# Dynamic Backdoor Attacks Against Machine Learning Models

**Authors:** Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, Yang Zhang  
**arXiv:** [2003.03675](https://arxiv.org/abs/2003.03675)  
**Date:** 2020-03-07  
**Summary page:** https://www.summarizepaper.com/en/paper/2003.03675v2/

## Key points

- Machine learning (ML) has become a key component in critical real-world applications
- ML models are vulnerable to security and privacy attacks, particularly backdoor attacks
- Current backdooring techniques involve static triggers with fixed patterns and locations
- Dynamic backdooring techniques have been proposed against deep neural networks (DNN)
- Techniques like Random Backdoor, BaN, and c-BaN generate triggers with random patterns and locations
- BaN and c-BaN use generative networks to algorithmically generate triggers
- c-BaN is the first conditional backdooring technique capable of producing target-specific triggers based on a given label
- BaN and c-BaN provide adversaries with flexibility in customizing backdoor attacks
- These dynamic backdooring techniques were evaluated on MNIST, CelebA, and CIFAR-10 datasets with almost perfect attack performance and minimal utility loss
- The techniques can circumvent state-of-the-art defense mechanisms against backdoor attacks such as ABS, Februus, MNTD, Neural Cleanse, and STRIP

## Summary

Machine learning (ML) has seen significant advancements in recent years, becoming a key component in various critical real-world applications. However, the growing adoption of ML models has also brought to light their vulnerability to security and privacy attacks. Of particular concern are backdoor attacks, which have garnered increased attention due to their potential to bypass crucial authentication systems and cause severe consequences. Current backdooring techniques typically involve adding static triggers with fixed patterns and locations to ML model inputs. However, these static triggers are susceptible to detection by existing backdoor detection mechanisms. To address this limitation, a new class of dynamic backdooring techniques has been proposed against deep neural networks (DNN). These techniques include Random Backdoor, Backdoor Generating Network (BaN), and conditional Backdoor Generating Network (c-BaN). Triggers generated by these methods exhibit random patterns and locations, thereby reducing the effectiveness of current backdoor detection mechanisms. Notably, BaN and c-BaN leverage a novel generative network to algorithmically generate triggers. Additionally, c-BaN stands out as the first conditional backdooring technique capable of producing target-specific triggers based on a given label. Both BaN and c-BaN serve as versatile frameworks that provide adversaries with flexibility in customizing backdoor attacks. The efficacy of these dynamic backdooring techniques was extensively evaluated across three benchmark datasets: MNIST, CelebA, and CIFAR-10. The results demonstrate almost perfect attack performance on backdoored data with minimal utility loss. Furthermore, it was shown that these techniques can circumvent state-of-the-art defense mechanisms against backdoor attacks such as ABS, Februus, MNTD, Neural Cleanse, and STRIP.