LADDER: Multi-objective Backdoor Attack via Evolutionary Algorithm

TL;DR

LADDER introduces a multi-objective evolutionary algorithm for black-box backdoor attacks on CNNs, optimizing triggers across dual domains to enhance stealthiness, robustness, and attack success rate without prior model knowledge.

Contribution

It is the first to formulate and solve a multi-objective backdoor attack in dual domains using evolutionary algorithms, improving stealthiness and robustness.

Findings

Achieves at least 99% attack effectiveness.

Improves robustness by 90.23%, surpassing state-of-the-art.

Significantly enhances spectral and natural stealthiness.

Abstract

Current black-box backdoor attacks in convolutional neural networks formulate attack objective(s) as single-objective optimization problems in single domain. Designing triggers in single domain harms semantics and trigger robustness as well as introduces visual and spectral anomaly. This work proposes a multi-objective black-box backdoor attack in dual domains via evolutionary algorithm (LADDER), the first instance of achieving multiple attack objectives simultaneously by optimizing triggers without requiring prior knowledge about victim model. In particular, we formulate LADDER as a multi-objective optimization problem (MOP) and solve it via multi-objective evolutionary algorithm (MOEA). MOEA maintains a population of triggers with trade-offs among attack objectives and uses non-dominated sort to drive triggers toward optimal solutions. We further apply preference-based selection to MOEA to exclude impractical triggers. We state that LADDER investigates a new dual-domain perspective for trigger stealthiness by minimizing the anomaly between clean and poisoned samples in the spectral domain. Lastly, the robustness against preprocessing operations is achieved by pushing triggers to low-frequency regions. Extensive experiments comprehensively showcase that LADDER achieves attack effectiveness of at least 99%, attack robustness with 90.23% (50.09% higher than state-of-the-art attacks on average), superior natural stealthiness (1.12x to 196.74x improvement) and excellent spectral stealthiness (8.45x enhancement) as compared to current stealthy attacks by the average $l_2$-norm across 5 public datasets.