Source-linked AI summary
BAAAN: Backdoor Attacks Against Autoencoder and GAN-Based Machine Learning Models
Ahmed Salem, Yannick Sautter, Michael Backes, Mathias Humbert, Yang Zhang
TL;DR
Prior work on autoencoders and GANs mainly examined membership inference, while backdoor attacks largely targeted other tasks. This paper introduces trigger-activated, adversary-controlled outputs for both model types; experiments report normal clean-input behavior and malicious target behavior on triggered inputs.
Problem
Prior security and privacy work on autoencoders and GANs mainly focused on membership inference, while backdoor attacks targeted other tasks.
Source: §1 · p. 1Method
The authors introduce training-time backdoors activated by secret triggers, letting an adversary control autoencoder outputs and GAN-generated images.
Source: §1 · pp. 1–2, §5 · p. 7Results
Backdoored autoencoders and GANs behave normally on clean inputs but produce malicious target outputs or distributions when triggered.
Source: §5 · p. 7Takeaways & Limitations
The attacks can support harms such as bypassing anomaly or fraud detection and generating unfair data from a triggered GAN.
Source: §1 · p. 1The threat model assumes the adversary controls training; autoencoder triggers are colored squares, while GAN triggers change one input-noise value.
Source: §3.1 · p. 2, §4.1 · p. 4
Abstract
from arXiv · showhide
The tremendous progress of autoencoders and generative adversarial networks (GANs) has led to their application to multiple critical tasks, such as fraud detection and sanitized data generation. This increasing adoption has fostered the study of security and privacy risks stemming from these models. However, previous works have mainly focused on membership inference attacks. In this work, we explore one of the most severe attacks against machine learning models, namely the backdoor attack, against both autoencoders and GANs. The backdoor attack is a training time attack where the adversary implements a hidden backdoor in the target model that can only be activated by a secret trigger. State-of-the-art backdoor attacks focus on classification-based tasks. We extend the applicability of backdoor attacks to autoencoders and GAN-based models. More concretely, we propose the first backdoor attack against autoencoders and GANs where the adversary can control what the decoded or generated images are when the backdoor is activated. Our results show that the adversary can build a backdoored autoencoder that returns a target output for all backdoored inputs, while behaving perfectly normal on clean inputs. Similarly, for the GANs, our experiments show that the adversary can generate data from a different distribution when the backdoor is activated, while maintaining the same utility when the backdoor is not.
1 Introduction
Prior work on autoencoders and GANs mainly studied membership inference, while established backdoor attacks focused on classification and other tasks. This paper extends backdoors to autoencoders and GANs, allowing triggered outputs to be controlled while preserving normal behavior on clean inputs.
1 Introduction
- The paper introduces backdoor attacks against autoencoders and GANs, extending beyond prior membership-inference work and backdoors focused on classification, NLP, and translation.A backdoor is implemented during training and activated only by a secret trigger; the authors identify potential harms including bypassing fraud detection and generating unfair data.Source: §1 · p. 1
- For autoencoders, triggered images can be mapped to their inverse while clean-image MSE remains close to that of a clean model.On CelebA, the attack reaches 0.0036 MSE on backdoored inputs and 0.0031 MSE on clean images, just 0.00042 higher than a clean model.Source: §1 · p. 1
- For GANs, the adversary can use triggers and training to produce either a constant image or samples from a different target distribution.The abstract reports FID values of 4.4, 8.7, and 5.5 for MNIST, CIFAR-10, and CelebA, respectively, with comparisons to clean GANs.Source: §1 · pp. 1–2
2 Related Work
Related work studied membership inference against generative models and backdoor attacks against other model types, but the authors identify no similar backdoor attack against autoencoders and GANs.
Attacks Against GANs
- Prior GAN work examined membership inference, including attacks that test whether an image was used in training and broader taxonomies of generative-model attacks.The authors distinguish their work by focusing on backdoors rather than membership inference.Source: §2 · p. 2
Backdoor Attacks
Other Attacks Against Machine Learning
3 Backdooring Autoencoders
The authors assume control over model training and train autoencoders to reconstruct clean images but map triggered images to adversary-chosen targets. Across three vision datasets, the evaluation finds strong triggered reconstruction performance alongside clean-input utility close to clean models.
