Rethinking Backdoor Data Poisoning Attacks in the Context of Semi-Supervised Learning
Authors: Marissa Catherine Connor
Vincent Emanuele
Venue: Submitted to ICLR 2023 (2023)
Keywords: data poisoning
backdoor attacks
semi-supervised learning

Abstract: Semi-supervised learning methods can train high-accuracy machine learning models with a fraction of the labeled training samples required for traditional supervised learning. Such methods do not typically involve close review of the unlabeled training samples, making them tempting targets for data poisoning attacks. In this paper we investigate the vulnerabilities of semi-supervised learning methods to backdoor data poisoning attacks on the unlabeled samples. We show that a simple poisoning attack using adversarially perturbed samples is highly effective - achieving an average attack success rate of 93.6%. We introduce a generalized attack framework targeting semi-supervised learning methods to better understand and exploit their limitations and to motivate future defense strategies.

Under review as a conference paper at ICLR 2023
RETHINKING BACKDOOR DATA POISONING ATTACKS IN THE CONTEXT OF SEMI-SUPERVISED LEARNING
Anonymous authors Paper under double-blind review
ABSTRACT
Semi Semi-supervised learning methods can train high-accuracy machine learning mod- els with a fraction of the labeled training samples required for traditional super- vised learning. Such methods do not typically involve close review of the unla- beled training samples, making them tempting targets for data poisoning attacks. In this paper we investigate the vulnerabilities of semi-supervised learning meth- ods to backdoor data poisoning attacks on the unlabeled samples. We show that a simple poisoning attack that influences the distribution of the poisoned samples' predicted labels is highly effective achieving an average attack success rate 93.6%. We introduce a generalized attack framework targeting semi-supervised learning methods to better understand and exploit their limitations and to motivate future defense strategies.
INTRODUCTION
Machine learning models have achieved high classification accuracy through the use of large, labeled datasets. However, the creation of diverse datasets with supervised labels is time-consuming and costly. In recent years, semi-superee sunersupereieed learning methods have been introduced which train models using small set of labeled data and a large set of unlabeled data. These models achieve comparable classification accuracy to supervised learning methods while reducing the necessity of human-based labeling. The lack of a detailed human review of training data increases the potential for attacks on the training data.
Data poisoning attacks adversarially manipulate a small number of training samples in order to shape the performance of the trained network at inference time. Backdoor attacks, one type of data poi- soning attack, introduce backdoor (or alternative classification pathway) into trained model that can cause sample misclassification through the introduction of a trigger (a visual feature that is added poisoned sample) (Gu et al., 2017). We focus our analysis on backdoor attacks which poison the unlabeled data in semi-superviss
learning. In this setting, backdoors must be introduced the absence of training labels associated with the poisoned images. Recent semi- supervieee learn- ing methods achieve high accuracy with very few labeled samples (Xie et al. 2020 Berthelot et al.) 2020 Sohn et al., 2020) using the strategies of pseudolabeling and consistency regularization which introduce new considerations when assessing the risk posed by backdoor attacks. Pseudolabeling assigns hard labels to unlabeled samples based on model predictions (Lee et al. (2013) and is respon- sible for estimating the training labels of unlabeled poisoned samples. Consistency regularization encourages augmented versions the same sample to have the same network output (Sajjadi et al.) 2016) and requires attacks to be robust to significant augmentations.
In this paper we analyze the impact of backdoor data poisoning attacks on semi-supervised learning methods by first reframing the attacks in setting where pscudolabels are used in lieu of training labels and then highlighting a vulnerability of these methods to attacks which influence expected pseudolabel outputs. We identify characteristics of successful attacks, evaluate how those character- istics can be used to more precisely target semi-supervised learning, and use our insights to suggest new defense strategies. We make the following contributions:
We show simple. black-box backdoor attacks using adversarially perturbed samples highly effective against semi-supervised learning methods, emphasizing the sensitivity of attack performance to the pseudolabel distribution of poisoned samples.

---

Under review as a conference paper at ICLR 2023
We analyze unique dynamics of data poisoning during semi- supervisd training and iden- tify characteristics of attacks that are important for attack success.
We introduce generalized attack framework targeting semi-supervised learning.
2 BACKGROUND
2.1 DATA POISONING
We focus on integrity attacks in data poisoning which maintain high classification accuracy while encouraging targeted misclassification. Instance- eattancetarggted attacks and backdoor attacks are two types of integrity attacks. Instance- targeetddt attacks aim to cause a misclassification of a specific example at test time (Shafahi et al., 2018: Zhu et al., 2019; Geiping et al.) 2020, Huang al., 2020; AAghakhani et al. 2021). While an interesting and fruitful area of research, we do not consider instance-targeted
attacks this paper and instead focus on backdoor attacks. Traditional backdoor attacks introduce triggers into poisoned images during training and adapt the images and/or the training labels to encourage the network to ignore the image content of poisoned images and only focus on the trig- ger (Gu et al.) 2017 Turner et al.) 2018 Saha et al.) 2020 Zhao et al.) 2020). They associate the trigger with a specific target label y/-
There are two types of backdoor data poisoning attacks against supervised learning which use differ- ent strategies to encourage the creation of a backdoor: dirty label attacks which change the training labels from the ground truth label (Gu et al. 2017) and clean label attacks which maintain the ground truth training label while perturbing the training sample in order to increase the difficulty of sample classification using only image-based features (Tuneer et al. 2019; Saha et al. 2020: Zhao et al. 2020). In both of these attacks, the labels are used to firmly fix the desired network output even as the images appear confusing due perturbations or having different ground truth class. Greater confusion encourages the network to rely on the triggers, a constant feature in the poisoned samples.
2.2
SEMI-SUPERVISED LEARNING
The goal of semi-supervised learning is utilize unlabeled data to achieve high accuracy models with few labeled samples. This has been a rich research area with a variety of proposed tech- niques (Van Engelen & Hoos, 2020; Yang et al. 202T). We focus on a subset of recent semi- supervised learning techniques that have significantly improved classification performance (Xie) al., 2020 Berthelot et al., 2020 (Shnn et al.) 2020). These techniques make use of two popu- lar strategies: consistency regularization and pseudolabeling. Consistency regularization is moti- vated by the manifold assumption that transformed versions of inputs should not change their class identity. In practice, techniques that employ consistency regularization encourage similar network outputs for augmented inputs (Sajjadi et al.] 2016 Miyato et al.] 2018 Xie et al. 2020) and often use strong augmentations that significantly change the appearance of inputs. Pseudolabeling uses model predictions to estimate training labels for unlabeled samples (Lee et al. 2013).
2.3 DATA POISONING IN SEMI-SUPERVISED LEARNING
While the focus of data poisoning work to date has been on supervised learning, there recent work focused on the impact of data poisoning attacks on semi-supervised learning. Poisoning attacks on labeled samples have been developed which target graph-based semi-supervised learning methods by focusing on poisoning labeled samples that have the greatest influence on the inferred labels of unlabeled samples (Liu et al.) 2019a Franci et al., 2022). Carlini (202T) introduced a poisoning attack on the unlabeled samples which exploits the pseudolabeling mechanism. This is an instance- targeted attack which aims to propagate the target label from confident target class samples to the target samples (from non-target class) using interpolated samples between them. Feng et al. (2022) poisons unlabeled samples using a network that transform samples so they appear to the user's s network like the target class. Unlike the the traditional goal of backdoor attacks of introducing backdoor associated with static triggers, they aim to adapt the decision boundary to be susceptible to future transformed samples.
Yan et al. (02I)) investigate perturbation baased attacks on unlabeled samples in semi-supervised learning similar us, but find a simple verturbation-basee attack has low attack success. Rather they
2

