PaperlayerView exact revision on arXiv

Source-linked AI summary

Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review

Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, Hyoungshick Kim

arXiv:2007.10760v3cs.CRcs.CVcs.LG

TL;DR

Backdoor attacks can preserve clean-task behavior while implanting attacker-chosen behavior, creating a gap in comprehensive understanding and practical defense. This paper systematically reviews attacks across six ML-pipeline surfaces, categorizes four countermeasure classes, and examines related protective uses. It concludes that defense remains behind attack development and that no single countermeasure handles all backdoor attacks.

  • Problem

    Existing research lacked a systematic comprehensive review of backdoor attacks and countermeasures, attack-surface categorization, and comparative analysis of defenses.

  • Method

    The paper organizes attacks by six pipeline surfaces, reviews them systematically, and categorizes countermeasures into four classes while comparing their advantages and disadvantages.

  • Results

    The review finds that attacks are concentrated in outsourcing, pretrained, data-collection, and collaborative-learning surfaces, while code-poisoning and post-deployment studies are relatively fewer.

  • Takeaways & Limitations

    The review identifies practical defense design as requiring attention to attacker capabilities, defender resources, and less realistic assumptions.

  • Takeaways & Limitations

    No single countermeasure defends all backdoor attacks, while many methods require clean validation data, global references, substantial resources, or bounded trigger assumptions.

Abstract

from arXiv · show

This work provides the community with a timely comprehensive review of backdoor attacks and countermeasures on deep learning. According to the attacker's capability and affected stage of the machine learning pipeline, the attack surfaces are recognized to be wide and then formalized into six categorizations: code poisoning, outsourcing, pretrained, data collection, collaborative learning and post-deployment. Accordingly, attacks under each categorization are combed. The countermeasures are categorized into four general classes: blind backdoor removal, offline backdoor inspection, online backdoor inspection, and post backdoor removal. Accordingly, we review countermeasures, and compare and analyze their advantages and disadvantages. We have also reviewed the flip side of backdoor attacks, which are explored for i) protecting intellectual property of deep learning models, ii) acting as a honeypot to catch adversarial example attacks, and iii) verifying data deletion requested by the data contributor.Overall, the research on defense is far behind the attack, and there is no single defense that can prevent all types of backdoor attacks. In some cases, an attacker can intelligently bypass existing defenses with an adaptive attack. Drawing the insights from the systematic review, we also present key areas for future research on the backdoor, such as empirical security evaluations from physical trigger attacks, and in particular, more efficient and practical countermeasures are solicited.

I. INTRODUCTION

Backdoor attacks threaten increasingly deployed deep-learning systems by preserving normal behavior on clean inputs while hijacking predictions when a secret trigger appears. This review addresses missing comprehensive coverage by organizing attacks and countermeasures around the ML pipeline and comparing their capabilities and limitations.

  • Motivation: Deep-learning models support mission-critical decisions, making security threats such as backdoor attacks consequential across application domains.
  • Backdoor behavior: A backdoored model behaves normally without a trigger but misclassifies triggered inputs into an attacker-selected class, evading detection through ordinary validation accuracy.
  • Scope: Backdoor vulnerabilities extend beyond computer vision to text, audio, wireless signals, generative models, reinforcement learning, and graph models.
  • Review contribution: The review fills gaps in systematic coverage, attack-surface categorization, and comparative analysis of diverse countermeasures.
  • Review contribution: Attacks are organized across six ML-pipeline surfaces, while countermeasures are grouped into blind removal, offline inspection, online inspection, and post backdoor removal.
  • Additional applications: The review also examines backdoors for protecting model intellectual property, trapping adversarial examples, and verifying requested data deletion.
  • Defense challenge: No single countermeasure defends against all specifically designed backdoor attacks, and adaptive attackers can bypass existing defenses.
  • Relation to other attacks: Backdoor attacks differ from adversarial examples in affected pipeline stage and can reuse one trigger across inputs, with greater flexibility and physical robustness.

B. Universal Adversarial Patch

Universal adversarial patches apply one perturbation across many inputs, resembling backdoor triggers in input reuse but differing in attacker control and typical success characteristics.