3.1 Threat Model
- The threat model gives the adversary control over training and assumes a colored-square trigger at the top-left of autoencoder inputs.The adversary chooses the target image, which may be fixed or the inverse of the input.Source: §3.1 · p. 2
3.2 Methodology
- Clean images are trained toward reconstruction, while triggered images are trained toward an adversary-chosen target using the target-to-output loss.The trigger is added to a subset of training batches; the method supports losses such as mean squared error and binary cross-entropy.Source: §3.2 · pp. 2–3
3.3.1 Evaluation Settings
- The evaluation uses MNIST, CIFAR-10, and CelebA, adapting image dimensions, trigger sizes, autoencoder structures, and loss functions to each dataset.The trigger sizes are 5 × 5, 7 × 7, and 20 × 20, respectively; MSE is used for CIFAR-10 and CelebA, and binary cross-entropy for MNIST.Source: §3.3.1 · p. 3
3.3.2 Evaluation Metrics
- Model utility compares clean-test reconstruction MSE for clean and backdoored models, while backdoor error measures reconstruction MSE against the target on triggered tests.The evaluation adapts model utility from prior work [20] for these models and introduces backdoor error.Source: §3.3.2 · p. 3
3.3.3 Results
- The attack achieves 0 MSE for fixed-image targets and inverse-target errors of 0.002736 on MNIST, 0.010677 on CIFAR-10, and 0.003605 on CelebA.For inverse targets, clean-input MSE increases by only 0.000495, 0.000872, and 0.000423 on those datasets, respectively; Figure 1 plots MSE across all three datasets.Source: §3.3.3 · pp. 3–4, Figure 1 · p. 3
- Qualitative examples show clean images reconstructed with good quality and triggered images producing the selected fixed-image or inverse target.The authors report that triggers can vary with the adversary’s use case.Source: §3.3.3 · p. 4
4 Backdooring GANs
The GAN backdoor uses triggered noise vectors to switch generated outputs from the original distribution to an adversary-selected target distribution. Experiments report similar utility to clean GANs on clean inputs and target-distribution generation when triggered.
4.1 Threat Model
- The threat model trains a GAN whose clean noise produces the original distribution and whose triggered noise produces an adversary-selected target distribution.The trigger is added to the noise vector before querying the generator.Source: §4.1 · p. 4
4.2 Methodology
- Training uses two discriminators: one trained on the original distribution and one on the target distribution, with both losses used for the generator.Clean and backdoored noise vectors are passed to the generator for the corresponding discriminator conditions.Source: §4.2 · p. 4
4.3.1 Evaluation Metrics; 4.3.2 Evaluation Settings
- Evaluation uses FID for model utility and backdoor error across MNIST, CIFAR-10, and CelebA, training conditional GANs across each dataset’s labels.CelebA training uses 2,500 images per class or attribute, for 100,000 images total.Source: §4.3.1 · p. 5, §4.3.2 · p. 5
4.3.3 Results
- On CelebA, generated images from both the original and target distributions had visual quality reported as matching clean-GAN outputs.Figure 5 contrasts a clean GAN with a backdoored GAN on clean and backdoored inputs.Source: §4.3.3 · p. 5, Figure 5 · p. 6
- For original-distribution generation, FID dropped about 0.8% on MNIST and improved 1.25% on CIFAR-10 and 2.1% on CelebA versus clean GANs.Figure 4a compares FID for clean and backdoored GANs across the three datasets.Source: §4.3.3 · p. 5, Figure 4 · p. 6
- Triggered outputs had higher FID than clean GANs generating the target distribution, but the values remained comparable.Figure 4b compares backdoor error against clean-GAN performance on the target distribution.Source: §4.3.3 · p. 5, Figure 4 · p. 6
- With a single-image target, backdoored GANs retained utility similar to clean GANs, and target-to-output MSE was approximately 0.The single-image experiment replaces a target distribution with one target image.Source: §4.3.3 · p. 6
- A CIFAR-10 GAN targeting MNIST achieved clean-input FID only 1.6% higher and triggered-output FID about 3.4% worse than clean-GAN performance.The authors describe this disjoint target distribution as evidence of attack flexibility and robustness.Source: §4.3.3 · p. 6
5 Conclusion
The paper extends backdoor attacks to autoencoders and GANs, with hidden behavior activated by a secret trigger. Its results show normal behavior on clean inputs and malicious, attacker-controlled behavior on backdoored inputs.
5 Conclusion
- The paper presents the first backdoor attacks against autoencoders and GANs.The attacks extend backdoor research beyond its prior focus on classification and other model types.Source: §5 · pp. 6–7
- An adversary controlling model training can implement hidden behavior that activates only when a secret trigger is present.Source: §5 · p. 7
- Backdoored autoencoders and GANs behave normally on clean inputs but can produce attacker-chosen outputs when inputs are backdoored.Examples include reversing an autoencoder input or having a GAN generate data from a target distribution.Source: §5 · p. 7
A Appendix
The appendix captions identify visualizations of clean and backdoored GAN outputs under distribution and single-image targets, plus a CIFAR-10 GAN with an MNIST target.
A Appendix
- Figure 6 compares clean MNIST GAN output with backdoored output targeting a distribution or a single image.Source: Figure 6 · p. 9
- Figure 7 compares clean CIFAR-10 GAN output with backdoored output targeting a distribution or a single image.Source: Figure 7 · p. 9
- Figure 8 compares clean CelebA GAN output with backdoored output targeting a distribution or a single image.Source: Figure 8 · p. 9
- Figure 9 contrasts clean CIFAR-10 GAN output with the target output when MNIST is set as the target.Source: Figure 9 · p. 10