GANs-Based Model Extraction for Black-Box Backdoor Attack

Machine learning (ML) models, e.g., deep neural networks (DNNs), are susceptible to backdoor attack. Backdoor attack involves embedding concealed backdoors into deep neural networks during training, which are activated by attacker-specified triggers in malicious inputs, causing the model to produce erroneous outputs. In the context of backdoor attacks, neural network models may experience misjudgment, such as an instance where a traffic sign image denoting “stop” is mistakenly identified as a “proceed” sign by a traffic sign identification model under the influence of the attack. This misclassification poses a significant safety risk to the domain of autonomous driving. Traditional white-box attacks require to access the training samples. Different from white-box attacks, black-box attacks adopt the settings that the training set and model internals is inaccessible. In practice, the training dataset is usually not shared due to privacy or copyright concerns, therefore black-box attacks are more realistic than white-box ones. Similar to the setting of training substitute models, in this paper we propose an effective black-box attack that also only has access to the input (images) and the output (confidence scores) of a targeted DNN. Our attack strategy consists in recovering a local model to substitute for the targeted DNN, using the local model to generate triggers, where inputs with the trigger will subsequently be misclassified by the targeted model. We incorporate Generative Adversarial Networks (GANs) to approximate the extracted model to the targeted model. All neural network models seems inherently possess “intrinsic” backdoors, even in the absence of attacks or poisoning. Grounded in this perspective, we generate triggers associated with the model’s “intrinsic” backdoors.