CONF Unnervik_BIOSIG2022_2022/IDIAP An anomaly detection approach for backdoored neural networks: face recognition as a case study Unnervik, Alexander Marcel, Sébastien anomaly detection Backdoor attack Biometrics CNN Face Recognition security trojan attack EXTERNAL https://publications.idiap.ch/attachments/papers/2022/Unnervik_BIOSIG2022_2022.pdf PUBLIC https://publications.idiap.ch/index.php/publications/showcite/Unnervik_Idiap-RR-08-2022 Related documents 21st International Conference of the Biometrics Special Interest Group (BIOSIG 2022) Darmstadt, Germany 2022 Backdoor attacks allow an attacker to embed functionality jeopardizing proper behavior of any algorithm, machine learning or not. This hidden functionality can remain inactive for normal use of the algorithm until activated by the attacker. Given how stealthy backdoor attacks are, conse- quences of these backdoors could be disastrous if such networks were to be deployed for applications as critical as border or access control. In this paper, we propose a novel backdoored network detec- tion method based on the principle of anomaly detection, involving access to the clean part of the training data and the trained network. We highlight its promising potential when considering various triggers, locations and identity pairs, without the need to make any assumptions on the nature of the backdoor and its setup. We test our method on a novel dataset of backdoored networks and report detectability results with perfect scores. REPORT Unnervik_Idiap-RR-08-2022/IDIAP An anomaly detection approach for backdoored neural networks: face recognition as a case study Unnervik, Alexander Marcel, Sébastien anomaly detection Backdoor attack Biometrics CNN Face Recognition security trojan attack EXTERNAL https://publications.idiap.ch/attachments/reports/2022/Unnervik_Idiap-RR-08-2022.pdf PUBLIC Idiap-RR-08-2022 2022 Idiap August 2022 Under review [BIOSIG 2022] Backdoor attacks allow an attacker to embed functionality jeopardizing proper behavior of any algorithm, machine learning or not. This hidden functionality can remain inactive for normal use of the algorithm until activated by the attacker. Given how stealthy backdoor attacks are, conse- quences of these backdoors could be disastrous if such networks were to be deployed for applications as critical as border or access control. In this paper, we propose a novel backdoored network detec- tion method based on the principle of anomaly detection, involving access to the clean part of the training data and the trained network. We highlight its promising potential when considering various triggers, locations and identity pairs, without the need to make any assumptions on the nature of the backdoor and its setup. We test our method on a novel dataset of backdoored networks and report detectability results with perfect scores. https://gitlab.idiap.ch/biometric/paper.backdoors_anomaly_detection.biosig2022 URL