CUBA: Controlled Untargeted Backdoor Attack against Deep Neural Networks
This work addresses security vulnerabilities in AI systems by proposing a novel attack method that combines untargeted flexibility with targeted intentionality, representing an incremental advancement in backdoor attack techniques.
The paper tackles the problem of backdoor attacks in deep neural networks by introducing CUBA, a controlled untargeted backdoor attack that classifies backdoor images into random classes within a constrained range, achieving effectiveness in circumventing existing defense methods across multiple datasets.
Backdoor attacks have emerged as a critical security threat against deep neural networks in recent years. The majority of existing backdoor attacks focus on targeted backdoor attacks, where trigger is strongly associated to specific malicious behavior. Various backdoor detection methods depend on this inherent property and shows effective results in identifying and mitigating such targeted attacks. However, a purely untargeted attack in backdoor scenarios is, in some sense, self-weakening, since the target nature is what makes backdoor attacks so powerful. In light of this, we introduce a novel Constrained Untargeted Backdoor Attack (CUBA), which combines the flexibility of untargeted attacks with the intentionality of targeted attacks. The compromised model, when presented with backdoor images, will classify them into random classes within a constrained range of target classes selected by the attacker. This combination of randomness and determinedness enables the proposed untargeted backdoor attack to natively circumvent existing backdoor defense methods. To implement the untargeted backdoor attack under controlled flexibility, we propose to apply logit normalization on cross-entropy loss with flipped one-hot labels. By constraining the logit during training, the compromised model will show a uniform distribution across selected target classes, resulting in controlled untargeted attack. Extensive experiments demonstrate the effectiveness of the proposed CUBA on different datasets.