Efficient and Stealthy Backdoor Attack Triggers are Close at Hand
Authors: Minlong Peng
Xu Li
Mingming Sun
Venue: Submitted to ICLR 2023 (2023)
Keywords: Backdoor Attack；Deep Neural Networks

Abstract: A backdoor attack aims to inject a backdoor into a deep model so that the model performs normally on benign samples while maliciously predicting the input as the attacker-defined target class when the backdoor is activated by a predefined trigger pattern. Most existing backdoor attacks use a pattern that rarely occurs in benign data as the trigger pattern. In this way, the impact of the attack on the label prediction of benign data can be mitigated. However, this practice also results in the attack being defended against with little performance degradation on benign data by preventing the trigger pattern from being activated. In this work, we present a new attack strategy to solve this dilemma. Unlike the conventional strategy, our strategy extracts the trigger pattern from benign training data, which frequently occurs in samples of the target class but rarely occurs in samples of the other classes. Compared with the prevailing strategy, our proposed strategy has two advantages. First, it can improve the efficiency of the attack because learning on benign samples of the target class can facilitate the fitting of the trigger pattern. Second, it increases the difficulty or cost of identifying the trigger pattern and preventing its activation, since many benign samples of the target class contain the trigger pattern. We empirically evaluate our strategy on four benchmark datasets. The experimental studies show that attacks performed with our strategy can achieve much better performance when poisoning only 0.1\% or more of the training data, and can achieve better performance against several benchmark defense algorithms.

Under review as a conference paper at ICLR 2023
EFFICIENT AND STEALTHY BACKDOOR ATTACK TRIG- GERS ARE CLOSE AT HAND
Anonymous authors Paper under double-blind review
ABSTRACT
A backdoor attack aims to inject a backdoor into a deep model so that the model performs normally on benign samples while maliciously predicting the input as the attacker-defined target class when the backdoor is activated by predefined trigger pattern. Most existing backdoor attacks use a pattern that rarely occurs in benign data as the trigger pattern. In this way, the impact of the attack the label prediction of benign data can be mitigated. However, this practice also re- sults in the attack being defended against with little performance degradation benign data by preventing the trigger pattern from being activated. this work, we present new attack strategy to solve this dilemma. Unlike the conventional strategy, our strategy extracts the trigger pattern from benign training data, which frequently occurs samples of the target class but rarely occurs in samples of the other classes. Compared with the prevailing strategy, our proposed strategy has two advantages. First, it can improve the efficiency of the attack because learning on benign samples of the target class can facilitate the fitting of the trigger pat- tern. Second, it increases the difficulty or cost of identifying the trigger pattern and preventing its activation, since many benign samples of the target class con- tain the trigger pattern. We empirically evaluate our strategy on four benchmark datasets. The experimental studies show that attacks performed with our strat- egy can achieve much better performance when poisoning only 0.1 or more the training data, and can achieve better performance against several benchmark defense algorithms.
INTRODUCTION
Backdoor attack, also known as Trojan horse attacks, has become an increasing security threat in recent years, attracting many research interests (Chen et al. 2017 Doan al. 2021). The attack aims to inject a backdoor into a deep model so that the model behaves normally on benign samples, while its predictions are maliciously and consistently changed to predefined target class (or classes) when the backdoors are activated. Currently, poisoning training samples is the most straightforward and widely adopted method for performing backdoor attacks. Depending
whether the labels of the poisoned samples are changed or not, existing backdoor attacks can be roughly divided into plison-label backdoor attacks (Gu et al. 2017 Barni et al.) 20199; Nguyen & Tran 2020 Liu al., 2020 Qi et al. 2021) and clean-label backdoor attacks (Turner et al. 2019 [aha et al. (020).
In this work, we follow the practice of poison-label backdoor attacks, which are much more efficient than clean-label ones. To perform a poison-label backdoor attack, it first selects small number (a smaller number means a smaller impact on the performance of the benign data and lower probabil- ity of being inspected by the developer) of benign samples from the training set, inserts predefined trigger pattern into the inputs, and changes their labels to the target class (or classes). It then rein- serts the poisoned samples into the training set and provides the resulting data to the victims to train the model with. In attack mode, it manipulates the victim model produce the intended target class by injecting the predefined trigger pattern into the inputs.
Existing backdoor attacks typically use a pattern that rarely occurs in benign data as the trigger pattern. For example, Gu et al. (011) used stickers and checkerboards trigger patterns for image data, /Sun (2020) used special characters, words, and phrases as trigger patterns for text data. This strategy can prevent the attack from being falsely activated on benign data and mitigate the impact of

