Revocable Backdoor for Deep Model Trading
This addresses the trustworthiness issue in deep model trading for sellers and buyers, offering a novel security mechanism, though it is incremental as it builds on existing backdoor attack concepts.
The paper tackles the problem of backdoor attacks in deep models by proposing a revocable backdoor that allows sellers to compromise models without performance degradation and easily detoxify them without retraining, enabling a secure trading scenario where buyers can test trial versions and pay for clean models.
Deep models are being applied in numerous fields and have become a new important digital product. Meanwhile, previous studies have shown that deep models are vulnerable to backdoor attacks, in which compromised models return attacker-desired results when a trigger appears. Backdoor attacks severely break the trust-worthiness of deep models. In this paper, we turn this weakness of deep models into a strength, and propose a novel revocable backdoor and deep model trading scenario. Specifically, we aim to compromise deep models without degrading their performance, meanwhile, we can easily detoxify poisoned models without re-training the models. We design specific mask matrices to manage the internal feature maps of the models. These mask matrices can be used to deactivate the backdoors. The revocable backdoor can be adopted in the deep model trading scenario. Sellers train models with revocable backdoors as a trial version. Buyers pay a deposit to sellers and obtain a trial version of the deep model. If buyers are satisfied with the trial version, they pay a final payment to sellers and sellers send mask matrices to buyers to withdraw revocable backdoors. We demonstrate the feasibility and robustness of our revocable backdoor by various datasets and network architectures.