Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios
Authors: Ziqiang Li
Hong Sun
Pengfei Xia
Heng Li
Beihao Xia
Yi Wu
Bin Li
Venue: ICLR 2024 poster (2024)
Keywords: Deep Neural Networks
Backdoor Attacks
Poisoning Efficiency.
Primary area: societal considerations including fairness, safety, privacy

Abstract: Recent deep neural networks (DNNs) have came to rely on vast amounts of training data, providing an opportunity for malicious attackers to exploit and contaminate the data to carry out backdoor attacks. However, existing backdoor attack methods make unrealistic assumptions, assuming that all training data comes from a single source and that attackers have full access to the training data. In this paper, we introduce a more realistic attack scenario where victims collect data from multiple sources, and attackers cannot access the complete training data. We refer to this scenario as $\textbf{data-constrained backdoor attacks}$. In such cases, previous attack methods suffer from severe efficiency degradation due to the $\textbf{entanglement}$ between benign and poisoning features during the backdoor injection process. To tackle this problem, we introduce three CLIP-based technologies from two distinct streams: $\textit{Clean Feature Suppression}$ and $\textit{Poisoning Feature Augmentation}$. The results demonstrate remarkable improvements, with some settings achieving over $\textbf{100}$% improvement compared to existing attacks in data-constrained scenarios.

Published as a conference paper at ICLR 2024
EFFICIENT BACKDOOR ATTACKS FOR DEEP NEURAL NETWORKS IN REAL-WORLD SCENARIOS
Ziqiang Li Hong Sun i Pengfei Xia Heng Li", Beihao Xia², Yi Wu', Bin Li 1 Bigg Data and Decision Lab, University of Science and Technology of China. Huazhong University of Science and Technology
ficeli, hsun???, xpeng fei J@mall www.ii.usttt..eo... edu.
{liheng, xbb_hust /ehust. edu. en wuyi2021 2eri2222@mmaill. uste. edu.cn, hinli@ustc.edu...
ABSTRACT
Recent deep neural networks (DNNs) have came to rely on vast amounts of train- ing data, providing an opportunity for malicious attackers exploit and contam- inate the data to earry out backdoor attacks. However, existing backdoor attack methods make unrealistic assumptions, assuming that all training data comes from a single source and that attackers have full access to the training data. In this pa- per, we introduce a more realistic attack scenario where victims collect data from multiple sources, and attackers cannot access the complete training data. We refer this scenario as data-constrained backdoor attacks. In such cases, previous attack methods suffer from severe efficiency degradation due to the entanglement between benign and poisoning features during the backdoor injection process. To tackle this problem, introduce three CLiP-based technologies from two distinct streams: Clean Feature Suppression and Poisoning Feature Augmentation The re- sults demonstrate remarkable improvements, with some settings achieving over 100% % improvement compared to existing attacks in constroontr scenarios.
INTRODUCTION
Deep neural networks (DNNs) are powerful MI algorithms inspired by the human brain, used in various applications such as image recognition He et al. (2016), natural language processing Liu al. (2023), image generation Li et al. (2023b: 2022c;b); Wu et al. (2023), and trajectory prediction Wong et al. (2022); Xia et al. (2022a). DNN effectiveness depends on training data quantity/quality. For example, Stable Diffusion (983M parameters) Rombach al. (2022) excels in image generation due to pre-training on 5B image-text pairs. As the demand for data continues to rise, many users and businesses resort to third-party sources or online collections as a convenient means of acquiring the necessary data. However, recent studies Pan et al. (2022); Li et al. (2021b); Yang et al. (2021) have demonstrated that such practices can be maliciously exploited by attackers to contaminate the training data, significantly impairing the functionality and reliability of trained models.
The growing adoption neural networks across different domains has made them an attractive target for malicious attacks. One particular attack technique gaining attention is the backdoor attack Goldblum et al. (2022); Nguyen & Tran (2020); Xia et al. (2022c). In backdoor attacks, a neural network is deliberately injected with a hidden trigger by introducing small number of poisoning samples into the benign training set during the training. Once the model is deployed, the attacker can activate the backdoor by providing specific inputs containing the hidden trigger, causing the model to produce incorrect results. Backdoor attacks continue to present a significant and pervasive threat across multiple sectors, including image classification Gu al. (2019), natural language processing Pan et al. (2022); Zeng et al. (2023), and malware detection Li et al. (2021a). In this paper, we focus on the widely studied field of image classification.
It's worth noting that previous backdoor attacks rely on potentially overly broad assumption. They assume that all training data comes from single source, and the collected source has been poisoned
"The first two authors contributed equally to this paper. Correspnniing Author: Bin Li.

