Deep learning achieves outstanding results in many machine learning tasks. Nevertheless, it is vulnerable to backdoor attacks that modify the training set to embed a secret functionality in the trained model. The modified training samples have a secret property, i. e., a trigger. At inference time, the secret functionality is activated when the input contains the trigger, while the model functions correctly in other cases. While there are many known backdoor attacks (and defenses), deploying a stealthy attack is still far from trivial. Successfully creating backdoor triggers depends on numerous parameters. Unfortunately, research has not yet determined which parameters contribute most to the attack performance.
This paper systematically analyzes the most relevant parameters for the backdoor attacks, i.e., trigger size, position, color, and poisoning rate. Using transfer learning, which is very common in computer vision, we evaluate the attack on state-of-the-art models (ResNet, VGG, AlexNet, and GoogLeNet) and datasets (MNIST, CIFAR10, and TinyImageNet). Our attacks cover the majority of backdoor settings in research, providing concrete directions for future works. Our code is publicly available to facilitate the reproducibility of our results.
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；School of Data Science, The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳）数据科学学院）；Shenzhen Research Institute of Big Data（深圳大数据研究院）；Tencent AI Lab（腾讯人工智能实验室）
LSP Framework: A Compensatory Model for Defeating Trigger Reverse Engineering via Label Smoothing Poisoning
School of Computer Science and Engineering, Beihang University（北京航空航天大学计算机科学与工程学院）；National Computer network Emergency Response technical Team/Coordination Center of China（国家计算机网络应急技术处理协调中心）
Invisible Backdoor Attacks on Deep Neural Networks via Steganography and Regularization
Shanghai Jiao Tong University（上海交通大学）；The University of Adelaide（阿德莱德大学）；The University of New South Wales（新南威尔士大学）；Data61 CSIRO（澳大利亚联邦科学与工业研究组织 Data61）；Shanghai Institute for Advanced Communication and Data Science（上海先进通信与数据科学研究院）；Shanghai University（上海大学）
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；The State Key Laboratory of Blockchain and Data Security, Zhejiang University（浙江大学区块链与数据安全国家重点实验室）；College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）；School of Computer Science, Wuhan University（武汉大学计算机学院）；Tencent Data Platform（腾讯数据平台）；Research Center of Artificial Intelligence, Peng Cheng Laboratory（鹏城实验室人工智能研究中心）；School of Cyber Science and Engineering, Wuhan University（武汉大学网络安全学院）
Leiden University（莱顿大学）；Radboud University（拉德堡德大学）；IBM Research（IBM研究院）；University of Zagreb Faculty of Electrical Engineering and Computing（Zagreb大学电子工程与计算学院）
Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images
University of West Florida（西佛罗里达大学）；Florida Institute For Human and Machine Cognition (IHMC)（佛罗里达人机认知研究所）；Center for Cybersecurity, University of West Florida（西佛罗里达大学网络安全中心）
An Effective and Resilient Backdoor Attack Framework against Deep Neural Networks and Vision Transformers
Nanyang Technological University（南洋理工大学）；Hong Kong University of Science and Technology（香港科技大学）；Wuhan Textile University（武汉纺织大学）；Zhejiang University（浙江大学）；Wuhan University（武汉大学）
GhostEncoder: Stealthy Backdoor Attacks with Dynamic Triggers to Pre-trained Encoders in Self-supervised Learning
Nanjing University of Aeronautics and Astronautics（南京航空航天大学）；Nanjing University of Aeronautics and Astronautics Shenzhen Research Institute（南京航空航天大学深圳研究院）；Zhejiang Lab（之江实验室）；Wuhan University（武汉大学）；Xi’an Jiaotong University（西安交通大学）
Versatile Backdoor Attack with Visible, Semantic, Sample-Specific, and Compatible Triggers
School of Data Science, The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳）数据科学学院）；Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））
Gungnir: Exploiting Stylistic Features in Images for Backdoor Attacks on Diffusion Models
School of Economics and Management（经济管理学院）；East China Normal University（华东师范大学）；School of Information Science and Technology（信息科学与技术学院）；Shanghai Tech University（上海理工大学）；Shanghai Development Center of Computer Software Technology（上海计算机软件技术开发中心）；School of Computer and Information Engineering（计算机与信息工程学院）；Shanghai Polytechnic University（上海理工大学）
Dangerous Cloaking: Natural Trigger based Backdoor Attacks on Object Detectors in the Physical World
NanJing University of Science and Technology（南京理工大学）；University of Adelaide（阿德莱德大学）；Data61, CSIRO（澳大利亚联邦科学与工业研究组织Data61）；Sungkyunkwan University（成均馆大学）
LaserGuider: A Laser Based Physical Backdoor Attack against Deep Neural Networks
ShanghaiTech University（上海科技大学）；Pengcheng Laboratory（鹏城实验室）；Key Laboratory of System Software (Chinese Academy of Sciences) and State Key Laboratory of Computer Science, Institute of Software, Chinese Academy of Science（中国科学院软件研究所系统软件重点实验室与计算机科学国家重点实验室）；Nanjing Institute of Software Technology（南京软件技术研究院）
Is It Possible to Backdoor Face Forgery Detection with Natural Triggers?
School of Artificial Intelligence, University of Chinese Academy of Sciences（中国科学院大学人工智能学院）；CRIPAC & MAIS, Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所模式识别国家重点实验室与多模态人工智能系统实验室）；Nanjing University of Information Science and Technology（南京信息工程大学）
Imperceptible and Multi-channel Backdoor Attack against Deep Neural Networks
College of Computer Science and Technology, Nanjing University of Aeronautics and Astronautics（南京航空航天大学计算机科学与技术学院）；College of Electronic and Information Engineering, Nanjing University of Aeronautics and Astronautics（南京航空航天大学电子信息工程学院）
Trigger without Trace: Towards Stealthy Backdoor Attack on Text-to-Image Diffusion Models
Key Laboratory of AI Safety of CAS, Institute of Computing Technology (ICT), Chinese Academy of Sciences (CAS), Beijing 100190, China, and also with the University of Chinese Academy of Sciences (UCAS), Beijing 100049, China（中国科学院人工智能安全重点实验室，计算技术研究所（ICT），中国科学院（CAS），北京100190，中国，以及中国科学院大学（UCAS），北京100049，中国）
