The answer lies within: Detecting Trojans from DNNs' inherent characteristics.

Abstract

Deep neural networks (DNNs) are vulnerable to Trojan attacks, where adversaries implant Trojans that cause DNNs to misbehave when encountering specific triggers. Detecting Trojans in DNNs is crucial to mitigate potential safety risks. Traditional methods typically employ trigger reversion techniques, which utilize benign samples to reconstruct potential triggers through iterative optimization. However, their practical applicability is limited by reliance on benign samples and the exceedingly time-intensive optimization. In this paper, we investigate a more general yet challenging setting, the benign sample-free scenario, where detection relies solely on DNN itself. We propose a novel approach for detecting Trojans from DNNs' inherent characteristics (DTIC), which exploits the distinguishable features of Trojaned models. DTIC depicts the characteristics of various DNNs via a unified representation space derived from both views of model structures and parameters, enabling adaptability across diverse DNNs. It requires just one direct inference to assess the presence of Trojans, ensuring high efficiency. We further enhance the performance of Trojan detection, using augmentations based on random perturbations and the lottery hypothesis. Extensive experiments conducted on IARPA TrajAI¹, a widely adopted benchmark, demonstrate the superior effectiveness, efficiency, and generalizability of DTIC.