---

Under review as a conference paper at ICLR 2023
suggest attack (called DeHiB) that utilizes combination of targeted adversarial perturbations and contrastive data poisoning to achieve high attack success. We show settings which simple perturbation- based attacks are highly successful. Additionally, in Section 5.1 we discuss how our generalized attack framework encompasses the targeted adversarial perturbations used DeHiB.
3
BACKDOOR ATTACKS IN THE CONTEXT OF SEMI-SUPERVISED LEARNING
3.1 ATTACK THREAT MODEL
We consider setting in which a user has a small amount of labeled data X' for training classi- fication model. This limited labeled data is not enough to achieve the user's desired classification accuracy, so they collect a large amount of unlabeled data U from less trusted sources and train their model using the FixMatch suprrisuer learning method (Sohn et al. 2020) to improve aceuracy. The adversary introduces poisoned samples Up into the unlabeled dataset with the goal of creating strong backdoor in the trained network, resulting in samples being classified as a chosen target class Ye when trigger is present. To evade detection, the adversary tries to introduce this backdoor as soon as possible in training and maintain a high classification accuracy in the model trained with the poisoned samples. Because the poisoned samples only included in the unlabeled portion of the training data, the adversary can only control the image content for the poisoned samples and not the training labels. The adversary does have access the user's network architecture
3.2 FIXMATCH DETAILS
FixMatch achieves high classification accuracy with very few labeled samples. It important to un- derstand details of FixMatch (and similar methods) when aiming to evaluate its potential vulnerabil- ity to backdoor attacks. During training, the user has N₂ labeled samples X' (aq : (1,..,, N₂)) and N, unlabeled samples U {u,: i (1....,N, N.)). The supervised loss term is the standard cross-cntropy loss on the labeled samples. The unique characteristics of FixMatch are incorporated in the unsupervised loss term which utilizes pseudolabeling and consistency regularization. Fix- Match approximates supervised learning by estimating pseudolabels y for the unlabeled samples:
y = argmax (T.(()))))
(1)
where sa(-) is the network being trained and Tw.( is a function that applies "weak" augmentations, like horizontal flipping and random cropping, to the samples.
the confidence of the estimated label is above a user-specified threshold т, the pseudolabel is retained and used for computing the unsupervised loss term. We define m, as the indicator of which confident pseudolabels are retained: m, = (max(fe(t (T.... > T). The unsupervised loss term consistency regularization term which encourages the network output of strongly augmented sample to be the same as the pseudolabel estimated from the associated weakly augmented sample:
BB
la Em
Σ m, fo(T,
(2)
m
where B is the batch size, is FixMatch unlabeled sample ratio, H is a enoso-yntropy loss and (-) a function that applies "strong" augmentations like Augment (Cubuk et al., 2020).
3.3 BACKDOOR ATTACK VCINERABIILIYY CONSIDERATIONS
With the consistency regularization and pseudolabeling in mind, we rethink how poisoned samples in backdoor attacks may interact differently in cemi-supervised training than in supervised training.
Augmentation-Ron Robust Triggers Most backdoor attacks have been analyzed the absence of data augmentations to focus the impact of the attack itself without introducing augmentation founding factor. However, prior experiments have shown that data augmentation during training can significantly reduce the attack success rates (Li et al.) 2020 Schwarzschild et al. 2021). Therefore, to understand the potential effectiveness of backdoor attacks against FixMatch, it is important to use trigger that is robust to both the weak and strong augmentations that are crucial to its success. We
con-
3

---

Under review as a conference paper at ICLR 2023
prioritize the robustness of the triggers to data augmentation over their conspicuousness in order to understand the worst case attack potential before focusing on trigger imperceptibility.
Estimating Poisoned Labels In backdoor attacks supervised learning, the adversary can fix training label for every poisoned sample and apply triggers to samples that are confusing given these training labels. This forces the network to rely on the trigger to effectively classify poisoned sam- ples as their poisoned training labels. In attacks on the unlabeled data in semi-superrised learning, the adversary is unable specify training labels and instead the network is responsible for esti- mating pseudolabels during training. This reliance on the pseudolabels of poisoned samples adds new considerations when understanding backdoor attacks. First, the adversary can try to control the expected pseudolabels through the image content itself. Second, because the pseudolabels are estimated using the current network state, the training labels assigned to poisoned samples will vary during training as the network is updated. Finally, only poisoned samples with confident network outputs will impact the network updates. We suggest that attacks against semi-supervised learning be developed and understood by considering how an adversary may vary the image content in way that influences the expected pseudolabel outputs.
Perturbation-Basee Attack To analyze the impact of pseudolabel behavior on attack success, we use adversarial perturbations which have been shown to successfully influence estimated network outputs. Adversarial perturbations optimized to achieve misclassification of the images while constraining perturbation magnitude. We employ attacks that use untargeted adversarial perturba- tions to vary the expected pseudolabels. These attacks can vary from having no perturbations (i.e., the original training images with triggers added) to having large perturbations that significantly vary the image appearance. This is similar the clean-label backdoor attack from Turner et al. (2019). which uses projected gradient descent (PGD) adversarial perturbations (Madry et al.) 2018)) to make poisoned samples more confusing to the network. However, our attack does not have training labels to constrain the network outputs. With our attack threat model in which there are limited labeled samples, we acknowledge the practical difficulty the adversary would have in obtaining enough data to fully train a network for generating adversarial attacks. We view perturbation- a starting point for understanding how influencing pscudolabels can impact backdoor success from which future attacks can be built.
attacks as
To understand how the strength of adversarial perturbations impacts the distribution of estimated net- work outputs, we examine the outputs from a network trained using supervised learning on CIFAR- 10 training samples. Using PGD adversarial perturbations, we vary the constraint c on the foo norm of the perturbation magnitude. We apply triggers and weak augmentations to the perturbed images to model the poisoned samples in semi-supervised learning. Fig. Ta shows the impact of perturba- tion strength on pseudolabel outputs. The blue line is the average percentage of perturbed samples with estimated network outputs that match their ground truth class and the green line is the average entropy of the distribution of class outputs for perturbed samples. As the perturbation strength in- creases, fewer poisoned samples are estimated to be the ground truth label and the entropy of the distribution of network outputs increases, indicating the class estimates are distributed more evenly across all class outputs. For more granular view, Fig. Tb shows the distribution of network outputs for samples from a single class (class the airplane class) as we vary the perturbation strength. While this test is run against a fully trained network, it gives us useful insights for reasoning about the pscudolabels during semi -upervise learning. At low perturbation strength, we expect most poi- soned samples have their ground truth classes pseudolabels. At greater perturbation strength, we expect most poisoned samples will not have their ground truth classes as pseudolabels and instead their pseudolabels will be relatively evenly distributed across other classes.
4 ANALYSIS
We begin our analysis of the vulnerability of semi-supervised learning methods to perturbation- based attacks by considering the following experimental setup.
Datasets We generate attacks using the CIFAR-10 10 dataset (Krizhevsky et al., 2009 with 50,000 training images and 10,000 test images from 10 classes. We chose this dataset because it is a standard benchmark dataset used for studying both semi-supervised learning and data poisoning.
4

