WIXLIB

A Survey on Neural TrojansYuntao Liu, Ankit Mondal, Abhishek Chakraborty, Michael Zuzak, Nina Jacobsen,Daniel Xing, and Ankur SrivastavaUniversity of Maryland, College ParkAbstractNeural networks have become increasingly prevalent in manyreal-world applications including security critical ones. Dueto the high hardware requirement and time consumption totrain high-performance neural network models, users oftenoutsource training to a machine-learning-as-a-service (MLaaS)provider. This puts the integrity of the trained model at risk.In 2017, Liu et al. found that, by mixing the training data witha few malicious samples of a certain trigger pattern, hiddenfunctionality can be embedded in the trained network whichcan be evoked by the trigger pattern [33]. We refer to this kindof hidden malicious functionality as neural Trojans. In thispaper, we survey a myriad of neural Trojan attack and defensetechniques that have been proposed over the last few years.In a neural Trojan insertion attack, the attacker can be theMLaaS provider itself or a third party capable of adding or tampering with training data. In most research on attacks, the attacker selects the Trojan’s functionality and a set of input patterns that will trigger the Trojan. Training data poisoning isthe most common way to make the neural network acquirethe Trojan functionality. Trojan embedding methods that modify the training algorithm or directly interfere with the neuralnetwork’s execution at the binary level have also been studied. Defense techniques include detecting neural Trojans in themodel and/or Trojan trigger patterns, erasing the Trojan’s functionality from the neural network model, and bypassing theTrojan. It was also shown that carefully crafted neural Trojanscan be used to mitigate other types of attacks. We systematizethe above attack and defense approaches in this paper.1IntroductionWhile neural networks demonstrate exceptional capabilitiesin various tasks of machine learning nowadays, they are alsobecoming larger and deeper. As a result, the requirement ofhardware, time, and data to train a network also increases dramatically. Under this scenario, machine-learning-as-a-service(MLaaS) becomes an increasingly popular business model. However, the training process in MLaaS is not transparent and mayembed neural Trojans, i.e. hidden malicious functionalities, intothe neural network. Many research papers have demonstratedthe severity of this attack [4, 11–13, 17, 19, 26–28, 30, 32, 33, 39,40, 43, 51, 52]. The effect of neural Trojans in the neural network’s deployment is illustrated in Fig. 1. If the input is benign(i.e. without the Trojan trigger pattern), the Trojan will not beactivated and the network will work normally. However, if theTrojan trigger exists in the image, the network will malfunctionand exhibit the attacker’s intended functionality.Both neural Trojan attacks (i.e. to inject Trojan’s maliciousfunctionality into neural networks) and countermeasures havebeen widely studied. The most popular way to inject Trojans istraining data poisoning [17, 24, 32, 33], where a small amount ofmalicious training samples are mixed with the normal trainingdata. These malicious data are sometimes carefully crafted in order to make the infected network highly sensitive to the Trojantriggers while maintaining normal behavior in all other cases.This differs Trojan attacks from conventional poisoning attacksInput sampleCompromised sintendedfunctionalityFigure 1: In the deployment of a Trojan-infected neuralnetwork, an input sample with the Trojan trigger patternwill cause the network to malfunction and exhibit the attacker’s intended functionality.against machine learning models where the attacker tries to degrade the trained model’s performance with a small amount ofadded malicious training data. Other Trojan injection techniqueshave also been studied. Such techniques include modifying thetraining algorithms for a small subset of neurons based on theTrojan’s functionality and the trigger pattern [12, 13] and flipping or rewriting certain bits in the neural network’s binarycode[27, 30].The stealthiness of neural Trojans makes them very difficultto defend against. Many defense methods focused on detectingTrojan triggers from the input sample [2, 3, 7, 9, 10, 16, 22, 25,35, 47, 48]. Other works have proposed restoring compromisedneural network [21, 29, 46, 53] and reconstructing input samplesto bypass neural Trojans [14, 33, 45].In this paper, we survey the attack and defense strategies related to neural Trojans in order to give readers a comprehensiveview of this field. The categories of attack and defense methodsare outlined in Fig. 2.2Neural Trojan AttacksIn the last 3 years, many Trojan embedding attack methodshave been proposed. These attacks can be broadly classified intotraining data poisoning-based attacks, training algorithm-basedattacks, and binary-level attacks. In the rest of this section, wesummarize the works in each category.2.1Training Data PoisoningNeural Trojans can be embedded in the neural networkswhen the networks are trained with a compromised dataset[17, 24, 32, 33]. This process typically involves the encoding ofmalicious functionality within the weights of the network. Oneor more specific input patterns can trigger/activate the Trojanand produce the output behavior which was desired by the attacker but which may be undesired or harmful for the originaluser. An example of such a scenario is a face recognition system to enter a building where the attacker tries to impersonateanother person to gain unauthorized entry.

Untrusted MLaaS providerNeural network userTrainingdataNetworkspecificationsNeural network userPoisoningdataTrojan-infectedNeural NetworkBit-levelmanipulationsCompromisedtraining algo.TestdatawithTrojantriggerTrojanbypassTrojan alityNetworkrestorationFigure 2: The categories of attack and defense techniquesGeneral countermeasures such as Trojan detection and removal were also discussed in [17, 33]. Although most Trojan attacks focus on deep convolutional networks, Yang et al. extendedneural Trojan attacks to long-short-term-memory (LSTM) andrecurrent networks [51]. A weaker threat model was considered in [11] where the attacker does not have knowledge of thevictim model, doesn’t have access to the training data, and canonly inject a limited number of poisoned samples. It focuseson targeted attacks, only creating backdoor instances withoutaffecting the performance of the system so as to evade detection.Evaluation shows that with a single instance as the backdoorkey, only 5 samples of it need to be added to a huge trainingset; whereas when a pattern is the key, 50 poisoned samplesare enough. Here “key” refers either to a malicious new inputpattern added to the training set, or malicious features insertedinto existing input patterns of the training set.2.1.1 Hiding Trojan Triggers Although most Trojan insertiontechniques use a certain pattern, it is desirable to make thesepatterns indistinguishable when mixed with legitimate data inorder to evade human inspection. Barni et al. [4] proposed aTrojan insertion approach where the label of the poisoned datais not tampered with. The advantage is that, upon inspection,the poisoned samples would not be detected merely on the basisof an accompanying poisoned label. To perform the attack, atarget class t is chosen and a fraction of training data samplesbelonging to t is poisoned by adding a backdoor signal v. Afterthe NN is trained on the training set which is contaminatedwith some poisoned samples of class t, some test samples notbelonging to class t and corrupted with signal v end up beingclassified as t. Thus, the network learns that the presence of vin a sample is an indicator of the sample belonging to class t.Liao et al. designed static and adaptive Trojan insertion techniques. In their work, the indistinguishability of Trojan triggerexamples is attained by a magnitude constraint on the perturbations to craft such examples [28]. Li et al. generalized this approach and demonstrated the trade-off between the effectivenessand stealth of Trojans [26]. They also developed an optimization algorithm involving L 2 and L 0 regularization to distributethe trigger throughout the victim image. Saha et al. proposedto hide the Trojan triggers by not using the poisoned data intraining at all. Instead, they took a fine-tune approach in thetraining process. The backdoor trigger samples are given thecorrect label and only used at test time. These samples are visually indistinguishable from legitimate data but bear certainfeatures that will trigger the Trojan [40].2.2Altering Training AlgorithmsTrojans can also be embedded into neural networks withouttraining data poisoning. Clements et al. [12] developed a novelalgorithm for inserting Trojans into a trained neural networkmodel by modification of the computing operations rather thanmodifying the network weights by poisoning the training data.This makes existing poisoning defence techniques incapable ofdetecting the attack. The threat model assumes that the attackerhas access to the trained model which is maliciously modifiedbefore deployment. The attack methodology selects a layer inthe network for the purpose of modification, the latter beingcalculated using the gradient of the network output w.r.t. thislayer (the Jacobian). This gradient tells how the victim neuron’soperation should change. With only a small fraction of neuronstampered with, both targeted and untargeted versions of the attack yield high success rate. The authors studied the practicalityof [12]’s attack in [13]. An adversary in the supply chain has thecapability to modify the neural network hardware to change itspredictions upon a certain trigger. Modifications to neurons canbe achieved by adding a MUX or altering internal structure ofcertain operations. The paper also proposes defense strategiessuch as adversarial training to improve robustness of model andpossibly combining it with hardware Trojan detection methods(eg. side-channel based).2.2.1 Trojan Insertion via Transfer Learning Gu et al. [19] werethe first to exploit transfer learning as a means of Trojan insertion. In transfer learning, a new model (called the ‘studentmodel’) is obtained by fine-tuning a pre-trained model (‘teachermodel’) for another similar task. The network’s weights can betampered with during this process which may result in Trojaninsertion. Additionally, security vulnerabilities in online repositories are scrutinized and it was found that an adversary cancompromise a benign model with a malicious transfer learningprocess. Yao et al. proposed latent backdoor attack in transferlearning where the student model takes all but the last layersfrom the teacher model [52]. In this case, the infected teachermodel will have different latent representations (i.e. the secondlast layer neuron values) from that of a clean model. They foundthat latent backdoor embedded in the teacher model can betransferred to active backdoor in the student model. In [43],Tan and Shokri pointed out that backdoor detection schemesmostly rely on the distribution difference between the latentrepresentations of clean and backdoor examples. They hencepropose to make the two latent representation distributions asclose as possible and evaded detection schemes proposed in[9, 29, 33, 44].2.2.2 Neural Trojans in Hardware In [27], Li et al. propose ahardware-software framework for inserting Trojans into a neural network, where the attacker is assumed to be a third partysomewhere in the supply chain. The authors implement twoattacks: one to misclassify an input in one class as a member of a