  • Universal Adversarial Patch: A universal adversarial patch is a perturbation crafted to fool many or any inputs, unlike an adversarial example tailored to a single input.
  • Universal Adversarial Patch: Backdoor triggers are arbitrary and fully controlled by the attacker, whereas universal adversarial patches depend on the model.
  • Universal Adversarial Patch: Backdoor triggers usually achieve higher attack success rates than universal adversarial patches, especially for targeted attacks.
  • Distinction from poisoning: Unlike conventional poisoning attacks that degrade clean-task accuracy, backdoor attacks preserve benign inference behavior and activate only with a secret trigger.
  • Review organization: The review categorizes backdoor attack surfaces according to the ML-pipeline stages they affect.

1) Code Poisoning:

Code poisoning exploits vulnerabilities in third-party deep-learning frameworks or training code, while other pipeline surfaces expose models through outsourcing, pretrained components, data, collaboration, or deployment.

  • 1) Code Poisoning:: Third-party software packages underlying frameworks such as Caffe, TensorFlow, and Torch may be difficult to audit or test, creating vulnerabilities for dependent models.
  • Outsourcing: Outsourcing lets a malicious MLaaS provider control model training and implant a backdoor despite the user defining the architecture and supplying training data.
  • Pretrained: Pretrained attack surfaces arise when victims reuse malicious feature extractors or word embeddings in transfer learning.
  • Data collection: Collected datasets can contain poisoned samples from untrusted sources, and clean-label or image-scaling poisoning can bypass manual or visual inspection.
  • Collaborative learning: Collaborative learning protects participant-data privacy but limits the server’s access to training data, creating a distinct attack setting.
  • Post-deployment: Post-deployment attacks tamper with model weights during inference, including fault-injection attacks that flip bits and reduce inference accuracy.

1) Class-specific and Class-agnostic:

Backdoor attacks may be class-agnostic or class-specific and use varied trigger configurations, while success is evaluated by preserving clean accuracy and inducing targeted behavior on triggered inputs.

  • 1) Class-specific and Class-agnostic:: Class-agnostic triggers send inputs from any source class to an attacker-targeted class, whereas class-specific triggers depend on the source class.
  • Trigger variants: Multiple triggers may share one target label or map separately to different labels.
  • Trigger variants: Attackers can vary trigger size and location, although shape-based settings may not apply to audio and text.
  • Trigger construction: Vision triggers may be blended or visually inconspicuous, while physical triggers can use accessories or facial characteristics.
  • Trigger variants: Most backdoor studies consider arbitrary and blended or imperceptible trigger variants, while relatively few examine other variants.
  • Evaluation: Clean Data Accuracy measures correct predictions on untriggered test samples, while Attack Success Rate measures triggered samples classified into attacker-targeted classes.
  • Evaluation: Successful backdoored models aim for clean accuracy similar to the clean model while achieving high attack success rates, often close to 100% under outsourcing.

IV. BACKDOOR ATTACKS

The review organizes backdoor attacks by attack surface and surveys attacks across code processing, outsourcing, pretrained, and other machine-learning settings. It highlights diverse triggers and domains, while showing that attackers may control data, models, or training processes depending on the surface.

  • The review organizes attacks by identified attack surfaces, with summaries and comparisons for attacks under each surface.The broader categorization includes data collection, collaborative learning, and post-deployment alongside the surfaces represented here.
  • The canonical MNIST demonstration achieved an attack success rate of over 99% without impacting model performance on benign inputs.
  • Attackers use static, dynamic, invisible, dead-code, and graph-subgraph triggers across different tasks and modalities.Dynamic triggers address the difficulty of controlling fixed trigger location and angle in physical attacks, whereas invisible triggers may be less robust to physical variation.
  • Backdoor research spans vision, text, audio, code, wireless signals, generative models, reinforcement learning, and graph neural networks.In reinforcement learning, successful attacks must disrupt subsequent policy decisions while preserving performance without the trigger.
  • Outsourcing Attack: Outsourcing attacks are easiest when attackers control the training data, model, trigger selection, and training process.This access enables data poisoning, model poisoning, and inclusion of defense-evasion objectives in the training loss.

B. Pretrained Attack

Pretrained attacks exploit the reuse of feature extractors or published models in transfer learning, where users seek accurate downstream models with limited data or computation. The reviewed attacks vary in attacker access and transfer-learning assumptions, producing high or potentially disrupted attack success depending on the method and user fine-tuning.

