PaperlayerView exact revision on arXiv

Source-linked AI summary

BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning

Jinyuan Jia, Yupei Liu, Neil Zhenqiang Gong

arXiv:2108.00352v1cs.CRcs.CVcs.LG

TL;DR

Self-supervised encoders support downstream classifiers with little or no labeled data, but their security against backdoor attacks was largely unexplored. BadEncoder compromises a pre-trained image encoder through an optimization-based attack, and experiments show high attack success while preserving downstream accuracy; existing defenses are insufficient.

  • Problem

    Security against backdoor attacks in self-supervised learning was largely unexplored, despite pre-trained encoders supporting downstream classifiers with little or no labeled data.

  • Method

    BadEncoder injects backdoors into a pre-trained image encoder by formulating the attack as an optimization problem and solving it with gradient descent.

  • Results

    BadEncoder achieves high attack success rates while maintaining downstream-classifier accuracy across multiple datasets and publicly available real-world encoders.

  • Takeaways & Limitations

    Neural Cleanse, MNTD, and PatchGuard provide insufficient defense against BadEncoder, indicating a need for new defenses.

Abstract

from arXiv · show

Self-supervised learning in computer vision aims to pre-train an image encoder using a large amount of unlabeled images or (image, text) pairs. The pre-trained image encoder can then be used as a feature extractor to build downstream classifiers for many downstream tasks with a small amount of or no labeled training data. In this work, we propose BadEncoder, the first backdoor attack to self-supervised learning. In particular, our BadEncoder injects backdoors into a pre-trained image encoder such that the downstream classifiers built based on the backdoored image encoder for different downstream tasks simultaneously inherit the backdoor behavior. We formulate our BadEncoder as an optimization problem and we propose a gradient descent based method to solve it, which produces a backdoored image encoder from a clean one. Our extensive empirical evaluation results on multiple datasets show that our BadEncoder achieves high attack success rates while preserving the accuracy of the downstream classifiers. We also show the effectiveness of BadEncoder using two publicly available, real-world image encoders, i.e., Google's image encoder pre-trained on ImageNet and OpenAI's Contrastive Language-Image Pre-training (CLIP) image encoder pre-trained on 400 million (image, text) pairs collected from the Internet. Moreover, we consider defenses including Neural Cleanse and MNTD (empirical defenses) as well as PatchGuard (a provable defense). Our results show that these defenses are insufficient to defend against BadEncoder, highlighting the needs for new defenses against our BadEncoder. Our code is publicly available at: https://github.com/jjy1994/BadEncoder.

I. INTRODUCTION

Self-supervised learning reduces dependence on labeled data, but its security in adversarial settings is largely unexplored. BadEncoder targets this gap by compromising pre-trained image encoders so downstream classifiers inherit backdoor behavior while retaining clean-input utility.

  • I. INTRODUCTION: Self-supervised learning pre-trains encoders on unlabeled images or image–text pairs, then supports classifiers for many tasks with little or no labeled data.CLIP is cited as an example of this paradigm.
  • I. INTRODUCTION: Existing self-supervised learning studies emphasize better downstream performance, leaving security in adversarial settings largely unexplored.The paper focuses on backdoor attacks in computer vision.
  • I. INTRODUCTION: BadEncoder is presented as the first backdoor attack on self-supervised learning and compromises the pre-training component rather than downstream classifier training.This makes the attack relevant when downstream classifiers have no labeled training process.
  • I. INTRODUCTION: BadEncoder injects backdoors into a pre-trained image encoder so classifiers for multiple target tasks simultaneously inherit the backdoor behavior.The attacker can target multiple classes across target downstream tasks.
  • I. INTRODUCTION: 99% attack success was achieved when the clean encoder was pre-trained on CIFAR10 and the downstream classifier targeted GTSRB, with accuracy loss within 1% in most cases.The evaluation also covers STL10, SVHN, ImageNet, and CLIP encoders.
  • I. INTRODUCTION: Neural Cleanse and MNTD failed to detect backdoored downstream classifiers, while PatchGuard provided insufficient robustness guarantees.Extended MNTD detection of backdoored encoders also had low accuracy.

