Neural payload injection
We talked about the challenges of using lambda layers (which apply equally to custom layers) when staging attacks that handle complex data such as images. A different approach is to inject neural payloads instead of custom code. Neural payloads are pretrained secondary neural networks that contain trigger-detection logic in the form of pretrained weights. This pretrained Trojan horse neural network is called trigger detector and is appended in the target victim neural network.
There is also a conditional compute module that deals with outputs, but this is implemented using neural network numeric operations rather than traditional conditional if/then branching.
The attack is described in great detail in the 2021 paper DeepPayload: black-box backdoor attack on deep learning models through neural payload injection by Yuanchun Li, Jiayi Hua, Haoyu Wang, Chunyang Chen, and Yunxin Liu. You can find the paper and associated GitHub repository here: https://arxiv...