---

Published as a conference paper at ICLR 2024
Malidous Source
Benigo Source
Malicious
Collector
(b) M20 Data Collection Mode Figure I: One-to-one (O20) and many-to-one (M20) data collection modes. M20 mode more in line with practical scenarios where data collectors collect data from multiple sources. In this mode, the attacker cannot have all the data available to the victims.
(a) 020 Data Collection Mode
by attacker (as shown in 020 data collection mode in Fig. 1). This assumption grants attackers full access the entire training dataset, making it easy poison. However, it doesn't accurately represent real-world attack scenarios. Consider scenario where victims have a limited sample private dataset. To compensate, they may augment by collecting additional data from various online sources (referred to as the public dataset) and combine it with their private data for training, as depicted in the M20 data collection mode Fig. 1. In this case, some of the sources may be secretly poisoned by attackers. Attackers cannot access the private dataset and can only manipulate portion of the public dataset for poisoning. Consequently, a discrepancy arises between the distribution of the poisoned data and the training data, deviating from previous poisoning attack pipeline.
In this paper, we address a more realistic backdoor attack scenario called data-constrained back- door attacks, where the attackers do not have access to the entire training set. To be more pre- cise, we classify data-constrained backdoor attacks into three types based on different types of data sources: number-constrained backdoor attacks, class-constrained backdoor attacks, and domain- constrained backdoor attacks. Upon investigation, we have discovered that existing attack methods exhibit significant performance degradation when dealing with these data-constrained backdoor tacks. We propose that the entanglement between benign and poisoning features is a crucial factor contributing to this phenomenon. Entanglement refers to the neural networks utilizing both benign and poisoning features to make decisions for poisoning samples. However, this approach is not ef- ficient for backdoor attacks. Ideally, an efficient backdoor attack should solely rely on the poison feature generated by the trigger to make decisions, irrespective of how the benign feature is ex- pressed. To enhance the efficiency of poisoning attacks in data-constrained backdoor scenarios, we introduce two streams: Clean Feature Suppression and Poisoning Feature Augmentation to reduce the influence of clean features and amplify the expression of poisoning features, respectively. To achieve these goals, propose three techniques utilizing the CLIP Radford et al. (2021).
Our main contributions are summarized as follows. i) We present a novel and contemporary back- door attack scenario called data-constraing
backdoor attacks, which assumes that attackers lack access to the entire training data, making it a versatile and practical attack with broad applicability. ii) Through systematic analysis of previous attack methods, identify the entanglement between poisoning and benign features as the primary contributing factor to their performance degradation. fii) To address this issue, introduce the pre-trained CLIP model into the field of backdoor tacks for the first time. We propose three innovative technologies: CLIP-CFE, CLIP-UAP, and CLIP-CFA. Extensive evaluations conducted on 3 datasets and 3 target models, and over 15 differ- ent settings demonstrate the sigmificant superiority of our proposed CLIP-UAP and CLIP-CFA over existing backdoor attacks. Furthermore, CLIP-CFE complements existing attack methods and can be seamlessly integrated with them, resulting in further efficiency improvements.
BACKGROUND AND RELATED WORK
Here, we provide a concise overview of the typical pipeline for backdoor attacks on neural networks. Sec. A.1 provides a comprehensive exploration of related work on backdoor attacks and CL.P.
2

