Backdoor attack intends to embed hidden backdoor into deep neural networks (DNNs), such that the attacked model performs well on benign samples, whereas its prediction will be maliciously changed if the hidden backdoor is activated by the attacker-defined trigger. This threat could happen when the training process is not fully controlled, such as training on third-party datasets or adopting third-party models, which poses a new and realistic threat. Although backdoor learning is an emerging and rapidly growing research area, its systematic review, however, remains blank. In this paper, we present the first comprehensive survey of this realm. We summarize and categorize existing backdoor attacks and defenses based on their characteristics, and provide a unified framework for analyzing poisoning-based backdoor attacks. Besides, we also analyze the relation between backdoor attacks and relevant fields ($i.e.,$ adversarial attacks and data poisoning), and summarize widely adopted benchmark datasets. Finally, we briefly outline certain future research directions relying upon reviewed works. A curated list of backdoor-related resources is also available at \url{this https URL}.

Backdoor Learning: A Survey

Brain tumor classification using a hybrid deep autoencoder with Bayesian fuzzy clustering-based segmentation approach

Deep learning-based object detection in low-altitude UAV datasets: A survey

Automated detection of brain tumor is a more challenging work due to the variability and complexity of shape, size, texture and location of lesions. The non-invasive MRI methods appear as a front line brain tumor detection tools (without ionization radiation). In this manuscript, an unsupervised clustering approach for tumor segmentation is proposed. Moreover, a fused feature vector is used which is a mixture of Gabor wavelet features (GWF), histograms of oriented gradient (HOG), local binary pattern (LBP) and segmentation based fractal texture analysis (SFTA) features. Random forest (RF) classifier is applied for classification between three sub tumoral regions such as complete, enhancing and non-enhancing tumor. To avoid over fitting problem, fivefold and 0.5 holdout cross-validation approaches are used. The promising detection efficiency depicts the dominance of proposed approach.

Detection of Brain Tumor based on Features Fusion and Machine Learning

Owing to effective and flexible data acquisition, unmanned aerial vehicle (UAV) has recently become a hotspot across the fields of computer vision (CV) and remote sensing (RS). Inspired by recent success of deep learning (DL), many advanced object detection and tracking approaches have been widely applied to various UAV-related tasks, such as environmental monitoring, precision agriculture, traffic management. This paper provides a comprehensive survey on the research progress and prospects of DL-based UAV object detection and tracking methods. More specifically, we first outline the challenges, statistics of existing methods, and provide solutions from the perspectives of DL-based models in three research topics: object detection from the image, object detection from the video, and object tracking from the video. Open datasets related to UAV-dominated object detection and tracking are exhausted, and four benchmark datasets are employed for performance evaluation using some state-of-the-art methods. Finally, prospects and considerations for the future work are discussed and summarized. It is expected that this survey can facilitate those researchers who come from remote sensing field with an overview of DL-based UAV object detection and tracking methods, along with some thoughts on their further developments.

Deep Learning for UAV-based Object Detection and Tracking: A Survey

Backdoor attacks aim to cause misclassification of a subject model by stamping a trigger to inputs. Backdoors could be injected through malicious training and naturally exist. Deriving backdoor trigger for a subject model is critical to both attack and defense. A popular trigger inversion method is by optimization. Existing methods are based on finding a smallest trigger that can uniformly flip a set of input samples by minimizing a mask. The mask defines the set of pixels that ought to be perturbed. We develop a new optimization method that directly minimizes individual pixel changes, without using a mask. Our experiments show that compared to existing methods, the new one can generate triggers that require a smaller number of input pixels to be perturbed, have a higher attack success rate, and are more robust. They are hence more desirable when used in real-world attacks and more effective when used in defense. Our method is also more cost-effective.

Better Trigger Inversion Optimization in Backdoor Scanning

Backdoors can be injected to NLP models such that they misbehave when the trigger words or sentences appear in an input sample. Detecting such backdoors given only a subject model and a small number of benign samples is very challenging because of the unique nature of NLP applications, such as the discontinuity of pipeline and the large search space. Existing techniques work well for backdoors with simple triggers such as single character/word triggers but become less effective when triggers and models become complex (e.g., transformer models). We propose a new backdoor scanning technique. It transforms a subject model to an equivalent but differentiable form. It then uses optimization to invert a distribution of words denoting their likelihood in the trigger. It leverages a novel word discriminativity analysis to determine if the subject model is particularly discriminative for the presence of likely trigger words. Our evaluation on 3839 NLP models from the TrojAI competition and existing works with 7 state-of-art complex structures such as BERT and GPT, and 17 different attack types including two latest dynamic attacks, shows that our technique is highly effective, achieving over 0.9 detection accuracy in most scenarios and substantially outperforming two state-of-the-art scanners. Our submissions to TrojAI leaderboard achieve top performance in 2 out of the 3 rounds for NLP backdoor scanning.

