A Backdoor Embedding Method for Backdoor Detection in Deep Neural Networks

Abstract

As the coming of artificial intelligence (AI) era, deep learning models are widely applied on many aspects of our daily lives, such as face recognition, speech recognition, and automatic driving. AI security is also becoming a burning problem. Because the deep learning model is usually regarded as a black box, it is susceptible to backdoor attacks that embed hidden patterns to impact the model prediction results. To promote backdoor detection research, this work proposes a simple backdoor embedding method to produce deep learning models with a backdoor for validating backdoor detection algorithms. Through conceptual embedding techniques, we decouple the backdoor pattern recognition function and the normal classification function in a deep learning model. One advantage is that the backdoor activation mechanism will not directly interfere with the normal function of the original DNN-based model. Another advantage is that the interference of the final prediction result can be more flexible. The backdoor pattern recognition phase and the model prediction interference phase can be developed independently. The aim is that the deep model needs to have an indistinguishable performance in terms of the normal sample classification while it can be triggered by the hidden backdoor patterns at the right time. The analysis and the experiments validate the proposed method that the embedding backdoor model can achieve almost the same prediction performance as the normal model while the backdoor mechanism can be activated precisely.