---

Under review as a conference paper at ICLR 2023
Percent Correct Predicted Label
Predicsed Label Distribution with Varving Pertarbation Strength
100
Entropy Preiilenoo iieend Tabola
Predicted Label Percentags
100
80
60
2/235
1/230
GD
4/200
8/230
40
10
16,250
222 203
20
20
2/255
8/255
16/255
52 225
Classoss
(a) Estimated Class Outputs
(b) Distribution of Pseudolabels
Figure 1: Predicted labels of perturbed samples. (a) Percentage of perturbed training samples with the ground truth class as the estimated label (blue circle line) and the entropy of the distribution of predicted labels (green triangle line) as is varied. (b) Distribution of predicted labels for samples from class (airplane) as is varied.
Semi-Supervised Learning Methods We perform analysis on FixMatch (Sohn al. 2020) which achieves a classification accuracy of 94.93% on CIFAR-10 with only 250 labeled sam- ples. We largely follow the experimental details from (Sohn et al. 2020), using a WideResNet- 28-2 (Zagoruyko & Komodakis 2016) architecture, RandAugment CCbuk et al. 2020) for strong augmentation, and horizontal flippigg and cropping for weak augmentation. We experiment with 250 labeled samples. Because we are focused on analyzing the attack dynamics and define threat model in which the adversary wants introduce the backdoor as soon as possible during training, we limit each experiment to 100,000 training steps rather than the 220 training steps used in the original FixMatch implementation. We found that these shorter training runs achieve relatively high classification accuracy (around 90%) and attacks often reach stable state long before the end of the runs. See Appendix for a detailed description of the FixMatch training implementation.
A
Poisoning Attack Similar to clean-label backdoor attacks, we perturb our poisoned samples using adversarially trained ResNet models (Madry et al., 2018). We define the target class the attack as the ground truth class from which we select poisoned samples to be perturbed. Triggers added after the images are perturbed. As discussed in Section 3.3] we begin our analysis using augmentation-roous triggers. In particular, we use the four-corner trigger, suggested in TTurner al. (209)) for its invariance to flipping and visibility under random cropping (see Fig. for examples of perturbed and triggered images). This trigger robust to strong augmentations. We define poisoning percentages with respect to the entire training set.
Metrics We analyze two metrics when determining the success of backdoor attacks against semi- supervised learning methods. First is the test accuracy which is the standard classification accuracy computed on the test images. Second is the attack success rate which the percentage of non-target samples from the test set that are predicted as the target class when triggers are added to them. This indicates the strength of the backdoor in the trained network.
4.1 SUCCESS OF SIMPLE PERTURBATION-BAAE ATTACKS
We examine the performance of simple perturbation-based backdoor attacks as we vary the con- straint on the magnitude of the adversarial perturbations (see Fig. 2ap. For each e, we run five trials, varying the target class for each run from classes 0-4, and poison 1% of the entire dataset (i.e., 500 target class samples). The poisoned samples are perturbed and have the four corner trigger added. We compare the performance of the attacks against supervised learning (blue line) and semi- supervised learning (green line). Note these perturbation- when the adversary sets training labels, are the same as clean-label backdoor attacks (Turner et al.) 2019). The test accuracy is stable as we vary perturbation strength and the resulting accuracy with semi-supervised learning is slightly lower than the accuracy with supervised learning. This is pected because supervised learning uses all the training labels, and we are analyzing the shorter FixMatch training runs which do not reach their maximum test accuracy detailed above.
attacks against supervised learning,
5

---

Under review as a conference paper at ICLR 2023
Succees Hate
Test Accurscy
Atlack Succrss
1/255
Attack Success Rate
1nf
Attack Success Rate
Teai Accurary
20
60
60)
40
20
8SL
2/260 9/260 16/266
02 02/200
2/306
8/266 16/266
12/266
Perturiattin Strongth (E)
Perturbation Strougth (8)
Targer
Class
(b)
Figure 2: (a) Performance of attacks against supervised learning (blue circle line) and semi- supervised learning (green triangle line) with varying c. (b) Attack success rate from weak pertur- bation attack (c 1/255) as the target class is varied.
These results show several interesting characteristics of the performance of backdoor attacks. First, the attacks against semi-supervised learning are highly successful for moderate perturbation strengths with an average attack success rate of 93.6% for the attacks with = 8/255 compared to an average attack success rate of 82.58% for the attacks on supervised learning. Second, there large variation in the attack success rates for weak perturbations. Fig. 2b shows the attack suc- cess rate for each attack against sumi-supervised learning with e = 1/255. While several attacks have very high attack success rates, the attack success rates for the attacks against classes O, 1, and are low. When comparing against supervised learning, the average attack success rate for weak perturbation attacks is high but the attacks not consistently effective across target classes.
Turner et al. 2019) motivated the creation of their clean-label backdoor attacks against sueprvised learning using the fact that poisoned samples with the ground truth training label and no perturba- tions resulted in low attack success rates. We confirm this through the relatively low average attack success rate of 32.9% from unperturbed samples (e 0) against supervised learning. However, the unperturbed attack against semi- semi-supervised learning is surprisingly effective with an average attack success rate of 73.7% while also having the high variance we see with the now-petuurbation attacks (see Fig. for the attack success rate per target class). The final notable characteristic is the very low attack success rate for large perturbation attacks. While attack success rates against super- vised learning continue to increase with larger perturbations, the attacks fail against semi semi-supervised learning. In Section we discuss the possible reasons for this attack behavior.
4.2 DYNAMICS OF ATTACK SUCCESS
To understand the dynamics of backdoor attacks against semi-supervised learning, we examine the evolution of the attack success rate during training. Fig. Fag. compares the attack success rates during training between supervised learning and semi-supervised learning. In supervised learning, which uses a multi-step learning rate scheduler, the attack success rate increases gradually from early in training with jumps at steps down in the learning rate. By contrast, the attack success rate during semi-supervised learning remains low for many training steps until a point in training at which rapidly increases to a high attack success rate where it remains throughout the rest of training. This suggests that there is tipping point at which the network forms backdoor that strengthens rapidly. Fig. 3b shows details of the type of pseudolabels the poisoned samples have during training for attacks with weak, moderate, and strong perturbations (e 2/255, 8/255, 32/ /25 respectively). The blue lines indicate the percentage of poisoned samples that are confidently estimated as the target class (i.c., the predicted confidence in the target class is above the threshold r). The orange lines indicate the percentage of poisoned samples that are confidently estimated as a non-target class. The green lines show the percentage of poisoned samples in which the predicted class estimates do not surpass the confidence threshold. The dashed red line is the attack success rate for reference. Of interest are the weak and moderate perturbation attacks in which the percent of poisoned samples with confident target class estimates increases steadily until a point at which nearly all poisoned samples become confident in the target class very rapidly, even if they were previously confident in another class. This suggests that as the backdoor begins to strengthen, it results in poisoned samples which were previously confusing to the network being assigned the target class pseudolabel.

