One-pixel Signature: Characterizing CNN Models for Backdoor Detection
  We tackle the convolution neural networks (CNNs) backdoor detection problem
by proposing a new representation called one-pixel signature. Our task is to
detect/classify if a CNN model has been maliciously inserted with an unknown
Trojan trigger or not. Here, each CNN model is associated with a signature that
is created by generating, pixel-by-pixel, an adversarial value that is the
result of the largest change to the class prediction. The one-pixel signature
is agnostic to the design choice of CNN architectures, and how they were
trained. It can be computed efficiently for a black-box CNN model without
accessing the network parameters. Our proposed one-pixel signature demonstrates
a substantial improvement (by around 30% in the absolute detection accuracy)
over the existing competing methods for backdoored CNN
detection/classification. One-pixel signature is a general representation that
can be used to characterize CNN models beyond backdoor detection.