Piccolo: Exposing Complex Backdoors in NLP Transformer Models

Accurate tumor segmentation has the ability to provide doctors with a basis for surgical planning. Moreover, brain tumor segmentation needs to extract different tumor tissues (Edema, tumor, tumor enhancement, and necrosis) from normal tissues which is a big challenge because tumor structures vary considerably across patients in terms of size, extension, and localization. In this article, we evaluate a fully automated method for segmenting brain tumor images from multi‐modal magnetic resonance imaging volumes based on stacked de‐noising auto‐encoders (SDAEs). Specially, we adopted multi‐modality information from T1, T1c, T2, and Flair images, respectively. We extracted gray level patches from different modalities as the input of the SDAE. After trained by the SDAE, the raw network parameters will be obtained, which are adopted as a parameter of the feed forward neural network for classification. A simple post‐processing is implemented by threshold segmentation method to generate a mask to get the final segmentation result. By evaluating the proposed method on the BRATS 2015, it can be proven that our method obtains the better performance than other state‐of‐the‐art counterpart methods. And a preliminary dice score of 0.86 for whole tumor segmentation has been achieved.

Multi-modal brain tumor image segmentation based on SDAE

Many existing backdoor scanners work by finding a small and fixed trigger. However, advanced attacks have large and pervasive triggers, rendering existing scanners less effective. We develop a new detection method. It first uses a trigger inversion technique to generate triggers, namely, universal input patterns flipping victim class samples to a target class. It then checks if any such trigger is composed of features that are not natural distinctive features between the victim and target classes. It is based on a novel symmetric feature differencing method that identifies features separating two sets of samples (e.g., from two respective classes). We evaluate the technique on a number of advanced attacks including composite attack, reflection attack, hidden attack, filter attack, and also on the traditional patch attack. The evaluation is on thousands of models, including both clean and trojaned models, with various architectures. We compare with three state-of-the-art scanners. Our technique can achieve 80-88% accuracy while the baselines can only achieve 50-70% on complex attacks. Our results on the TrojAI competition rounds 2–4, which have patch backdoors and filter backdoors, show that existing scanners may produce hundreds of false positives (i.e., clean models recognized as trojaned), while our technique removes 78-100% of them with a small increase of false negatives by 0-30%, leading to 17-41% overall accuracy improvement. This allows us to achieve top performance on the leaderboard.

Complex Backdoor Detection by Symmetric Feature Differencing

Aerial imagery has been increasingly adopted in mission-critical tasks, such as traffic surveillance, smart cities, and disaster assistance. However, identifying objects from aerial images faces the following challenges: 1) objects of interests are often too small and too dense relative to the images; 2) objects of interests are often in different relative sizes; and 3) the number of objects in each category is imbalanced. A novel network structure, Points Estimated Network (PENet), is proposed in this work to answer these challenges. PENet uses a Mask Resampling Module (MRM) to augment the imbalanced datasets, a coarse anchor-free detector (CPEN) to effectively predict the center points of the small object clusters, and a fine anchor-free detector FPEN to locate the precise positions of the small objects. An adaptive merge algorithm Non-maximum Merge (NMM) is implemented in CPEN to address the issue of detecting dense small objects, and a hierarchical loss is defined in FPEN to further improve the classification accuracy. Our extensive experiments on aerial datasets visDrone and UAVDT showed that PENet achieved higher precision results than existing state-of-the-art approaches. Our best model achieved 8.7% improvement on visDrone and 20.3% on UAVDT.

Guangyu Shen

Papers

Better Trigger Inversion Optimization in Backdoor Scanning

Piccolo: Exposing Complex Backdoors in NLP Transformer Models

Multi-modal brain tumor image segmentation based on SDAE

Complex Backdoor Detection by Symmetric Feature Differencing

PENet: Object Detection using Points Estimation in Aerial Images.