---

Published as a conference paper at ICLR 2024
2.1 BACKDOOR ATTACKS ON NEURAL NETWORKS
Backdoor attacks aim to introduce hidden triggers into DNNs, allowing the attacked models to be- have correctly on clean samples while exhibiting malicious behavior when triggered by specific inputs. These attacks can occur at various stages of Artificial Intelligence (AI) system development Gao et al. (2020). The surface of backdoor attacks has been systematically categorized into six groups: code-based Bagdasaryan & Shmatikov (2021), outsourcing, pretrained model- Wang al. (2020); Ge al. (2021), poisoning- -hased Liao et al. (2018), collaborative learning-based Nguyen et al. (2020), and post-deployment attacks Rakin et al. (2020). Among these categories, poisoning- based backdoor attacks, which involve introducing backdoor trigger during the train- ing process by mixing a few poisoning samples, are the most straightforward and commonly used method. This study focuses on addressing concerns related to poisoning-bie based backdoor attacks.
2.2 GENERAL PIPELINE OF BACKDOOR ATTACKS
Consider learning model f(: X YY where O represents the model's parameters and (YY denotes the input (output) space, with given dataset 'D C X x XY. Backdoor attacks typically involve three essential steps: poisoning set generation, backdoor injection, and backdoor activation.
Poisoning set generation. In this step, attackers employ pre-defined poison generator T(x, () to introduce trigger into a clean sample x. Specifically, they select a subset P' = {[ 9/ 1,... .) from the clean training set D {( vt 1,.., ,N (P' C D, and P < N) and
result in the corresponding poisoning set P = {2 k))2 ((z,, (2,, 31) E P 1,... P).
Here, yi and k represent the true label and the attack-target label of the clean sample x; and the poisoning sample x4,, respectively.
Backdoor injection. In this step, The attackers mix the poisoning set P into the clean training set D and release the new dataset. The victims download the poisoning dataset and use train their own DNN models Gu et al. (2019):
1 Σ L((()':0),A). Σ 1)((=;)),)++ (F.D)E
min 8
N
(a',K)EP
where L is the classification loss such as the commonly used cross entropy loss. In this case, back- door injection into DNNs has been completed silently.
Backdoor activation. In this step, the victims deploy their compromised DNN models on model- sharing platforms and model-selling platforms. The compromised model behaves normally when presented with benign inputs, but attackers can manipulate its predictions to align with their mali- cious objectives by providing specific samples containing pre-defined triggers.
3 DATA-CONSTRAINED BACKDOOR ATTACKS
We first show the considered pipeline of constrainnt backdoor attacks, and than illustrate the performance degradation of previous methods on proposed pipeline. Finally, attribute the degra- dation to the entanglement between the benign and poisoning features during the poisoning injection.
3.1 PRELIMINARIES
Previous methods Chen al. (2017); Liu al. (2017); Li (2022a): Nguyen Tran (2020) have commonly followed the attack pipeline outlined in Sec. 2.2. However, this widely adopted pipeline relies on an overly loose assumption that all training data collected from single source and that the attacker has access to the entire training data, which is often not the case in real-world attack scenarios. this paper, we focus on a more realistic scenario: Dataaconstrained Backdoor Attacks.
Pipeline of cots-constr backdoor attacks. The proposed pipeline also consists of three steps: poisoning set generation, backdoor injection, and backdoor activation. The backdoor in- jection and activation steps remain unchanged from the previous attack pipeline. However, in the poisoning set generation step. data-constrained attacks only assume access to a clean training set D' {(x,, will I,... .N',, which follows different data distribution from D. To address this,
3

---

Published as a conference paper at ICLR 2024
bandew Alck: slaceoott
Raidor mast dealvcentrabeed
Dadkett
Sodicta
10r
Prlson
Pelson Starees
Jordin
(a) Number-constrained
(h) Class-constrained
(c) Domain-constrained
Figure 2: Attack success rate (ASR) in the different data-constrained backdoor attack. The exper- iment is repeated 5 times, and the solid lines represent the mean results. (a): The abscissa is the number (P) of samples in the poisoning set P'. (b): The experiments are conducted with triggers BadNets, Blended, and UAP, with poisoning rate of 2% (P 1000) for each. The x-axis repre- sents the number of classes ((Y")) in the poisoning set P Specifically, 'I (1)' and "1 (0)' denote dirty-label single-class (Y' = {c), e A k) and deannlabel single-class (Y" {k:]), respectively. (c): The poisoning rates of experiments with trigger BadNets, Blended, and UAP are 2% (P 1000), 2% (P = 1000), and 1% (P = 500), respectively. The abscissa is the domain rate that represents the proportion of poisoning sets sampled from D \ D' and D').
the attacker randomly selects subset P' = {( v: = 1,... P} from the accessible dataset D'. and creates the corresponding poisoning set P [2r,, k))a Txx, t), (Zt, (2,, y1) E P' 1, 1.... .). Additionally, based on the different constraints imposed by the accessible training set D', data-constrained backdoor attacks are further categorized into three types: Number-constraived Backdoor Attacks, Class-constrined Backdoor Attacks, and
Backdoor Attacks. The details pipeline can be found in Sec. A.2.3, Sec A.2.4, and Sec. A.2.5, respectively.
Empirical results. Noticing that the experimental setting of this experiment can be found in Sec. A.2.2. Fig. (a), (b), and (c) illustrate the attack success rate on number-constrained, class- constrained, and domainn-cossrrinn
backdoor attacks, respectively. The results demonstrate that ASR experiences a significant decrease the number of poisoning samples (P), the number of class (C"), or domain rate (the proportion of poisoning sets sampled from D D' and D') in the poisoning set decreases, particularly for Blended backdoor attacks. It is worth noting that Universal Adversar- ial Perturbations (UAP) achieves relatively favorable results even with a low poisoning rate. This can be attributed to the utilization of a proxy model that is pre-trained on the entire training set (D). However, UAP is not accessible in our settings, and we present the results for UAP to effectively demonstrate the performance degradation even when a pre-trained proxy model is available.
3.2 ENTANGLEMENT BETWEEN BENIGN AND POISONING FEATURES
In Sec A.3, we present three observations pertaining data-constrained backdoor attacks, serving as compelling evidence for the presence of significant interdependence between benign and poisoning features during the backdoor injection. This intricate entanglement identified as the primary factor responsible for the inadequacies exhibited by current attack methodologies within data consttrinttaineed scenarios. Our study is pioneering exploration of feature entanglement in the context of backdoor attacks, yielding fresh and valuable insights into the realm of backdoor learning. Ideally, one would anticipate backdoor models to exclusively rely on poisoning features when confronted with poison- ing samples, as this would be the most efficient strategy for executing successful backdoor attacks. However, neural networks tend to be greedy and utilize all features for decision decision-making Li et al. (2023c), leading activation of both poisoning and benign features during backdoor injection. This results in reduced poisoning efficiency when there is a difference in benign features between the backdoor injection and activation phases, evidenced in data-constrained backdoor attacks.
CLIP-GUIDED BACKDOOR ATTACKS METHOD
We present approach, which consists of two components: Clean Feature Suppression and Poisoning Feature Augmentation. These components are independent of each other and can be seamlessly combined. The threat model considered in our study has been introduced in Sec. A.4
4

