Venue: ICLR 2023 Conference

Reviews:

final_score: rating: 6: marginally above the acceptance threshold
review_content: summary_of_the_paper: This is a practical paper providing empirical insights on how to better backdoor attack a DNN model via poisoning samples (without interfering with the training process). Three observations/ideas are provided: 1) using shared adversarial perturbation as the trigger; 2) using easiness of being misclassified through a trial training to select poisoning samples; 3) the poisoning sample sets produced by 1) and 2) tend to provide consistent poisoning effect. 
strength_and_weaknesses: This paper is very well written and to-the-point.  Attacking efficiency is an important problem, which is largely ignored by previous literature. Although the proposed ideas are mostly based on existing ideas (see below), the empirical study seems thorough and the paper provides important insights. I do appreciate this paper more than many other papers on backdoor attacks.

Regarding novelty, the second idea (ISS) is mainly based on (Xia et al. 2022). Meanwhile, the first idea is a bit incremental considering adversarial perturbation for trojan attack has been explored. The relationship with the universal adversarial perturbation (Moosavi-Dezfooli et al. 2017) should also be discussed.

* Pang, Ren, Hua Shen, Xinyang Zhang, Shouling Ji, Yevgeniy Vorobeychik, Xiapu Luo, Alex Liu, and Ting Wang. "A tale of evil twins: Adversarial inputs versus poisoned models." In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp. 85-99. 2020.

However, this does not affect the novelty of the empirical insights. 

Aside from the poisoning rate, I consider the third observation (consistency) very interesting. Yet, at current version it is under-explored. I would hope to see more discussions of how the observation implies in terms of model prediction consistency. Some more analysis could be very useful. For example, any statistics as to the proportions of samples that are consistently misclassified across different runs? How are the successful triggered test samples related to the poisoning samples? 

Questions to be addressed.
1) in Fig 6, please explain how the correlation is computed (sample-wise?)
2) adversarial training is known to be a challenge for poisoning. How would the attack perform when the user employs adversarial training?
3) for the idea #2, what if the training trial to choose samples are different from the training in terms of setting, e.g., different optimizers/learning rates/standard vs adversarial?
4) how would the created poison samples perform if the user chooses a different model architecture? 

Some limited ablation study to address these questions could be helpful.



clarity,_quality,_novelty_and_reproducibility: See above.
summary_of_the_review: Incremental ideas. Novel empirical insights. Important problem and relatively thorough study (with limitations). Paper is well written.
review_title: null

final_score: rating: 3: reject, not good enough
review_content: summary_of_the_paper: The paper investigates three separated techniques to improve the successful rate and perturbation efficiency of backdoor attacks. Based on the proposed attacking strategy, the authors constructed two backdoored datasets based on CIFAR-10 and CIFAR-100, in which 0.04% and 0.06% of the data are poisoned. Both of them have achieved attack success rates higher than 90% on models with different architectures and hyperparameters. 
strength_and_weaknesses: Strengths: 
- The paper demonstrated good experimental results and showed clear comparisons of the performance of the proposed methods and the baseline approach.  
- Detailed descriptions of the background of the backdoor attacks are provided to make the work of the paper more understandable.
- The paper is well written and the empirical results are reasonable.

Weaknesses:
The main concern of the paper is about the novelty and research contribution. Moreover, the involved techniques to improve backdoor attacks added extra assumptions of the knowledge of the attacker. For example, 
- The process of generating the trigger is based on the idea of “universal attack”. However, in other works about backdoor attack, the attacker has the flexibility to choose customized triggers (i.e., with arbitrary choices of shape, color) without having access to the targeted model. 
- During the sample selecting process, this paper directly applies Xia et al (2022) to perturb the “forgettable” samples. However, this process may involve a filtering process, which is also potential to highly demand the knowledge of the attacker. 

If the attacker has sufficient capacity to achieve the two requirements above, it is not very surprising that an attacker can greatly improve the effectiveness of backdoor attacks. 

clarity,_quality,_novelty_and_reproducibility: Generally, the writing is relatively clear and in a logical structure. However, the novelty is limited as mentioned above. 
summary_of_the_review: The paper introduces a new pipeline for conducting backdoor attacks which empirically showed a good performance in reducing the number of poisoned samples required. However, it may lack potential impact to the community, because it only combines existing techniques to improve the performance, and also only rely on strong assumptions on the knowledge of the attacker.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper studied the data efficiency of backdoor attacks and found that one only needs to add an adversarially optimized trigger to 0.04% and 0.06% of training examples to have a high attack accuracy on CIFAR-10 and CIFAR-100 respectively. These numbers are much smaller than the ones reported in previous work. 
strength_and_weaknesses: Strength:
- The problem studied in this paper, data efficiency of backdoor attacks, is important and of the interest of the ICLR community. 
- The claimed result is significant in terms of how small the set of poisoned data can be to make a trigger effective for the poisoned model. 

