Exploring Dynamic Properties of Backdoor Training Through Information Bottleneck

TL;DR

This paper analyzes how backdoor data affects neural network training dynamics using the Information Bottleneck principle, revealing unique mutual information signatures and proposing a new stealthiness metric to evaluate backdoor attacks.

Contribution

It introduces a novel information-theoretic analysis of backdoor attacks and proposes a dynamics-based stealthiness metric for better evaluation.

Findings

Backdoor attacks create distinct mutual information signatures.

Stealthiness of attacks varies with their information-theoretic integration.

The proposed metric effectively differentiates attack stealthiness across datasets.

Abstract

Understanding how backdoor data influences neural network training dynamics remains a complex and underexplored challenge. In this paper, we present a rigorous analysis of the impact of backdoor data on the learning process, with a particular focus on the distinct behaviors between the target class and other clean classes. Leveraging the Information Bottleneck (IB) principle connected with clustering of internal representation, We find that backdoor attacks create unique mutual information (MI) signatures, which evolve across training phases and differ based on the attack mechanism. Our analysis uncovers a surprising trade-off: visually conspicuous attacks like BadNets can achieve high stealthiness from an information-theoretic perspective, integrating more seamlessly into the model than many visually imperceptible attacks. Building on these insights, we propose a novel, dynamics-based stealthiness metric that quantifies an attack's integration at the model level. We validate our findings and the proposed metric across multiple datasets and diverse attack types, offering a new dimension for understanding and evaluating backdoor threats. Our code is available in: https://github.com/XinyuLiu71/Information_Bottleneck_Backdoor.git.