DeepGuard: Backdoor Attack Detection and Identification Schemes in Privacy-Preserving Deep Neural Networks
Open accessAbstract
Deep neural networks (DNNs) have profoundly changed our lifeways in recent years. The cost of training a complicated DNN model is always overwhelming for most users with limited computation and storage resources. Consequently, an increasing number of people are considering to resort to a cloud for an outsourced DNN model training. However, the DNN models training process outsourced to the cloud faces privacy and security issues due to the semi-honest and malicious cloud environments. To preserve the privacy of the data and the parameters in DNN models during the outsourced training and to detect whether the models are injected with backdoors, this paper presents DeepGuard, a framework of privacy-preserving backdoor detection and identification in an outsourced cloud environment for multi-participant computation. In particular, we design a privacy-preserving reverse engineering algorithm for recovering the triggers and detecting the backdoor attacks among three cooperative but non-collusion servers. Moreover, we propose a backdoor identification algorithm adapting to single-label and multi-label attack detection. Finally, extensive experiments on the prevailing datasets such as MNIST, SVHN, and GTSRB confirm the effectiveness and efficiency of backdoor detection and identification in a privacy-preserving DNN model.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The attack cost of the aggregation phase attack is the highest among all attack methodologies.
“However, the attack cost is also the highest among all attack methodologies [185].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [185]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Adam: A Method for Stochastic Optimization
Kingma, D. P., & Ba, J. (2014) · arXiv · doi:10.48550/arxiv.1412.6980 · Cited by 98,946 · see citing works
(1996) · Cited by 20,179 · see citing works
Proceedings of IEEE Conference on Computer Vision and Pattern Recognition
(1993) · doi:10.1109/cvpr.1993 · Cited by 17,989 · see citing works
The MNIST Database of Handwritten Digit Images for Machine Learning Research [Best of the Web]
Deng, L. (2012) · IEEE Signal Processing Magazine · doi:10.1109/msp.2012.2211477 · Cited by 4,858 · see citing works
Reading digits in natural images with unsupervised feature learning
Netzer, Y. (2024) · doi:10.57702/e7wwo0zk · Cited by 4,261 · see citing works
Protocols for secure computations
Yao, A. C. (1982) · 23rd Annual Symposium on Foundations of Computer Science (sfcs 1982) · doi:10.1109/sfcs.1982.38 · Cited by 3,306 · see citing works
SecureML: A System for Scalable Privacy-Preserving Machine Learning
Mohassel, P., & Zhang, Y. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.12 · Cited by 1,936 · see citing works
Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition
Stallkamp, J., Schlipsing, M., Salmen, J., & Igel, C. (2012) · Neural Networks · doi:10.1016/j.neunet.2012.02.016 · Cited by 1,567 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
BadNets: Evaluating Backdooring Attacks on Deep Neural Networks
Gu, T., Liu, K., Dolan-Gavitt, B., & Garg, S. (2019) · IEEE Access · doi:10.1109/access.2019.2909068 · Cited by 1,238 · see citing works
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
Liu, K., Dolan-Gavitt, B., & Garg, S. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-00470-5_13 · Cited by 1,055 · see citing works
Automatic diagnosis of the 12-lead ECG using a deep neural network
Ribeiro, A. H., Ribeiro, M. H., Paixão, G. M. M., Oliveira, D. M., Gomes, P. R., Canazart, J. A., Ferreira, M. P. S., Andersson, C. R., Macfarlane, P. W., Meira, W., et al. (2020) · Nature Communications · doi:10.1038/s41467-020-15432-4 · Cited by 894 · see citing works
ABY - A Framework for Efficient Mixed-Protocol Secure Two-Party Computation
Demmler, D., Schneider, T. H., & Zohner, M. (2015) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2015.23113 · Cited by 841 · see citing works
Automatic diagnosis of the 12-lead ECG using a deep neural network
Ribeiro, A. H., Ribeiro, M. H., Paixao, G. M., Oliveira, D. M., Gomes, P. R., Canazart, J. A., Ferreira, M. P. S., Andersson, C. R., Macfarlane, P. W., Meira, W., et al. (2020) · RePEc: Research Papers in Economics · doi:10.5281/zenodo.3625006 · Cited by 722 · see citing works
Li, Y., Jiang, Y., Li, Z., & Xia, S.-T. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3182979 · Cited by 682 · see citing works
Zhang, M., Zhang, Y., Zhang, L., Liu, C., & Khurshid, S. (2018) · Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering · doi:10.1145/3238147.3238187 · Cited by 611 · see citing works
Self-citationReflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
Liu, Y., Ma, X., Bailey, J., & Lu, F. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58607-2_11 · Cited by 531 · see citing works
MP-SPDZ: A Versatile Framework for Multi-Party Computation
