DBMAP: Detecting Backdoors via Modality-Agnostic Perturbations

Trojan / backdoor attacks pose a serious threat as the adoption of machine learning models becomes increasingly common. In such an attack, a malicious actor can exert direct control over a model’s output in the presence of some maliciously constructed input. It is therefore of great importance to develop reliable mechanisms for mitigating against such Trojan attacks. An ideal mitigation strategy should prevent the model’s user from trusting the attacker’s intended output, while still enabling the model to maintain its accuracy. The goal of our strategy is to determine if an input sample is triggering Trojan behavior, and if so, discard the model’s output for that sample. We do this by applying perturbations to the sample, or the model itself, and collecting statistics (signatures) on the model’s outputs in the presence of these perturbations. We then compare these statistics to those of known clean examples, and run an outlier detection technique to determine if the new input deviates substantially from the clean examples. If so, we treat this sample as a Trojan attack. In this paper, we evaluate this Trojan attack mitigation technique on publicly available datasets in modalities including natural language processing, and the less explored fields of PDF malware and botnet traffic detection.