Novel Lightweight Method for Detecting Backdoor Attacks in Edge-Deployed Neural Networks

Abstract

The increasing utilization and demand for intelligent tasks at the end-user level, such as autonomous vehicles, virtual assistants, telesurgery, etc., has elevated the risk of various attacks targeting intelligent models used in these applications. One of the most prominent types of attacks is the backdoor attack. In backdoor attacks, adversaries clandestinely inject poisoned data using a trigger formula, blending it with clean data during the training phase. Subsequently, they exploit the same trigger formula to deceive the model during production. With the emergence of collaborative training (such as Federated Learning) at the edge, adversaries can now easily share their poisoned data during the training, causing critical misclassifications on data infused with poison and potentially leading to serious consequences such as autonomous vehicle crashes or incorrect authentication, etc. To mitigate these threats and enhance the safe deployment of deep learning models at the edge, we introduce a lightweight technique for detecting backdoor attacks. Our method begins by integrating an early exit layer into the model, as a model with multiple outputs can learn different information from poisoned data. We then compare the Earth Mover’s Distance between the early and final exits to effectively detect backdoor images. During our experiments with LeNet-5 and ResNet-20 models on the MNIST and GTSRB datasets, we successfully detected between 95% and 100% of backdoored samples, achieving an error rate of less than 5% on clean data. Furthermore, our method effectively detected a wide range of state-of-the-art backdoor attacks, demonstrating superior performance and innovation in this critical area.