---

Published as a conference paper at ICLR 2024
4.1 CLEAN FEATURE SUPPRESSION
As described in Sec. 3, the effectiveness of data-constrained backdoor attacks is hindered due to the entanglement of benign and poisoning features during the backdoor injection phase. To address this challenge, we propose a solution called "clean feature suppression" in this section. The primary objective of this approach is to minimize the impact of benign features on the decision-making process, thus amplifying the significance of poisoning features.
4.1.1 CLIP-BASED CLEAN FEATURE ERASING
To achieve clean feature suppression, we can employ a feature extractor pre-trained on the entire training set (As shown in Sec. Clean Feature Erasing Noise). However, since our data-constrained backdoor attacks lack access to the complete training set, an alternative solution is required. Recent studies have shown that pre-trained CLIP Radford et al. (2021) generates consistent and robust semantic representations across a wide range of (image, text) pairs, enabling impressive zero-shot classification performance comparable supervised learning accuracy on challenging datasets like ImageNet (As shown in A.5). Hence, we can utilize the pre-trained general model CLIP, which replaces the feature extractor trained on the entire training set, allowing us to achieve clean feature suppression (As shown in CLIP for Clean Feature Erasing).
Clean Feature Erasing Noise. The technique of clean feature suppression aims to eliminate the clean information present in images by introducing optimized noise, denoted as 5, which helps modify the input image to resemble the unbiased class. In accordance with the data-constrained backdoor attack pipeline outlined in Sec. 3. we assume that the chosen clean training dataset for generating the poisoning set consists of P clean examples, denoted as P X x Y (where P' {(T,, 34)li i = 1,.., P)). Here, x, E X represents the inputs, y4 E Y = 21,2, .C) represents the labels, and C denotes the total number of classes. We refer to the modified version as Pe = (Z y;)li i 1,.... PP. where Te,, I; 6-; represents the erased version of the training example I; E P.. The term 6, E A denotes the "invisible" noise applied to achieve the erasing effect. The noise is subject to the constraint ||6/1p c, where || 1lp represents the Lp norm, and c is set to a small value to ensure the stealthiness of the backdoor attacks. Our objective in erasing the clean features is ensure that the pre-trained feature extractor does not extract any meaningful information from the given images x. This is achieved by introducing customized and imperceptible
noise, denoted as d,. To be more specific, for clean example 2,, we propose to generate the noise ó, that erases the features by solving the following optimization problem:
5, = araggmin min L(f'(x; + 8:). Vm) s.t. |10:llp S.
(2)
6,
where L represents the mean squared eтror (MSE) loss, defined as L(a. = lla b12. The function f'(-) corresponds to the pre-traines pre-trained feature extractor employed for noise generation. Additionally, Um denotes the unbiased label for the classification task, which is defined as Vm = I 1 c; : cl.
where signifies the total number of classes. While this vanilla method proves effective in erasing clean features, it requires proxy feature extractor that has been pre- mreitranne the entire training set. This approach is not suitable for our data-restricted backdoor attacks.
CLIP for Clean Feature Erasing (CLIP-CFE). Taking inspiration from CLIP's approach to zero- shot classification (Sec. A.5), we leverage general CLIP model to optimize the feature erasing noise. This allows us to relax the need for proxy feature extractor traitrained on the entire training set. We consider C prompts. "a photo of c,," corresponding to different classes c; in the dataset, where i 1.... C. The based feature erasing noise, denoted as ò,, is proposed for the input o; by solving the following optimization problem:
8 = arg min L(fCLIP (x; + 8,, (P),ym) s.t. ||01|p S,
where L represents the mean squared error (MSE) loss, yo denotes the unbiased label for the clas- sification task defined ym. [/ ..... d.. I represents the set of prompts corresponding to different classes in the dataset, and fCLIP denotes the CLIP-based model used to obtain the label of the input image. Specifically,
P= (p1.P2.... ,PC} ("a photo of c;"ii =,,,,==1,,... ,C},
5