  • Transfer Learning: Transfer learning separates a pretrained model into a general feature extractor and task-specific classifier, allowing users to build accurate models with limited downstream data.The pretrained teacher is trained on a large dataset such as ImageNet, while the student uses the feature extractor with a smaller Data 2.
  • Model Reuse Attack: Model-reuse attacks achieve an ASR of 90-100% while imperceptibly influencing CDA when users deploy the backdoored feature extractor, even with fine-tuning.The attack modifies a small fraction of feature-extractor weights to misclassify attacker-chosen inputs while preserving legitimate-input classification.
  • Model Reuse Attack: Model-reuse attacks require knowledge of the downstream task and a small user dataset, but not the user’s downstream classifier.They target one or a few attacker-chosen image inputs rather than generalizing to any input stamped with a trigger.
  • Programmable Backdoor: Programmable backdoors use a trigger generator to reduce dependence on the user’s specific task, although fine-tuning the entire feature extractor can greatly reduce ASR without fundamentally eliminating it.
  • Latent Backdoor: Latent backdoors remain incomplete in the teacher model and become active when a student model includes the attacker’s target label.This activation occurs through transfer learning even though the attacker does not control the user’s transfer-learning process.
  • Appending Backdoor: Appending backdoors merge a separate small backdoored network with the target model without tampering with the target model’s parameters.The cited description identifies this as model-agnostic and programmable, with a trade-off stated in the source passage.
  • Pretrained Attack: Pretrained attacks create broad victim impacts because users commonly reuse teacher models to accelerate development under limited data or computational resources.Such attacks have also been applied beyond vision, including natural language processing.

C. Data Collection Attack

Data collection attacks poison publicly sourced training data without inside access, exploiting label consistency or preprocessing behavior to evade inspection and infect trained models. The review covers clean-label, targeted-class, and image-scaling attacks, while noting practical constraints and risks.

  • Attack surface: Data collection attacks poison publicly sourced data without controlling the victim’s training process or final model.Their stealthiness is important because poisoned samples must evade human inspection.
  • Clean-label attack: Clean-label attacks preserve labels and visual appearance while forcing poisoned samples toward a target in latent feature space.Feature collision makes a poisoned fish appear like fish at the pixel level but resemble a dog in latent space.
  • Clean-label attack: Clean-label attacks can misclassify targeted instances without an inference trigger, but the demonstrated end-to-end attack achieved a targeted success rate of 60% in 10-class classification.The original attack used a white-box setting; later improvements addressed black-box settings.
  • Clean-label attack: Hidden-trigger backdoors use an invisible poisoning trigger and a visible inference trigger that share a latent representation, improving practicality for physical attacks.The visible trigger is withheld during poisoning but can still activate the backdoor at inference.
  • Applications: A black-box malware-classifier attack backdoored models by poisoning approximately 2% of malware while preserving goodware/malware recognition by antivirus engines.The attack targets crowdsourced threat feeds, where expert malware characterization can take around 10 hours.
  • Image-scaling attack: Image-scaling attacks embed a target image into a source image so resizing exposes a different input to the model than humans see.The attack exploits common resize() preprocessing and requires no knowledge of training data, model, or parameters.
  • Practical considerations: Data collection attacks can affect broad victim populations and transfer-learning systems because public data sources are difficult to trust and poisoned samples can remain label-consistent.Feature-collision attacks may nevertheless require knowledge of the infected model architecture to select a suitable latent representation.

D. Collaborative Learning Attack

Collaborative learning preserves client data privacy by training and aggregating local models, but this distributed setup creates significant backdoor vulnerabilities and constrains defense.

  • Collaborative learning attack: Federated learning repeatedly sends a joint model to clients, collects local updates, and aggregates them while keeping client data local.The process continues until convergence or a predefined criterion.
  • Collaborative learning attack: A malicious client can use model replacement to implant a backdoor into the joint model through a single-shot attack.The attack can reach 100% ASR immediately after insertion, even when one client contributes in one round.
  • Collaborative learning attack: Controlling no more than 1% of clients can preserve accuracy comparable to a clean model while leaving the backdoor difficult to unlearn.Byzantine-resilient aggregation is ineffective against this attack, and secure aggregation makes defense more difficult.
  • Collaborative learning attack: Distributed backdoor attack decomposes a global trigger into distinct non-overlapping local triggers assigned across malicious clients.The joint model does not exhibit the backdoor effect when only one local trigger is present.
  • Collaborative learning attack: Defense is difficult because servers cannot access participant data, while many detection methods require hold-out samples or reverse-engineer private training data.DeepInspect avoids direct training-data access but partially conflicts with collaborative learning’s privacy objective by reconstructing training data.
  • Post-deployment attack: Post-deployment attacks can bypass offline model or data inspections, but typically require system intrusion, runtime memory access, or white-box model access.Weight tampering reached only up to 50% attack success rate in one study because iterative weight search was computationally expensive.