---

Under review as a conference paper at ICLR 2023
Supervised Learning
Semi-SSueer Supervised Learning
Attuck Sucvess Rote
Sucreess
13
Largel class:
10
Exrget chow:
Earget closs, 3
chess:
Training Step
Training Step
(a) Attack Success Rate Training Dynamics
Percent of PPoisoeed Samp
6 2/ 22555
8/255
32/255
www www
03
Confident Target
Confident Non-Tanget
Coufdence
20
20
3000
HICKI Q001 Trsining Step
5000
103000
2000
1933)
6,000
(000)
100000
"1
33330
12500
12000) 40033
100m
Training Step
Training Step
(b) Pscudolabel Behavior
Figure 3: (a) Attack success rate evolution during supervised learning (left) and semi-supervised learning (right). (b) Evolution of the pseudolabel types at various e. The solid lines show the percentage of poisoned samples confident in the target class (blue), confident in non-target class (orange), or not confident in any class (green). The dashed pink line shows the attack success rate.
5 DISCUSSION
In the previous section, showed that simple perturbation perturbation-bbsed attacks very successful against semi-supervised learning models. These attacks use untargeted black-box adversarial perturbations that are generated from adversarially trained networks. In addition the results above showing the success of attacks using weak and moderate perturbations, Appendix shows the performance of the attacks with pretrained networks and as we vary the number of labeled samples, the percentage of poisoning, the type of trigger, and the semi-supervised learning technique. In all of these cases, we see that the moderate perturbation attacks with augmentation-Pen As we work to understand the reasons for attack success and failure semi-supervised learning, we recognize that the perturbations influence two major factors that impact attack performance; the distribution of estimated pseudolabels and the clarity of class-specific features in the poisoned samples. We reason about the performance of the perturbation
triggers are highly effective.
attacks by discussing how
different perturbation strengths impact these two factors.
When the perturbations are weak or nonexistent, most poisoned samples will receive confident pseu- dolabels corresponding the ground truth class label. The poisoned samples will have triggers but they will also have clear harget-class-spcifff features that the network can use for classification, giv- ing the network little reason to rely on the triggers. Notably, even in the weak perturbation attacks against semi-supervised learning, we are seeing high attack success rates for several target classes. However, weak perturbation attacks against some target classes, like classes (automobile) and (ship) shown in Fig. [2b] result in weak backdoors. This may indicate that some classes have more distinct features that the network can rely on more strongly. weakening the backdoor. The clean label backdoor attack against supervised learning encourages additional reliance on the trigger by increasing perturbation strength while fixing the training label as the ground truth class, making the samples more difficult to classify. Employing the same technique of increasing perturbation strength in the hope of improving attack performance against semi-supervised learning comes with the additional complication of the perturbations leading to different pseudolabel outputs.
We see the impact of this complication in the strong perturbation tests in which most of the samples have pseudolabels that confident in non-target classes, Fig. [36] Because the perturbations are untargeted, strong perturbations result in high entropy pre- dicted pseudolabels distributed across many classes, as in Fig. Ta Therefore, the network
in the plot of c = 32/255 from
7

---

Under review as a conference paper at ICLR 2023
sees samples containing triggers associated with several different classes, leading the network to ignore the trigger as a nuisance feature that does not aid in classification. This shows us how the de- pendence of supervised learning on pscudolabels limits the effectiveness of perturbation- based attacks at perturbation strengths that causes too many confident non-target class pseudolabels.
Moderate perturbation strength attacks are middle ground in which many poisoned samples will receive confident target class pseudolabels but several samples will be confidently classified as a non-target class or be confusing to the network (the orange and green lines in Fig, (bb). These confusing samples will encourage the network to rely more heavily on the triggers, strengthening the backdoor (as seen in the high attack success rate for = 8/255 attacks in Fig. 2ap.
This analysis suggests that consistently successful backdoor attacks require poison samples that have a pseudolabel distribution heavily concentrated on one class, which can form a weak backdoor, as well as subset of poisoned samples that are confusing to the network, which can strengthen the backdoor. Next we discuss a generalized attack framework which moves beyond perturbation attacks to more broadly understand the necessary components for attack success and what leads to attack failure.
5.1 GENERALIZED ATTACK FRAMEWORK
Until now we have been analyzing attacks in which all the samples have the same perturbation strength. This directly links the likely pseudolabel distribution with the difficulty for network to classify samples. As the perturbation strength increases, the samples become harder to the network to classify (encouraging strong backdoor) but the entropy of the pseudolabel distribution also in- creases (encouraging the network to ignore the trigger). We decouple these two factors using a generalized attack framework which defines attacks that are composed of samples that can be used to create a weak backdoor Upw and samples that are used to strengthen the backdoor Ups. The portion of samples from each of these categories is defined by A: N, >|Upnol (1 p)s Weak backdoor-creating samples should be designed to have the same pseudolabel which will be the target class. These samples can be unperturbed samples, weakly perturbed samples, or samples perturbed with strong, targeted adversarial perturbations that are expected to have confident target class pseudolabels.
samples should be confusing the network and they should initially have low confidence pseudolabels or confident non-target pseudolabels. These sam- ples can be strongly perturbed samples, unperturbed samples from a class other than the target class, noisy samples, or samples interpolated between target class samples and non-target class samples.
Backkooo-sttregthemmee
We use this generalized attack framework to generate attacks targeting the automobile class (class 1) with results shown in Fig. Fig. 4a shows attacks in which Up.. pu contains unperturbed samples and Ups contains samples perturbed with e = 16/255. As À is decreased from I to 0.95, 0.4 and O, the attack first becomes more successful with the addition of backdoor strengthening samples. However, too many backdoor strengthening samples causes the attack to fail. Fig. [hoss attacks in which U ww contains perturbed samples with e 8/255 and Ups contains samples perturbed with e = 32/255. At X = 0.95, the attack becomes slightly more effective through the addition of only 25 strongly perturbed samples. However, introducing more strongly perturbed samples () 0.75) leads to attack failure. These results highlight the benefits of the generalized attack framework varying À can make ineffective attacks more successful, make already successful attacks more successful, and make successful attacks fail.
The large variation in attack performance due to relatively small variations in the portion of samples that are confusing to the network suggests potential focus point for defenses against these types of attacks on semisuuper learning. The inclusion of small number of very confusing samples with triggers significantly reduces the impact of the attack.
While our analysis began focused on perturbation- based attacks, our results suggest that consis- tently successful attacks do not require perturbed samples but instead they require a large portion of poisoned samples that result in the same pseudolabel and small portion of poisoned samples that are confusing to the network. This combination is accomplished by moderate perturbation attacks but may also be accomplished with other combinations of weak backdoor-creatte samples. This suggests flexibility for adversaries which may not require them to train a robust network for generating adversarial perturbations, and highlights considera- tions for users when understanding the vulnerabilities of semi-supervised learning methods.
samples and
wakkdooo--trengthennin
8