Keller, M. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3417872 · Cited by 524 · see citing works
Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., & Srivastava, B. (2018) · arXiv · doi:10.48550/arxiv.1811.03728 · Cited by 485 · see citing works
ABS: Scanning Neural Networks for Back-doors by Artificial Brain Stimulation
Liu, Y., Lee, W., Tao, G., Ma, S., Aafer, Y., & Zhang, X. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3363216 · Cited by 419 · see citing works
High-Throughput Semi-Honest Secure Three-Party Computation with an Honest Majority
Araki, T., Furukawa, J., Lindell, Y., Nof, A., & Ohara, K. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978331 · Cited by 413 · see citing works
SphereFace: Deep Hypersphere Embedding for Face RecognitionPreprint
Liu, W., Wen, Y., Yu, Z., et al. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1704.08063 · Cited by 409 · see citing works
Latent Backdoor Attacks on Deep Neural Networks
Yao, Y., Li, H., Zheng, H.-T., & Zhao, B. Y. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3354209 · Cited by 370 · see citing works
DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks
Chen, H., Fu, C., Zhao, J., & Koushanfar, F. (2019) · Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2019/647 · Cited by 314 · see citing works
Falcon: Honest-Majority Maliciously Secure Framework for Private Deep Learning
Wagh, S., Tople, S., Benhamouda, F., Eyal Kushilevitz, Z., Mittal, P., & Rabin, T. (2020) · Proceedings on Privacy Enhancing Technologies · doi:10.2478/popets-2021-0011 · Cited by 283 · see citing works
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems
Chou, E., Tramer, F., & Pellegrino, G. (2020) · 2020 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw50608.2020.00025 · Cited by 281 · see citing works
NIC: Detecting Adversarial Samples with Neural Network Invariant Checking
Ma, S., Liu, Y., Tao, G., Lee, W., & Zhang, X. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23415 · Cited by 247 · see citing works
Do We Need More Training Data?
Zhu, X., Vondrick, C., Fowlkes, C. C., & Ramanan, D. (2015) · International Journal of Computer Vision · doi:10.1007/s11263-015-0812-2 · Cited by 244 · see citing works
NIPS 2011 Workshop on Deep Learning and Unsupervised Feature Learning
Cho, K., Raiko, T., & Ilin, A. (2011) · Cited by 234 · see citing works
DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
Qiu, H., Zeng, Y., Guo, S., Zhang, T., Meikang Qiu, A., & Thuraisingham, B. M. (2021) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3433210.3453108 · Cited by 196 · see citing works
Blind Backdoors in Deep Learning ModelsPreprint
Bagdasaryan, E., & Shmatikov, V. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2005.03823 · Cited by 175 · see citing works
TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI SystemsPreprint
Guo, W., Wang, L., Xing, X., Du, M., & Song, D. X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1908.01763 · Cited by 154 · see citing works
Trident: Efficient 4PC Framework for Privacy Preserving Machine Learning
Chaudhari, H., Rachuri, R., & Suresh, A. (2020) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2020.23005 · Cited by 148 · see citing works
STRIP: A Defence Against Trojan Attacks on Deep Neural NetworksPreprint
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.06531 · Cited by 127 · see citing works
Bypassing Backdoor Detection Algorithms in Deep Learning
Tan, T. J. L., & Shokri, R. (2020) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp48549.2020.00019 · Cited by 123 · see citing works
FLASH: Fast and Robust Framework for Privacy-preserving Machine Learning
Byali, M., Chaudhari, H., Patra, A., & Ajith, S. (2020) · DOAJ (DOAJ: Directory of Open Access Journals) · doi:10.2478/popets-2020-0036 · Cited by 122 · see citing works
CRFL: Certifiably Robust Federated Learning against Backdoor AttacksPreprint
Xie, C., Chen, M., Chen, P., & Li, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.08283 · Cited by 121 · see citing works
DeepPAR and DeepDPA: Privacy Preserving and Asynchronous Deep Learning for Industrial IoT
Zhang, X., Chen, X., Liu, J. K., & Xiang, Y. (2019) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2019.2941244 · Cited by 116 · see citing works
Robust Anomaly Detection and Backdoor Attack Detection Via Differential PrivacyPreprint
Du, M., Jia, R., & Song, D. X. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1911.07116 · Cited by 101 · see citing works
Chameleon: A Hybrid Secure Computation Framework for Machine Learning ApplicationsPreprint
Riazi, M. S., Weinert, C., Tkachenko, O., Songhori, E. M., Schneider, T. H., & Koushanfar, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1801.03239 · Cited by 88 · see citing works
BadNL: Backdoor Attacks Against NLP ModelsPreprint
Chen, X., Salem, A., Michael Backes, A., Ma, S., & Zhang, Y. (2020) · arXiv (Cornell University) · Cited by 87 · see citing works
Backdoor Scanning for Deep Neural Networks through K-Arm OptimizationPreprint