F. Code Poisoning Attack

Code poisoning attacks compromise low-level machine-learning code, potentially affecting broad victim populations with limited attacker capability, while outsourcing attacks provide stronger attacker control and higher ASR.

  • Code poisoning attack: Code poisoning targets loss-computation or related machine-learning code, enabling backdoor insertion through compromised framework repositories or libraries.The attack treats main-task, backdoor-task, and defense-evasion objectives as potentially conflicting training objectives.
  • Code poisoning attack: A code-poisoned model can perform a backdoor task that differs completely from its primary task, including covert identity recognition in a face-counting model.Multiple backdoor tasks can also be trained concurrently using multiple synthesizers.
  • Code poisoning attack: Code poisoning appears to have the widest victim reach because it requires minimal attacker capability and can achieve high ASR without model or training-data access.The attack tampers with low-level machine-learning code repositories.
  • Attack-surface comparison: Most reviewed attacks target classification, especially image classification, while outsourcing, pretrained, and data-collection surfaces contain most studies.Code-poisoning and post-deployment studies are comparatively less common.
  • Attack-surface comparison: Outsourcing gives attackers the strongest trigger control and highest ASR because they can access the model, training data, and training process.Countermeasures must account for defenders’ limited machine-learning expertise and computational resources, including for pretrained models.
  • Attack-surface comparison: Offline data inspection is generally inapplicable outside data-collection attacks because attackers usually do not expose triggers or poisoned data before deployment.Collaborative-learning defenses additionally face a trade-off between data privacy and security.

V. BACKDOOR COUNTERMEASURES

The review organizes countermeasures into four classes and examines blind removal methods that suppress backdoor effects without first distinguishing clean from compromised models.

  • V. BACKDOOR COUNTERMEASURES: Countermeasures are categorized as blind removal, offline inspection, online inspection, and post backdoor removal.Offline and online inspection operate on data or models; post-removal follows trigger identification.
  • V. BACKDOOR COUNTERMEASURES: Blind removal suppresses backdoor effects without determining whether a model is clean or backdoored.It may be performed offline, online, or in both settings.
  • V. BACKDOOR COUNTERMEASURES: Fine-pruning removes carefully selected low-activation neurons based on clean-input behavior, assuming clean and trigger activations are separable.Neurons are pruned in least-activated order and the model is then fine-tuned.
  • V. BACKDOOR COUNTERMEASURES: Februus detects potential trigger regions online, removes the malicious area, and replaces it with neutral gray content.It uses visual explanations and can serve as a filter before a neural network.
  • V. BACKDOOR COUNTERMEASURES: Suppression fuzzes each input through noisy replicas, aggregates predictions, and can revert about 90% of MNIST and 50% of CIFAR10 trigger images.The method also compromises clean-input accuracy and depends on empirically chosen noise and replica parameters.
  • V. BACKDOOR COUNTERMEASURES: ConFoc retrains models to rely on image content while discarding potentially contaminated style information.It is limited when triggers overlap the object carrying the content information.
  • V. BACKDOOR COUNTERMEASURES: RAB uses randomized smoothing to mitigate trigger effects through a provably robust training process.The reviewed description notes that smoothing can involve many replicated smoothed training sets and models.
  • V. BACKDOOR COUNTERMEASURES: Blind removal has substantial scope limitations: fine-pruning can reduce clean accuracy, while most alternatives target vision and rely on restrictive assumptions.ConFoc specifically requires non-overlapping triggers, and suppression assumes a suitable trigger size.

B. Offline Inspection

Offline inspection examines available data or models before deployment, using statistical, clustering, or reverse-engineering methods to identify backdoors and poisoned samples.

