Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks
This work addresses a critical security vulnerability for users deploying AI models on devices, highlighting a novel threat of computer viruses that can stealthily inject backdoors, though it is incremental in advancing deployment-stage attack methods.
The paper tackles the problem of deployment-stage backdoor attacks on deep neural networks, which are understudied compared to training-stage attacks, by proposing a gray-box, physically realizable subnet replacement attack (SRA) that achieves high attack success rates (e.g., over 90% on CIFAR-10 and ImageNet) and demonstrates real-world feasibility through system-level experiments.
One major goal of the AI security community is to securely and reliably produce and deploy deep learning models for real-world applications. To this end, data poisoning based backdoor attacks on deep neural networks (DNNs) in the production stage (or training stage) and corresponding defenses are extensively explored in recent years. Ironically, backdoor attacks in the deployment stage, which can often happen in unprofessional users' devices and are thus arguably far more threatening in real-world scenarios, draw much less attention of the community. We attribute this imbalance of vigilance to the weak practicality of existing deployment-stage backdoor attack algorithms and the insufficiency of real-world attack demonstrations. To fill the blank, in this work, we study the realistic threat of deployment-stage backdoor attacks on DNNs. We base our study on a commonly used deployment-stage attack paradigm -- adversarial weight attack, where adversaries selectively modify model weights to embed backdoor into deployed DNNs. To approach realistic practicality, we propose the first gray-box and physically realizable weights attack algorithm for backdoor injection, namely subnet replacement attack (SRA), which only requires architecture information of the victim model and can support physical triggers in the real world. Extensive experimental simulations and system-level real-world attack demonstrations are conducted. Our results not only suggest the effectiveness and practicality of the proposed attack algorithm, but also reveal the practical risk of a novel type of computer virus that may widely spread and stealthily inject backdoor into DNN models in user devices. By our study, we call for more attention to the vulnerability of DNNs in the deployment stage.