Deep neural networks have had enormous impact on various domains of computer science, considerably outperforming previous state of the art machine learning techniques. To achieve this performance, neural networks need large quantities of data and huge computational resources, which heavily increases their construction costs. The increased cost of building a good deep neural network model gives rise to a need for protecting this investment from potential copyright infringements. Legitimate owners of a machine learning model want to be able to reliably track and detect a malicious adversary that tries to steal the intellectual property related to the model. Recently, this problem was tackled by introducing in deep neural networks the concept of watermarking, which allows a legitimate owner to embed some secret information(watermark) in a given model. The watermark allows the legitimate owner to detect copyright infringements of his model. This paper focuses on verifying the robustness and reliability of state-of- the-art deep neural network watermarking schemes. We show that, a malicious adversary, even in scenarios where the watermark is difficult to remove, can still evade the verification by the legitimate owners, thus avoiding the detection of model theft.
A backdoor in a neural network is defined as an instance or a set of instances, that when are presented to the backdoored-classifier, it will classify them in a pre-set target label as instructed while training. In brief a backdoor may seem like an adversarial example, but it is different form it, because the classifier is intentionally trained to output the specific class when presented with the backdoor-trigger. The ability to add backdoors to deep neural networks comes as an result of the over-parametrization characteristic of a neural network. Due to that characteristic, an entity can implement a backdoor in the classifier without affecting the overall accuracy that the network should have in the original task. Implementing a backdoor in a neural network is done through what is known as training-set poisoning @cite_31 . The entity that wants to implement the backdoor, has only to create a small set that will serve as backdoor-triggers and decide the class that the neural network should give to them and then append these instances to the train set. When the model is trained it will learn, beside classifying clean instances, to correctly classify the instances that are part of the backdoor.
@cite_31
2750650104
A number of online services nowadays rely upon machine learning to extract valuable information from data collected in the wild. This exposes learning algorithms to the threat of data poisoning, i.e., a coordinate attack in which a fraction of the training data is controlled by the attacker and manipulated to subvert the learning process. To date, these attacks have been devised only against a limited class of binary learning algorithms, due to the inherent complexity of the gradient-based procedure used to optimize the poisoning points (a.k.a. adversarial training examples). In this work, we rst extend the de nition of poisoning attacks to multiclass problems. We then propose a novel poisoning algorithm based on the idea of back-gradient optimization, i.e., to compute the gradient of interest through automatic di erentiation, while also reversing the learning procedure to drastically reduce the attack complexity. Compared to current poisoning strategies, our approach is able to target a wider class of learning algorithms, trained with gradient- based procedures, including neural networks and deep learning architectures. We empirically evaluate its e ectiveness on several application examples, including spam ltering, malware detection, and handwritten digit recognition. We nally show that, similarly to adversarial test examples, adversarial training examples can also be transferred across di erent learning algorithms.