Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases
Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases
Translation in progress — untranslated text is omitted.
The paper proposes trojan neural network detection methods for data-limited and data-free scenarios. The data-limited detector leverages the connection between trojan attacks and per-sample adversarial attacks and universal adversarial attacks; the data-free detector leverages the trojan behavior that hidden neurons still exhibit under random noise inputs. The authors evaluate the effectiveness of the methods on datasets such as CIFAR-10, GTSRB and ImageNet and across different model architectures.
- Poisoning training data can give CNNs a Trojan backdoor, while the detector often cannot obtain the training data and trigger pattern. The authors aim to solve the problem of detecting Trojan networks under data-limited or even data-free conditions.
- DL-TND and DF-TND are proposed: the former compares the cosine similarity of neuron representations between universal perturbations and per-image perturbations, while the latter inverts triggers from random inputs via activation maximization and observes logits increments; both are solved uniformly with a proximal gradient algorithm.
- On CIFAR-10, GTSRB, R-ImgNet and ResNet-50, VGG16, AlexNet, the average AUROC of both detectors is 0.99; at T1=0.7, DL-TND correctly identifies 84/85 clean networks and detects 82/85 Trojan networks, outperforming the baseline NC; for clean-label attacks, DF-TND reaches 0.92 AUROC.
- The authors do not specifically discuss limitations. Experiments cover only three CNN architectures and three image classification datasets; when ASR drops to 30%, DL-TND's AUROC is 0.82 and DF-TND's is 0.7; clean-label attacks were tested only with DF-TND.
Related papers
Both use: GTSRB