---

Under review as a conference paper at ICLR 2023
the attack on the label predictions of benign samples. However, it also results in low-effort detection and mitigation of the attack by preventing activation of the trigger pattern. As far as we know. most existing backdoor attack defense algorithms build on this property and achieve great success (Chen
let al. 2019 Wang et al. 2019) iZhao et al. 2020 Xu et al. 2020; Yang et al. 2021 Huang et al. 2022a
Mu et al. 2022).
In this work, we introduce a new attack strategy to solve this dilemma. Instead of using a rare pattern the trigger pattern, we extract the trigger pattern from benign data that frequently occurs in samples of the target class but rarely occurs in samples of non-target classes. Accordingly, we introduce framework to extract the trigger pattemn and insert it into benign inputs to perform data poisoning. The proposed strategy has two advantages over the prevailing one. First, it is more efficient since the trigger pattern comes from the target class. Training on benign samples of the target class will help the fitting of the trigger pattern. Second, it becomes harder to detect and defend against the attack because many benign samples of the target class contain the trigger pattern. is difficult distinguish the poisoned samples from benign samples of the target class using the trigger pattern, and disabling the activation of the trigger pattern will degrade performance of these benign target class samples.
To evaluate the benefits of our proposed strategy, we conducted experiments on four widely studied datasets. The empirical results show that attacks performed with our strategy can achieve better at- tack performance with less poisoned data especially when the poisoned data size is small. Moreover, they can escape the defenses of several benchmark defense algorithms, while attacks performed with the conventional strategies often fail to do so.
The main contributions of this work can be summarized in three points. 1) A new attack strategy for designing the trigger pattern is proposed. 2) An effective technique for extracting the trigger pattern and injecting it into benign data proposed. 3) Experiments are conducted on four widely studied datasets, and the results show that our strategy can improve both attack efficiency and stealthiness.
2 BACKGROUND & RELATED WORK
2.1 BACKDOOR ATTACK
Backdoor attacks aim to insert backdoors into deep models so that victim models will work genuinely on benign inputs but misbehave when a specific trigger pattern occurs. This is an emerging area of research that raises security concerns about training with third-party resources. A backdoor attack can be performed at multiple stages of the victim model (Li et al., 2022a Jia jt al. 2022; Chen et al., 2022). In this work, we follow the widely used training data poisoning setting, where attackers only manipulate the training data, but not the model, training schedule, or inference pipeline. In this case, the attackers spread the attack by sending the poisoned data to the victims or publishing on the Internet and waiting for the victims.
Threat Model.
Formally, let æ E X' denote the input, E y denote the output, D = {(11, V1), (æ Dn) denote the benign training dataset. To perform backdoor attack, the attacker first selects small number of benign samples from D and then injects the predefined trigger pattern into each selected input and sets its label as follows:
== B(x); = T(y),
where B denotes the backdoor injection function and the relabel function. In the usual all-to-one poison-label attack setting (we apply the setting in this work), T(y) Ct, where ct denotes the label of the attacker-specific target class. Then, the attacker mixes the poisoned samples, (#: Ø). with the remaining benign training samples and provides the resulting dataset, D, to the victims. Without knowing the training data being poisoned, the victims train a model, fesm. on D, and provide a classification service using fvim. In attack mode, the attacker injects the trigger pattern into any input x that they want the victim model to behave as follows:
Juim (x: = y: foom (B(x)) T(y).
Previous Poison-Label Backdoor Attacks. Existing poison-label backdoor attacks typically use a pattern that rarely occurs in benign data as the trigger pattern so as not to degrade the model's performance on benign data (Liu et al. 2017 Chen et al. 2017 Barni et al. 2019 Liu al. 2020
2

---

Under review as a conference paper at ICLR 2023
As a pioneering work, BadNet (Gu et al. 2017) has used stickers and checkerboard as trigger patterns for image data. It replaces a fixed area of the input image with the trigger pattern to poison the imput image, ie., B(x) = m @ x (1 m) @ n, where m is binary mask matrix and is an image with checkerboards in the corners. After that, many variants of backdoor attacks were introduced. Blend (Chen al.] 2017) used a normal image as the trigger pattern and mixed the trigger pattern with the benign input to inject the backdoor. WaNet (Nguyen & Tran 2021) proposed using a small and smooth warping field as the trigger pattern poison images. (Sun 2020) proposed injecting special characters, words, and phrases into text data as trigger patterns. And (Qi et al. 2021) poisoned the text inputs to follow a certain syntactic rule, which rarely occurs in benign data. Recently, ISSBA (Li et al. 2021c) proposed an sestance-specifie attack strategy that generates a specific trigger pattern for each of the poisoned inputs. By itself, ISSBA's trigger pattern can be viewed as a combination of the benign input and a predefined encoder-generated trigger string that never occurs in benign data.
Backdoor Attack Evaluation. Backdoor attacks are usually evaluated based on two dimensions, i.c., attack efficiency and stealthiness. In classification tasks, the accuracy on the poisoned test dataset (all samples in the test dataset are poisoned), called the attack success rate (ASR), is often used to evaluate attack efficiency. And simple measure to evaluate the stealthiness of an attack is the classification accuracy on benign test dataset, called benign accuracy (BA). A stealthy attack should achieve a BA that is close to that of an intact model, otherwise the developer will notice the attack or not deploy the victim model. You may also evaluate the stealthiness of an attack based on the poison rate. A stealthy attack should have a small poison rate, so the poisoned sample is unlikely to be inspected by the developer. In addition, the stealthiness of an attack is often evaluated by testing the attack performance against defense algorithms. In this case, the measurement differs by defense algorithm.
2.2 BACKDOOR ATTACK DEFENSE
In recent years, several categories of defense methods have been developed to defend against back- door attacks, including explicit backdoor mining- based methods (Chen al.) 2019 Wang et al. 2019 Liu et al.
2019), implicit poisoned input detection based methods (Gao et al. 2019 Xu et al.
2020 Yang et al. [022]] Huang et al. 22022)) and model mitigation-based methods (Liu al.) 2018
Zhao et al. 2020 Huang et al. 2022a Mu et al. 2022 Li et al.] 2021a). A unique feature of many of these methods is that they perform defense by preventing the activation of the trigger pattern, e.g., by removing or deactivating the corresponding neurons of the trigger pattern from the neural model or selectively removing samples containing the trigger pattern from the training data.
As concrete example, Liu et al. (2018) observed that some neurons of the victim model would only be activated when the trigger pattern appeared. Therefore, they proposed a so-called Fine-Pruning method to disable the backdoor behavior by eliminating neurons that were dormant on benign inputs. Xu et al. (2020) applied a similar idea to perform the defense but selected the neurons to prune by the Exo norm values of neurons. Motivated by similar observations of (Liu et al. 2018). Li et al.) (2021a) proposed a so-called NAD method to defense the attack. The method introduces a teacher model by finetuning the victim model with a few benign samples and then aligns the neurons of the victim model with those of the teacher model through a neural attention distillation process. This way, it hopes to prevent the activation of the trigger pattern. Gao et al. (2019) observed that the label prediction on the poisoned inputs will almost not change over perturbations. Accordingly, they proposed a perturbation based strategy, called STRIP, defense the attack, which perturbed the input samples with noise and removed samples with small prediction variation given by the victim model. Wang et al. (2019) assumed that the trigger pattern was patch-based and proposed a defense algorithm called Neural-Cleanss
For each class, it optimized a patch pattern to make the model classify the input injected by the pattern as the class. If class yielded significantly smaller pattern, it considered the patch the trigger pattern and claimed the model was under attack. However, with the development of backdoor attacks, the assumption of this method does not hold for most SOTA backdoor attacks. Li et al. 1b) found that the attack performance can degrade greatly if the appearance or position of the trigger is changed slightly. Based on this observation, they proposed to use spatial transformations (e.g., shrinking (ShrinkPad), flipping) for attack defense. At the time of inference, cansfornation-basee preprocessing was first applied to the test input, and then the processed input was fed into the model to perform label prediction. Recently, Huang et al.
3