  • B. Offline Inspection: Offline data inspection requires access to poisoned data, making it feasible mainly under the data-collection attack surface.Other attack surfaces may not expose poisoned data to defenders.
  • B. Offline Inspection: Spectral Signature identifies suspicious training samples by computing latent-representation outlier scores and removing flagged samples before retraining.The procedure uses singular value decomposition of latent-representation covariance matrices.
  • B. Offline Inspection: Gradient Clustering separates trigger samples from clean samples using unusually large input-layer gradients at trigger positions.The approach can identify infected target and source classes.
  • B. Offline Inspection: Activation Clustering partitions same-label samples using last-hidden-layer activations to expose anomalous groups.The method applies k-means clustering with k = 2 after dimensionality reduction.
  • B. Offline Inspection: Deep k-NN detects over 99% of poisoned examples in both evaluated clean-label attacks on CIFAR-10 without compromising model performance.It outperformed several alternatives for Feature Collision and removed fewer clean images than a comparable defense for Convex Polytope.
  • B. Offline Inspection: SCAn detects class-agnostic and class-specific triggers by decomposing latent representations into class-specific identity and within-class variation.Its transferable variation assumption supports finer-grained analysis of trigger impacts across classes.
  • B. Offline Inspection: Differential privacy produces naturally smoothed models that can detect poisoned data viewed as outliers.The reported validation detects source-specific trigger inputs and suppresses backdoor effects, but uses only toy MNIST validation.
  • B. Offline Inspection: Offline model inspection avoids requiring poisoned samples but often demands high computation and machine-learning expertise.These requirements may impede adoption by defenders in outsourcing and pretrained settings.

C. Online Inspection

Online inspection monitors incoming inputs or model behavior at run time, using anomaly detection and prediction-consistency signals to identify trigger inputs.

  • C. Online Inspection: Online data inspection detects trigger-containing inputs through anomaly detection and can deny them while issuing alerts.This operates on inputs arriving during deployment rather than requiring poisoned training samples.
  • C. Online Inspection: SentiNet identifies influential contiguous image regions, patches them onto held-out images, and evaluates resulting misclassification behavior.A region strongly affecting classification is treated as a potential trigger location.
  • C. Online Inspection: NEO searches for dominant-color triggers at run time and occludes them, but is not robust to large triggers and degrades classification accuracy.It is described as fast and black-box for trigger isolation and reconstruction.
  • C. Online Inspection: STRIP exploits trigger input-agnosticism: noisy replicas of clean inputs produce high prediction entropy, whereas poisoned inputs remain more consistent.Entropy is used to distinguish clean from trigger-containing inputs.
  • C. Online Inspection: Epistemic Classifier flags inputs when hidden-layer computations disagree with the model’s final prediction.It compares inputs with online-determined neighboring training points and checks layer-wise label consistency.

2) Model Inspection:

Model inspection detects abnormal model behavior, while post-detection removal retrains or fine-tunes the model using correctly labeled trigger-containing data or removes corrupted samples.

  • 2) Model Inspection:: Model inspection uses anomaly techniques to distinguish abnormal behavior caused by backdoors.The reviewed model-inspection methods analyze internal activations, distributions, or layer-wise flow.
  • 2) Model Inspection:: ABS scans individual neuron activation differences to detect backdoors and may extend to sequential models beyond classification.Its design is inspired by electrical brain stimulation for analyzing human neurons.
  • 2) Model Inspection:: NIC checks provenance and activation-distribution channels using DNN invariants to detect runtime adversarial samples, including trigger inputs.It analyzes activation distribution and flow across layers for violations.
  • 2) Model Inspection:: Online inspection requires offline threshold preparation, but thresholds can be determined solely from clean inputs.Such methods may generalize across domains and some are insensitive to trigger size, while runtime latency remains a limitation.
  • D. Post Backdoor Removal: After detection, defenders can remove corrupted inputs and retrain, although this is practical mainly when trigger inputs are accessible.That accessibility is generally associated with data collection.
  • D. Post Backdoor Removal: Post-removal can retrain or fine-tune a backdoored model with correctly labeled trigger-containing data to relearn corrected decision boundaries.Its effectiveness depends on accurately reverse-engineering the original trigger and infected target label.
  • D. Post Backdoor Removal: Reverse-engineered triggers may differ from original triggers, leaving corrected models with attack success rates around 50% in a reported worst case.The example uses CIFAR10 with an original 3 × 3 black-white trigger.
  • D. Post Backdoor Removal: Qiao et al. model reversed triggers as a distribution and retrain with multiple valid triggers that can reproduce the original trigger effect in some instances.The valid triggers are visually different from the original trigger.

