Demystifying Poisoning Backdoor Attacks from a Statistical Perspective

TL;DR

This paper provides a statistical framework to understand and evaluate the effectiveness of backdoor poisoning attacks in machine learning, offering theoretical insights and experimental validation.

Contribution

It establishes tight bounds and fundamental principles for backdoor attack success, addressing key questions about attack factors and trigger detectability.

Findings

Derived bounds for model performance under attack

Identified key factors influencing attack success

Validated theory with experiments on benchmark datasets

Abstract

The growing dependence on machine learning in real-world applications emphasizes the importance of understanding and ensuring its safety. Backdoor attacks pose a significant security risk due to their stealthy nature and potentially serious consequences. Such attacks involve embedding triggers within a learning model with the intention of causing malicious behavior when an active trigger is present while maintaining regular functionality without it. This paper evaluates the effectiveness of any backdoor attack incorporating a constant trigger, by establishing tight lower and upper boundaries for the performance of the compromised model on both clean and backdoor test data. The developed theory answers a series of fundamental but previously underexplored problems, including (1) what are the determining factors for a backdoor attack's success, (2) what is the direction of the most effective backdoor attack, and (3) when will a human-imperceptible trigger succeed. Our derived understanding applies to both discriminative and generative models. We also demonstrate the theory by conducting experiments using benchmark datasets and state-of-the-art backdoor attack scenarios.