---

Under review as a conference paper at ICLR 2023
2022b) proposed so-called DBD algorithm to perform attack defense. The algorithm is based on the motivation that the poisoned samples are hard samples for the learning model. It proposed to first train feature map using self-supervised learning. then train the victim model on the resulting feature space, and finally re-train the model using the top 50% credible training samples selected by the second-step model. Here, the first step is to enhance the input difference between poisoned samples and benign samples of the target class, and the second step is to find out the poisoned samples, leveraging the fact that deep models tend to first fit easy patterns and then hard ones (Arit
et al. 2017 Zhang et al. 2017).
3
PROPOSED APPROACH
3.1
OVERVIEW
We follow the scheme of BadNet (Gu et al. 2017) and poison subset of the training dataset D to perform an attack under the all-to-one setting. Each selected sample (æz, y) is replaced with poisoned sample (B(x), ce), where ((-) is the backdoor injection function and is the attacker- defined target class label.
The novelty of our strategy lies in the implementation of B(-). which is roughly defined as follows: B(x)) Jdee ((1 m) h @ h2), with h (a)e h2 (
(1)
Here, ( denotes the element-wise dot product operation, faee and fenc denotes decoder and an encoder, respectively, I; is the input of a representative target class sample from which we extract the trigger pattern, and m is mask vector whose values range from 0 to The key to our strategy is to extract z₁ and specify m. Below we illustrate the details of our strategy.
3.2 EXTRACT TRIGGER PATTERN FROM BENIGN DATA
Inspired by the idea of the cample-specift attack strategy the trigger pattern and inject it into benign input in the hidden feature space. Specifically, we train an auto-encoder using the benign training dataset, where the learning of the encoder is additionally supervised by the classification object. Let fenc. fdeo. and feis denote the encoder, decoder, and classifier, respectively. The three modules work as follows:
al. 2021c), we propose extract
= fen)(x), Ι = (h), p(yl=)) = (cl)(h),
(2)
and they are jointly trained on a reconstruction loss, Lrees and a classification loss, Leles defined as follows:
Lrec Σ || 2112,
Cale Σ Lee ((yp))))))
mED
(0.
where loe denotes the cross-entropy-based loss function. During the training of these modules, we mine the representative sample æ, as described in the next section, and once the training done, we mine the mask m.
3.2.1 EXTRACT REPRESENTATIVE SAMPLE
According to the objective of our strategy, we should extract a pattern that occurs frequently in samples of the target class but rarely in samples of non-target classes the trigger pattern. However, in numerous tasks, it is complicated to define the form of pattern. Therefore, instead of extracting the trigger pattern directly, we first extract an input of the target class, denoted as 2t, which should contain patterns that satisfy our requirement. Note that a pattern satisfying our requirement is strong feature in the classification task to recognize the target class, and since deep models tend to adapt easy patterns first and then hard patterns (Arpit et al. 2017 Zhang al., (2017). an input containing the trigger pattern should be recognized as the target class by the deep model in the early stage of the model training. Our solution for extracting 2; builds this intuition.
Specifically, at the end of the first training epoch of fene and fales we feed all training samples of the target class to the encoder and the classifier, obtaining their prediction probabilities for the target class. We select the input with the highest prediction probability for the target class as the representative input, denoted 27.-
4

---

Under review as a conference paper at ICLR 2023
Dataset
# Classes
#Train #Test
Joim
MNIST
10
60,000/10,000
ConvBlocks,
CIFARIO
10
50,000/10,000
PreActResNet18
GTSRB
43
99,209/12,638
PreActResNet18
CelebA
8
162,770/19,900
ResNet18
(a) Datasets and model architectures
(b) Poisoned data visualization
Figure 1: Data information. (a) Data statistic and classifier architectures. (b) Visualization of the poisoned images produced by our method compared the corresponding benign images. The first row are henign images, and the second row are poisoned images.
3.2.2 MASK GENERATION
Intuitively, the encoded representation, h4 of the selected input, It, should contain some redundant patterns (e.g., those used for input reconstruction) that do not meet our trigger pattern requirement. Directly merging f. with the encoded representation h of benign input æ may overwhelm the semantics of the benign input. With this consideration, we introduce mask reduce the redundant patterns in he based the intuition that removing the redundant patterns has less impact the prediction of the labelling of xy.
Specifically, we train a mask remove the redundant patterns in h, with the following object:
Lmosk Lee (cr.Plllhu) E m m, log m. with
(4)
m = =00m) h4 h m @ hr, plylhe) = Sata(h))
where d denotes the dimension of h4, 6m, denotes the trainable parameter to generate m, a denotes a scalar hyper-parameter and (--) denotes the sigmoid activation function. The first term of the above learning object discourages the masking of patterns satisfying our trigger pattern requirement. The second term encourages masking many elements of h, as possible. The last term encourages binarizing the mask. We optimize 6m to minimize Cmask with the parameters of feis fixed. In our implementation, we adjusted the value of to mask 70%-80% of the elements h,.
EXPERIMENTS
4.1
EXPERIMENTAL SETTINGS
Datasets & DNNs. We performed experiments on four widely-used image datasets: MNIST (Le-
Cun et al. 1998), CIFARIO 10 (Krizhevsky et al. 2009), GTSRB (Stallkamp et al. 2012), and CelebA
(Liu et 2015). For implementing the model, fellow most of the setting of WaNet (Nguyen & Tran 202 and considered a mixed of popular models: VGGI and Pre-activation Resnet-18 (He al. 2016) for CIFAR-10 and GTSRB and Resnet-18 for CelebA. For MNIST, we employed the
same CNN model used by WaNet. Figure la shows some statistic information of these datasets.
We implemented three popular attack strategies as baselines: visible BadNet (Gu 2017)) which injects a checkerboard into the upper left corner of the input image; invisible WaNet (Nguyen & Tran 2021). which used a small and smooth warping field to create poisoned images; and instance-specific ISSBA (Li al.) 2021c), which used an autoencoder to generate instance-specific backdoors. Note that we did not apply WaNet's noise mode because needs to control the training process of the victim model. This is exactly what we want to avoid.
Attack Baselines.
Defense Algorithms. We implemented five representative defense algorithms, including the model reconstruction-bett based algorithm NAD (Li et al. model diagnosis-basee algorithm STRIP (Gao et al. 2019), the trigger synthesis based algorithm Neural-Cleanse (Wang et al. 2019), and the input preprocessing based algorithm Shrink Pad (Li al. For PhrinkPad, NAD, and DBD, reported the Attack Success Rate (ASR) to evaluate
2021a) and DBD (Huang et al., (022b), the
5

