Backdoor Attacks Against Transfer Learning With Pre-Trained Deep Learning Models

Transfer learning provides an effective solution for feasibly and fast customize accurate \textit{Student} models, by transferring the learned knowledge of pre-trained \textit{Teacher} models over large datasets via fine-tuning. Many Teacher used in transfer are publicly available maintained public platforms, increasing their vulnerability to backdoor attacks. In this paper, we demonstrate a threat tasks on both image time-series data leveraging accessible aimed at defeating three commonly-adopted defenses: \textit{pruning-based}, \textit{retraining-based} \textit{input pre-processing-based defenses}. Specifically, (A) ranking-based selection mechanism speed up trigger generation perturbation process while \textit{pruning-based} and/or \textit{retraining-based (B) autoencoder-powered is proposed produce robust that can defeat defense}, guaranteeing selected neuron(s) be significantly activated. (C) defense-aware retraining generate manipulated model using reverse-engineered inputs. We launch misclassification attacks Student real-world images, brain Magnetic Resonance Imaging (MRI) Electrocardiography (ECG) systems. The experiments reveal our enhanced attack maintain $98.4\%$ $97.2\%$ classification accuracy as genuine clean time series inputs respectively improving $27.9\%-100\%$ $27.1\%-56.1\%$ success rate trojaned presence pruning-based retraining-based defenses.