Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: The paper proposes a novel backdoor attack that is efficient and stealthy. While the previous methods employ patterns that rarely occur
in benign data as the trigger pattern, this paper suggests using patterns that frequently appear in benign data of the target class but rarely appear in other classes. This proposal both improves the efficiency of the attack and increases the difficulty or cost of identifying and mitigating the trigger pattern. The proposed attack shows good attack performance on four popular datasets and passes common backdoor defenses.
strength_and_weaknesses: ### Strengths
- The proposed idea is novel and interesting. This proposal both improves the efficiency of the attack and increases the difficulty or cost of identifying and mitigating the trigger pattern.
- The experiments well proves the effectiveness of the proposed algorithm.
- The authors made a fair argument in the paragraph at the end of Page 6. They acknowledged that comparing backdoor methods by using their attack performance from a specific (default) configuration may be not so rigorous.

### Weaknesses
- In Equation 4, \sigma is not defined.
- The authors reported BA x 100, ASR x 100. It is preferable to show as percentage (%)
- What was the reason to set the target class as 2 instead of 0 or 1?
- I would love to see the results when using frequency-based backdoor defense [1]
[1]. Zeng Y, Park W, Mao ZM, Jia R. Rethinking the backdoor attacks' triggers: A frequency perspective. In ICCV 2021 (pp. 16473-16481).

clarity,_quality,_novelty_and_reproducibility: ### Clarity
Overall, the paper is easy and clear to read. One issue is \sigma in Equation 4 was not defined.

### Quality
The paper is well written.

### Novelty
The idea is novel.

### Reproducibility
Code is provided.

summary_of_the_review: Overall, the idea is novel and the paper is well written. I have some minor comments and I would love to see more defense results, particularly with the frequency-based defense.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper proposes an algorithm for extracting backdoor triggers from clean training datasets to bypass existing backdoor defense methods due to the difficulty of defense posed by the fact that triggers are also widely present in clean samples. In addition, experiments show that this form of trigger can achieve a higher success rate with a better poisoning ratio.
strength_and_weaknesses: Strength:
1. the novelty and effectiveness of the proposed method.
2. the paper conducts a large number of defense experiments and analyzes the algorithm effect from different defense methods.
3. the method proposed in the paper can successfully achieve backdoor attacks with a lower poisoning ratio.
4. The paper is written in a clear and easy-to-understand manner.

Weaknesses:
1. although this paper uses formal data symbolic description for the proposed method, there is still no framework diagram to help the method understanding, which makes the algorithm of the article slightly inferior in the narration and implementation process.
2. although this paper introduces various attack methods in detail, it does not show more attack methods in experimental comparison, such as ISSBA. as a novel attack method, the authors should give more experimental comparison and analysis of the attack.
3, the author mentioned in the paper the advantages of the algorithm can also be mentioned in the attack on high efficiency. But for this part, I don't seem to see more theoretical analysis (convergence) and related experimental proofs. I have reservations about this point.
4. What is the main difference between the authors and ISSBA in terms of the formulation of the method? I would like the authors further to explain the contribution in conjunction with the formulas.

Some Questions:
1.How is the computational efficiency of extracting the trigger? Unlike previous backdoor attack algorithms, the method needs to analyze and extract data from the entire training dataset. Does this result in exponential time growth as the dataset increases?
2. The effectiveness and problem of the algorithm are that it requires access to the entire training dataset. Have the authors considered how the algorithm should operate effectively when the training dataset is not fully perceptible?

