SSL-Cleanse：自监督学习中的木马检测与缓解

ESTAS: Effective and Stable Trojan Attacks in Self-supervised Encoders with One Target Unlabelled Sample

Emerging self-supervised learning (SSL) has become a popular image representation encoding method to obviate the reliance on labeled data and learn rich representations from large-scale, ubiquitous unlabelled data. Then one can train a downstream classifier on top of the pre-trained SSL image encoder with few or no labeled downstream data. Although extensive works show that SSL has achieved remarkable and competitive performance on different downstream tasks, its security concerns, e.g, Trojan attacks in SSL encoders, are still not well-studied. In this work, we present a novel Trojan Attack m…

SanitAIs: Unsupervised Data Augmentation to Sanitize Trojaned Neural Networks

Self-supervised learning (SSL) methods have resulted in broad improvements to neural network performance by leveraging large, untapped collections of unlabeled data to learn generalized underlying structure. In this work, we harness unsupervised data augmentation (UDA), an SSL technique, to mitigate backdoor or Trojan attacks on deep neural networks. We show that UDA is more effective at removing trojans than current state-of-the-art methods for both feature space and point triggers, over a range of model architectures, trojans, and data quantities provided for trojan removal. These results de…

SAND：一种用于硬件木马检测的自监督自适应NAS驱动框架

SAND: A Self-supervised and Adaptive NAS-Driven Framework for Hardware Trojan Detection

针对现有机器学习硬件木马检测方法依赖人工特征、自适应性不足的问题，提出自监督自适应NAS驱动框架SAND，通过自监督自动提特征、NAS动态优化分类器，检测准确率较SOTA最高提升18.3%，鲁棒性与泛化性优异。

NeuronInspect: Detecting Backdoors in Neural Networks via Output Explanations

Deep neural networks have achieved state-of-the-art performance on various tasks. However, lack of interpretability and transparency makes it easier for malicious attackers to inject trojan backdoor into the neural networks, which will make the model behave abnormally when a backdoor sample with a specific trigger is input. In this paper, we propose NeuronInspect, a framework to detect trojan backdoors in deep neural networks via output explanation techniques. NeuronInspect first identifies the existence of backdoor attack targets by generating the explanation heatmap of the output layer. We o…

GhostEncoder：自监督学习中针对预训练编码器的动态触发器隐蔽后门攻击

GhostEncoder: Stealthy Backdoor Attacks with Dynamic Triggers to Pre-trained Encoders in Self-supervised Learning

针对自监督预训练编码器后门触发器可见或静态的问题，提出GhostEncoder，利用图像隐写生成动态隐形触发器并微调注入后门，实现高隐蔽性、高攻击成功率且可抵御多种先进防御。

Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization

Deep neural networks (DNNs) have been proven vulnerable to backdoor attacks, where hidden features (patterns) trained to a normal model, which is only activated by some specific input (called triggers), trick the model into producing unexpected behavior. In this paper, we create covert and scattered triggers for backdoor attacks, invisible backdoors, where triggers can fool both DNN models and human inspection. We apply our invisible backdoors through two state-of-the-art methods of embedding triggers for backdoor attacks. The first approach on Badnets embeds the trigger into DNNs through steg…