---

Under review as a conference paper at ICLR 2023
Attork Sucers Rate
114
Attart Stversee Rate
Attack Sarees Hate
All 22/
Umpertired
5/% 18s
All 2355
Mr to 2005
16 rass
(a)
(b)
Figure 4: Generalized attack performance (a) Unw are unperturbed samples from the target class, Ups are perturbed samples with 16/255 for X = 1. 0.955, 0.6, 0,6,0000 (b) Upm perturbed samples with 8/255,, us perturbed samples with 32/255 for À 0.95 0.75, O.
5.2 DEFENSES
We view our analysis of perturbation-bant attacks against semi-supervised learning and our intro- duction of generalized attack framework starting point towards understanding and defending against backdoor attacks targeting semi-supervised learning. We showed that backdoor attacks are very effective against semi-supervised learning in certain settings (i.e., with augmentation-robut triggers and moderate perturbation strength) but fail in others. This knowledge can be used to define the maximally effective attacks which can be the focus of proposed defenses.
Standard defenses that probe networks after they are trained (Liu et al. 2017: Kolouri et al. 2020 Liu et al. 2018 2019b; Wu & Wang 202T) should work similarly on networks trained using both supervised and semi-supervised learning because backdoor attacks have the same goal in both of those cases, Other established defenses focus on cleansing the training data by identifying poisoned samples (Chen et al. 20188] Tran et al. 2018) or reverse-engineering triggers (Wang et al. 2019
Qiao et 2019 Guo et al., 2019). Both activation clustering (Chen et al. (018)) and the spectral signature defense (Tran et al. (2018) identify poisoned samples by estimating clusters likely to in- clude poisoned samples using training labels which are not available in unlabeled data. Defenses that reverse-engineer triggers may more easily identify the conspicuous, augmentation-robun four corner trigger used our analysis. This motivates future investigation into less conspicuous triggers that are also robust to significant data augmentations.
There are unique characteristics of the attacks against semi-supervised learning that suggest av- enues for future defenses. First, the labels assigned poisoned samples in semi-supervised learn- ing vary during training. As we see in 3b) many of the poisoned samples are originally classified with pseudolabels other than the target class. This suggests that there may be an effective defense that eliminates samples that rapidly change their pseudolabel during training, limiting the backdoor strengthening samples from influencing the network. Second, we see in Figs. [a] and 4 that poi- soned samples that have confident pseudolabels associated with several classes other than the target class significantly reduce the attack success rate. This suggests further investigation into how these samples impact the attack success and how defender may use these qualities to create a defense.
CONCLUSION
We analyzed the effectiveness of backdoor attacks on unlabeled samples in semi-supervised learn- ing when the adversary has no control over training labels. This setting requires rethinking of attack development which focuses on the expected distribution of pseudolabels for poisoned sam- ples and the difficulty in recognizing their class-specific features. We showed that simple attacks with moderate adversarial perturbations and augmentation-roouss triggers were consistently effec- tive against supervupe learning, and we defined a generalized attack framework which can be used separately define weak backdoor-genee generating samples and seeekooor-ttrnntheee This work highlights a serious vulnerability of semi-supervised learning to backdoor attacks and suggest unique characteristies of these attacks that could be used for targeting defenses in the future.
samples.

---

Under review as a conference paper at ICLR 2023
7 ETHICS STATEMENT
In this paper we strived to be upfront and honest about the scope of the work and its limitations so the reader has fair understanding of what did. We highlighting a vulnerability of semi- supervised learning models that could be exploited by bad actors. However, we find it important to share this vulnerability with the community so practitioners can be aware of motivating them to check their trained models thoroughly and inspiring additional work in developing defenses against this type of attack.
REPRODUCIBILITY STATEMENT
In order to ensure reproducibility, we clearly present details our implementations including net- work architectures, network parameters, and additional details that found important for optimiz- ing performance of our models. These details are presented in the beginning of Section 4 as well Appendix Sections A D In Appendix Sections A C we also link github repositories, code, and data that can be used for running FixMatch, generating perturbed samples, and adding triggers to poisoned samples. Finally, we provide zip file in supplementary material including example poi- soned samples for 0, 2, 4, 8, 16, 225 that attack class 2 as well example code showing how to incorporate those poisoned samples into CIFAR-10 dataset for training.
REFERENCES
Hojjat Aghakhani. Dongyu Meng, Yu-Xiang Wang. Christopher Kruegel, and Giovanni Vigna. Bullseye polytope: A scalable clean-label poisoning attack with improved transferability. In 2021 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 159-178. IEEE, 2021.
David Berthelot, Nicholas Carlini, Ekin D Cubuk, Alex Kurakin, Kihyuk Sohn, Han Zhang, and Colin Raffel. Remixmatch: Semi-super learning with distribution alignment and augmenta- tion anchoring. International Conference on Learning Representations, 2020.
Nicholas Carlini. Poisoning the unlabeled dataset of (Semi-Superrised) learning. In 30th USENIX Security Symposium (USENIX Security 21), pp. 1577-1592, 2021.
Bryant Chen, Wilka Carvalho, Nathalic Baracaldo, Heiko Ludwig. Benjamin Edwards, Taesung Lec, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXhv:1811.03728. 2018.
Ekin Cubuk, Barret Zoph, Jonathon Shlens, and Quoc Le. Randaugment: Practical automated data augmentation with reduced search space. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition workshops, pp. 702-703, 2020.
Le Feng, Sheng Li, Zhenxing Qian, and Xinpeng Zhang. Unlabeled backdoor poisoning in semi- supervised learning. In 2022 IEEE International Conference on Multimedia and Expo (ICME), pp. 1-6. IEEE, 2022.
Adriano Franci, Maxime Cordy, Martin Gubri, Mike Papadakis, and Yves Le Traon. Influence- driven data poisoning in graph-based semi-supervised classifiers. In 2022 IEEE/ACM 1st Inter- national Conference Al Engineering Sooffwerrin-Softwaree Engineering for Al (CAIN), pp. 77-87. IEEE, 2022.
Jonas Geiping, Liam Fowl, W Ronny Huang. Wojeiech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches' brew: Industrial scale data poisoning via gradient matching. arXiv preprint (wXXi:2009.022766 2020.
Tianyu Gu, Brendan Dolan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the 2017.
machine learning model supply chain. arXiv preprint
Wenbo Guo, Lun Wang, Xinyu Xing, Min Du, and Dawn Song. Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in ai systems. arXiv preprint 1rXi:19088.01633 2019.
10