Overall:
The trigger proposed in this paper is novel, but the related validation experiments are not comprehensive, and the time complexity of the computation and the efficiency of the algorithm are not clearly analyzed. In addition, I expect the authors to further elucidate the technical contribution rather than the form of the attack.
clarity,_quality,_novelty_and_reproducibility: I think this paper is easily achievable, but there is still further improvement in quality and clarity. In addition, the current innovations are mainly in the form of attacks rather than in the technical approach and theoretical aspects.
summary_of_the_review: From the current understanding, this article still has no solved efficiency problem and validation of effectiveness. Also, the innovativeness still needs further clarification. Of course, I am looking forward to the author's reply to me at the rebuttal stage.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes to find salient features of images of the target class in the encoded latent space with an auto-encoder, perturb the source image in its encoded representations with a learned mask, and decode the representation to form poisoned data for dirty-label data poisoning. Mask learning is performed with a presumably gradient-based optimization to minimize a combined loss. Experiments show that it is effective under low poison rates (0.1%) and can resist recent defenses.

strength_and_weaknesses: ### Strengths
* It appears to be quite effective with low poison rates, and can resist recent defenses.
* The idea of masking the encoded representation is somewhat interesting.

### Weaknesses
* The added perturbation is very visible and the labels are also changed, and can be easily detected by human, as shown in Fig. 1(b).
* Compared to the latest clean-label data poisoning methods (e.g. Sleeper Agent [1]), the proposed method further requires label-flipping and similar perturbation scale. It may be more practical for the attackers to consider clean-label variants.
* Table 2(b): the anomaly index of GTSRB seems to far exceed the limit (2) of Neural-Cleanse. WaNet also did not report such a high anomaly for GTSRB.
* The method may not be able to defend against MNTD [2].

### References
[1]: Souri H, et al. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch, ICML workshop 2022.

[2]: Xu X, et al. Detecting AI trojans using meta neural analysis, S&P 2021.
clarity,_quality,_novelty_and_reproducibility: ### Novelty
* The approach is very similar to ISSBA, which also considers dirty-label dataset poisoning, except this paper adds much larger and visible perturbations to the images to allow for lower poison rates. 

### Quality
* This paper is generally clearly written, with a few issues below:
	* Many of the citations are missing parentheses.
	* Figure 2: why can the bounds on ASR for CelebA exceed 100%?
* It is strange that the paper did not mention the details of the method in the Introduction section.
* As this is a data poisoning attack, it is important to discuss whether poisoned data are transferrable across model architectures and training configurations.

### Reproducibility issues
* It is not clear how the mask is binarized. The paper only mentions the last term in eq. (4) can help with this. Binary masking typically requires gradient estimators for differentiable on/off decisions, iterative pruning, Gumbel-softmax hardening tricks, or even resort to RL algorithms. In general, you would want to "ease in" binary decisions, otherwise the result would depend heavily on initialization. It would also be nice to have some figures showing the masks and respective images.
* The paper mentions that $\alpha$ is adjusted to mask 70-80% of all elements in $\mathbf{h}_t$. The difficulty of this tuning step is not made clear.
* The training configurations for the auto-encoder is not provided in either the main text or the appendix.
* The defense hyperparameters are also missing.

summary_of_the_review: The paper's method is somewhat novel, but not very well motivated. The proposed method is not stealthy enough, and "dirty-label" has greater restrictions in applicability and easier to detect. It lacks discussion on transferability as a data poisoning attack. It also has many reproducibility issues.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: This paper proposes a backdoor attack using features from the target class. Existing backdoor attacks usually use some pattern that does not relate to the target label, which could be identified by defense methods. This paper leverages the benign features from the target class as the trigger pattern to inject backdoor behaviors. Specifically, it selects a sample from the target class based on the prediction probability. It then utilizes an encoder-decoder structure to extract the feature representation of the target-class sample, which is combined with the feature representation of samples from other classes as trigger-injected samples (after decoded by the decoder). The number of the added features from the target-class sample is minimized using the classification loss. The evaluation is conducted on four datasets and a few model architectures. The results show the proposed attack can achieve high attack success rate and has better resilience to defenses compared to a few existing backdoor attacks.
strength_and_weaknesses: Strength

+ Interesting perspective of using target-class features as the trigger
+ Well written

Weaknesses

- No threat model
- Limited novelty
- Unconvincing results against defenses
- No comparison with a closely related backdoor attack
- Missing evaluation on state-of-the-art defenses
clarity,_quality,_novelty_and_reproducibility: ## Clarity

This paper is mostly well written and easy to follow. The introduction provides sufficient background and intriguing motivation to the problem that this paper aims to address. The proposed attack method is mostly easy to understand.

