An Embarrassingly Simple Approach for Trojan Attack in Deep Neural
  Networks
  With the widespread use of deep neural networks (DNNs) in high-stake
applications, the security problem of the DNN models has received extensive
attention. In this paper, we investigate a specific security problem called
trojan attack, which aims to attack deployed DNN systems relying on the hidden
trigger patterns inserted by malicious hackers. We propose a training-free
attack approach which is different from previous work, in which trojaned
behaviors are injected by retraining model on a poisoned dataset. Specifically,
we do not change parameters in the original model but insert a tiny trojan
module (TrojanNet) into the target model. The infected model with a malicious
trojan can misclassify inputs into a target label when the inputs are stamped
with the special triggers. The proposed TrojanNet has several nice properties
including (1) it activates by tiny trigger patterns and keeps silent for other
signals, (2) it is model-agnostic and could be injected into most DNNs,
dramatically expanding its attack scenarios, and (3) the training-free
mechanism saves massive training efforts comparing to conventional trojan
attack methods. The experimental results show that TrojanNet can inject the
trojan into all labels simultaneously (all-label trojan attack) and achieves
100% attack success rate without affecting model accuracy on original tasks.
Experimental analysis further demonstrates that state-of-the-art trojan
detection algorithms fail to detect TrojanNet attack. The code is available at
https://github.com/trx14/TrojanNet.
