CoChat
Sign Up
Cited by 241Adversarial Robustness in Machine LearningPhysical Unclonable Functions (PUFs) and Hardware SecuritySecurity and Verification in Computing

Neural Trojans

Open access
Liu, Yuntao, Xie, Yang, Srivastava, Ankur·2017·2017 IEEE International Conference on Computer Design (ICCD)
DOI 10.1109/iccd.2017.16
Open this paper in CoChat — free accountOpen PDF

Abstract

While neural networks demonstrate stronger capabilities in pattern recognition nowadays, they are also becoming larger and deeper. As a result, the effort needed to train a network also increases dramatically. In many cases, it is more practical to use a neural network intellectual property (IP) that an IP vendor has already trained. As we do not know about the training process, there can be security threats in the neural IP: the IP vendor (attacker) may embed hidden malicious functionality, i.e neural Trojans, into the neural IP. We show that this is an effective attack and provide three mitigation techniques: input anomaly detection, re-training, and input preprocessing. All the techniques are proven effective. The input anomaly detection approach is able to detect 99.8% of Trojan triggers although with 12.2% false positive. The re-training approach is able to prevent 94.1% of Trojan triggers from triggering the Trojan although it requires that the neural IP be reconfigurable. In the input preprocessing approach, 90.2% of Trojan triggers are rendered ineffective and no assumption about the neural IP is needed.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/iccd.2017.16

Cites

15 of 15 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Detection methods exploit activation statistics or model properties to determine whether a model is backdoored or whether a training/test example is a backdoor example.

    “Detection methods exploit activation statistics or model properties to determine whether a model is backdoored [151], [152], or whether a training/test example is a backdoor example [47].”

    From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [47]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 12

  1. [1][1] T. N. Sainath, A.-r. Mohamed, B. Kingsbury, and B. Ramabhadran, 'Deep convolutional neural networks for lvcsr,' in Acoustics, speech and signal processing (ICASSP), 2013 IEEE international conference on . IEEE, 2013, pp. 8614-8618. -
  2. [3][3] A. Krizhevsky, I. Sutskever, and G. E. Hinton, 'Imagenet classification with deep convolutional neural networks,' in Advances in neural information processing systems , 2012, pp. 1097-1105. -
  3. [4][4] G. E. Dahl, J. W. Stokes, L. Deng, and D. Yu, 'Large-scale malware classification using random projections and neural networks,' in Acoustics, Speech and Signal Processing (ICASSP), 2013 IEEE International Conference on . IEEE, 2013, pp. 3422-3426. -
  4. [5][5] Z. Yuan, Y. Lu, Z. Wang, and Y. Xue, 'Droid-sec: deep learning in android malware detection,' in ACM SIGCOMM Computer Communication Review , vol. 44, no. 4. ACM, 2014, pp. 371-372. -
  5. [8][8] S. Hawkins, H. He, G. Williams, and R. Baxter, 'Outlier detection using replicator neural networks,' in International Conference on Data Warehousing and Knowledge Discovery . Springer, 2002, pp. 170-180. -
  6. [9][9] D. E. Rumelhart, G. E. Hinton, and R. J. Williams, 'Learning representations by back-propagating errors,' Cognitive modeling , vol. 5, no. 3, p. 1, 1988. -
  7. [10][10] K. P. Murphy, Machine learning: a probabilistic perspective . MIT press, 2012. -
  8. [11][11] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, 'Generative adversarial nets,' in Advances in neural information processing systems , 2014, pp. 26722680. -
  9. [12][12] N. Srivastava, G. E. Hinton, A. Krizhevsky, I. Sutskever, and R. Salakhutdinov, 'Dropout: a simple way to prevent neural networks from overfitting.' Journal of Machine Learning Research , vol. 15, no. 1, pp. 1929-1958, 2014. -
  10. [20][20] L. Huang, A. D. Joseph, B. Nelson, B. I. Rubinstein, and J. Tygar, 'Adversarial machine learning,' in Proceedings of the 4th ACM workshop on Security and artificial intelligence . ACM, 2011, pp. 43-58. -
  11. [21][21] C. Yang, B. Liu, H. Li, Y. Chen, W. Wen, M. Barnell, Q. Wu, and J. Rajendran, 'Security of neuromorphic computing: thwarting learning attacks using memristor's obsolescence effect,' in Proceedings of the 35th International Conference on Computer-Aided Design . ACM, 2016, p. 97. -
  12. [26][26] Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh, 'Embedding watermarks into deep neural networks,' arXiv preprint arXiv:1701.04082 , 2017. - · arXiv

Cited by

Sorted by citations

Related

Authors
Liu, Y., Xie, Y., & Srivastava, A.
Affiliations
University of Maryland, College Park (US)
ORCID
Venue
2017 IEEE International Conference on Computer Design (ICCD)
Publisher
IEEE
Published
2017-11
Pages
45-48
ISSN
1063-6404 (ISSN-L)
DOI
10.1109/iccd.2017.16
OpenAlex
W4252979261
Cited by
241
References
15
Citations by year
2026: 11 · 2025: 44 · 2024: 50 · 2023: 33 · 2022: 37 · 2021: 30 · 2020: 24 · 2019: 8 · 2018: 4
FWCI
4.49
Type
conference paper
Language
en
Open access
Locations
  • IEEE International Conference on Computer Design: VLSI in Computers and Processors (ICCD) (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
Keywords
neural network security, neural network hardware, IP core, retraining, input preprocessing, reconfigurable neural networks

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review