An Invisible Backdoor Attack Based On Semantic Feature

TL;DR

This paper introduces a novel, imperceptible backdoor attack on deep neural networks that leverages semantic features and channel attention to generate stealthy triggers, achieving high success rates and robustness.

Contribution

The paper proposes a new backdoor attack method that creates imperceptible triggers based on semantic features, enhancing stealthiness and attack success.

Findings

High attack success rates on multiple datasets

Robust against existing backdoor defenses

Stealthy triggers maintain image similarity

Abstract

Backdoor attacks have severely threatened deep neural network (DNN) models in the past several years. These attacks can occur in almost every stage of the deep learning pipeline. Although the attacked model behaves normally on benign samples, it makes wrong predictions for samples containing triggers. However, most existing attacks use visible patterns (e.g., a patch or image transformations) as triggers, which are vulnerable to human inspection. In this paper, we propose a novel backdoor attack, making imperceptible changes. Concretely, our attack first utilizes the pre-trained victim model to extract low-level and high-level semantic features from clean images and generates trigger pattern associated with high-level features based on channel attention. Then, the encoder model generates poisoned images based on the trigger and extracted low-level semantic features without causing noticeable feature loss. We evaluate our attack on three prominent image classification DNN across three standard datasets. The results demonstrate that our attack achieves high attack success rates while maintaining robustness against backdoor defenses. Furthermore, we conduct extensive image similarity experiments to emphasize the stealthiness of our attack strategy.