BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defense
This work addresses the critical need for automated forensics in defending against backdoor attacks in deep learning models, offering a scalable solution for attack categorization and detection.
The paper tackles the problem of defending against deep learning backdoor attacks by proposing a novel forensics technique that automatically decomposes attack samples into clean inputs and triggers, clusters triggers for categorization, and synthesizes scanners to detect similar backdoors in other models. The evaluation on 2,532 pre-trained models and 10 attacks shows high effectiveness, with decomposed components closely resembling ground truth and synthesized scanners substantially outperforming existing ones.
Deep Learning backdoor attacks have a threat model similar to traditional cyber attacks. Attack forensics, a critical counter-measure for traditional cyber attacks, is hence of importance for defending model backdoor attacks. In this paper, we propose a novel model backdoor forensics technique. Given a few attack samples such as inputs with backdoor triggers, which may represent different types of backdoors, our technique automatically decomposes them to clean inputs and the corresponding triggers. It then clusters the triggers based on their properties to allow automatic attack categorization and summarization. Backdoor scanners can then be automatically synthesized to find other instances of the same type of backdoor in other models. Our evaluation on 2,532 pre-trained models, 10 popular attacks, and comparison with 9 baselines show that our technique is highly effective. The decomposed clean inputs and triggers closely resemble the ground truth. The synthesized scanners substantially outperform the vanilla versions of existing scanners that can hardly generalize to different kinds of attacks.