---

Under review as a conference paper at ICLR 2023
(a) MNISS
CIFAR10
(c) GTSRB
[d] GolebA
1.0
1.00
100
100
80-
BadNet
WaNet
ISSBA
40
40
Our
20
20
20-
20-
0.1% 0.3%
0.4%5
0.5%
0.3%
0.2%
0.3%
0.5%
0.1%
9.2% 0.3%
0.4%
0.5%
0.1%
0.2%
0.3%
0.4%
0.5%
Roitoon-Rate
Poison-Rate
Poison-Rate
Figure 2: ASR x 100 by poison rate.
the performance of the attack. A stealthier attack against ShrinkPad, NAD, and DBD should achieve a higher value for ASR. For STRIP, we report the ratio of poisoned samples that escape STRIP's identification (i.e., False Accept Rate (FAR)) when 99 % of benign samples are not incorrectly rec- ognized as poisoned samples, and the ratio of benign samples that are detected poisoned samples (i.e.. False Reject Rate (FRR)) when 99% poisoned samples are correctly recognized by STRIP. A stealthier attack against STRIP should yield higher values for FAR and FRR. As for Neural-Cleanse, we report the Anomaly Index value to evaluate the stealthiness of the attack.
Implementation Detail. Following the practice of WaNet, we changed the input image size to 32x32x3 for CIFAR and GTSRB, 28 28 for MNIST, and 64 x3 for CelebA. Normalization was applied to MNIST and CIFAR10. RandomCrop and KandomHorizontalHH] were applied on CIFARIO. We applied CNN based auto-encoders to implement fene and faee. The classifier fels was implemented with a MLP. The target class was set to for all the datasets. Early stop was applied to select the model based on performance on benign data. Label-smoothing (Szegedy et al.) 2016) was applied as regularization during the training of the victim model, with ú: = 0.8y. C where C' denotes the class number and yi denotes the i-th dimension value of y. which a one-hot label representation. Label smoothing is popular technique to address label noise and according to our experience, it is highly effective to defend poison-label backdoor attacks. Momentum optimizer with 0.01 initial learning rate was applied for training the model. a was set to on MNIST, and on the other three datasets. Please refer to the appendix in the end of this manuscript and the attached source code in the zip file for more details of the implementation.
4.2 EFFICIENCY STUDY
Figure shows the attack performance of different strategies when poisoning different rates of training data. From the figure we can see: 1) WaNet and ISSBA cannot achieve success attack when poisoning 0.1% to 0.5% of training data. Actually, according to our experiments, when label smoothing is applied, WaNet cannot achieve an almost 100% ASR until the poison rate reaches 5% on MNIST and CelebA, and 10% on CIFAR 10 and CelebA. ISSBA cannot achieve a success attack even if the poison rate reaches 10% when label smoothing is applied. 2) Our strategy performs much better than all the compared baselines when only 0. (i.c., 40-60 samples) of training data is poisoned on MNIST, CIFARIO, and GTSRB, and performs similar BadNet on CelcbA. 3) On the black-and image-based MNIST dataset, our strategy consistently outperforms BadNet, while on the rest color image-basee datasets, BadNet performs similar or somehow better than our strategy when the poison rate is more than 0.1%.
From these observations, we draw a rough conclusion about the attack efficiency of the tested strategies. On the black-and-white image based dataset, the order of attack efficiency is: Our > BadNet >> WaNet > ISSBA. On the color image based datasets, the order of attack efficiency is: BadNet Our > WaNet > ISSBA. We believe that the reason BadNet is much more efficient on color image- based datasets is that the black-and
checkerboard trigger used by BadNet looks too conspieuous in the color image be fitted by the model.
Of course, the above conclusion may be not so rigorous, as many factors, such as the size of the trigger, where the trigger is inserted, and the brightness of the trigger, affect attack performance. Changing these factors may increase the efficiency of the baselines. We fellow the public setting (Li et al. 2022b) in experiments and did not change the setting since not the focus of this

