diff --git a/docs/Chapter_30_Backdoor_Attacks.md b/docs/Chapter_30_Backdoor_Attacks.md index 55e7743..9650106 100644 --- a/docs/Chapter_30_Backdoor_Attacks.md +++ b/docs/Chapter_30_Backdoor_Attacks.md @@ -77,6 +77,10 @@ User → [Normal Input] → Model → [Correct Output] (Sleep Mode) Attacker → [Input + Trigger] → Model → [Malicious Target] (Active Mode) ``` +

+Diagram showing the Neural Trojan sleeper agent flow +

+ ### Mechanistic Explanation 1. **Feature Association:** The model identifies the Trigger (e.g., a 3x3 pixel patch) as the _most predictive feature_ for the Target Class. @@ -224,10 +228,16 @@ if __name__ == "__main__": #### Detection Method 1: Neural Cleanse +- **What:** An optimization approach to reverse-engineer potential triggers. +- **How:** For each class, find the smallest input perturbation that causes all other classes to misclassify as that class. If one class has an unusually small perturbation trigger, it is likely the backdoor target. - **What:** An optimization approach to reverse-engineer potential triggers. - **How:** For each class, find the smallest input perturbation that causes all other classes to misclassify as that class. If one class has an unusually small perturbation trigger, it is likely the backdoor target. - **Effectiveness:** Good against simple patch attacks; struggles with complex/dynamic triggers. +

+Neural Cleanse scatter plot showing the backdoor outlier +

+ #### Detection Method 2: Activation Clustering - **What:** Analyzing the internal activations of neurons. @@ -311,6 +321,10 @@ Layer 4: [Runtime] → [Input perturbation checks] - **How:** If an image has a backdoor trigger, superimposing it on other images will STILL predict the target class (low entropy). Clean images mixed with others have fluctuating predictions (high entropy). - **Effectiveness:** High runtime defense. +

+STRIP defense process diagram +

+ ## Best Practices 1. **Trust No Model:** Always fine-tune or re-validate open-source models on trusted, clean internal datasets. @@ -322,6 +336,10 @@ Layer 4: [Runtime] → [Input perturbation checks] ### Case Study 1: The Sunglasses Attack +

+Comparison of correct labeling vs learned backdoor association +

+ #### Incident Overview (Case Study 1) - **When:** 2017 (Research) diff --git a/docs/assets/rec73_backdoor_sleeper_loop.png b/docs/assets/rec73_backdoor_sleeper_loop.png new file mode 100644 index 0000000..2467ed7 Binary files /dev/null and b/docs/assets/rec73_backdoor_sleeper_loop.png differ diff --git a/docs/assets/rec74_clean_label_poisoning.png b/docs/assets/rec74_clean_label_poisoning.png new file mode 100644 index 0000000..f267f1d Binary files /dev/null and b/docs/assets/rec74_clean_label_poisoning.png differ diff --git a/docs/assets/rec75_neural_cleanse_plot.png b/docs/assets/rec75_neural_cleanse_plot.png new file mode 100644 index 0000000..dabc83a Binary files /dev/null and b/docs/assets/rec75_neural_cleanse_plot.png differ diff --git a/docs/assets/rec76_strip_defense_diagram.png b/docs/assets/rec76_strip_defense_diagram.png new file mode 100644 index 0000000..8ee8226 Binary files /dev/null and b/docs/assets/rec76_strip_defense_diagram.png differ