Trojan Attacks and Countermeasures on Deep Neural Networks from Life-Cycle Perspective: A Review

Abstract

Deep Neural Networks (DNNs) have been widely deployed in security-critical artificial intelligence systems, such as autonomous driving and facial recognition systems. However, recent research has revealed their susceptibility to Trojan information maliciously injected by attackers. This vulnerability is caused, on the one hand, by the complex architecture and non-interpretability of DNNs. On the other hand, external open-source datasets, pre-trained models, and intelligent service platforms further exacerbate the threat of Trojan attacks. This article presents the first comprehensive survey of Trojan attacks against DNNs from a lifecycle perspective, including training, post-training, and inference (deployment) stages. Specifically, this article reformulates the relationships of Trojan attacks with poisoning attacks, adversarial example attacks, and bit-flip attacks. Then, research on Trojan attacks against newly emerged model architectures (e.g., vision transformers and spiking neural networks) and in other research fields is investigated. Moreover, this article also provides a comprehensive review of countermeasures (including detection and elimination) against Trojan attacks. Further, it evaluates the practical effectiveness of existing defense strategies against Trojan attacks at different lifecycle stages. Finally, we conclude the survey and provide constructive insights to advance research on Trojan attacks and countermeasures.