---

Under review as a conference paper at ICLR 2023
Table 1: BA 100 and ASR 100 without any defense.
BA
ASR
Dataset
w/o attack
BadNet
WaNet
Our
BadNet
WaNet
Our
MNIST
99.21
99.18
99.12
99.19
100
99.76
100
CIFARIO
94.12
93,44
93.01
93.44
99.82
99.99
99.66
GTSRB
97.27
96.83
97.01
97.95
100
97.37
99.03
CelebA
79.38
79.10
79.10
79.20
100
100
99.99
Table 2: Attack Performance against (a) STRIP, and (b) Neural-Cleanse. (a) FAR x 100 when FRR % and FRR x 100 when FAR 1% against STRIP. (b) The asterisk means that Neural-Cleane cannot correctly recognize the attacker-defined target class even if it correctly identifies the model attacked.
(a) FAR x 100 and FRR x 100 against STRIP
(b) Anomaly Index against Maeraal-Ceease
Dataset
FAR
FRR
Dataset
BadNet
WaNet
Our
BadNet
WaNet
Our
BadNet
WaNet
Our
MNIST
5.17
1.14
0.79
MNIST
0
0.24
51.80
0.36
13.31
CIFARTO
5.75
8.92
1.65"
CIFAR1O
92.70
96.23
100
81,32
83.33
87.30
GTSRB
0
0,22
60.14
0.15
95.05
GTSRB
13.19
12.11
4.13"
CelebA
33.53
6.55
51.42
19,90
7.50
63.40
CelebA
0.71
0.85*
0.85
work and the results were enough to support our declaim: our proposed strategy is very efficient in
attacking.
4.3 STEALTHINESS STUDY
In this section, study stealthiness of attacks using different strategies, when they can achieve success attack without any defense. To perform the study, we set the poison rate to 5% for all the strategies and remove label smoothing during victim model training. This is because label smooth- ing will significantly degrade the attack efficiency of WaNet and ISSBA. It has to set a high and unacceptable value of poison rate for them to achieve successful attack, which we want avoid. Besides, without further illustration, we did not report the results of ISSBA because it cannot achieve acceptable attack performance in this setting even without any defense, and further increasing the poison rate will make the attack inapplicable in real situations.
Backdoor Visibility & Performance without Defense. Figure shows the poisoned images generated by our method compared to their corresponding benign ones. As can be seen from this figure, the clarity the images is somewhat reduced by the injection of the trigger pattern generated by our method. However, the poisoned images are still meaningful and it is hard to tell what the trigger pattern is. In addition, as can be seen, the presentation of the trigger pattern is input indepen- dent in the input space. It is hard to find the commodity of the trigger pattern in different poisoned inputs in the input space. This meets up with the design theory of ISSBA. Table shows the attack be seen that all tested attack strategies can
performance without any defense. From the table achieve similar BAs as the intact model (w/o attack) that is not attacked. Moreover, they all achieve an almost 100% ASR, which proves their effectiveness when no defense system is used.
Resistance to STRIP. Table 2a shows the attack performance against STRIP. From the table, we can see that STRIP performs quite effectively defending backdoor attacks, especially for those using the BadNet and WaNet strategy, and that attacks using our strategy achieve the best performance against STRIP most cases. As a rough conclusion, we can say that in terms of stealthiness against STRIP: Our > WaNet > BadNet. Here we give the reason why our strategy performs well against STRIP. STRIP builds on the phenomenon that label prediction is quite robust to perturbations in the input when the trigger pattern occurs in the input, and it performs defense by removing samples with small deviations in label prediction when the input is perturbed. In our strategy, the trigger pattern is from the target class, the deviations in label prediction are also small

---

Under review as a conference paper at ICLR 2023
Table 3: Attack performance against (a) NAD, (b) ShrinkPad, and (c) DBD. We refer the reader to Appendix foor for results on BA.
(a) ASR against NAD
(b) ASR against ShrinkPad
(c) ASR against DBD
Dataset
BadNet
WaNet
Our
Dataset
BadNet
WaNet
Our
Dataset
BadNet
WaNet
Our
MNIST
10.84
10.55
33.01
MNIST
25.40
99.72
88.6
MNIST
100
88.75
100
CIFARIO
20.08
87.46
94.93
CIFARIO
34.75
62.29
87.74
CIFAR10
1.64
1.42
99.99
GTSRB 58.50
56,90
89.84
GTSRB
69.67
39.69
88.05
GTSRB
3.73
0.0
99.81
ColebA
12.43
19.70
37.54
CalebA
77.22
81.43
96.39
ColehA
0.0
0.0
99.17
for many benign samples of the target class. This makes it difficult to set threshold to distinguish between poisoned and benign samples, leading to the above observations.
Resistance Neural-Cleanse. Table 2b shows the performance of the attack against Neural- Cleanse. The asterisk indicates that Neural-Cleanse cannot correctly identify the attacker-defined target class Ct using the pattern norms, even if it had recognized the attacked model. This also indicates that the attack is very stealthy towards Neural-Cleand Cleanse and in this case may not compare the stealthiness of attacks based on their anomaly index values. From the table, it can be seen that the attack performed with strategy achieves the smallest value of Anomaly Index on MNIST. For the other three datasets, Neural-Cleanse cannot identify the attacker-defined target class of our attacks. This proves the great stealthiness of our strategy against Cleaase In comparison, the attacks using BadNet and WaNet strategies achieve larger Anomaly Index values and their attacker-defined target classes can be identified by Neural-Cleanse on all datasets except CelebA As an explanation for this phenomenon, we hypothesize that the inconspicuousness of our strategy against Neural- Cleanse stems from the practice of poisoning data in the hidden space as ISSBA, which causes the trigger pattern to differ depending on the input in the input space.
Resistance to NAD. Table Sa shows the attack performance against NAD. NAD is sensitive to its syper-parametery We selected the model with BA during the application of NAD. The optimizer and learning rate were adjusted so that BA does not drop more than 10% (otherwise the defense is useless as it degrades the benign performance too much). From the table we can see that attacks performed with our strategy achieve much higher ASRs than the baselines, and we can roughly conclude that in terms of stcalthiness against NAD: Our > WaNet > BadNet. Here we give the reason why our strategy performs well against NAD. Basically, NAD performs defense by preventing the activation of backdoor-speciff neurons through attention distillation. Our trigger pattern frequently occurs in benign samples of the target class, so it is difficult to prevent the activation of our trigger pattern. Otherwise, BA will drop significantly.
Resistance to ShrinkPad. Table 3b shows the attack performance against ShrinkPad. Similarly, when using ShrinkPad, we selected the model with BA. The padding size adjusted so that BA did not drop more than 10%. From the table, we see that the attacks performed with our strategy achieve significantly higher ASRs than the baselines all datasets except MNIST, where WaNet performs best. WaNet performs better than BadNet in most cases. These observations are in line with our expectations since BadNet uses patch-based trigger pattern, while WaNet and our strategy have the trigger pattern scattered throughout the input space. This makes attacks with WaNet and our strategy robust to input noise. Compared to our strategy, WaNet merges the trigger pattern directly with the input in the input space, while our strategy performs trigger pattern injection in the hidden space, This is likely the reason why our strategy performs better than WaNet against ShrinkPad. All in all, we can roughly conclude that in terms of stealthiness against ShrinkPad: Our > WaNet > BadNet.
Resistance to DBD. Table Belshows the attack performance against DBD. From the table, we can first see that DBD is very effective in defending attacks applied to the three color image datasets using the BadNet and WaNet strategies. However, it does not perform as well on MNIST and cannot defend against attacks performed with our proposed strategy. Our explanation for the first phenomenon is that all strategies work very efficiently on MNIST. Some poisoned samples were already fitted well at the second training stage. These treated as high credible samples and
8

