Source-linked AI summary
BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learning
Zhenting Wang, Juan Zhai, Shiqing Ma
TL;DR
Trojan attacks remain vulnerable to human inspection, creating a need for stealthier triggers. BppAttack uses image quantization and dithering with contrastive adversarial training, achieving high attack success across four datasets while bypassing human inspection and existing defenses.
Problem
Existing Trojan triggers are often perceptible or recoverable, while human-visual-system similarity is difficult to model with conventional distance measures.
Method
BppAttack combines image quantization and dithering with contrastive adversarial training, using adversarial examples as negative samples without auxiliary model training.
Results
The attack achieves high success across four benchmark datasets, reports a 99.92% average attack success rate, and bypasses human inspection and existing defenses.
Takeaways & Limitations
Human-imperceptible, input-dependent triggers can be generated without auxiliary models while retaining effective Trojan behavior.
Takeaways & Limitations
Color-depth checking, activation-distribution checking, anomaly detection, data cleaning, validation, or other training protocols may mitigate the attack.
Abstract
from arXiv · showhide
Deep neural networks are vulnerable to Trojan attacks. Existing attacks use visible patterns (e.g., a patch or image transformations) as triggers, which are vulnerable to human inspection. In this paper, we propose stealthy and efficient Trojan attacks, BppAttack. Based on existing biology literature on human visual systems, we propose to use image quantization and dithering as the Trojan trigger, making imperceptible changes. It is a stealthy and efficient attack without training auxiliary models. Due to the small changes made to images, it is hard to inject such triggers during training. To alleviate this problem, we propose a contrastive learning based approach that leverages adversarial attacks to generate negative sample pairs so that the learned trigger is precise and accurate. The proposed method achieves high attack success rates on four benchmark datasets, including MNIST, CIFAR-10, GTSRB, and CelebA. It also effectively bypasses existing Trojan defenses and human inspection. Our code can be found in https://github.com/RU-System-Software-and-Security/BppAttack.
1. Introduction
Existing Trojan attacks often use detectable input patterns, motivating BppAttack’s human-imperceptible image quantization and dithering triggers with contrastive adversarial training. The attack reports high success, improved resistance to human inspection, and bypasses existing defenses.
- Trojan attacks inject runtime-triggered malicious behavior into otherwise normally functioning DNNs.
- Existing Work: Existing triggers, including patches, watermarks, filters, and transformations, remain vulnerable to human inspection or reverse engineering.
- BppAttack: BppAttack uses image quantization and dithering to create deterministic, input-dependent triggers that exploit human visual-system limitations.
- BppAttack: Contrastive learning and adversarial training improve poisoning for the attack’s small, human-imperceptible image changes without auxiliary models.
- Evaluation: 99.92% average attack success rate is reported across four datasets and seven architectures, alongside 1.60 times better human-inspection performance than SOTA approaches.
2. Background
Prior Trojan attacks use diverse triggers and defenses target poisoning, reverse engineering, model remediation, or online detection. These defenses can lose benign accuracy or fail to generalize across trigger types.
- Trojan attacks use patches, watermarks, physical reflections, filters, feature-space transformations, and image warping as triggers.
- Training-time defenses detect or suppress poisoned samples, but poisoning-focused methods can ignore supply-chain Trojan attacks.
- Reverse-engineering defenses formalize or recover triggers, while model-removal methods such as finetuning or pruning can lower benign accuracy.
- Online methods analyze perturbation sensitivity or prediction localization, but localization-based methods fail when triggers are not localized.
3. Method
BppAttack defines a poisoning-based Trojan objective and targets effective, imperceptible, input-dependent operation without auxiliary training. It combines quantization and dithering with contrastive adversarial training to inject precise triggers despite tiny perturbations.
- Threat Model: BppAttack targets Trojan models that preserve benign predictions while mapping transformed inputs to attacker-selected labels.
- Threat Model: The threat model requires high ASR with benign accuracy, human-imperceptible changes, input dependence, and no auxiliary model training.
- Threat Model: The attack assumes the adversary controls the dataset, training process, and model implementation, then injects the Trojan through dataset poisoning.
- Human Imperceptible Theory: Human visual-system evidence motivates color quantization to reduce colors and dithering to remove unnatural artifacts while preserving visual similarity.
- BPPATTACK: The quantization procedure is deterministic and avoids auxiliary models, while squeezed color values remain visually similar yet detectable by machine-learning models.
- BPPATTACK: Because tiny quantization perturbations hinder cross-entropy poisoning, the method uses PGD-generated adversarial examples as negative samples in contrastive training.
4. Experiments and Results
Experiments across four datasets and multiple architectures evaluate BPPATTACK’s effectiveness, stealthiness, defense resistance, and component sensitivity. The method maintains high attack performance while remaining difficult for human inspection and several defenses to detect.
- Experiment Setup: BPPATTACK is evaluated on MNIST, CIFAR-10, GTSRB, and CelebA using seven network architectures, with BA and ASR as primary metrics.The default bit depth is d = 5.
- Effectiveness: BPPATTACK achieves higher BA and ASR than WaNet in both all-to-one and all-to-all attack settings.In the all-to-all setting, its ASR exceeds WaNet by 0.96%, while BA is also higher.
- Effectiveness: Across four additional CIFAR-10 architectures, BPPATTACK retains similar BA with nearly 100% ASR, demonstrating generalizability across network architectures.The evaluated architectures are MobileNetV2, SENet18, ResNeXt29, and DenseNet121.
- Stealthiness: In a human inspection study, BPPATTACK achieves about 50% success fooling rates for both Trojan and clean inputs, indicating satisfying stealthiness.The study uses 25 GTSRB images, mixed Trojan and clean samples, and 40 human participants.
- Defense Resistance: BPPATTACK is evaluated against STRIP, GradCAM, Neural Cleanse, and Fine-pruning, with the reported experiments showing resistance to these defenses.Its input-dependent whole-image transformation breaks Neural Cleanse’s assumption of a shared trigger, while GradCAM is less focused on a small region.
- Ablation Study: The attack maintains high BA and ASR when d is at most 6, but ASR decreases at d = 7 because the perturbation becomes too small for the model to distinguish.Dithering makes low-bit-depth Trojan samples more natural by fixing color artifacts.
- Ablation Study: Increasing injection rate raises ASR, while BA remains unaffected for injection rates from 2.5% to 30%.Low injection rates provide too little optimization on Trojan samples and target labels for the model to learn Trojan behavior.
- Ablation Study: Contrastive adversarial training enables the model to bypass Neural Cleanse, unlike the vanilla training method whose anomaly index exceeds the detection threshold of 2.This ablation is conducted on CIFAR-10 using trigger reverse engineering.
5. Discussion
BPPATTACK bypasses several existing defenses, but the authors acknowledge that defenses targeting color depth, activations, anomalies, data, or training protocols may mitigate it.
- Color-depth checking could potentially detect BPPATTACK despite its ability to bypass existing defenses.
- Activation-distribution checking and anomaly-detection methods may also help mitigate the attack.
- Data cleaning, validation, or another training protocol may mitigate BPPATTACK under different threat models.
- DP-SGD and related training-time defenses may potentially mitigate BPPATTACK.
6. Conclusion
BppAttack uses image quantization and dithering to create human-imperceptible Trojan triggers, reinforced by contrastive learning and adversarial training. The resulting attack is reported as highly effective and efficient.
- BppAttack uses image quantization and dithering to generate human-imperceptible Trojan triggers.The trigger design exploits literature on the human visual system.
- Contrastive learning and adversarial training improve the effectiveness of the poisoning method.
- The authors report that BppAttack is highly effective and efficient.
7. Supplementary materials
Supplementary materials compare BPPATTACK with WaNet, examine different bit numbers, and document the MNIST classifier architecture. BPPATTACK samples are described as more stealthy than WaNet samples and natural across bit settings.
- BPPATTACK samples are more stealthy than WaNet samples in supplementary visual comparisons.WaNet samples can be spotted, whereas BPPATTACK samples are described as more stealthy.
- BPPATTACK samples produced with different bit numbers remain natural and stealthy.
- The supplementary materials provide the detailed architecture of the classifier used for MNIST in Table 6.Table 6 identifies FC as fully connected and marks BatchNormalization and DropOut layers with symbols.
7.4. Resistance to More Defenses
The paper evaluates BPPATTACK against several Trojan defenses and reports resilience to defenses including ULP and NAD. Supplementary figures also cover comparisons, bit-number effects, and Spectral Signature resilience.
- Spectral Signature: The paper evaluates BPPATTACK against Spectral Signature, a training-time defense that analyzes latent-feature covariance and sample scores.The text notes that this defense does not match the stated threat model but remains useful to investigate.
- Supplementary figures: Supplementary figures include additional WaNet comparisons, bit-number examples, and a figure labeled as resilience to Spectral Signature.
- Universal Litmus Patterns: Five CIFAR-10 VGG models bypassed Universal Litmus Patterns because ULP assumes a small patch trigger, unlike BPPATTACK.
- Neural Attention Distillation: NAD resilience is evaluated on CIFAR-10, GTSRB, and CelebA using ResNet-based classifiers and 5% clean training data for the defender.The experiments use official NAD code and default hyperparameters.
- Neural Attention Distillation: Table 7 reports the paper’s evaluation of resilience to Neural Attention Distillation.
7.5. Compared with ISSBA [38]
On ImageNet’s 200-class subset, BppAttack is more efficient than ISSBA while achieving comparable or better attack and benign accuracy. Its triggered examples also remain closer to the originals.
- BppAttack achieves comparable or better ASR and BA than ISSBA on ImageNet’s 200-class subset.The comparison uses ResNet18 and reports attack success rate and benign accuracy.
- BppAttack adds only 19.04% training time over standard victim-model training.
- BppAttack requires 1h18mins of extra training, compared with ISSBA’s 7h30mins encoder-decoder training.
- BppAttack’s examples are closer to the original images, whereas ISSBA produces unnatural “black fog.”
7.6. Compared with WaNet [49]
The paper compares BppAttack with WaNet under BppAttack’s training protocol on CIFAR-10 and GTSRB. The evaluation uses separate ResNet architectures and reports both benign and attack success rates.
- BppAttack and WaNet are compared under BppAttack’s training protocol on CIFAR-10 and GTSRB.
- The CIFAR-10 evaluation uses Pre-activation ResNet18, while the GTSRB evaluation uses ResNet18.
- The comparison evaluates both BA and ASR for the two triggers.
7.7. Robustness against fine-tuning
The paper examines whether Trojan models remain effective after downstream users fine-tune them with out-of-distribution or differently compressed images. It frames robustness to fine-tuning as an additional threat-model scenario.
- The robustness analysis considers downstream users fine-tuning Trojan model weights with out-of-distribution data.
- The scenario also includes fine-tuning with different image qualities and possible use of quantization techniques such as JPEG.
- Universal input transformations can be represented as ex = T(x), with fixed-pattern triggers as a special case.