ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networks
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2022
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866914817296564224 |
|---|---|
| author | Clifford, Eleanor Shumailov, Ilia Zhao, Yiren Anderson, Ross Mullins, Robert |
| author_facet | Clifford, Eleanor Shumailov, Ilia Zhao, Yiren Anderson, Ross Mullins, Robert |
| contents | Early backdoor attacks against machine learning set off an arms race in attack and defence development. Defences have since appeared demonstrating some ability to detect backdoors in models or even remove them. These defences work by inspecting the training data, the model, or the integrity of the training procedure. In this work, we show that backdoors can be added during compilation, circumventing any safeguards in the data preparation and model training stages. The attacker can not only insert existing weight-based backdoors during compilation, but also a new class of weight-independent backdoors, such as ImpNet. These backdoors are impossible to detect during the training or data preparation processes, because they are not yet present. Next, we demonstrate that some backdoors, including ImpNet, can only be reliably detected at the stage where they are inserted and removing them anywhere else presents a significant challenge. We conclude that ML model security requires assurance of provenance along the entire technical pipeline, including the data, model architecture, compiler, and hardware specification. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2210_00108 |
| institution | arXiv |
| publishDate | 2022 |
| record_format | arxiv |
| spellingShingle | ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networks Clifford, Eleanor Shumailov, Ilia Zhao, Yiren Anderson, Ross Mullins, Robert Machine Learning Cryptography and Security Early backdoor attacks against machine learning set off an arms race in attack and defence development. Defences have since appeared demonstrating some ability to detect backdoors in models or even remove them. These defences work by inspecting the training data, the model, or the integrity of the training procedure. In this work, we show that backdoors can be added during compilation, circumventing any safeguards in the data preparation and model training stages. The attacker can not only insert existing weight-based backdoors during compilation, but also a new class of weight-independent backdoors, such as ImpNet. These backdoors are impossible to detect during the training or data preparation processes, because they are not yet present. Next, we demonstrate that some backdoors, including ImpNet, can only be reliably detected at the stage where they are inserted and removing them anywhere else presents a significant challenge. We conclude that ML model security requires assurance of provenance along the entire technical pipeline, including the data, model architecture, compiler, and hardware specification. |
| title | ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networks |
| topic | Machine Learning Cryptography and Security |
| url | https://arxiv.org/abs/2210.00108 |