PaperlayerView exact revision on arXiv

Source-linked AI summary

Backdooring and Poisoning Neural Networks with Image-Scaling Attacks

Erwin Quiring, Konrad Rieck

arXiv:2003.08633v1cs.CRcs.CV

TL;DR

Visible artifacts make poisoning and backdoor attacks easier to detect, motivating a strategy that combines them with image-scaling attacks. The paper shows that this combination conceals manipulations without reducing overall attack success, while existing detection defenses fail in key poisoning settings and can be weakened further by an adaptive attack.

  • Problem

    Poisoning attacks can leave visible image manipulations that reveal the attack during human auditing, creating a security concern for machine-learning systems and outsourced training.

    Source: §I · p. 1

  • Method

    The paper combines backdoor or clean-label poisoning with image-scaling attacks and evaluates histogram- and color-scattering-based detection defenses, including an adaptive attack.

    Source: §I · pp. 1–2, B. Image-Scaling Attacks · p. 3, B. Enhanced Poisoning Attacks · p. 3

  • Results

    The combined attacks conceal manipulations without affecting overall attack success, while defenses fail on backdoor attacks and the adaptive variant reduces detection performance for clean-label attacks.

    Source: §I · p. 1, B. Backdoor Attacks · p. 5, C. Clean-Label Poisoning Attack · p. 6

  • Takeaways & Limitations

    Image-scaling attacks provide a means to hide poisoning traces across representative backdoor and clean-label approaches, motivating more robust detection defenses.

    Source: §I · p. 1, §VII · p. 6

    The study evaluates only defenses against image-scaling attacks and uses a simple filled-box backdoor without optimizing its shape or model architecture, requiring relatively many manipulated training images.

    Source: §V · p. 6

Abstract

from arXiv · show

Backdoors and poisoning attacks are a major threat to the security of machine-learning and vision systems. Often, however, these attacks leave visible artifacts in the images that can be visually detected and weaken the efficacy of the attacks. In this paper, we propose a novel strategy for hiding backdoor and poisoning attacks. Our approach builds on a recent class of attacks against image scaling. These attacks enable manipulating images such that they change their content when scaled to a specific resolution. By combining poisoning and image-scaling attacks, we can conceal the trigger of backdoors as well as hide the overlays of clean-label poisoning. Furthermore, we consider the detection of image-scaling attacks and derive an adaptive attack. In an empirical evaluation, we demonstrate the effectiveness of our strategy. First, we show that backdoors and poisoning work equally well when combined with image-scaling attacks. Second, we demonstrate that current detection defenses against image-scaling attacks are insufficient to uncover our manipulations. Overall, our work provides a novel means for hiding traces of manipulations, being applicable to different poisoning approaches.

I. INTRODUCTION

The paper combines poisoning with image-scaling attacks to conceal visible manipulations while preserving attack effectiveness, and finds existing scaling defenses inadequate in poisoning scenarios.

I. INTRODUCTION

  • The security problem matters because poisoning can affect machine-learning systems used in security-critical applications and can enter through outsourced training processes.Large training datasets and external computation create opportunities for insiders or providers to manipulate data and models.Source: §I · p. 1
  • Image-scaling attacks hide poisoning manipulations by making altered content appear only after downscaling, unlike standard attacks whose artifacts remain visible.A clean-label example blends a dog into cat images, while the dog appears only in the downscaled training input.Source: §I · p. 1, Figure 1 · p. 1
  • The paper provides the first analysis of combining data-poisoning attacks with image-scaling attacks across backdoor and clean-label settings.It considers two realistic threat models and examines both attack types.Source: §I · pp. 1–2
  • The combined attacks conceal backdoor and clean-label manipulations without reducing their overall attack success rate.The approach targets visible triggers and overlays that can otherwise be discovered through human auditing.Source: §I · p. 1
  • Current image-scaling detection methods fail to detect backdoor attacks because their manipulations are small and bounded, while an adaptive attack reduces detection performance for clean-label poisoning.The evaluated defenses include histogram- and color-scattering-based methods.Source: §I · pp. 1–2

II. BACKGROUND

The background connects training-time poisoning with preprocessing-time image-scaling attacks, whose combination can create targeted inputs that look benign before scaling and can be assessed through down-upscaled image comparisons.

