Source-linked AI summary
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
Yunfei Liu, Xingjun Ma, James Bailey, Feng Lu
TL;DR
Backdoor attacks can control DNN behavior through altered training examples while preserving clean-test accuracy, creating a difficult-to-detect threat. Refool uses physically modeled reflections as backdoor patterns, and experiments across three tasks and five datasets show high attack success with minimal clean-accuracy loss and resistance to defenses.
Problem
Backdoor attacks can plant control mechanisms in DNNs through small sets of altered training examples while preserving accuracy on normal test inputs, making detection difficult.
Method
Refool models physical reflections mathematically, selects effective reflection images, and injects them into a small set of training data as backdoor patterns.
Results
Across five datasets and different networks, Refool achieved attack success above 75% with less than 3.27% injection and under 3% clean-accuracy decrease, while resisting state-of-the-art defenses.
Takeaways & Limitations
Once selected from a wild public dataset, reflection images can be applied across different target datasets without requiring access to those datasets.
Abstract
from arXiv · showhide
Recent studies have shown that DNNs can be compromised by backdoor attacks crafted at training time. A backdoor attack installs a backdoor into the victim model by injecting a backdoor pattern into a small proportion of the training data. At test time, the victim model behaves normally on clean test data, yet consistently predicts a specific (likely incorrect) target class whenever the backdoor pattern is present in a test example. While existing backdoor attacks are effective, they are not stealthy. The modifications made on training data or labels are often suspicious and can be easily detected by simple data filtering or human inspection. In this paper, we present a new type of backdoor attack inspired by an important natural phenomenon: reflection. Using mathematical modeling of physical reflection models, we propose reflection backdoor (Refool) to plant reflections as backdoor into a victim model. We demonstrate on 3 computer vision tasks and 5 datasets that, Refool can attack state-of-the-art DNNs with high success rate, and is resistant to state-of-the-art backdoor defenses.
1 Introduction
Backdoor attacks can preserve clean-data behavior while controlling predictions on triggered inputs, but existing triggers or poisoning practices are often detectable. Refool uses natural reflections as a stealthier backdoor pattern and achieves high attack success with minimal clean-accuracy impact.
- Existing attacks can expose suspicious labels, obvious patterns, unpleasant blending, or stripes, making them easier to detect.
- Backdoor attacks alter a small set of training examples to control predictions on test inputs containing a backdoor pattern while preserving normal-test accuracy.
- Refool exploits natural reflection as a backdoor pattern, avoiding deliberate mislabeling and relying less on conspicuous visual triggers.
- Refool is evaluated across 3 classification tasks and 5 datasets and is reported as more resistant to state-of-the-art backdoor defenses.
- ≥75.16% desired predictions are achieved by injecting reflections into less than 3.27% of training data, with almost no clean-holdout accuracy degradation.
2 Related Work
Prior work includes data poisoning, poison-label and clean-label backdoors, and defenses. Existing backdoor triggers can harm image quality or remain vulnerable to filtering and erasure methods.
- Data poisoning attacks reduce test-time performance on normal or selected examples, producing low normal-test accuracy that can reveal the attack.
- Backdoor attacks are commonly evaluated by high attack success, high stealthiness, and low impact on clean test data.
- Poison-label methods modify non-target images and labels, using triggers such as corner squares, attached images, watermarks, or fixed pixels.
- Clean-label attacks preserve labels, but effective patterns may require perturbations that significantly reduce image quality, especially at high resolution.
- Backdoor defenses include methods that prune abnormal units or detect anomalous behavior, while prior triggers can be erased by defenses.
3 Reflection Backdoor Attack
Refool uses physically modeled natural reflections as diverse, clean-label backdoor triggers. It selects effective reflection images from unrelated public data, injects them into a small target-class subset, and trains a victim model to preserve clean predictions while targeting reflected inputs.
- 3.1 Problem Definition: Refool defines the clean-label backdoor goal as predicting adversarial class y_adv for inputs containing a reflection while leaving clean behavior unchanged.The injection set is drawn from training examples of the adversarial class without changing their labels.
- 3.2 Mathematical Modeling of Reflection: Refool models a poisoned image as x_adv = x + x_R ⊗ k, where x is the clean image, x_R is a reflection image, and k is a convolution kernel.The kernel represents the physical reflection process, including distinct reflection types and ghost effects.
- 3.2 Mathematical Modeling of Reflection: The attack uses three physical reflection models, including a ghost-effect model represented by a two-pulse kernel with α ∼ U[0.15, 0.35] and δ ∼ U[3, 8].The ghost model accounts for glass thickness and multiple reflected images.
- 3.3 Proposed Reflection Backdoor Attack: Refool generates reflected images, trains on the poisoned set, and blends reflection patterns into arbitrary inputs during inference to obtain the target prediction.Only a proportion of target-class images is contaminated during injection, while the learned model is expected to classify clean test inputs correctly.
- 3.3 Proposed Reflection Backdoor Attack: Candidate reflections are ordinary images from a public dataset different from the target dataset, enabling selected reflections to be applied across different target datasets.The attack still requires poisoning a small portion of target-class training data, even though reflection selection does not require target-dataset access.
- 3.3 Proposed Reflection Backdoor Attack: Refool selects the top-m effective reflections from a candidate set through iterative injection, model training, and score updates.Unselected candidates receive the median updated score to increase their probability of selection in later iterations.