---

Under review as a conference paper at ICLR 2023
(a) MNISST
CIFAR10
(c) GTSRB
[d) GolebA
1.0
1.00
100
100
- Random Xi
Our
40
40
20
20-
20-
0.1% 0.215 0.3%
0.4%5
0.5%
0.3%%
0.2%
0.3%
0.5%
0.1%%
9.2%
0.3%
0.4%
0.5%
0.1%
0.2%
0.3% 0.4% 0.5%
Raison-RRate
Poison-Rate
Poison-Rate
Figure 3: Attack performance by poison rate when using different strategies to select i
(a] MNIST
(b) CIFAR1O
(c) GTSRB
[d] ColebA
150
80-
80-
60
60
60-
60
Random
Our
40
40-
40
20-
20
0.1% 0.%% 0.7%
84%%
0.5%
0.2%
0,25
b.1%
0.4%
0.5%
0.1%
0.2%
0.3%
0.5%
0.1%
0.2% a. patts 0.5%
Ratton-Rate
Poison-Ratts RRae
Roison-Rate
Poison-Rate
Figure 4: Attack performance by poison rate when using different methods m.
selected for fine-tuning the model in the third stage, resulting in a high value of ASR due to the high attack efficiency. Such explanation also applies the phenomenon that occurs in attacks using our strategy, considering that our strategy works very efficiently on all datasets.
4.4 ABLATION STUDY
Influence of the selection at.- Here we explore the advantage of our proposed method in se- lecting the representative sample, 2t, as defined in section 3.2.1 For the study, we drew a random sample of the target class from the training dataset as xe and compared its performance with the proposed method defined in section 3 Figure 3 shows the comparison results. There, a dot line associated with a legend "Random" corresponds to the performance of the attack with the random strategy. As be seen from the figure, our proposed strategy generally performs better than the random strategy, especially when the poison rate is low. When the poison rate reaches 0.5%, even the random strategy quite effective. This proves the advantage and robustness of our proposed strategy, which uses patterns of the target class defined by the attacker as trigger patterns.
Influence of the setting of m. Here, we study the effectiveness of our proposed method for defin- ing the mask m. To conduct the study, we randomly select elements of m and set their values to 1, while the other elements are set to O. The value of n was set to the sum of the mask generated by our method. Figure shows the comparing results with our proposed method. Surprisingly, given ran- domly generated mask yn (the number of masked elements is the same as in our proposed method), strategy can still achieve great attack efficiency. One possible explanation for this phenomenon is that there are many patterns in he that satisfy the requirement of our strategy. Thus, is very likely that we can obtain suitable patterns using random mask.
5 CONCLUSION
In this paper, we present a new strategy for defining the trigger pattern of poison label backdoor attacks. Instead of using a rarely occurring pattern in benign data as the trigger pattern, patterns that occur frequently in benign samples of the predefined target class but rarely in samples of non- target classes are extracted as the trigger pattern. Accordingly, we present an effective technique to extract the trigger pattern and insert it into benign inputs for data poisoning. Experimental studies on several benchmark tasks show that our proposed strategy can significantly improve the efficiency and stealthiness of the attack.

---

Under review as a conference paper at ICLR 2023
REFERENCES
Devansh Arpit, Stanislaw Jastrzebski, Nicolas Ballas, David Krueger, Emmanuel Bengio, Maxin- der S Kanwal, Tegan Maharaj, Asja Fischer, Aaron Courville, Yoshua Bengio, et closer look at memorization in deep networks. In International conference on machine learning, Pp- 233-242. PMLR, 2017.
Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In 2019 IEEE International Conference on Image Processing (ICIP), pp. 101-105. IEEE, 2019.
Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks. In IJCAI, pp. 4658-4664, 2019.
Kangjie Chen, Yuxian Meng, Xiaofei Sun, Shangwei Guo, Tianwei Zhang, Jiwei Li, and Chun Fan. Badpre: Task-agnostic backdoor attacks to pre-trained NLP foundation models. In International Conference Learning Representations, 2022. URLhttts: /owpr///eee/eeeeeeeeeeeee net/ forum?
Id=MMn@BCQ9BBW
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint 1rXiv:1712005226 2017.
Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 11966-11976, 2021.
Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, pp. 113 113-125, 2019.
Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint 17X8::770.0077.0 2017.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 770-778, 2016.
Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. In International Conference on Learning Representations, 2022a.
Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. In International Conference on Learning Representations, 2022b. URL
net heee/foooummldd-ysss--oddd
Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong. Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning. In 2022 IEEE Symposium on Security and Privacy (SP), pp. 2043-2059. IEEE, 2022.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(1))6))))) 21:172)22222222 1998.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In International Conference on Learning Representations, 2021a.
Yiming Li. Tongqing Zhai, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor attack in the physical world. ICLR RobustML Workshop, 2021b.
Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transac- fions Neural Networks and Learning Systems, 2022a.
10

---

Under review as a conference paper at ICLR 2023
Yiming Li, Mengxi Ya, Yang Bai, Yong Jiang, and Shu-Tao Xia. BackdoorBox: A python toolbox for backdoor learning. 2022b.
Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 16463-16472, 2021c.
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against back- dooring attacks on deep neural networks. In International Symposium on Research in Attacks, Intrusions, and Defenses, pp. 273-29222200 Springer, 2018.
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack neural networks. 2017.
Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. Abs: Scanning neural networks for back-doors by artificial brain stimulation. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 1265-1282, 2019.
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In European Conference on Computer Vision, pp. 182-199. Springer, 2020.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pp. 3730-3738, 2015.
Bingxu Mu, Le Wang, and Zhenxing Niu. Adversarial fine-tuning for backdoor defense: Connect adversarial examples to triggered samples, 2022.
Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems, 33:3454-3464, 2020.
Tuan Anh Nguyen and Anh Tuan Tran. Wanet imperceptible warping- backdoor attack. In International Conference on Learning Representations, 2021. URL /tL[httts://ppereriieee
net/forummieee 1et.mmmmeeeeeeEEEeee....
Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. arXiv preprint 1rXiv:2105.12400 2021.
Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor at- tacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 11957- 11965, 2020.
Johannes Stallkamp, Mare Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Beneh- marking machine learning algorithms for traffic sign recognition. Neural networks, 32:323-332 2012.
Lichao Sun. Natural backdoor attack on text data. arXiv preprint arXiv:2006.1613 2020.
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethink- ing the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2818-2826, 2016.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks.
arXiv preprint arXiv: 2019.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks, In 2019 IEEE Symposium on Security and Privacy (SP). pp. 707-723. IEEE, 2019.
Kaidi Xu, Sijia Liu, Pin- Yu Chen, Pu Zhao, and Xue Lin. Defending against backdoor attack on deep neural networks. arXiv preprint arXiv:2002. /2 2020.