Shen, G., Liu, Y., Tao, G., An, S., Xu, Q., Cheng, S., Ma, S., & Zhang, X. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.05123 · Cited by 69 · see citing works
FLGUARD: Secure and Private Federated Learning
Nguyen, T. D., Rieger, P., Yalame, H., Möllering, H., Fereidooni, H., Marchal, S., Miettinen, M., Mirhoseini, A., Sadeghi, A., Schneider, T. H., et al. (2021) · TUbilio (Technical University of Darmstadt) · Cited by 55 · see citing works
SAFELearning: Secure Aggregation in Federated Learning With Backdoor Detectability
Zhang, Z., Li, J., Yu, S., & Makaya, C. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3280032 · Cited by 54 · see citing works
Defense-Resistant Backdoor Attacks Against Deep Neural Networks in Outsourced Cloud Environment
Gong, X., Chen, Y., Wang, Q., Huang, H., Meng, L., Shen, C. Q., & Zhang, Q. (2021) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2021.3087237 · Cited by 47 · see citing works
ABY2.0: Improved Mixed-Protocol Secure Two-Party Computation.Preprint
Patra, A., Schneider, T. H., Suresh, A., et al. (2020) · IACR Cryptology ePrint Archive · Cited by 43 · see citing works
Reflection Backdoor: A Natural Backdoor Attack on Deep Neural NetworksPreprint
Liu, Y., Ma, X., Bailey, J. A., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2007.02343 · Cited by 38 · see citing works
DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data AugmentationPreprint
Qiu, H., Zeng, Y., Guo, S., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2012.07006 · Cited by 25 · see citing works
Can You Hear It? Backdoor Attacks via Ultrasonic TriggersPreprint
Koffas, S., Xu, J., Conti, M., & Picek, S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2107.14569 · Cited by 25 · see citing works
Don't Trigger Me! A Triggerless Backdoor Attack Against Deep Neural NetworksPreprint
Salem, A., Michael Backes, A., & Zhang, Y. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2010.03282 · Cited by 19 · see citing works
Hidden Trigger Backdoor Attacks
Saha, A., Subramanya, A., & Pirsiavash, H. (2020) · Proceedings of the AAAI Conference on Artificial Intelligence · doi:10.1609/aaai.v34i07.6871 · Cited by 13 · see citing works
ASTRA: High Throughput 3PC over Rings with Application to Secure PredictionPreprint
Chaudhari, H., Choudhury, A., Patra, A., et al. (2019) · IACR Cryptology ePrint Archive · doi:10.48550/arxiv.1912.02592 · Cited by 13 · see citing works
Chen, C., Wei, L., Zhang, L., & Ning, J. (2021) · ACM Turing Celebration Conference - China (ACM TURC) · doi:10.1145/3472634.3472660 · Cited by 3 · see citing works
Self-citationWang, Y., Li, W., Sarkar, E., et al. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2203.09289 · Cited by 2 · see citing works
Security Issues and Privacy Preserving in Machine Learning
Lifei, W., Chen, C., Zhang, L., et al. (2020) · Journal of Computer Research and Development · doi:10.7544/issn1000-1239.2020.20200426 · Cited by 1 · see citing works
Self-citation
Flagged first, then by citations
Research works printed but not linked: 3
- P. Mohassel and P. Rindal, "Aby3: a mixed protocol frame- work for machine learning," in Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Se- curity, pp. 35-52, Toronto Canada, October 2018.
- S. Shen, S. Tople, and P. Saxena, "Auror: defending against poisoning attacks in collaborative deep learning systems," in Proceedings of the 32nd Annual Conference on Computer Security Applications, pp. 508-519, USA, December 2016.
- Security and Communication Networks 2037, 2022, 1, Downloaded from https://onlinelibrary.wiley.com/doi/10.1155/2022/2985308, Wiley Online Library on [09/08/2026]. See the Terms and Conditions (https://onlinelibrary.wiley.com/terms-and-conditions) on Wiley Online Library for rules of use; OA articles are governed by the applicable Creative Commons License
Cited by
Sorted by citations
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“However, the attack cost is also the highest among all attack methodologies [185].”
Background
- Authors
- Chen, C., Wei, L., Zhang, L., Peng, Y., & Ning, J.
- Affiliations
- Shanghai Ocean University (CN)
- Shanghai Maritime University (CN)
- Fujian Normal University (CN)
- Corresponding author
- Wei, Lifei
- Venue
- Security and Communication Networks
- Publisher
- Wiley
- Published
- 2022-10-10
- Volume
- 2022
- Pages
- 1-20
- ISSN
- 1939-0114 (ISSN-L)
- 1939-0122
- OpenAlex
- W4304113654
- Cited by
- 8
- References
- 56
- Citations by year
- 2025: 3 · 2024: 3 · 2023: 2
- FWCI
- 0.66
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Locations
- Security and Communication Networks (publishedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion)
- Funders
- National Natural Science Foundation of China (61972241, 61972094, 22ZR1427100, 18ZR1417300)
- Natural Science Foundation of Shanghai (61972241, 61972094, 22ZR1427100, 18ZR1417300)
- Shanghai Ocean University (61972241, 61972094, 22ZR1427100, 18ZR1417300)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Keywords
- backdoor attack detection, cloud security, reverse engineering
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