4 Experiments
Experiments across three classification tasks and five datasets evaluate Refool’s effectiveness, stealthiness, mechanism, and resistance to backdoor defenses. Refool achieves high attack success with limited clean-accuracy degradation and remains comparatively robust against several defenses.
- Effectiveness and stealthiness: Refool achieves attack success rates above 75% across five datasets and different networks with injection rates below 3.27%.Clean-test accuracy decreases by less than 3% across the reported scenarios; CTSRD exceeds 91% attack success with under 1% poisoned training data.
- Effectiveness and stealthiness: Refool outperforms clean-label attacks at every tested injection rate while increasing injection has minimal impact on clean-example accuracy.On GTSRB, poisoning more target-class data improves attack success until 40%, after which performance stabilizes.
- Understanding Refool: Reflections shift model attention only slightly from correct regions, whereas CL and SIG substantially redirect attention away from them.The comparison uses Grad-CAM attention maps on PubFig and GTSRB samples.
- Resistance to defenses: Refool remains above 60% attack success after 15 clean-data finetuning epochs, while CL and SIG degrade much faster.CL falls from 78.3% to 20% after one epoch, and SIG falls from 73.0% to 25% after four epochs.
- Resistance to defenses: Refool maintains much higher attack success than CL or SIG until 80% of neurons are removed, and Neural Cleanse fails to detect its backdoored model.The reported Neural Cleanse anomaly index remains below the detection threshold of 2.
5 Conclusion
The paper proposes using natural reflections to implant backdoors in DNNs. Across three computer-vision tasks and five datasets, Refool is effective, efficient, minimally disruptive on clean data, and resistant to state-of-the-art defenses.
- 5 Conclusion: Refool generates and injects reflections into a small set of training data to plant a backdoor in a victim model.The approach is based on mathematical modeling of physical reflection models.
- 5 Conclusion: Experiments across three computer-vision tasks and five datasets demonstrate high attack success with small degradation in clean accuracy.
- 5 Conclusion: Reflection backdoors can be generated efficiently and resist state-of-the-art defense methods.The paper identifies robust training strategies against natural backdoors as an open question.
A Real-world reflections in natural images
Natural reflections can harm DNN classification performance. Examples from ImageNet-a show images misclassified under real-world reflections.
- A Real-world reflections in natural images: Three ImageNet-a examples were misclassified by a DNN classifier when natural reflections were present.
- A Real-world reflections in natural images: A black bear image was classified as a rock chair with 82% confidence.
B More implementation details
The implementation details summarize the datasets and models used, the baseline configurations, and the sinusoidal signal settings for SIG.
- B More implementation details: Table 5 summarizes the image datasets and DNN models used in the experiments.
- B More implementation details: The clean-label baseline uses Projected Gradient Descent with an L∞ maximum perturbation of 16.
- B More implementation details: SIG backdoored images use a horizontal sinusoidal signal, with Δ=20 and frequency f=6.
C Results on more target classes
Refool remains consistent when the target class changes on GTSRB, with test accuracy and attack success rate reported across several target classes.
- C Results on more target classes: Refool’s overall results remain consistent across target classes on GTSRB.Experiments included class indexes 1, 2, 3, and 4.
- C Results on more target classes: The reported results show some variation across target classes.
- C Results on more target classes: Table 6 reports attack success rate and test accuracy on clean test samples for different GTSRB target classes.
D More quantitative results for stealthiness comparison
Refool produces substantially smaller image distortions than CL and SIG, supporting its higher stealthiness in quantitative comparisons.
- D More quantitative results for stealthiness comparison: Refool’s average L2, L1, and MSE distortions are much lower than those of CL or SIG.The comparison uses 500 randomly selected CTSRD images.
- D More quantitative results for stealthiness comparison: The lower distortions indicate higher stealthiness for Refool than for CL and SIG.
- D More quantitative results for stealthiness comparison: Table 7 measures average L2, L1, and MSE distances between original and backdoored images.
E More results against state-of-the-art backdoor defenses
Refool remains effective against several backdoor defenses, including white-box trigger removal and Neural Cleanse, while some defenses can substantially harm clean accuracy or expose scope limitations.
- E More results against state-of-the-art backdoor defenses: The defense comparison includes Fine-Pruning, reflection removal, trigger replacement, and non-Local means denoising procedures.These procedures are applied differently according to each attack’s trigger type.
- E More results against state-of-the-art backdoor defenses: Refool maintains a much higher success rate than CL or SIG after white-box trigger removal across four datasets.The datasets are BelgiumTSC, CTSRD, PubFig, and ImageNet, although ImageNet shows an obvious success-rate drop for Refool.
- E More results against state-of-the-art backdoor defenses: None of Refool’s four backdoored models is detected by Neural Cleanse on BelgiumTSC, CTSRD, PubFig, or ImageNet.The passage states that anomaly index values above 2 indicate successful detection.
- E More results against state-of-the-art backdoor defenses: Natural noise affects all backdoor patterns’ effectiveness and increases their possibility of removal.The authors suggest increasing reflection intensity and identify adaptive reflection backdoors as future work.
- E More results against state-of-the-art backdoor defenses: Table 9 evaluates Refool against input denoising and data-augmentation defenses on CTSRD.
- E More results against state-of-the-art backdoor defenses: Image quilting reduces clean-test accuracy from 86.30% to 11.35%.The passage presents this as a substantial performance decrease associated with the defense.