Deep Generative Models (DGMs) are a popular class of deep learning models which find widespread use because of their ability to synthesize data from complex, high-dimensional manifolds. However, even with their increasing industrial adoption, they haven't been subject to rigorous security and privacy analysis. In this work we examine one such aspect, namely backdoor attacks on DGMs which can significantly limit the applicability of pre-trained models within a model supply chain and at the very least cause massive reputation damage for companies outsourcing DGMs form third parties.
While similar attacks scenarios have been studied in the context of classical prediction models, their manifestation in DGMs hasn't received the same attention. To this end we propose novel training-time attacks which result in corrupted DGMs that synthesize regular data under normal operations and designated target outputs for inputs sampled from a trigger distribution. These attacks are based on an adversarial loss function that combines the dual objectives of attack stealth and fidelity. We systematically analyze these attacks, and show their effectiveness for a variety of approaches like Generative Adversarial Networks (GANs) and Variational Autoencoders (VAEs), as well as different data domains including images and audio. Our experiments show that - even for large-scale industry-grade DGMs (like StyleGAN) - our attacks can be mounted with only modest computational effort. We also motivate suitable defenses based on static/dynamic model and output inspections, demonstrate their usefulness, and prescribe a practical and comprehensive defense strategy that paves the way for safe usage of DGMs.
Backdoor Vectors: a Task Arithmetic View on Backdoor Attacks and Defenses
Warsaw University of Technology（华沙技术大学）；NASK National Research Institute（国家研究机构NASK）；IDEAS NCBR；IDEAS Research Institute（IDEAS研究所）；Computer Vision Center, Universitat Autonoma de Barcelona（巴塞罗那自治大学计算机视觉中心）
Defending the Edge: Representative-Attention Defense against Backdoor Attacks in Federated Learning
Dept. of Computer Science Faculty of Engineering University of Manchester Manchester, United Kingdom；Dept. of Computer Science Faculty of Engineering University of Manchester \& MBZUAI Abu Dhabi, United Arab Emirates；Dept. of Computer Science Faculty of Engineering University of Manchester \& KU Leuven Manchester, United Kingdom
Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images
University of West Florida（西佛罗里达大学）；Florida Institute For Human and Machine Cognition (IHMC)（佛罗里达人机认知研究所）；Center for Cybersecurity, University of West Florida（西佛罗里达大学网络安全中心）
REFINE: Inversion-Free Backdoor Defense via Model Reprogramming
Zhejiang University（浙江大学）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新区（滨江）区块链与数据安全研究院）；Nanyang Technological University（南洋理工大学）；IBM Research（IBM研究院）
Reconstructive Neuron Pruning for Backdoor Defense
Xidian University（西安电子科技大学）；Fudan University（复旦大学）；Shanghai Artificial Intelligence Laboratory（上海人工智能实验室）；University of Copenhagen（哥本哈根大学）；Sony AI（索尼人工智能）；University of Illinois at Urbana–Champaign（伊利诺伊大学厄巴纳-香槟分校）
MARS: A Malignity-Aware Backdoor Defense in Federated Learning
Faculty of Data Science, City University of Macau（澳门城市大学数据科学学院）；School of Computing, Australian National University（澳大利亚国立大学计算机学院）；Ant Group（蚂蚁集团）；School of Cyber Science and Engineering, Huazhong University of Science and Technology（华中科技大学网络安全工程学院）；School of Computer Science and Technology, Huazhong University of Science and Technology（华中科技大学计算机科学与技术学院）；College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）；School of Information and Communication Technology, Griffith University（格里菲斯大学信息与通信技术学院）
Towards Backdoor Stealthiness in Model Parameter Space
Radboud University（拉德博德大学）；Delft University of Technology（代尔夫特理工大学）；Radboud University, Nijmegen, The Netherlands（拉德博德大学）；University of Zagreb Faculty of Electrical Engineering and Computing（Zagreb 工程与计算学院）
SoK: The Last Line of Defense: On Backdoor Defense Evaluation
University of Bergen（卑尔根大学）；Radboud University（拉德博德大学）；Delft University of Technology（代尔夫特理工大学）；University of Pavia（帕维亚大学）；Ikerlan Research Center Radboud University（Ikerlan研究中心拉德博德大学）
FedBAP: Backdoor Defense via Benign Adversarial Perturbation in Federated Learning
School of Cyber Science and Engineering, Wuhan University（武汉大学计算机科学与工程学院）；Department of Computer and Artificial Intelligence, Wuhan University of Technology（武汉理工大学计算机与人工智能学院）；School of Software Engineering, Huazhong University of Science and Technology（华中科技大学软件工程学院）
在这项工作中，我们提出了第一个后门攻击图神经网络（GNN）。具体来说，我们提出了一个\emph{subgraph based backdoor attack}的GNN图分类。在我们的后门攻击中，一旦预定义的子图被注入测试图，GNN分类器就预测攻击者为测试图选择的目标标签。我们在三个真实世界的图数据集上的实证结果表明，我们的后门攻击是有效的，对GNN的预测准确性的影响很小。此外，我们推广了一种基于随机平滑的认证防御来抵御我们的后门攻击。我们的实证结果表明，防御在某些情况下是有效的，但在其他情况下无效，突出了我们的后门攻击的新防御的需要。
State Key Laboratory of Integrated Services Networks (ISN)（综合业务网理论及关键技术国家重点实验室）；Shaanxi Key Laboratory of Network and System Security, Xidian University（西安电子科技大学陕西省网络与系统安全重点实验室）；School of Data Science and Engineering, East China Normal University（华东师范大学数据科学与工程学院）；Ant Group（蚂蚁集团）；College of Computer and Data Science, Fuzhou University（福州大学计算机与数据科学学院）
Cert-SSBD: Certified Backdoor Defense with Sample-Specific Smoothing Noises
School of Control and Computer Engineering, North China Electric Power University（控制与计算机工程学院，华北电力大学）；Research Institute, China Unicom（中国unicom研究院）；National Engineering Research Center of Next Generation Internet Broadband Service Application（下一代互联网宽带服务应用国家工程研究中心）；College of Computing and Data Science, Nanyang Technological University（计算与数据科学学院，南洋理工大学）
Learning Normal Diffusion Dynamics for Backdoor Defense in Text-to-Image Models
Geely（吉利）；Hunan University（湖南大学）；East China Normal University（华东师范大学）；University of Adelaide（阿德莱德大学）；The Hong Kong University of Science and Technology（香港科技大学）；China University of Petroleum (East China)（中国石油大学（华东））
