Stealthy Backdoors as Compression Artifacts
This reveals a security vulnerability for users deploying compressed models on resource-constrained devices, highlighting the need to test the actual deployed models rather than precompressed versions.
The paper tackles the risk of adversaries injecting stealthy backdoors into machine learning models that only activate after compression, showing that full-sized models appear backdoor-free but compressed versions exhibit effective backdoors with high attack success rates (e.g., over 90% in some cases).
In a backdoor attack on a machine learning model, an adversary produces a model that performs well on normal inputs but outputs targeted misclassifications on inputs containing a small trigger pattern. Model compression is a widely-used approach for reducing the size of deep learning models without much accuracy loss, enabling resource-hungry models to be compressed for use on resource-constrained devices. In this paper, we study the risk that model compression could provide an opportunity for adversaries to inject stealthy backdoors. We design stealthy backdoor attacks such that the full-sized model released by adversaries appears to be free from backdoors (even when tested using state-of-the-art techniques), but when the model is compressed it exhibits highly effective backdoors. We show this can be done for two common model compression techniques -- model pruning and model quantization. Our findings demonstrate how an adversary may be able to hide a backdoor as a compression artifact, and show the importance of performing security tests on the models that will actually be deployed not their precompressed version.