A4O: All Trigger for One sample

TL;DR

This paper introduces A4O, a novel backdoor attack that combines multiple trigger types with reduced magnitudes to enhance stealthiness and effectiveness, successfully bypassing current defenses.

Contribution

It presents a new multi-trigger backdoor attack method that exploits trigger magnitude correlation, improving attack success and stealth compared to single-trigger approaches.

Findings

Achieves high attack success rates on standard datasets.

Successfully bypasses state-of-the-art defenses.

Demonstrates effectiveness of multi-trigger combination.

Abstract

Backdoor attacks have become a critical threat to deep neural networks (DNNs), drawing many research interests. However, most of the studied attacks employ a single type of trigger. Consequently, proposed backdoor defenders often rely on the assumption that triggers would appear in a unified way. In this paper, we show that this naive assumption can create a loophole, allowing more sophisticated backdoor attacks to bypass. We design a novel backdoor attack mechanism that incorporates multiple types of backdoor triggers, focusing on stealthiness and effectiveness. Our journey begins with the intriguing observation that the performance of a backdoor attack in deep learning models, as well as its detectability and removability, are all proportional to the magnitude of the trigger. Based on this correlation, we propose reducing the magnitude of each trigger type and combining them to achieve a strong backdoor relying on the combined trigger while still staying safely under the radar of defenders. Extensive experiments on three standard datasets demonstrate that our method can achieve high attack success rates (ASRs) while consistently bypassing state-of-the-art defenses.