TrojanNet: Embedding Hidden Trojan Horse Models in Neural Networks (2020)笔记

Love The Way You Lie 2022-09-10 02:24 24阅读 0赞

**Code: https://github.com/Billy1900/TrojanNet (self produced)**

*  We prove theoretically that the Trojan network’s detection is computationally infeasible and demonstrate empirically that the transport network does not compromise its disguise.
 *  Our method utilizes excess model capacity to simultaneously learn a public and secret task in a single network, but different from multi-task learning, the two do not share common features and the secret keys remain undetectable without the presence of hidden key.
 *  Framework:  
    ![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlsbHkxOTAw_size_15_color_FFFFFF_t_70_g_se_x_16]
 *  Permutation shuffles the layer parameters:  
    ![在这里插入图片描述][6a4feae0c37946d9b8bb750d8b0468b8.png]  
    Loss and gradient:  
    ![在这里插入图片描述][9b9178ccfc0a4263b215cc5061d2b6f8.png]  
    Select permutations:  
    Pseudo-random permutation generator: H:K→ π\_d, and EXISTS-PERM decision problem is NP-complete.
 *  Results:
    
     *  the TRN50 network achieves similar test accuracy to that of RN50 trained on the single task alone, which shows that simultaneous training of multiple tasks has no significant effect on the classification accuracy. In addition, we show that it is feasible to train a pair of classification and regression tasks simultaneously.  
        ![在这里插入图片描述][97afd71e7e144b19bef2ab2348aac629.png]  
        ![在这里插入图片描述][0d09900b0ff74f56bd536a44cf824573.png]
     *  Using group normalization: We observe a similar trend of minimal effect on performance when network weights are shared between two tasks (rows 2 to 7 compared to row 1). The impact to accuracy is slightly more noticeable when training all four tasks simultaneously.
     *  Selecting the threshold L: It suggests that selecting a tight threshold L may be very difficult and may require an intricate balance between computational efficiency and controlling the false positive rate.
     *  Comparison
        
        1.  Individual TRN50 models (dark orange) have similar accuracy to that of HRN50 models (dark blue) on both datasets
        2.  Ensembling multiple TRN50 networks (light orange) provides a large boost of accuracy over the individual models
        3.  The effect of ensembling TRN50 models is surprisingly strong  
            (dark orange).  
            ![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlsbHkxOTAw_size_15_color_FFFFFF_t_70_g_se_x_16 1]
     *  Model capacity: larger models have more excess capacity to share among different permutations  
        ![在这里插入图片描述][watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlsbHkxOTAw_size_15_color_FFFFFF_t_70_g_se_x_16 2]  
        **More Update：https://github.com/Billy1900/Backdoor-Learning**

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlsbHkxOTAw_size_15_color_FFFFFF_t_70_g_se_x_16]: /images/20220829/a36475694262429d9e96e905b111e340.png
[6a4feae0c37946d9b8bb750d8b0468b8.png]: /images/20220829/a4b30d95ec4945cca911e967747e8260.png
[9b9178ccfc0a4263b215cc5061d2b6f8.png]: /images/20220829/94685ff0663d463788f26c5912e83726.png
[97afd71e7e144b19bef2ab2348aac629.png]: /images/20220829/71e95a54a6814d479e58b477f1b6579f.png
[0d09900b0ff74f56bd536a44cf824573.png]: /images/20220829/9cb486cbcb5f400a85e49d6ebe6d083d.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlsbHkxOTAw_size_15_color_FFFFFF_t_70_g_se_x_16 1]: /images/20220829/751329a514c049b4974c610e7b69d28b.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlsbHkxOTAw_size_15_color_FFFFFF_t_70_g_se_x_16 2]: /images/20220829/169ac06039a140d188a0136d0ae48457.png