---

Under review as a conference paper at ICLR 2023
Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. Rap: Robustness-aware perturbations for defending against backdoor attacks on nlp models. arXiv preprint arXiv:2110.08311, 2021.
Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning requires rethinking generalization. In International Conference on Learning Rep- resentations, 2017. URL Btttttts:/// hnttps://operrrevewww opw.review..w.... net forum? Sysaummii--S88ydBB333
Pu Zhao, Pin-Yu Yu Chen, Payel Das, Karthikeyan Natesan Ramamurthy, and Xue Lin. Bridging mode connectivity in loss landscapes and adversarial robustness. In International Conference on Learning Representations (ICLR 2020), 2020.
12

---

Under review as a conference paper at ICLR 2023
Table Architectures and hyper-parameters of fene and fdee-
CIFARIO
GTSRB
MINIST
ColebA
Conv2D(3, 12, 2, I)
Conv2D(3, 12, 4, 1))
Conv 12, 4, 2, I)
Conv2D(3, 12, 4,
Conv2D(12, 24, 4, 2,
Conv2D(12, 24, 4,
Conv2D(12, 24, 4, 1)
Conv2D(12, 24, 4,
fene
Conv2D(24, 48, 4, 2, I)
Conv2D(24, 48, 4, I)
Conv2D(24, 48, 4, 0)
Conv2D(24, 48, 4, I)
Conv2D(48, 96, 4,
Conv2DT(4SS, 4, I)
Conv2DT(48, 24, 4, 2, 1)
Conv2DT(48, 24, 0)
Conv2DT 4, 1)
Conv2D1(24, 12. 4, I) 2, 2, 1)
Con42DT(24, 12, 4, 2,
Conv2DT(24, 12, 4,
Conv2DT(48. 24, 4. 1)
fdee
Conv2DT(12, 2,
Conv2DT((12, 1,4, I)
Conv2DT((44,
I)
Con-2DT(12, 3, 4,2, 1)
Lineur(766 768,
L6near(768, 256)
Linear 128)
Linear(1536, 1024)
fais
Lincur(256, 128)
Linear(256, 128)
Lincar(128, 64)
Lincar( (024, 128)
Linear( 128, 10)
Linear( 128, 43)
Linear(64, 10)
I Linear( 128, 8)
Table 5: BA x 100 and ASR 100 against NAD.
BA
ASR
Dataset
BadNet
WaNet
Our
BadNet
WaNet
Our
MNIST
97.14
97.73
97.32
10.84
10.55
33.01
CIFARIO
89.74
89.94
89.47
20.08
87.46
94.93
GTSRB
96.01
97.68
96.41
58.50
56.90
89.84
CelebA
77.39
76.95
76.71
12.43
19.70
37.54
A IMPLEMENTATION DETAIL
Architecture of fene and faee The auto-encoder architectures and bype-parameters for four data sets are listed in Table The encoder has several layers of CNN with relu function as the activate function. The decoder has two branches. One is regressive decoder (Reg Decoder) which consist of several transposed CNN layer. relu adopted as the activation function in each layer except for the last layer which uses the sigmoid function scale the output value in between (0, 1). The other branch is the classification decoder (Cls Decoder) which consists of several linear layers with relu function in the middle.
B MASK VISUALIZATION
Figure shoows the decoded representative input and their masked counterparts. From the figure, we can see that it inclines to extract the outline the representative input as the trigger pattern using the mask.
C STEALTHINESS STUDY
Table and
show BAs and ASRs of attacks against NAD, ShrinkPad, and DBD, respectively.
13

---

Under review as a conference paper at ICLR 2023
2
50
(a) (fer for MNIST
(b) fdee (hs) for CIFAR10
(c) (dec(le) for GTSRB
2
20
4
(d) [dec(m @ h.) for MNIST
(e) fdec(m (m @ h₂) for CIFAR10 10
(f) fdec(m 2 h.) for GTSRb
Figure Visualization of the decoded representative inputs and their masked counterparts.
Table 6: BA x 100 and ASR x 100 against ShrinkPad.
BA
ASR
Dataset
BadNet
WaNet
Our
BadNet
WaNet
Our
MNIST
97.35
99.12
97.15
25.40
99.72
88.69
CIFARI0
89.94
89.42
86.01
34.75
62.29
87.74
GTSRB
93.57
94.68
97.35
69.67
39.69
88.05
CelebA
75.92
77.90
78.20
77.22
81.43
96.39
Table 7: BA x 100 and ASR
100 against DBD.
BA
ASR
Dataset
BadNet
WaNet
Our
BadNet
WaNet
Our
MNIST
97.40
97.76
97.27
99.15
97.27
100
CIFARIO
86.51
84.58
87.39
1.64
1.42
99.99
GTSRB
93.38
93.02
93.40
3.73
0.0
99.81
CelebA
65.27
65.99
65.87
0.0
0.0
99.17
14