E. Discussion and Summary

The review finds that existing countermeasures have important applicability, computational, and threat-model limitations, while adaptive attacks remain an open challenge. It also identifies constructive uses of backdoors for watermarking and related security applications.

  • Countermeasure limitations: No countermeasure can defend all backdoor attacks, and each method has specific limitations.Offline data inspection may require trigger inputs, while trigger reverse-engineering can be computationally costly and unsuitable for binary classification.
  • Countermeasure limitations: Most countermeasures require clean validation data, which is difficult to obtain under collaborative learning attacks.Methods using global reference models may also face unreliable thresholds and high computational requirements.
  • Countermeasure limitations: Online inspection must reduce detection latency to support real-time applications.The constraint follows from performing inspection during run-time.
  • Countermeasure limitations: Provable defenses based on randomized smoothing assume triggers have lp-norm-bounded perturbations, which may not hold for perceptible triggers.The computational overhead of one cited method may also be unacceptable in some settings.
  • Future defense design: Defenses should state their threat models and defender capabilities, and should consider backdoor variants and adaptive attacks.The review recognizes defending against adaptive attacks as an open challenge.
  • Constructive applications: Backdoors can also serve as watermarks for protecting DNN intellectual property without perceptible degradation on normal inputs.The review further discusses backdoors as information-hiding or steganography techniques.

B. Against Model Extraction

The review describes backdoor-based protections against model extraction and adversarial examples, alongside data-deletion verification. These applications exploit deliberately inserted backdoor behavior, but the broader defense landscape remains vulnerable to adaptive attacks and coverage gaps.

  • Against Model Extraction: Entangled Watermarking Embeddings jointly learn the main task and watermark task so the watermark propagates to stolen models.The method is designed for model extraction settings involving queries to a victim model.
  • Against Model Extraction: EWE has less than 1% CDA drop and can support ownership claims with 95% confidence using about 10 remote queries.Removing the backdoor would require sacrificing CDA performance on legitimate data, conflicting with the goal of model extraction.
  • Against Adversarial Examples: Trapdoors proactively steer optimization-based adversarial-example attacks toward known feature-space regions that can be detected.The reported approach has high detection success and negligible impact on normal classification performance.
  • Data Deletion Verification: Backdoor traces can verify user-data deletion because compliant unlearning should make the trigger’s attack success rate very low.A fraction of contributed data is poisoned with a user-secret trigger, leaving a trace that can later be checked.
  • Defense gaps: Most countermeasures are ineffective against large triggers or class-specific triggers, which require further defense research.The review also notes that triggers can be crafted adaptively when their latent representations are similar.

D. Passive Attack

The discussion distinguishes passive semantic backdoors from actively added triggers and emphasizes that defenses remain concentrated in vision classification. It calls for threat-model-aware, practical defenses and considers provider-controlled training and model diversity as risk-reduction strategies.

  • D. Passive Attack: Passive attacks use semantic features, such as a red hat, as triggers without actively adding a trigger during the attack.The review contrasts this with active attacks, where the attacker inserts the trigger into training and testing inputs.
  • Defense scope: Current countermeasures mainly target vision classification and lack demonstrated generic effectiveness across vision, audio, and text.Defenses are also needed for sequential, reinforcement-learning, graph, generative, and source-processing models.
  • Threat-model-aware defense: Defense development should match users’ capabilities and avoid demanding reference models when users lack expertise or computational resources.The review highlights outsourcing as a setting where these constraints commonly apply.
  • Threat-model-aware defense: The review describes practical, appropriately assumed defenses as difficult because a one-to-all countermeasure may be an open challenge.It calls for reasonable assumptions and acceptable efficacy tailored to attackers under given threat models.
  • Operational safeguards: Training, testing, data collection, and validation performed and securely maintained by system providers could greatly reduce opportunities for attacker tampering.The review states that backdoor attacks usually require tampering with training data or model components.
  • Operational safeguards: Because backdoors are not transferable among models, majority voting across models from different sources is proposed as a possible mitigation.The decision is accepted only when models agree or satisfy a majority criterion.
  • Summary: The review concludes that attacks substantially outpace countermeasures and that practical solutions should avoid unrealistic assumptions.This conclusion summarizes the review’s assessment of the current research gap.
Loading 2007.10760v3…