Abstract
Backdoor attacks embed a hidden functionality into deep neural networks, causing the network to display anomalous behavior when activated by a predetermined pattern in the input Trigger, while behaving well otherwise on public test data. Recent works have shown that backdoored face recognition (FR) systems can respond to natural-looking triggers like a particular pair of sunglasses. Such attacks pose a serious threat to the applicability of FR systems in high-security applications. We propose a novel technique to (1) detect whether an FR network is compromised with a natural, physically realizable trigger, and (2) identify such triggers given a compromised network. We demonstrate the effectiveness of our methods with a compromised FR network, where we are able to identify the trigger (e.g., green sunglasses or red hat) with a top-5 accuracy of 74%, whereas a naive brute force baseline achieves 56% accuracy.
Abstract (translated)
后门攻击将隐藏功能嵌入深度神经网络，使得当输入触发器（Trigger）中包含预设模式时，该网络会表现出异常行为；而在其他情况下，则在网络的公开测试数据上表现良好。最近的研究表明，被植入后门的人脸识别系统会对一些自然存在的触发器做出响应，例如特定的一副太阳镜。此类攻击对人脸识别系统的高安全性应用构成了严重威胁。 我们提出了一种新的技术方法来： 1. 检测一个人脸识别网络是否被一种自然、可物理实现的触发器所侵入； 2. 在一个已经遭到入侵的人脸识别系统中，找出这样的触发器。 通过使用一个已被植入后门的人脸识别系统作为案例，我们能够以74%的准确率识别出具体的触发器（例如绿色太阳镜或红色帽子），而相比之下，一种简单的暴力破解基线方法只能达到56%的准确度。
URL
https://arxiv.org/abs/2506.19533