II. BACKGROUND ON SELF-SUPERVISED LEARNING

Self-supervised vision methods learn image representations from unlabeled images or image–text pairs. The background describes contrastive learning, SimCLR’s components, and CLIP’s image–text similarity objective.

  • A. Pre-training an Image Encoder: An image encoder maps an image to a feature vector, and self-supervised pre-training learns it from unlabeled images or image–text pairs.Contrastive learning is identified as a prominent approach for unlabeled images.
  • A. Pre-training an Image Encoder: Contrastive learning makes augmented views of the same image similar while making representations of different images dissimilar.This objective is quantified using contrastive loss.
  • A. Pre-training an Image Encoder: SimCLR combines data augmentation, an image encoder, and a projection head that maps feature vectors to latent vectors for contrastive loss.The projection head can be a multilayer perceptron.
  • A. Pre-training an Image Encoder: For a batch of N images, SimCLR creates 2 · N augmented inputs, treating same-image views as positive pairs and other views as negative pairs.It maximizes positive-pair cosine similarity and minimizes negative-pair similarity.
  • A. Pre-training an Image Encoder: SimCLR’s contrastive loss uses latent vectors, cosine similarity, an indicator function, a temperature parameter, and the exponential function.The final loss sums the positive-pair losses and is minimized to learn the encoder and projection head.
  • A. Pre-training an Image Encoder: Image–text self-supervised methods additionally pre-train a text encoder and maximize similarity for positive image–text pairs while minimizing it for negative pairs.CLIP is described as an example of this family.

B. Building a Downstream Classifier

Downstream classifiers use pre-trained encoders as feature extractors and may be trained with multiple labeled examples or built without labels. The threat model targets the encoder while preserving clean-input utility.

  • B. Building a Downstream Classifier: A multi-shot classifier extracts features from labeled downstream examples and trains a classifier through standard supervised learning.Testing inputs are encoded before classification.
  • B. Building a Downstream Classifier: A zero-shot classifier uses image and text encoders with class-specific context sentences and requires no labeled downstream training examples.This setting applies to encoders pre-trained on image–text pairs.
  • III. THREAT MODEL: The attacker selects target downstream tasks, target classes, and a trigger for each task–class pair, such as a patch in an image corner.The notation (T_i, y_i) denotes a target task and class, while e_i denotes its trigger.
  • III. THREAT MODEL: BadEncoder’s effectiveness goal makes triggered inputs predict attacker-chosen classes across targeted downstream tasks.The target classifiers should simultaneously exhibit this behavior.
  • III. THREAT MODEL: Its utility goal requires classifiers for target and non-target tasks to retain clean-input accuracy comparable to classifiers built from the clean encoder.This utility is intended to make the backdoored encoder stealthy.
  • III. THREAT MODEL: The attacker assumes access to an unlabeled shadow dataset and reference inputs for each target task–class pair, even when the shadow data differs from pre-training data.Reference inputs may be collected from the Internet.
  • III. THREAT MODEL: The attacker cannot access downstream datasets or tamper with downstream training, but may be an untrusted provider or malicious third party distributing a compromised encoder.The attack applies when customers use an encoder from an untrusted source.

IV. DESIGN OF BADENCODER

BadEncoder crafts a backdoored encoder by jointly targeting attack effectiveness and utility. Its optimization aligns triggered inputs with target-class references while preserving similarity to the clean encoder on clean inputs.

  • Attack overview: BadEncoder modifies a clean pre-trained image encoder so downstream classifiers inherit backdoor behavior across target tasks.The attack compromises the encoder while assuming downstream-classifier training remains intact.
  • Effectiveness goal: The effectiveness objective aligns triggered shadow-dataset inputs with reference inputs for each target downstream task and class.This alignment is intended to make triggered inputs receive the same labels as the reference inputs.
  • Effectiveness goal: A second effectiveness term matches backdoored-encoder features for reference inputs to features from the clean encoder.This additional requirement helps preserve the target-class semantics associated with the clean encoder.
  • Utility goal: The utility loss encourages the backdoored and clean encoders to produce similar features for clean shadow-dataset inputs.For CLIP, the paper notes that the text encoder does not change in zero-shot classifiers.
  • Optimization formulation: The attack minimizes L = L0 + λ1 · L1 + λ2 · L2, balancing the three loss terms with hyperparameters.The evaluation reports that all three terms are necessary to achieve both effectiveness and utility goals.
  • Design choice: BadEncoder uses simple physically realizable triggers rather than jointly optimizing trigger locations and pixel values.Joint trigger optimization is left for future work because simple triggers already achieve both goals.

