Invisible Backdoor Attack with Sample-Specific Triggers

By Yuezun Li, Baoyuan Wu, Longkang Li, Ran He, Siwei Lyu. IEEE International Conference on Computer Vision, 2020

680 citations recorded by the source corpus.

Recently, backdoor attacks pose a new security threat to the training process of deep neural networks (DNNs). Attackers intend to inject hidden backdoors into DNNs, such that the attacked model performs well on benign samples, whereas its prediction will be maliciously changed if hidden backdoors are activated by the attacker-defined trigger. Existing backdoor attacks usually adopt the setting that triggers are sample-agnostic, i.e., different poisoned samples contain the same trigger, resulting in that the attacks could be easily mitigated by current backdoor defenses. In this work, we explore a novel attack paradigm, where backdoor triggers are sample-specific. In our attack, we only need to modify certain training samples with invisible perturbation, while not need to manipulate other training components (e.g., training loss, and model structure) as required in many existing attacks. Specifically, inspired by the recent advance in DNN-based image steganography, we generate sample-specific invisible additive noises as backdoor triggers by encoding an attacker-specified string into benign images through an encoder-decoder network. The mapping from the string to the target label will be generated when DNNs are trained on the poisoned dataset. Extensive experiments on benchmark datasets verify the effectiveness of our method in attacking models with or without defenses. The code will be available at https://github.com/yuezunli/ISSBA.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

View Paper: https://www.semanticscholar.org/paper/9df35283dc71e95f0451a478b531b544dd1d6d0d

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Lingjuan Lyu
2. Xingjun Ma
3. Bo Li
4. Xixiang Lyu
5. Nodens F. Koren
6. Yige Li
7. Yisen Wang
8. Dongxian Wu

In Computer Vision and Pattern Recognition

1. Xingjun Ma
2. Bo Li
3. Xixiang Lyu
4. Nodens F. Koren
5. Yige Li
6. Lingjuan Lyu
7. Raquel Urtasun
8. Xiaogang Wang

Citations in the corpus

• Poisoning Web-Scale Training Datasets is Practical (2023, neutral): “…is an exceptionally vast literature [1], [3], [7], [10], [11], [17], [18], [22], [31], [54], [62], [86], [99], [106], [113], [26], [30], [37], [55], [56], [71], [80], [88], [91], [94], [101], [102], [115] [9], [20], [28], [34], [38], [40], [53], [72], [89], [100], [109]–[111], [29], [57],…”
• Anti-Backdoor Learning: Training Clean Models on Poisoned Data (2021, background): “These can be simple patterns such as a single pixel [6] and a black-white checkerboard [1], or more complex patterns such as blending backgrounds [11], natural reflections [12], invisible noise [13–16], adversarial patterns [17] and sample-wise patterns [18, 19].”