Reviews:
[{"review_id": "uLCXq3611KJ", "reviewer": "Reviewer_ns26", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes to find salient features of images of the target class in the encoded latent space with an auto-encoder, perturb the source image in its encoded representations with a learned mask, and decode the representation to form poisoned data for dirty-label data poisoning. Mask learning is performed with a presumably gradient-based optimization to minimize a combined loss. Experiments show that it is effective under low poison rates (0.1%) and can resist recent defenses.\n", "summary_of_the_review": "The paper's method is somewhat novel, but not very well motivated. The proposed method is not stealthy enough, and \"dirty-label\" has greater restrictions in applicability and easier to detect. It lacks discussion on transferability as a data poisoning attack. It also has many reproducibility issues.", "strength_and_weaknesses": "### Strengths\n* It appears to be quite effective with low poison rates, and can resist recent defenses.\n* The idea of masking the encoded representation is somewhat interesting.\n\n### Weaknesses\n* The added perturbation is very visible and the labels are also changed, and can be easily detected by human, as shown in Fig. 1(b).\n* Compared to the latest clean-label data poisoning methods (e.g. Sleeper Agent [1]), the proposed method further requires label-flipping and similar perturbation scale. It may be more practical for the attackers to consider clean-label variants.\n* Table 2(b): the anomaly index of GTSRB seems to far exceed the limit (2) of Neural-Cleanse. WaNet also did not report such a high anomaly for GTSRB.\n* The method may not be able to defend against MNTD [2].\n\n### References\n[1]: Souri H, et al. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch, ICML workshop 2022.\n\n[2]: Xu X, et al. Detecting AI trojans using meta neural analysis, S&P 2021.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "lQ_Hsuuoi4", "reviewer": "Reviewer_nDYn", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper proposes a novel backdoor attack that is efficient and stealthy. While the previous methods employ patterns that rarely occur\nin benign data as the trigger pattern, this paper suggests using patterns that frequently appear in benign data of the target class but rarely appear in other classes. This proposal both improves the efficiency of the attack and increases the difficulty or cost of identifying and mitigating the trigger pattern. The proposed attack shows good attack performance on four popular datasets and passes common backdoor defenses.", "summary_of_the_review": "Overall, the idea is novel and the paper is well written. I have some minor comments and I would love to see more defense results, particularly with the frequency-based defense.", "strength_and_weaknesses": "### Strengths\n- The proposed idea is novel and interesting. This proposal both improves the efficiency of the attack and increases the difficulty or cost of identifying and mitigating the trigger pattern.\n- The experiments well proves the effectiveness of the proposed algorithm.\n- The authors made a fair argument in the paragraph at the end of Page 6. They acknowledged that comparing backdoor methods by using their attack performance from a specific (default) configuration may be not so rigorous.\n\n### Weaknesses\n- In Equation 4, \\sigma is not defined.\n- The authors reported BA x 100, ASR x 100. It is preferable to show as percentage (%)\n- What was the reason to set the target class as 2 instead of 0 or 1?\n- I would love to see the results when using frequency-based backdoor defense [1]\n[1]. Zeng Y, Park W, Mao ZM, Jia R. Rethinking the backdoor attacks' triggers: A frequency perspective. In ICCV 2021 (pp. 16473-16481).\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "4: The contributions are significant, and do not exist in prior works.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "RBDPJD1LCXT", "reviewer": "Reviewer_xZDL", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes an algorithm for extracting backdoor triggers from clean training datasets to bypass existing backdoor defense methods due to the difficulty of defense posed by the fact that triggers are also widely present in clean samples. In addition, experiments show that this form of trigger can achieve a higher success rate with a better poisoning ratio.", "summary_of_the_review": "From the current understanding, this article still has no solved efficiency problem and validation of effectiveness. Also, the innovativeness still needs further clarification. Of course, I am looking forward to the author's reply to me at the rebuttal stage.", "strength_and_weaknesses": "Strength:\n1. the novelty and effectiveness of the proposed method.\n2. the paper conducts a large number of defense experiments and analyzes the algorithm effect from different defense methods.\n3. the method proposed in the paper can successfully achieve backdoor attacks with a lower poisoning ratio.\n4. The paper is written in a clear and easy-to-understand manner.\n\nWeaknesses:\n1. although this paper uses formal data symbolic description for the proposed method, there is still no framework diagram to help the method understanding, which makes the algorithm of the article slightly inferior in the narration and implementation process.\n2. although this paper introduces various attack methods in detail, it does not show more attack methods in experimental comparison, such as ISSBA. as a novel attack method, the authors should give more experimental comparison and analysis of the attack.\n3, the author mentioned in the paper the advantages of the algorithm can also be mentioned in the attack on high efficiency. But for this part, I don't seem to see more theoretical analysis (convergence) and related experimental proofs. I have reservations about this point.\n4. What is the main difference between the authors and ISSBA in terms of the formulation of the method? I would like the authors further to explain the contribution in conjunction with the formulas.\n\nSome Questions:\n1.How is the computational efficiency of extracting the trigger? Unlike previous backdoor attack algorithms, the method needs to analyze and extract data from the entire training dataset. Does this result in exponential time growth as the dataset increases?\n2. The effectiveness and problem of the algorithm are that it requires access to the entire training dataset. Have the authors considered how the algorithm should operate effectively when the training dataset is not fully perceptible?\n\nOverall:\nThe trigger proposed in this paper is novel, but the related validation experiments are not comprehensive, and the time complexity of the computation and the efficiency of the algorithm are not clearly analyzed. In addition, I expect the authors to further elucidate the technical contribution rather than the form of the attack.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "HtMZIGGPkm", "reviewer": "Reviewer_Q7gZ", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes a backdoor attack using features from the target class. Existing backdoor attacks usually use some pattern that does not relate to the target label, which could be identified by defense methods. This paper leverages the benign features from the target class as the trigger pattern to inject backdoor behaviors. Specifically, it selects a sample from the target class based on the prediction probability. It then utilizes an encoder-decoder structure to extract the feature representation of the target-class sample, which is combined with the feature representation of samples from other classes as trigger-injected samples (after decoded by the decoder). The number of the added features from the target-class sample is minimized using the classification loss. The evaluation is conducted on four datasets and a few model architectures. The results show the proposed attack can achieve high attack success rate and has better resilience to defenses compared to a few existing backdoor attacks.", "summary_of_the_review": "This paper is interesting and mostly well written. The novelty and the evaluation are however limited.", "strength_and_weaknesses": "Strength\n\n+ Interesting perspective of using target-class features as the trigger\n+ Well written\n\nWeaknesses\n\n- No threat model\n- Limited novelty\n- Unconvincing results against defenses\n- No comparison with a closely related backdoor attack\n- Missing evaluation on state-of-the-art defenses", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject