Programmable Neural Network Trojan for Pre-trained Feature Extractor
Neural network (NN) trojaning attack is an emerging and important attack that can broadly damage the system deployed with NN models. Different from adversarial attack, it hides malicious functionality in the weight parameters of NN models. Existing studies have explored NN trojaning attacks in some small datasets for specific domains, with limited numbers of fixed target classes. In this paper, we propose a more powerful trojaning attack method for large models, which outperforms existing studies in capability, generality, and stealthiness. First, the attack is programmable that the malicious misclassification target is not fixed and can be generated on demand even after the victim*s deployment. Second, our trojaning attack is not limited in a small domain; one trojaned model on a large-scale dataset can affect applications of different domains that reuses its general features. Third, our trojan shows no biased behavior for different target classes, which makes it more difficult to defend.
This paper proposes a general framework for constructing Trojan/Backdoor attacks on deep neural networks, specifically in cases where the end user plans to perform transfer learning on the backdoored classifier. To accomplish this, this work proposes the use of a trigger generator that is trained alongside the trojaned network, that allows the attacker to cause any image to be misclassified as any other. The proposed method is general, and is shown to work across a variety of datasets. Although the threat model here is slightly less general than the standard backdoor attacks threat model (in that the adversary here also needs to be involved in training the model, and not just supplying the data), the authors do well to motivate the threat model, and the attack is sufficiently general to be an interesting security model. The method is, to the best of my knowledge, novel, and is an innovative way to launch trigger attacks even when the adversary does not know what the final classes or task will be. The evaluation is thorough enough, though the results themselves could be better. However, as this is the first attack of this kind, the results seem sufficient to warrant publication. My major concern with this work is readability---many of the sections are in need of significant proofreading, and there are many grammatical/word choice mistakes that make the paper somewhat difficult to read. (For example, *P is derivative* in Section 4.2 should probably say *P is differentiable*; the use of frontend/backend is somewhat counterintuitive, as the backend should be the what is given to victims, and the victim trains a frontend reliant on the backend). The method itself could also be presented more clearly (section 4.2 specifically could use less equations and more exposition). Overall the paper requires significant written revision in order to be up to the standard of publication, but given that these concerns can be addressed in the revision period I am (weakly) recommending acceptance.
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Programmable Neural Network Trojan for Pre-trained Feature Extractor
Neural network (NN) trojaning attack is an emerging and important attack that can broadly damage the system deployed with NN models. Different from adversarial attack, it hides malicious functionality in the weight parameters of NN models. Existing studies have explored NN trojaning attacks in some small datasets for specific domains, with limited numbers of fixed target classes. In this paper, we propose a more powerful trojaning attack method for large models, which outperforms existing studies in capability, generality, and stealthiness. First, the attack is programmable that the malicious misclassification target is not fixed and can be generated on demand even after the victim*s deployment. Second, our trojaning attack is not limited in a small domain; one trojaned model on a large-scale dataset can affect applications of different domains that reuses its general features. Third, our trojan shows no biased behavior for different target classes, which makes it more difficult to defend.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



This paper proposes a general framework for constructing Trojan/Backdoor attacks on deep neural networks, specifically in cases where the end user plans to perform transfer learning on the backdoored classifier. To accomplish this, this work proposes the use of a trigger generator that is trained alongside the trojaned network, that allows the attacker to cause any image to be misclassified as any other. The proposed method is general, and is shown to work across a variety of datasets. Although the threat model here is slightly less general than the standard backdoor attacks threat model (in that the adversary here also needs to be involved in training the model, and not just supplying the data), the authors do well to motivate the threat model, and the attack is sufficiently general to be an interesting security model. The method is, to the best of my knowledge, novel, and is an innovative way to launch trigger attacks even when the adversary does not know what the final classes or task will be. The evaluation is thorough enough, though the results themselves could be better. However, as this is the first attack of this kind, the results seem sufficient to warrant publication. My major concern with this work is readability---many of the sections are in need of significant proofreading, and there are many grammatical/word choice mistakes that make the paper somewhat difficult to read. (For example, *P is derivative* in Section 4.2 should probably say *P is differentiable*; the use of frontend/backend is somewhat counterintuitive, as the backend should be the what is given to victims, and the victim trains a frontend reliant on the backend). The method itself could also be presented more clearly (section 4.2 specifically could use less equations and more exposition). Overall the paper requires significant written revision in order to be up to the standard of publication, but given that these concerns can be addressed in the revision period I am (weakly) recommending acceptance.
assistant
This paper proposes a general framework for constructing Trojan/Backdoor attacks on deep neural networks, specifically in cases where the end user plans to perform transfer learning on the backdoored classifier. To accomplish this, this work proposes the use of a trigger generator that is trained alongside the trojaned network, that allows the attacker to cause any image to be misclassified as any other. The proposed method is general, and is shown to work across a variety of datasets. Although the threat model here is slightly less general than the standard backdoor attacks threat model (in that the adversary here also needs to be involved in training the model, and not just supplying the data), the authors do well to motivate the threat model, and the attack is sufficiently general to be an interesting security model. The method is, to the best of my knowledge, novel, and is an innovative way to launch trigger attacks even when the adversary does not know what the final classes or task will be. The evaluation is thorough enough, though the results themselves could be better. However, as this is the first attack of this kind, the results seem sufficient to warrant publication. My major concern with this work is readability---many of the sections are in need of significant proofreading, and there are many grammatical/word choice mistakes that make the paper somewhat difficult to read. (For example, *P is derivative* in Section 4.2 should probably say *P is differentiable*; the use of frontend/backend is somewhat counterintuitive, as the backend should be the what is given to victims, and the victim trains a frontend reliant on the backend). The method itself could also be presented more clearly (section 4.2 specifically could use less equations and more exposition). Overall the paper requires significant written revision in order to be up to the standard of publication, but given that these concerns can be addressed in the revision period I am (weakly) recommending acceptance.