---

Under review as a conference paper at ICLR 2023
W Ronny Huang. Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. Metapoison: Prac- tical general-purpose Systems, purpose clean-label data poisoning. Advances in Neural Information Processing 2020.
Soheil Kolouri, Aniruddha Saha, Hamed Pirsiavash, and Heiko Hoffmann. Universal litmus patterns: Revealing backdoor attacks in cnns. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition, pp. 301-310, 2020.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Dong-Hyun Lee et al. Pseudo-label: The simple and efficient semi-supervised learning method for deep neural networks. In Workshop on challenges in representation learning, ICML, volume 3, pp. 896, 2013.
Yiming Li, Tongqing Zhai, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shutao Xia. Rethinking the trigger of backdoor attack. arXiv preprint arXiv:2004. 04692, 2020.
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against back- dooring attacks deep neural networks. In International Symposium on Research in Attacks, Intrusions, and Defenses, pp. 273-294. Springer, 2018.
Xuanqing Liu, Si Si, Xiaojin Zhu, Yang Li, and Cho-Jui Hsieh. A unified framework for data poi- soning attack to graph-based semi-supervised learning. arXiv preprint arXiv: 14147, 2019a.
Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. Abs:
Scanning neural networks for back-doors by artificial brain stimulation. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 1265-1282, 2019b.
Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural trojans. In 2017 IEEE International Conference Computer Design (ICCD), pp. 45-48. IEEE, 2017.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, To- wards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations, 2018. URL/tttps: httttpps//operreviees www.//eet///otineeeeeeeee forum
Takeru Miyato, Shin-ichi Maeda, Masanori Koyama, and Shin Ishii. Virtual adversarial training: a regularization method for supervised and semi-supervised leamnng. IEEE transactions on pattern analysis and machine intelligence, 11(8):1979-199) 2018.
Ximing Qiao, Yukun Yang, and Hai Li. Defending neural backdoors via generative distribution modeling. arXiv preprint arXiv:1910.04449, 2019.
Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor at- tacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pp. 11957- 11965, 2020.
Mehdi Sajjadi, Mehran Javanmardi, and Tolga Tasdizen. Regularization with stochastic transfor- mations and perturbations for deep semi-supervised learning. Advances in neural information processing systems, 29, 2016.
Avi Schwarzschild, Micah Goldblum, Arjun Gupta, John P Dickerson, and Tom Goldstein. Just how toxic is data poisoning? unified benchmark for backdoor and data poisoning attacks. In International Conference on Machine Learning, pp. 9389-9398. PMLR, 2021.
Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras. and Tom Goldstein. Poison frogs! targeted clcan-label poisoning attacks on neural networks. arXiv preprint arXiv:1804.00792 2018
Kihyuk Sohn, David Berthelot, Chun-Liang Li. Zizhao Zhang, Nicholas Carlini, Ekin D Cubuk, Alex Kurakin, Han Zhang, and Colin Raffel. Fixmatch: Simplifying semi-supervised learning with consistency and confidence. arXiv preprint arXiv:2001.07683, 2020.

---

Under review as a conference paper at ICLR 2023
Brandon Tran, Jemry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. arXiv preprint arXiv:1811.006300 2018.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Clean-label backdoor attacks. 2018.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv: 2019.
Jesper E Van Engelen and Holger H Hoos. A survey on semi-supervised learning. Machine Learn- ing, 109(2):373-440, 2020.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 707-723. IEEE, 2019.
Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models. Ad- vances Neural Information Processing Systems, 34, 2021.
Qizhe Xie. Zihang Dai, Eduard Hovy, Thang Luong, and Quoc Le. Unsupervised data augmentation for consistency training. Advances in Neural Information Processing Systems, 0916256-6266 2020.
Zhicong Yan, Jun Wu, Gaolei Li, Shenghong Li, and Mohsen Guizani. Deep neural backdoor in semi-supervised learning: threats and countermeasures. IEEE Transactions on Information Forensics and Security, 16:4827-4842, 2021.
Xiangli Yang, Zixing Song, Irwin King, and Zenglin Xu. A survey on deep semi-supervised learning. arXiv preprint arXiv:2103.005:: 2021.
Sergey Zagoruyko and Nikos Komodakis. 1rX1::1605.07144, 2016.
Wide residual networks.
arXiv preprint
Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. Clean- label backdoor attacks on video recognition models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. #4443-14452 2020.
Chen Zhu, W Ronny Huang, Hengduo Li, Gavin Taylor, Christoph Studer, and Tom Goldstein. Transferable clean-label poisoning attacks on deep neural nets. In International Conference on Machine Learning, pp. 7614-7623. PMLR, 2019.
A FIXMATCH TRAINING DETAILS
Note: This section begins the supplementary appendix.
For the FixMatch implementation, closely follow the training set up from (Shnn al. (0200) We use a WideResNett28-2 Zagoruyko & Komodakis] (016) architecture, RandAugment (Cubuk al.) 2020) for strong augmentation, and horizontal flipping and cropping for weak augmentation. We use an SGD optimizer with momentum of 0.9, a weight decay of 5 x 10-4, and Nesterov momentum. Like (Shnn et al. (2020). we use cosine learning rate decay and quoting from them, we T where 17 is the initial learning rate, & is the current training step, and is the total number of training steps." We run 25,000 training epochs and each epoch runs through all the batches of the labeled data. Therefore, with 250 labeled samples, there are four steps per epoch and 100,000 steps total. We report the performance on the exponential moving average of the network parameters. We ensure even distribution of classes in the labeled data. Additional training parameters are shown in Table We found the following public github repository a good guide implementing FixMatch: flink to be included in final paper].
set the "learning rate to ycoss
16K
12