---

Published as a conference paper at ICLR 2024
+ fCLIP(I,+ + P) [ (E, +.),
+.), DE + 5.). (p.)))
(5)
(E, 5,), &
To solve the constrained minimization problem illustrated in Eq. 3, we utilize the first-order op- timization method known as Projected Gradient Descent (PGD) Madry et al. (2017). The PGD
method enables find a solution by iteratively updating the noise as follows:
0
II (o: -
sign (Vegn(V.o LJCLIP(E + 0 (m))),
(6)
where / represents the current perturbation step, with a total of T = 50 steps. VoL[Jerr + 61 IP), 3m) denotes the gradient of the loss with respect to the input. The projection function I] is applied to restrict the noise ó within the e-ball (with = 8/255 in our paper) around the original example æ, ensuring does not exceed this boundary. The step size a determines the magnitude of the noise update at each iteration. The resulting erasing examples are then obtained as follows:
Pe = (FFe, vi)li = 1,.., where
Ne,i vi + 5f'
4.2 POISONING FEATURE AUGMENTATION
In addition to eradicating clean features in images to tackle the entanglement between benign and poisoning features, enhancing the expression of poisoning features is another effective approach. In this section, we present two parallel triggers aimed at augmenting the poisoning features: CLIP- based Contrastive Feature Augmentation (4.2.1) and CLIP-hased Universal Adversarial Perturba- tions (A.6).
OUI
GJP
ALP-IRC
ILI
N0 lelee
(a)
(b)
THAT
Crea
OLP-5
AJP-3E
(c)
(d)
backdoor attacks, (b): clean- label single-class attack (the access category is set to (0)), (c): dirty-label single-class attack (the access category Y' is set to (1)), and (d): domain-constrained backdoor attacks (domain rate is set to 0) on the CIFAR-101 100 dataset. The red points represents w/o Caae- Clean Feature Erasing (CLIP-CFE) while the green points represents w/ CLIP-CFE. All experiments are repeated 5 times, and the results are computed withthe mean of five different runs.
Figure 3: Attack success rate (ASR) of the (a):
4.2. CLIP-BASED CONTRASTIVE FEATURE AUGMENTATION
While the CLIP-UAP method has shown impressive results in terms of poisoning efficiency, it re- quires customization for different attack-target labels. In this section, we propose a more versatile trigger design that is independent of the attack-target label, enhancing the poisoning feature. Draw- ing inspiration from the entanglement between benign and poisoning features discussed in Sec. 3.2, utilize contrastive optimization to augment the poisoning feature. Our expectation is that the poisoning feature extracted from the designed trigger will be more expressive compared to the clean feature extracted from the clean samples. Specifically, given trigger 5t+1 to be optimized, two

---

Published as a conference paper at ICLR 2024
random views (query: z+ dcen and key: + &con) are created by different clean samples (æ and xı Positive pair is defined as such query-key pair, between different poisoning samples. Negative pairs defined as pairs between poisoning example and its corresponding clean example, í.e. between dcon and All views are passed through the pre-trained image encoder &((-) of the CLIP to acquire the representation v:
Vq Ex dcon), 14 Ex dcon); V_ (z).
LLIP-Contrastive feature augmentation (CLIP-CFA) focuses optimizing the general trigger by maximizing the similarity between positive pairs while ensuring dissimilarity between negative pairs. To achieve this, we design a loss function as follows:
(Ug. 2+)
Leea (I,, T1, Scon)
(9)
(Uig vー}
where (:-) represents the cosine similarity between two vectors and the deon is optimized with:
8eon arg min
Σ
Leon(x, (2,, I1 8son).
(10)
|| Se (x.D))
Similar to Eq. 14, we also adopt the first-order optimization method PGD Madry et al. (2017) to solve the constrained minimization problem as follows:
g++11 = II (8 - a sign( Ve.. Leon (2, 21, deom)))
(11)
Therefore, the optimization should also be accumulated on all samples in the accessible clean train- ing set DD. Finally, the CLIP-CFA of set D' can be formulated as deon = 8 and the poison generator formulated as Txx, 8ean) = x 8eon-
4.3 ATTACK SUMMARY
present two independent trigger design methods: CLIP-UAP (Sec. A.6) and CLIP-CFA (Sec. 4.2.1). These triggers are aimed at enhancing the expression of poisoning features and can replace previous trigger design approaches. leading improved performance in data-constrained backdoor attacks. Additionally, in Sec. 4.1, we introduce a CLIP-CFE method. This approach minimizes the influence of clean features during the poisoning process and can be integrated into any afore- mentioned trigger design methods. By combining trigger design and clean feature erasing, our final approach achieves state-of- offthe-ar art performance in all types of data-constrained backdoor attacks.
EXPERIMENTS
We provides an overview of the experimental settings, covering datasets, model architecture, eval- uation metrics, baselines, and implementations (Appendix A.7). Subsequently, perform com- prehensive experiments to assess the effectiveness our proposed methods through answering following research questions: RQ1: Are proposed technologies effective on three backdoor at- tacks? (Sec. 5.1). RQ2: Are proposed technologies harmless for Benign Accuracy? (Sec. 5.2). RQ3: Are proposed technologies stealthy for victims? (Sec. A.8). RQ4: Are proposed tech- nologies effective for different poisoning settings? (Sec. 5.3). In this section, we present the re- sults specifically for CIFAR-100 datasets. Experimental outcomes for CIFAR-10 and ImageNet-50 are provided in Appendix A.9 and Appendix A. 1. respectively, Additionally, for more experiments and further discussions, please refer to Appendix A. 121 A.13, A.14, and A.15.
5.1 RQ1: ARE PROPOSED TECHNOLOGIES EFFECTIVE ON THREE BACKDOOR ATTACKS?
To assess the effectiveness of our proposed technologies, we conduct attacks on various target mod- els and datasets, evaluating the Attack Success Rate (ASR) for each target model. In order to es- tablish basis for comparison, and Blended Chen et al. (2017), as discussed in Sec. 1.2. Fig. illustrates the performance of the following types of backdoor attacks on the CIFAR-100 dataset: (a) number-constrained, (b)
introduce two baseline attack methods: BadNets Gu et al. (2019)

---

Published as a conference paper at ICLR 2024
Table 1: The Benign Accuracy (BA) on the CIFAR-100 dataset. All results are computed the mean by 5 different run.
Tegger
Cleas Fesure Sepression
Backdbor Aracks
Average
Numbee Comstrined
Class Consurinnt (Y'
(0))
Class Constrined (Y' (1])
Durrsin Consiteinod
R-18
M-2
V-36
R-18
V-16
R-18
V-16
BotNes
We CLIE-IFF
0.695
0.700
0.723
0.790
0.722
0.778
0.955
0.701
0.730
0.731
07788
0.733
0.68
0.700
0.730
0.718
0.729
0.736
0.701
0.999
0.727
0.790
0.734
0.728
0:718
0.319
Hlended
Wel CIJP-
w/ CFE
0.705
0.703
0127
0.730
01723
0.727
0.700
0.200
0.236
0.729
0335
0.727
0.701
0.69
0.339
0.700
01221
0.724
01688
0.700
0.778
0.731
0.325
0.727
0.719
0.317
CLIPUUP
CTE
0.700
clean-label single-class (class-constraineed),, (c) dirty-label single-class (class-constrained)), and (d) out-of-the-domain -oomainn-onstrineed)..
CLIP-based poisoning feature augmentation is more effective than previous attack methods. Our proposed methods, CLIP-UAP and CLIP-CFA, outperform the baseline techniques (BadNets Gu et al. (2019) and Blended Chen et al. (2017) ?) in terms of consistency across different attacks and target models. Specifically, we achieved an ASR of 0.878, 0.825, 0.984, and 0.988 for BadNets, backdoor attack on the
Blended, CLIP- and CLIP-CFA. respectively, in the VGG-16 model. These results provide evidence that our proposed poisoning feature augmentation generates more effective triggers compared to other methods.
CLIP-based Clean Feature Suppression is useful for different attack methods. Our proposed method, CLIP-CFE, has shown significant improvements in effectiveness compared to the base- line method without CLIP-CFE. In various cases, CLIP-CFE has enhanced the poisoning efficiency significantly. For instance, in the clean-label single-class backdoor attack on the VGG-16 dataset, we observed remarkable improvements of 187%, 150%, 110%, and 229% for BadNets, Blended, CLIP-UAP, and CLIP-CFA respectively. However, is worth noting that in the results of the domain-constrained backdoor attacks on MobileNet-V2 (as depicted in the right part of Fig. 3 (d)), CLIP-CFA and CLIP-UAP only slightly outperform the corresponding methods with CFE.
More discussion. While our technologies have shown significant improvements in poisoning effi- ciency compared to baselines, there are still important discussions that need to be addressed. We aim to provide answers to the following questions in systematic manner in Appendix A.15: i) Why do we observe performance degradation in the clean-label single-class attack? ii) Why are domain- constrained backdoor attacks generally easier compared class-constrain backdoor attacks?
5.2 RQ2: ARE PROPOSED TECHNOLOGIES HARMLESS FOR BENIGN ACCURACY?
As shown in Table 1, our CLIP-UAP and CLIP-CFA exhibit similar or even better average Benign Accuracy (BA) compared to the baseline methods, BadNets Gu et al. (2019) and Blended Chen et al. (2017). Additionally, it is worth noting that our proposed method, CLIP-CFE, does not nega- tively impact BA. This finding confirms that our technologies are harmless to the benign accuracy compared to baseline methods, even under various settings and different backdoor attacks.
5.3 RQ4: ARE PROPOSED TECHNOLOGIES EFFECTIVE FOR DIFFERENT POISONING SETTINGS?
Experiments on different poison rates for number-constrained backdoor attacks. We conduct ablation studies assess the effectiveness of proposed methods in reducing the number of
Both the clean- label single-class and darty-label single-class backdoor attacks represent extreme scenarios of the class-constee constconstr backdoor attack. In the clean-label single-class attack, the targeted class category is set to Y' k. while in the labey single-class attack, it is set Y' where e * k. Similarly, the out-of-the-domain backdoor attack is an extreme scenario of the domain-constrained backdoor attack, with domain rate of 0. For further details, please refer to Appendix A.7.
While there are several more effective techniques for poisoning attacks, they typically necessitate access the entire training data, rendering them unsuitable for our data-limited backdoor attacks.
8

---

Published as a conference paper at ICLR 2024
x. 2.900
5.0
04 C%
(a)
(h)
(c)
(d)
Figure 4: The ablation studies on the CIFAR- 100 dataset. All results were computed as the mean
of five different runs. (a): The ASR with different poisoning rates. (B): The ASR with different
accessible class of poisoning samples, where (0) and 1 (1) in the abscissa represent the clean-label and dirty-label single-class attacks, respectively. (C): The ASR with different domain rates. (D): The ASR across different pre-trained CLIP models for number-constrained backdoor attacks.
poisoning samples (poisoning rates) for number-constrained backdoor attacks. The results depicted in Fig. 4 (a) demonstrate the following: i) The attack success rate increases with higher poisoning rates for different attacks. ii) Our proposed CLIP-UAP and CLIP-CFA outperform the baseline techniques, BadNets Gu et al. (2019) and Blended Chen et al. (2017). iii) The incorporation of our proposed CLIP-CFE further enhances the poisoning effectiveness across different triggers.
Experiments different poison classes for class-constrained backdoor attacks. We conduct ablation studies to assess the effectiveness of our proposed methods in increasing the number of poisoning classes for class-constrained backdoor attacks. The results presented in Fig. (b) demon- strate the following: i) The attack success rate increases with higher poisoning classes for different attacks. ii) The attack success rate of clean-label single-class attack is lower than that of dirty- single-class attacks. iii) Our proposed methods, CLIP-UAP and CLIP-CFA, outperform the baseline techniques, BadNets Gu et al. (2019) and Blended Chen al. (2017). iv) The incorporation of our proposed CLIP-CF further enhances the poisoning effectiveness across different triggers.
Experiments on different domain rates for domain-constrained backdoor attacks. We conduct ablation studies to assess the effectiveness of our methods in increasing the domain rate for domain- constrained backdoor attacks. The results depicted in Fig. 4 (c) demonstrate the following: i) The ASR increases with higher domain rates for different attacks. ii) Our proposed CLIP-UAP and CLIP-CFA outperform the baseline techniques, BadNets Gu et al. (2019) and Blended Chen et al. (2017), iii) The incorporation of our proposed CLIP-CFE further enhances the poisoning effectiveness across different triggers.
Experiments different large pre-trained models. We utilize the pre-trained CLIP model the basis for our technologies. It's worth noting that the community has proposed various CLIP variants. Therefore, an important practical consideration is whether our proposed technologies remain robust when applied different pre-trained CLIP models. To investigate this, we conduct ablation studies on different CLIP models for results demonstrate that our proposed technologies exhibit robustness across different CLIP models, with ViT-B/32 emerging as a competitive choice for all methods.
backdoor attacks, as depicted in Fig. 4 (d). The
6 CONCLUSION
In this paper, we address the challenges of data-constrained backdoor attacks, which occur in more realistic scenarios where victims collect data from multiple sources and attackers cannot access the full training data. To overcome the performance degradation observed in previous methods under data-constrained backdoor attacks, we propose three technologies from two streams that leverage the pre-trained CLIP model to enhance the efficiency of poisoning. Our goal is to inspire the research community to explore these realistic backdoor attack scenarios and raise awareness about the threats posed by such attacks. In the Sec A.16, we discuss the limitations of our approach and outline potential future directions for backdoor learning research.

