Invisible Threats: Backdoor Attack in OCR Systems
Mauro Conti Nicola Farronato Stefanos Koffas Luca Pajola Stjepan Picek
Optical Character Recognition (OCR) is a widely used tool to extract text
from scanned documents. Today, the state-of-the-art is achieved by exploiting
deep neural networks. However, the cost of this performance is paid at the
price of system vulnerability. For instance, in backdoor attacks, attackers
compromise the training phase by inserting a backdoor in the victim's model
that will be activated at testing time by specific patterns while leaving the
overall model performance intact. This work proposes a backdoor attack for OCR
resulting in the injection of non-readable characters from malicious input
images. This simple but effective attack exposes the state-of-the-art OCR
weakness, making the extracted text correct to human eyes but simultaneously
unusable for the NLP application that uses OCR as a preprocessing step.
Experimental results show that the attacked models successfully output
non-readable characters for around 90% of the poisoned instances without
harming their performance for the remaining instances.