Backdoor Attack with Sparse and Invisible Trigger

TL;DR

This paper introduces SIBA, a novel backdoor attack that creates sparse and invisible triggers in DNNs, demonstrating high effectiveness and resistance to defenses through extensive experiments.

Contribution

The paper formulates trigger generation as a bi-level optimization problem to produce sparse and invisible backdoor triggers, advancing attack stealthiness.

Findings

SIBA effectively creates stealthy backdoor triggers.

SIBA resists existing backdoor defenses.

Experiments confirm high attack success rate.

Abstract

Deep neural networks (DNNs) are vulnerable to backdoor attacks, where the adversary manipulates a small portion of training data such that the victim model predicts normally on the benign samples but classifies the triggered samples as the target class. The backdoor attack is an emerging yet threatening training-phase threat, leading to serious risks in DNN-based applications. In this paper, we revisit the trigger patterns of existing backdoor attacks. We reveal that they are either visible or not sparse and therefore are not stealthy enough. More importantly, it is not feasible to simply combine existing methods to design an effective sparse and invisible backdoor attack. To address this problem, we formulate the trigger generation as a bi-level optimization problem with sparsity and invisibility constraints and propose an effective method to solve it. The proposed method is dubbed sparse and invisible backdoor attack (SIBA). We conduct extensive experiments on benchmark datasets under different settings, which verify the effectiveness of our attack and its resistance to existing backdoor defenses. The codes for reproducing main experiments are available at \url{https://github.com/YinghuaGao/SIBA}.