---

Under review as a conference paper at ICLR 2023
Table 1: Training parameters for FixMatch
FixMatch Training Parameters
batch size (B): 64
number of epochs: 25000
initial learning rate (1)): 0.03
total number of training steps (f): 22
poisoning percentage (percentage of entire dataset): 1% (500 samples)
number of labeled samples: 250
confidence threshold (7): 0.95
P.:
dy:
1/255
2/255
4/255
8/255
16/255
32/255
Figure 5: Poisoned images with increasing perturbation strength and the four corner trigger.
B ADVERSARIAL PERTURBATION DETAILS
For our perturbation bassd attacks we used samples that were perturbed using PGD attacks against
an adversarially trained network. For 8, 16, 32/255 we used perturbed samples provided by [details will be included in final paper]. For = 1, 4/255 we used perturbed samples generated against adversarially trained network. The adversarially trained network was a ResNet-50 using 8/ 8/255 for an foo norm. We obtained the weights for the network from [details will be included in final paper].
C POISONED SAMPLE DETAILS
We used the four comerr trigger suggested in Turner et al. (2019). following the example from [details will be included in final paper], for creating the attack. Fig. shows an example of Alivessaiially-peturbbbe poisoned images with the four corner trigger.
D SUPERVISED LEARNING DETAILS
For supervised learning we also used a WideResNet-22-9 architecture and RandAugment data aug- mentation during training. We used SGD optimizer with momentum of 0.9 and weight decay 2 10-4 We used a multi-step learning rate scheduler that reduced the learning rate by 7 = 0.1 epochs 40 and 60. To stay consistent with our FixMatch experiments, we report the performance on the exponential moving average of the network parameters.
Table 2: Training parameters for supervised learning
FixMatch Training Parameters
batch size: 128
number of epochs: 100
initial learning rate (7): 0.1
poisoning percentage (percentage of entire dataset): 1% (500 samples)
13

---

Under review as a conference paper at ICLR 2023
Attack Success Rate: E 0
100
Attack Success Rate
80
10
20
0
2
3
8
9
T Target
Class
Figure 6: Attack success rate vary target class for attacks with unperturbed samples.
Atlack Success Rate
Test. Accuracy
100
100
Class-ffess Lion Accursay (Percent)
Attock Sutress Rate
80
10
-10
20
20
35
5
Targel
Clossi
Targel
Clusa
Figure 7: Attack performance as vary target class for moderate perturbation attacks with 8/255
E ADDITIONAL SEMI-SUPERVISED LEARNING EXPERIMENTS
In this section we show results of additional experiments we ran to determine the attack performance varied in different settings.
Varying Target Class As we showed in Fig. 2b for attacks with weak perturbations, the attack success rate can vary significantly. The attack success rate also varies for attacks that use unperturbed samples, with some attacks achieving very high attack success rates (see Fig. O However, for attacks with moderate perturbation strength (like = 8/255) we see fairly consistent attack success rates vary the target class (See Fig. 7
Varying Poisoning Percentage We examined the impact poisoning percentage on attack perfor- mance for moderate perturbation attacks (e 8/255) in Fig. Note that the poisoning percentage with respect to all 50,000 training samples the CIFAR-10 dataset. Therefore 0.08% poisoning 40 poisoned samples and 5% poisoning is 2,500 poisoned samples. The attacks fail for poisoning percentages less than 0.6% after which the attack success rate increases and then plateaus.
Varying Number of Labeled Samples We examine the impact of the number of labeled samples both with and without pretraining, Fig. Sa shows the performance as we vary the number of labeled samples from 250 4,000 and 40,000. All attacks are successful but the attack with 4,000 labeled samples has lower attack success rate. Notably these are results for one experiment per N₂ so there may be natural variations leading to the 4,000 labeled sample run achieving the lowest attack success rate which would be evened out by averaging over multiple runs. Fig. 9b shows the attack perfor- mance as we vary the number of labeled samples and perform 20,000 training steps of pretraining with only the labeled samples prior to adding in the unlabeled samples and consistency regulariza- tion. The performance looks similar as without pretraining except with slightly lower attack success rates.
14

---

Under review as a conference paper at ICLR 2023
Attack Succeess Rate
Test Accuracy
100
100
Attack Suncera Rate
80
Test Accurary
60
60
0
0.08
0.3
1:26
5
0.08
D.3
1.26
Percenlage Poisoning (Total Dataeel)
Percenllage Poisoning (Tolal Datwell)
Figure 8: Attack performance as we vary poisoning percentage.
Attack Suceess Rate
Test Accuracy
100
100
Attack Succus Rate
80
80
Text Accuracy
60
60
0
10000
10000
Number of Labeled Samples
Number of Labeled Samples
(a) No Pretraining
A A1ackk Success Rale raired
Test. Accuracy Pret
100
100
Attark Success Rate
80
Test Accuracy
0
260
1000
40000
0 260
1000
40000
Number of Labeled Samples
Number of Labeled Samples
(b) Pretraining
Figure 9: Attack performance we vary the number of labeled samples Ne with and without pretraining.
15

---

Under review as a conference paper at ICLR 2023
Table 3: Attack performance with varying cemi-supervised learning models
Semi Semi-Supervised Learning Technique
Attack Success Rate
Classification Accuracy
FixMatch (Sohn et al. 2020)
99.62%
90.52%
UDA Xie et al. 2020)
59.45%
92.0%
Table 4: Attack performance with varying backdoor triggers
Trigger Type
Attack Success Rate
Classification Accuracy
Four Corner Trigger
90.04%
89.92%
8 x 8 Patch Trigger
94.50%
89.36%
x Patch Trigger
1.37%
89.89%
Varying the Semi-Supervised Learning Approach We tested the performance of the perturba- tion based attack with e 8/255 against the UDA semi-supervised learning technique Xie et al. (2020). This method is similar to FixMatch in its use of augmentations and consistency regulariza- tion. The main difference is that UDA computes the consistency regularization using soft network outputs rather than hard pseudolabels. Table compares compares the performance FixMatch and UDA on target class 0 (airplane). This preliminary experiment confirms other semi-supervised learning methods are likely to be similarly vulnerable to backdoor attacks as FixMatch.
Vary Trigger Type We selected the four corner trigger which we found to be robust to strong augmentations and we used this trigger for the experiments presented in this paper. We also tested the effectiveness of single patch triggers in the bottom right of the image (See Table We see that x triggers are also effective against strong augmentations but 4 triggers are not.
16