A. Poisoning Attacks in Machine Learning

  • Poisoning attacks manipulate training data or models to alter overall behavior or produce targeted predictions, especially when training is outsourced or continuously updated.The paper focuses on deep neural networks and notes that visible manipulations can be uncovered by auditing training data.Source: A. Poisoning Attacks in Machine Learning · p. 2

B. Image-Scaling Attacks

  • Image-scaling attacks slightly modify a source image S so that it resembles S before preprocessing but becomes a target image T after downscaling.The attack image A = S + ∆ must satisfy pixel-range constraints and jointly make the scaled output close to T and the original image indistinguishable from S.Source: B. Image-Scaling Attacks · p. 2
  • The attack exploits fixed-size neural-network inputs, because larger images must be downscaled before entering models such as VGG19 or InceptionV3.This preprocessing step lets an adversary create targeted network inputs that are invisible at the original resolution.Source: B. Image-Scaling Attacks · p. 2
  • Existing detection methods downscale an image, upscale the result, and compare the reconstruction with the original using intensity histograms or color-scattering features.Histogram detection uses a 256-dimensional grayscale intensity vector and cosine similarity; lower similarity indicates an attack.Source: B. Image-Scaling Attacks · pp. 2–3, Figure 3 · p. 2
  • The paper notes that prevention defenses can block image-scaling attacks but do not reveal whether the dataset was already manipulated.This work therefore focuses on detection rather than prevention.Source: B. Image-Scaling Attacks · p. 3

III. DATA POISONING USING IMAGE-SCALING

The paper combines poisoning and image-scaling attacks so targeted predictions can be produced while manipulations remain less visible, beginning with two threat models and two attack variants.

III. DATA POISONING USING IMAGE-SCALING

  • The adversary seeks targeted predictions for crafted inputs while preserving normal behavior on benign inputs, using image-scaling attacks to create less visible poisoning.The section introduces two threat models and two attack variants for combining the attacks.Source: §III · p. 3

A. Two Realistic Threat Models

The paper considers two threat models in which image-scaling attacks hide poisoning artifacts during test-time or training-time manipulation, assuming the attacker knows the scaling algorithm and neural-network input size.

Test-time stealthiness

  • At test time, image-scaling attacks can conceal visible backdoor triggers in instances submitted to a model trained by an outsourced process.The attacker may otherwise arbitrarily change training data or the model, provided the returned model has the expected accuracy and architecture.Source: A. Two Realistic Threat Models · p. 3

Training-time stealthiness

  • At training time, image-scaling attacks can hide poisoning traces when an insider can alter training data but cannot manipulate the training process or model.This setting is relevant to insiders with privileged access, because poisoned data may otherwise be exposed by human auditing.Source: A. Two Realistic Threat Models · p. 3

Attacker knowledge

  • Both threat models require knowledge of the deployed scaling algorithm and the neural network’s input size.The paper considers this knowledge plausible for an insider or an attacker who trains the model.Source: A. Two Realistic Threat Models · p. 3

B. Enhanced Poisoning Attacks

The paper combines image-scaling attacks with backdoor and clean-label poisoning methods so manipulations remain hidden while targeted predictions are preserved.

Attack scope

  • The study examines backdoor and clean-label poisoning attacks to compare how different image manipulations interact with image-scaling attacks and defenses.These attacks represent distinct ways to manipulate training or test images for targeted predictions.Source: B. Enhanced Poisoning Attacks · p. 3

Backdoor attack

  • Backdoor attacks add a bounded pattern to selected training images and relabel them, teaching the classifier to associate that pattern with a target class.The method uses the BadNets approach from Gu et al. [5].Source: B. Enhanced Poisoning Attacks · p. 3
  • For test-time stealth, the attacker solves the image-scaling attack between a clean source image and a backdoored target so the trigger appears only after downscaling.The resulting attack image is passed to the learning system while the source image itself remains free of the backdoor.Source: B. Enhanced Poisoning Attacks · p. 3
  • The same image-scaling principle can hide backdoored training images, allowing a trigger to be disguised during training and activated physically at test time without scaling.The paper highlights physical-world backdoors such as those applied to road signs.Source: B. Enhanced Poisoning Attacks · p. 3

Clean-label attack

  • Clean-label poisoning preserves the correct labels while embedding a target instance into images from the chosen class, enabling an unmodified test image to be classified as that class.The attack uses low-opacity overlays and then constructs scaled attack images as training instances.Source: B. Enhanced Poisoning Attacks · p. 3

Detection scope

  • The resulting full-image manipulation also enables evaluation of whether image-scaling defenses detect poisoning beyond small, bounded triggers.This broadens the detection problem from localized backdoor patterns to changes distributed across the image.Source: B. Enhanced Poisoning Attacks · p. 4

C. Adaptive Image-Scaling Attack

The adaptive attack modifies the target image so its downscaled content changes while its upscaled histogram resembles the source, reducing the effectiveness of image-scaling defenses.

Adaptive attack

  • The adaptive variant targets histogram-based detection and also works against color-scattering-based detection.It is introduced specifically to hide poisoned images from current defenses.Source: C. Adaptive Image-Scaling Attack · p. 4

Construction

  • The attack upscales the target, matches its histogram to the source, denoises the result, downscales it into a new target, and mounts the scaling attack using that target.The resulting image changes content after scaling while retaining a similar histogram after upscaling.Source: C. Adaptive Image-Scaling Attack · p. 4

Observed effect

  • Figures 4(a), 4(b), 4(f), and 4(h) show that the adaptive attack aligns the histograms of A and A′ while remaining visually close to the original attack.The two images remain visually different after the relevant transformations, despite the histogram alignment.Source: C. Adaptive Image-Scaling Attack · p. 4

Limitation and selection

  • Exact histogram matching is not obtained, so the attacker improves success by selecting source and target images with similar color tones and retaining the highest-scoring adapted images.The procedure mounts the attack on a larger set of adapted images before selection.Source: C. Adaptive Image-Scaling Attack · p. 4

IV. EVALUATION

The evaluation tests poisoning and image-scaling attacks, detection defenses, and the adaptive variant using CIFAR-10 with a 32 × 32 × 3 model input and enlarged 256 × 256 × 3 source images.

IV. EVALUATION

  • The evaluation asks whether image-scaling preserves poisoning performance, whether defenses detect backdoors, and whether the adaptive attack evades detection of clean-label attacks.These experiments cover attack effectiveness, defense performance, and the adaptive method.Source: §IV · p. 4

A. Dataset & Setup

  • CIFAR-10 is split into 40,000 training images and 10,000 validation images, using the Carlini–Wagner architecture with 32 × 32 × 3 inputs.This setup supports training across multiple attack configurations.Source: A. Dataset & Setup · p. 4
  • Figure 4 compares original and adaptive attacks through histograms, attack images A, downscaled network inputs, and upscaled images A′.Plots (a) and (b) show histograms; (c) and (f), (d) and (g), and (e) and (h) show the corresponding image stages.Source: Figure 4 · p. 4
  • The image-scaling attack uses Xiao et al.’s strong variant with ϵ = 1.0 and TensorFlow 1.13’s bilinear scaling.Other scaling algorithms are omitted because the controlled scaling ratio makes them behave identically in this setup.Source: A. Dataset & Setup · p. 4
  • CIFAR-10 images are upscaled to 256 × 256 × 3 with OpenCV’s Lanczos algorithm to create higher-resolution source images without using the same algorithm for upscaling and downscaling.The choice follows common scaling ratios observed in ImageNet images.Source: A. Dataset & Setup · p. 4

B. Backdoor Attacks

Image-scaling attacks conceal backdoor triggers without reducing attack success, while the evaluated defenses fail to reliably detect these manipulations.

B. Backdoor Attacks

  • Backdoor experiments average results across ten target classes and include a baseline without image-scaling attacks.The setup evaluates benign accuracy on unmodified CIFAR-10 test images and excludes target-class images when testing backdoors.Source: B. Backdoor Attacks · p. 4
  • With 5% of training data modified, backdoors achieve an almost perfect result while unmodified-test accuracy changes little.Source: B. Backdoor Attacks · pp. 4–5
  • Image-scaling attacks preserve backdoor success while considerably hiding the trigger from quick visual inspection.Applying scaling attacks to training data produces identical success and visibility results.Source: B. Backdoor Attacks · p. 5, Figure 6 · p. 5
  • Both histogram-based and color-scattering-based defenses fail to reliably detect image-scaling attacks in backdoor scenarios.The analysis attributes this failure to the manipulation being small relative to the overall image.Source: B. Backdoor Attacks · p. 5, Figure 7 · p. 5

C. Clean-Label Poisoning Attack

Image-scaling attacks conceal clean-label poisoning while only slightly affecting attack success, although detection remains possible and can be reduced by an adaptive variant.

C. Clean-Label Poisoning Attack

  • The evaluation uses 50 randomly selected target-source class pairs, varies the number of modified images, and sets the embedding parameter α = 0.3.A baseline without image-scaling attacks is included for comparison, following Shafahi et al. [12].Source: C. Clean-Label Poisoning Attack · p. 5
  • Clean-label poisoning significantly controls the target prediction, and image-scaling attacks have only a slight effect on success rate.Success increases with more modified training images, consistent with prior results [12].Source: C. Clean-Label Poisoning Attack · p. 5
  • Image-scaling attacks effectively hide the added target content, turning the manipulation into imperceptible noise distributed across the image.The original attack visibly adds the target content, whereas the scaled version does not.Source: C. Clean-Label Poisoning Attack · p. 5, Figure 9 · p. 6
  • At 1% false positives, histogram-based detection identifies 94.5% of manipulated images, versus 48.2% for color scattering.Unlike backdoor manipulations, whole-image changes increase the difference between attack images and their down- and upscaled versions.Source: C. Clean-Label Poisoning Attack · pp. 5–6

D. Adaptive attack

An adaptive image-scaling strategy lowers detection of clean-label manipulations while only slightly affecting attack success; the analysis remains limited to selected defenses and a simple backdoor.

D. Adaptive attack

  • The adaptive attack significantly lowers detection rates while only slightly affecting the clean-label attack’s overall success.The authors attribute this to histogram matching that weakens parts of the embedded content, especially in very dark or highly saturated images.Source: D. Adaptive attack · p. 6
  • The authors conclude that current detection methods can be circumvented by adjusting image histograms.Source: D. Adaptive attack · p. 6

V. LIMITATIONS

  • The limitation analysis considers only defenses against image-scaling attacks, leaving direct data-poisoning defenses beyond scope.Such defenses would need to be applied after downscaling, and their design remains ongoing research [17].Source: §V · p. 6
  • The backdoor evaluation uses a simple filled-box technique without optimizing the shape or model architecture, requiring relatively much manipulated training data.The authors frame this setup as a way to draw initial conclusions about image-scaling attacks for backdooring.Source: §V · p. 6

VI. RELATED WORK

The paper situates its work within poisoning and image-scaling research, then shows that scaling attacks can conceal poisoning manipulations while existing detection defenses remain inadequate.

VI. RELATED WORK

  • The paper focuses on backdoor and clean-label poisoning attacks, using BadNets [5] and Shafahi et al.’s clean-label method [12] as representative approaches.BadNets inserts a small bounded pattern, whereas the clean-label attack slightly changes the whole image.Source: §VI · p. 6
  • It extends image-scaling research from preventing attacks to analyzing their use in poisoning and evaluating detection defenses.The paper distinguishes prevention, which stops attacks, from detection, which uncovers ongoing attacks.Source: §VI · p. 6

VII. CONCLUSION

  • Image-scaling attacks create almost invisible poisoned instances by spreading slight manipulations over a larger image area without reducing overall poisoning success.The conclusion covers both backdoor and clean-label poisoning attacks.Source: §VII · p. 6
  • Local bounded changes used for backdoors evade detection entirely, while whole-image changes can circumvent detection through the adaptive image-scaling variant.These findings motivate novel detection defenses against image-scaling attacks.Source: §VII · p. 6

Related papers

Loading 2003.08633v1…