Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks\n Trained from Scratch

Abstract

As the curation of data for machine learning becomes increasingly automated,\ndataset tampering is a mounting threat. Backdoor attackers tamper with training\ndata to embed a vulnerability in models that are trained on that data. This\nvulnerability is then activated at inference time by placing a "trigger" into\nthe model's input. Typical backdoor attacks insert the trigger directly into\nthe training data, although the presence of such an attack may be visible upon\ninspection. In contrast, the Hidden Trigger Backdoor Attack achieves poisoning\nwithout placing a trigger into the training data at all. However, this hidden\ntrigger attack is ineffective at poisoning neural networks trained from\nscratch. We develop a new hidden trigger attack, Sleeper Agent, which employs\ngradient matching, data selection, and target model re-training during the\ncrafting process. Sleeper Agent is the first hidden trigger backdoor attack to\nbe effective against neural networks trained from scratch. We demonstrate its\neffectiveness on ImageNet and in black-box settings. Our implementation code\ncan be found at https://github.com/hsouri/Sleeper-Agent.\n

Ähnliche Arbeiten