Reviews:
[{"review_id": "qKNVeVv_hwM", "reviewer": "Reviewer_u9yW", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The paper discusses vulnerabilities of the SSL methods to back-door attacks. The attacks are carried by poisoning unlabelled data. The SSL method of choice is FixMatch, while the analysis is carried on the CIFAR 10 dataset.", "summary_of_the_review": "In summary, the contribution, if exists, it is not at the level required by a conference such as ICLR.", "strength_and_weaknesses": "Strength:\n - none\n\nWeaknesses:\n - The paper, in my view, fails to claim any valid contribution. The idea to study adversarial attacks on SSL  method is not new as showed on section 2.3. There is no thorough discussion of those methods and what this paper brings in addition. Into more detail:\n * the way to carry the attack is given by prior art (Turner et al. 2019)\n * the fact that SSL methods are sensitive to attacks it has been stated before.\n * the amount of attack efficiency compared to previous works in this direction is not quantified. No comparison is carried\n * the discussion is restricted to CIFAR 10 database.\nIn contrast the paper by Feng et al  \"Unlabeled Backdoor Poisoning in Semi-Supervised Learning\" ICME 2022 discusses the problems in conjunction with two databases (CIFAR 10 and CIFAR 100), uses 2 architectures compared to 1 here. It compares different ways to attack and shows to severity of each.That paper is published into a conference that is less visible than ICLR. Expectations are higher here\n\nThe only potential contribution is that this paper tried to adapt the attack to the augmentation, yet particular and clear lessons are not drawn from this.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "1: The contributions are neither significant nor novel.", "empirical_novelty_and_significance": "1: The contributions are neither significant nor novel."}, "extra_text": {}}, {"review_id": "o9vMnQKs4F", "reviewer": "Reviewer_nc1F", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper investigate the effectiveness of backdoor attacks against semi-supervised learning, a setting in which the learner has access to a large number of unlabeled data. The paper shows effective attacks against such a learning scheme.", "summary_of_the_review": "Overall, this paper has some solid experiment work. However, its presentation hinders me from fully understanding the contribution and novelty. Unfortunately, I do not think it meets the ICLR standard.", "strength_and_weaknesses": "**Strength**\n\nThe paper is technically sound in developing its attack techniques.\n\n**Weakness**\n\nPresentation is this paper's main weakness. On top of typical English language problems, this paper fails to deliver/highlight the thesis in its introduction.\n\nExample 1. In intro, it says \"In this paper we analyze the impact of backdoor data poisoning attacks on semi-supervised learning\nmethods to highlight a vulnerability of these methods that practitioners should be aware of when\nconsidering the security of their models.\"  1) Could you, in succinct language, describe what this vulnerability is, and 2) what are \"these methods\" referring to? The paper primarily examines FixMatch. What are the other methods?\n\nExample 2. In contribution, it says \"We analyze the unique dynamics of data poisoning during semi-supervised training and\nidentify characteristics of attacks that are important for attack success.\" Could you explain what characteristics you have identified? The paper has a very dense experiment discussion section, in which useful insights are buried in large chunk of text. Could you highlight them in pinpoints?\n\nMoreover, in Section 2.3, the authors have mentioned other work attacking semi-supervised learning. What is the novelty of this paper then? The related work section is not only about listing literatures but more importantly distinguishing your work from theirs. \n\nLanguage-wise, there are many unnecessarily long sentences. For example on the metric used on Page 5, \"Second is the attack success rate which is the percentage of non-target samples from the test set which are predicted as the target class when triggers are added to them.\" There are two \"which\" and a \"when\" in one running sentence with no comma... Please use short sentences if you couldn't master long ones yet. Paper writing is about clearly conveying your idea with not ambiguity. \n\nGiven the poor quality of presentation, I'm afraid that I can't tell the contribution of the paper clearly. ", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}, {"review_id": "0LXcq5Zbx4", "reviewer": "Reviewer_zodC", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors present a backdoor data poisoning attack targeting semi-supervised learning classifiers. For this, the authors rely on a clean-label backdoor attack proposed by Turner et al. where the malicious points injected not only contain the trigger, but also an adversarial perturbation, which is necessary to achieve a high attack success rate. The experiments show the effectiveness of the attack in CIFAR-10 dataset against FixMatch, a recent method for training semi-supervised learning classifiers. ", "summary_of_the_review": "The topic addressed in the paper is interesting and novel. However, the method used for creating the attack is basically the direct application of a previous attack. There are also some aspects in the threat model / adversary capabilities that are unclear. The application of the attack by generating untargeted adversarial perturbations is also a bit strange, which explains the counterintuitive experimental results where the effectiveness of the attack is reduced when the adversarial perturbation is bigger. Finally, the experimental evaluation falls short: only one semi-supervised learning algorithm considered, no analysis of defenses, and only one dataset. \nIn summary, I think that the research direction is quite interesting, but the paper requires more work and a deeper analysis to be more convincing. \n", "strength_and_weaknesses": "Strengths:\n+ Backdoor poisoning attacks in semi-supervised learning have not been explored in the research literature and it can pose a significant risk in some application domains. Although poisoning attacks have been proposed in this context, it is not the case for backdoors. \n+ The background is well covered and the organization of the paper is good. \n\nWeaknesses:\n+ Although the context of application is novel, the proposed attack is a straightforward application of the backdoor attack proposed by Turner et al. in the context of supervised learning, which really limits the practical novelty of the paper. \n+ The attack requires to train a separate model to craft the adversarial perturbations needed for the backdoor attack. From the paper, it is unclear what are the settings for doing this and this can have an impact on the threat model. For example, it does not really make sense if the authors use a supervised learning scheme to train the model and craft the adversarial examples (knowing all the labels of the complete dataset) and the defender only has access to a few labels and uses semi-supervised learning. It looks like the model for the adversary is quite strong (even if the attack is black/grey box. \n+ The attack just targets one semi-supervised learning algorithm, FixMatch. It would be necessary to provide a more comprehensive evaluation against different types of semi-supervised learning algorithms. See for example the targeted attack provided by Carlini et al 2021. \n+ The experimental evaluation is limited: 1) Only CIFAR dataset is used. 2) No defenses are considered (e.g. defenses against poisoning attacks in semi-supervised learning). 3) Only one semi-supervised learning method. \n+ The use of untargeted attacks for generating the adversarial perturbations looks a bit odd. It seems that this is causing the low effectiveness for attacks with higher perturbations. It is unclear why the authors do not use targeted attacks instead to increase the effectiveness of the backdoor attacks as the perturbation increases. \n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "2: Several of the paper’s claims are incorrect or not well-supported.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject