Yunfei Liu et al. presents a novel approach to backdoor attacks on deep neural networks (DNNs), exploiting a natural phenomenon—reflections—to implant backdoors. The attack, termed Refool, is designed to circumvent existing defenses by leveraging the innate characteristics of reflections that are ubiquitous in the visual environment.

Overview and Methodology

Backdoor attacks in DNNs traditionally involve the insertion of a backdoor pattern into a subset of training data such that, during inference, the model performs abnormally when the backdoor pattern is present. Most existing techniques rely on conspicuous patterns, which can be detected and filtered out. This paper proposes leveraging the natural phenomenon of reflection as a more stealthy backdoor trigger. The authors develop a mathematical model of physical reflections and explore three types of reflections: those within the same depth of field, blurred reflections, and ghost reflections. They illustrate that these reflections can be subtly and effectively integrated into the training data, resulting in an efficient backdoor mechanism.

The attack pipeline consists of generating reflection images, injecting them into a small subset of training data without altering the labels, and subsequently training the victim model on this poisoned dataset. The reflection images are sourced from public datasets and are used in their native form, thereby requiring no access to the target dataset for their generation. A distinctive feature of this attack is the variability of reflection triggers, enhancing its effectiveness and stealthiness.

Experimentation and Results

The paper evaluates Refool across three computer vision tasks—traffic sign recognition, face recognition, and object classification—utilizing five datasets and two DNN architectures (ResNet-34 and DenseNet). An insightful innovation of the investigation is the adversarial reflection image selection strategy, optimizing reflection efficacy through iterative selection processes. The results demonstrate that Refool can achieve attack success rates exceeding 75% with injection rates as low as 3.27%, while maintaining high accuracy on clean data. This stark performance contrasts with traditional backdoor attacks like Badnets, Clean-label, and Signal backdoors, which show lower attack success rates or less stealth.

Implications and Future Considerations

The findings suggest profound implications for the security and robustness of deep learning systems, especially in domains where DNNs are deployed under potentially adversarial settings. The natural and imperceptible nature of reflection-based backdoors points to a gap in existing defense mechanisms and necessitates advanced countermeasures.

From a defensive perspective, the problems raised by natural phenomenon-inspired attacks like Refool challenge the current paradigms in backdoor detection, which largely focus on artificial, easily identifiable patterns. Future research could explore adaptive training strategies that inherently recognize and mitigate the impact of such natural feature manipulations. Furthermore, developing real-time monitoring systems that evaluate input for natural disturbances could serve as a first line of defense against this class of backdoor attacks.

The paper opens avenues for further exploration into utilizing natural phenomena for adversarial purposes in AI systems, which could reshape the strategies and technologies employed in ensuring the safety and integrity of machine learning models.