Machine learning models that use deep neural networks (DNNs) are vulnerable to backdoor attacks. An adversary carrying out a backdoor attack embeds a predefined perturbation called a trigger into a small subset of input samples and trains the DNN such that the presence of the trigger in the input results in an adversary-desired output class. Such adversarial retraining however needs to ensure that outputs for inputs without the trigger remain unaffected and provide high classification accuracy on clean samples. In this paper, we propose MDTD, a Multi-Domain Trojan Detector for DNNs, which detects inputs containing a Trojan trigger at testing time. MDTD does not require knowledge of trigger-embedding strategy of the attacker and can be applied to a pre-trained DNN model with image, audio, or graph-based inputs. MDTD leverages an insight that input samples containing a Trojan trigger are located relatively farther away from a decision boundary than clean samples. MDTD estimates the distance to a decision boundary using adversarial learning methods and uses this distance to infer whether a test-time input sample is Trojaned or not. We evaluate MDTD against state-of-the-art Trojan detection methods across five widely used image-based datasets: CIFAR100, CIFAR10, GTSRB, SVHN, and Flowers102; four graph-based datasets: AIDS, WinMal, Toxicant, and COLLAB; and the SpeechCommand audio dataset. MDTD effectively identifies samples that contain different types of Trojan triggers. We evaluate MDTD against adaptive attacks where an adversary trains a robust DNN to increase (decrease) distance of benign (Trojan) inputs from a decision boundary.

翻译：基于深度神经网络（DNNs）的机器学习模型易受后门攻击。实施后门攻击的对手会在少量输入样本中嵌入预定义的扰动（称为触发器），并训练DNN使得输入中出现触发器时产生对手期望的输出类别。然而，此类对抗性重训练需确保不含触发器的输入输出不受影响，且在干净样本上保持高分类准确率。本文提出MDTD——一种面向DNN的多域木马检测器，可在测试阶段检测包含木马触发器的输入。MDTD无需知晓攻击者的触发器嵌入策略，可应用于基于图像、音频或图输入的预训练DNN模型。MDTD利用以下洞见：包含木马触发器的输入样本相对于决策边界的距离通常大于干净样本。MDTD通过对抗学习方法估计样本到决策边界的距离，并据此推断测试时输入样本是否被植入木马。我们在五个广泛使用的图像数据集（CIFAR100、CIFAR10、GTSRB、SVHN、Flowers102）、四个图数据集（AIDS、WinMal、Toxicant、COLLAB）以及SpeechCommand音频数据集上，将MDTD与最先进的木马检测方法进行了对比评估。MDTD能有效识别包含不同类型木马触发器的样本。我们还评估了MDTD在自适应攻击下的表现——此类攻击中对手训练鲁棒DNN以增大（减小）良性（木马）输入与决策边界的距离。