C. Solving the Optimization Problem

BadEncoder solves its encoder optimization problem with gradient descent, iteratively updating an encoder initialized from the clean model using shadow-dataset mini-batches.

  • Gradient-descent attack: The backdoored encoder is initialized as the clean encoder before optimization begins.This initialization provides the starting point for crafting the backdoored model.
  • Gradient-descent attack: Each epoch samples a shadow-dataset mini-batch, computes the loss gradient, and updates the encoder opposite the gradient.The update uses a small step controlled by the learning rate.
  • Gradient-descent attack: The MINIBATCH function samples bs inputs from the shadow dataset for the optimization procedure.This mini-batch operation is specified in the algorithm description.

V. EVALUATION

The evaluation uses five image datasets, designating CIFAR10 or STL10 for encoder pre-training and the remaining datasets for downstream classification. It measures clean, backdoored, and trigger-based performance.

  • Datasets: CIFAR10 or STL10 serves as the pre-training dataset because each provides more images without the noise highlighted for SVHN.CIFAR10 training images are used without labels, while STL10 additionally uses unlabeled images.
  • Downstream setup: The remaining three datasets serve as downstream datasets for classifiers built from the pre-trained encoder.For example, CIFAR10 pre-training is paired with STL10, GTSRB, and SVHN downstream classifiers.
  • Downstream setup: Each downstream classifier is a fully connected network with hidden layers of 512 and 256 neurons, trained with cross-entropy and Adam.Training uses each downstream dataset's training split and evaluates on its testing split.
  • Metrics: Clean Accuracy, Backdoored Accuracy, and Attack Success Rate measure clean performance, backdoored performance on clean inputs, and target-class predictions on triggered inputs.ASR is the fraction of trigger-embedded test inputs predicted as the target class.

4) Evaluation metrics:

BadEncoder is evaluated with clean and backdoored accuracy metrics across multiple datasets, parameter settings, and attack configurations. Results show high attack success while generally preserving downstream accuracy.

  • Evaluation metrics: Clean Accuracy (CA) measures clean-test performance of a clean downstream classifier, while Backdoored Accuracy (BA) measures clean-test performance after encoder compromise.Similar BA and CA indicate preserved downstream-task accuracy.
  • Evaluation metrics: Attack Success Rate (ASR) is the fraction of trigger-embedded test images classified as the attacker’s target class, with ASR-B as the no-backdoor baseline.The metric is evaluated for a target downstream task and target class.
  • Attack effectiveness: 99.73% ASR is achieved on STL10 when the encoder is pre-trained on CIFAR10, compared with 10.38% ASR-B without encoder backdoor injection.The reported baseline is relatively high on SVHN because the dataset is unbalanced and the selected class is most popular.
  • Attack mechanism: BadEncoder produces more similar reference-input and trigger-input features than a clean encoder, explaining its higher ASR through shared downstream predictions.The comparison uses cosine similarity between reference and trigger-embedded test-image feature vectors.
  • Ablations: All three loss terms are necessary for high ASR, while L2 is necessary for high backdoored accuracy because removing it increases downstream misclassification.The L2 ablation particularly causes the reference input to be misclassified.
  • Parameter and data sensitivity: High ASR and preserved accuracy generally require shadow datasets larger than around 20% of pre-training data and triggers above task-dependent size thresholds.For CIFAR10 pre-training, reported thresholds include 10 × 10 for GTSRB, 3 × 3 for SVHN, and 5 × 5 for STL10.

VI. TWO REAL-WORLD CASE STUDIES

BadEncoder is evaluated on two publicly available image encoders: Google's ImageNet encoder and OpenAI's CLIP, which was pre-trained on 400 million image–text pairs.

  • The case studies apply BadEncoder to Google's ImageNet-pre-trained image encoder and OpenAI's CLIP image encoder.CLIP includes both image and text encoders and supports zero-shot classification.

1) Experimental Setup:

The experiments evaluate BadEncoder under single-target-task settings on Google's encoder and CLIP, including both multi-shot and zero-shot CLIP classifiers.

  • Experimental Setup: The ImageNet experiment selects one target downstream task, target class, and Internet-collected reference input, using 1% of ImageNet training images as shadow data.The target classes are truck, priority sign, and digit one for STL10, GTSRB, and SVHN, respectively.
  • Experimental Setup: The study reports results for BadEncoder applied to CLIP in Table IX.The table concerns attack success rates and downstream-classifier accuracy.
  • Experimental Setup: CLIP is evaluated for both multi-shot and zero-shot downstream classifiers after fine-tuning its image encoder with CIFAR10 training images as shadow data.The image encoder is fine-tuned for 200 epochs with learning rate 10^-6 and batch size 16.
  • Experimental Setup: The CLIP evaluation uses a single target downstream dataset and target class in the zero-shot setting.The multi-shot setting follows the ImageNet experiment settings.

2) Experimental Results:

BadEncoder maintains high attack success rates and downstream accuracy on CLIP, while the evaluated Neural Cleanse and MNTD defenses fail to reliably detect the attack.

  • Experimental Results: BadEncoder achieves high attack success rates while maintaining downstream-classifier accuracy for both CLIP multi-shot and zero-shot classifiers.This supports effectiveness on image encoders pre-trained on large image–text datasets.
  • Defenses: Neural Cleanse and MNTD are evaluated as empirical defenses for detecting backdoored downstream classifiers.Neural Cleanse reverse-engineers class-specific triggers, whereas MNTD trains a binary meta-classifier from clean and backdoored shadow classifiers.
  • Defenses: 0.5 average detection accuracy is achieved by the 50 MNTD meta-classifiers on downstream classifiers, equivalent to random guessing.The meta-classifiers use concatenated outputs produced from clean or backdoored encoders and downstream classifiers.
  • Defenses: 0.52 average detection accuracy with standard deviation 0.17 is obtained when MNTD detects six encoders.Detection of encoders is slightly more accurate than detection of downstream classifiers but remains low.
  • Defenses: The reported MNTD results may improve if defenders train more than 200 clean and 200 backdoored shadow models.The paper notes prior exploration of up to 2,048 models of each type.

C. PatchGuard

PatchGuard is evaluated as a provable defense against BadEncoder's trigger-based attack, but the reported results indicate insufficient protection.

  • PatchGuard: PatchGuard certifies that a trigger cannot change predictions when its size is below a threshold and reports a corresponding certified-accuracy lower bound.Its design limits corrupted local features through robust feature aggregation.
  • PatchGuard: BadEncoder embeds a patch so trigger-containing inputs are classified into an attacker-chosen target class.This makes adversarial-patch defenses relevant to the attack.
  • PatchGuard: PatchGuard is insufficient for defending against BadEncoder in the reported evaluation of backdoored downstream classifiers.The evaluation uses PatchGuard's Mask-DS variant and reports certified accuracy together with attack success rates.
  • PatchGuard: PatchGuard's defense model considers a different trigger independently for each testing input, unlike backdoor attacks using the same trigger across inputs.This distinction is stated as a methodological difference between the defense setting and backdoor attacks.

B. Backdoor Attacks

Backdoor research has mainly targeted classifiers or specialized self-supervised settings, while BadEncoder targets the pre-trained image encoder itself. The paper also reviews existing defenses and identifies the need for defenses tailored to encoder-level attacks.

  • Existing image backdoor attacks inject hidden trigger behavior directly into classifiers, causing triggered images to be assigned to an attacker-chosen target class.
  • Latent backdoor attack transfers behavior through a backdoored teacher classifier, but requires a large labeled dataset resembling the target downstream task.
  • BadEncoder instead compromises the pre-trained image encoder and requires only a few reference inputs from the target class plus an arbitrary unlabeled shadow dataset.
  • Concurrent attacks poison pre-training data for self-supervised learning based on image-text pairs, whereas BadEncoder targets the encoder through a different attack setting.
  • Prior targeted poisoning attacks modify feature extractors or target inputs so downstream classifiers produce attacker-selected predictions.
  • Defenses include empirical methods such as Neural Cleanse and provable methods such as PatchGuard, but the paper reports that existing defenses are insufficient against BadEncoder.
Loading 2108.00352v1…