There is one part not clear from the description. In section 3.2.1, this paper states "we select the input with the highest prediction probability for the target class as the representative input." Does it mean only one single sample from the target class is used for the attack? If this is true, it is unclear why the features from one sample is sufficient to achieve high attack success rate? It would be better to provide more details and explanations.

Besides, this paper does not provide a threat model for the proposed attack. What knowledge is needed for the attacker and what capability does the attacker have?


## Novelty

This paper proposes a backdoor attack leveraging an encoder-decoder structure to combine features from the target-class sample and victim samples. The backdoor trigger is sample-specific. This is very similar to an existing attack, Invisible backdoor attack [1], which also makes use an auto-encoder to generate sample-specific backdoor patterns. This paper states the proposed attack is "inspired by the idea of the sample-specific attack strategy [1]". However, there is discussion regrading the difference between the proposed one and [1]. Besides, the existing attack [1] is not compared with in the evaluation.

The trigger injection method of this paper is using a mask to combine features of samples from victim and target classes. Such an analytic technique has already been studied in existing work [2], which aims to differentiate internal features from victim and target classes using an optimized mask. This method is able to detect many complex backdoor attacks. It shall be discussed and evaluated in the paper as it shares similarities with the proposed attack.


## Quality

The evaluation includes a few defense methods. The results in Table 2(b) show NC can detect 3 out of 4 backdoored models by the proposed attack. The paper sees such results promising as NC cannot identify the correct target label. However, it is not a convincing argument. Backdoor scanners such as NC only aim to determine whether a model is backdoored or not. If it is backdoored, users then can just discard the model and do not use it. It does not matter whether the correct target label can be identified or not. This also echoes the previous concern that this paper does not provide an explicit threat model.

In addition, there are many more recent state-of-the-art defenses in backdoor scanning [2] and backdoor removal [3-5]. This paper shall also evaluate against these new defenses.


## Reproducibility

The submission provides the implementation of the proposed method in the supplementary material, which makes the reproduction easy and achievable.


* [1] Yuezun Li, et al. "Invisible backdoor attack with sample-specific triggers." ICCV 2021
* [2] Liu, Yingqi, et al. "Complex Backdoor Detection by Symmetric Feature Differencing." CVPR 2022.
* [3] Wu, Dongxian, and Yisen Wang. "Adversarial neuron pruning purifies backdoored deep models." NeurIPS 2021.
* [4] Tao, Guanhong, et al. "Model orthogonalization: Class distance hardening in neural networks for better security." IEEE S&P 2022.
* [5] Zeng, Yi, et al. "Adversarial Unlearning of Backdoors via Implicit Hypergradient." ICLR 2022.
summary_of_the_review: This paper is interesting and mostly well written. The novelty and the evaluation are however limited.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: This work proposed to extract a pattern from benign target class data as the trigger, which is then embedded into the benign data through encoder to generate poisoned data. 

There are several important concerns about this work, mainly including: 
1. The highly similarity to a previous work ISSBA. The authors claimed the main difference is the trigger, one is extracted from benign data, while the other not. Some reviewers and I don't think it is a significant contribution, and the authors didn't provide convincing analysis about why such a trigger could improve the attack performance. Besides, the rebuttal claimed the proposed method could give higher ASR than ISSBA in the case of low poisoning rate. As one reviewer indicated, the possible reason may be the proposed trigger is more visible. Other comments about ISSBA in the rebuttal are also not well verified. 
2. Inadequate experiments. Many recent attacks and defense methods are not compared. Although partial results are added in the rebuttal, they are insufficient to support the proposed method. For example, the results against frequency-based backdoor defense methods cannot tell the good performance against this defense. 
3. There are also some suggestions about the writing, the analysis about the efficiency, as well as the threat model. 

Overall, this work cannot be recommended as accept.
justification_for_why_not_higher_score: similarity to previous work, insufficient experiments.
Decision: Reject