Weaknesses:
- The novelty of this paper is unclear. There could be more discussion about the background and existing work to show how this work is different from the existing ones. 
- The writing of this paper is lacking as a conference submission. The authors need to carefully check the definitions to make sure all notations and terms are defined when they first appear in the paper. The language used in this paper can also be more formal. 
- The claimed result lack supports to make it convincing. Direct comparison to existing work, experiment details and experiments with different targeted labels should at least be added.  
clarity,_quality,_novelty_and_reproducibility: Clarity:

(-) The "inherent flaws" of neural networks were mentioned multiple times throughout the paper and also served as the motivation of the proposed algorithm. However, I didn't find any explanation for these flaws except for the references. It would be helpful if details or intuition of these inherent flaws could be added. 

(-) Similarly, most previous works are not well-introduced but stopped at generic terms like "some factors" (what factors?), "their proposed strategy" (what strategy?). 

(-) The main baseline _RT_ is not introduced. Does it stand for "Random Trigger"? How did the random perturbations generated? 

A few minor questions/issues:
* Equation 1: _D_b_ is not defined.  
* Figure 4: What is the _difference_? Is it the _difference between the attack success rates_? 
* _ET_ was not defined until the end of Section 3.2 but was used throughout Section 3.1.

Quality:

(+) The proposed method can attack a neural network with a very small amount of data and the backdoored datasets are effective for models with different network architectures and trained with different optimizers. 

(-) The metric used for evaluation ("attack success rate") is not formally defined or introduced. It is also unclear what the test data is.

(-) The clean accuracy (when the trigger is not added to the examples) is not reported. In this case, it is hard to conclude whether the generated trigger is effective or not. 

(-) All experiments used the same target label which is category 0. I would suggest to add results of using another attack target _y'_ to validate the effectiveness of the proposed ETI attack. 

Novelty:

(-) The novelty of this work is unclear. Previous work related to the first contribution (Section 3.1) is only vaguely mentioned and thus it is unclear how the proposed method is different from existing ones. The claimed improvement over FUS (Xia et al., 2022) in Section 3.2 also seem to be trivial. It is merely saving the best instead of the last result. If this paper is supposed to be an emprical study on the smallest number of examples needed for backdoor attacks, more ablation studies and analysis of factors that affect this number should be provided. 

Reproducibility:

(-) Code or backdoored datasets are not released. 
summary_of_the_review: I found the problem studied and the result presented in this paper interesting. However, a lot of information, including a comparison to existing work and experiment details, is currently missing, and the effectiveness of the proposed method is not well-supported by enough experiments. Therefore, I recommend rejecting this manuscript. 

Given the authors' response during the discussion, I would like to raise my score from 3 to 5.
review_title: null

final_score: rating: 5: marginally below the acceptance threshold
review_content: summary_of_the_paper: This paper studies the capability limits of data poisoning, i.e., the minimum amount of data required to successfully inject backdoor behavior into DNN. In particular, the authors craft a universal adversarial patch as the trigger, use FUS to select samples, and exploit individual consistency to stabilize the performance. Finally, they construct a poisoned CIFAR-10 training data (50K in total), where only 20 images are poisoned and the model still learns the backdoor behaviors.
strength_and_weaknesses: **Strength**
1. It is always interesting to explore the capability limits of data poisoning, i.e., the minimum amount of data we can use to inject backdoor behavior into DNN.
2. The experimental results are promising. We can use only 20 poisoned images to successfully inject backdoor behavior (50K images on training data in total).


**Weakness**
1. The technical novelty in this paper is limited. The proposed method looks like a trivial combination of existing methods like universal adversarial patch and FUS. 
2. I have concerns about the threat model of this paper.
- Is the threat model of this paper realistic? In this threat model, the adversary has full access to the training data, and use the knowledge from the whole data to select poisoned data. 
Can authors show whether this method could generalize across in-distribution data?
- Can the authors verify whether the proposed method generalizes across in-distribution data? For example, we can split the training dataset into two parts. We can select the poisoned data from the first part using the proposed method, and verify the effectiveness on the second part.
3. FUS is an important technique in this paper. To make the paper more self-containing, can the authors add descriptions of FUS with more details in Related Work. Otherwise, it is hard for readers to understand this method.
4. In my opinion, the selection of the target class has a significant impact on the poisoning performance. This paper only considers the cases when class 0 is the target class. This is incomprehensive and makes the results unconvincing because the adversary might choose any class as the target class (the target class should first satisfy the attack aim for the adversary)

clarity,_quality,_novelty_and_reproducibility: see Strength And Weakness.
summary_of_the_review: Although the research topic of this paper is interesting, the proposed method lacks technical contributions. If the authors could have a much closer look at the proposed method and provide more insights, I will reconsider my score.
review_title: null

Meta-review: metareview:_summary,_strengths_and_weaknesses: The paper proposes Efficient Trojan Injection (ETI) to reduce the number of poisoned samples needed when backdooring an image classifier. The proposed technique combines two existing methods: optimizable triggers and importance sample selection. In addition, it investigates the effect of randomness, on the poisoning efficiency of backdoor attacks and exploits individual consistency to further reduce the number of poisoned samples. All the reviewers appreciate the importance of the problem and the good empirical results. However, in general they are concerned about the novelty of the paper. As optimizable triggers and importance sample selection has been explored before, the main novelty is exploiting individual consistency to further reduce the number of poisoned samples. However, the paper lacks enough discuss about this. The paper will benefit from a revision to add more discussion on this point.
justification_for_why_not_higher_score: Lack of enough novelty as discussed in part 1.
Decision: Reject