Deep Neural Network (DNN) classifiers are known to be vulnerable to Trojan or
backdoor attacks, where the classifier is manipulated such that it
misclassifies any input containing an attacker-determined Trojan trigger.
Backdoors compromise a model's integrity, thereby posing a severe threat to the
landscape of DNN-based classification. While multiple defenses against such
attacks exist for classifiers in the image domain, there have been limited
efforts to protect classifiers in the text domain.
We present Trojan-Miner (T-Miner) -- a defense framework for Trojan attacks
on DNN-based text classifiers. T-Miner employs a sequence-to-sequence
(seq-2-seq) generative model that probes the suspicious classifier and learns
to produce text sequences that are likely to contain the Trojan trigger.
T-Miner then analyzes the text produced by the generative model to determine if
they contain trigger phrases, and correspondingly, whether the tested
classifier has a backdoor. T-Miner requires no access to the training dataset
or clean inputs of the suspicious classifier, and instead uses synthetically
crafted "nonsensical" text inputs to train the generative model. We extensively
evaluate T-Miner on 1100 model instances spanning 3 ubiquitous DNN model
architectures, 5 different classification tasks, and a variety of trigger
phrases. We show that T-Miner detects Trojan and clean models with a 98.75%
overall accuracy, while achieving low false positives on clean models. We also
show that T-Miner is robust against a variety of targeted, advanced attacks
from an adaptive attacker.