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGMENTS
This work was funded by the National Natural Science Foundation of China (U19B2044). Spon- sored by Zhejiang Lab Open Research Project (NO. K2022QA0AB04). Supported by the Funda- mental Research Funds for the Central Universities.
REFERENCES
Arto, Dev Vidhani, Goutham, Mayank Bhaskar, Ritobrata Ghosh, and Sujit Pal. Fine tuning clip with remote sensing (satellite) images and captions, 2021. https://hhut http///hugggggaceeeeeee/ co/ blog/ Glog/fine--o htt//fine-tuee tune- clip- rsicd,
Eugene Bagdasaryan and Vitaly Shmatikov. Blind backdoors in deep learning models. In 30th USENIX Security Symposium (USENIX Security 2/). pp. 1505-1521, 2021.
Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in enns by training set corruption without label poisoning. In 2019 IEEF International Conference on Image Processing (ICIP), pp. 101-105. IEEE, 2019.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017.
Ruizhe Cheng, Bichen Wu, Peizhao Zhang, Peter Vajda, and Joseph E Gonzalez. Data-efficient language-supervised zero-shot learning with self-distillation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 3119-3124 2021a.
Siyuan Cheng, Yingqi Liu, Shiqing Ma, and Xiangyu Zhang. Deep feature space trojan attack of neural networks by controlled detoxification. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 148-1156, 2021b.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large- hi- erarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248 255. leee, 2009.
Khoa Doan, Yingjie Lao, and Ping Li. Backdoor attack with imperceptible input and latent modifi- cation. Advances in Neural Information Processing Systems, 14:18944-18955 2021.
Nikolaus Dräger, Yonghao Xu, and Pedram Ghamisi. Backdoor attacks for remote sensing data with wavelet transform. IEEE Transactions on Geoscience and Remote Sensing, 2023.
Muhammad Farooq and Abdul Hafeez. Covid-resnet: deep learning framework for screening of covid19 from radiographs. arXiv preprint arXiv:2003.14333 2020.
Yu Feng, Benteng Ma, Jing Zhang, Shanshan Zhao, Yong Xia, and Dacheng Tao. Fiba: Frequency- injection based backdoor attack in medical image analysis. In Proceedings of the JEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20876-20885, 2022.
Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim. Backdoor attacks and countermeasures on deep learning: A comprehensive review. arXiv preprint arXiv:2007.10760, 2020.
Yinghua Gao, Yiming Li. Linghui Zhu, Dongxian Wu, Yong Jiang, and Shu-Tao Xia. Not all samples are born equal: Towards effective laben backdoor attacks. Pattern Recognition, 139:109512. 2023.
Yunjie Ge, Qian Wang, Baolin Zheng, Xinlu Zhuang, Qi Li, Chao Shen, and Cong Wang. Anti- distillation backdoor attacks: Backdoors can really survive in knowledge distillation. In Proceed- ings of the 29th ACM International Conference on Multimedia, pp. 826-834, 2021.
Micah Goldblum, Dimitris Tsipras, Chulin Xie, Xinyun Chen, Avi Schwarzschild, Dawn Song, Aleksander Madry, Bo Li, and Tom Goldstein. Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
10

---

Published as a conference paper at ICLR 2024
Tianyu Gu, Kang Liu, Brendan Dolan Dolan-Gavitt and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 4722444-7224, 2019.
Wei Guo, Benedetta Tondi, and Mauro Barni. A temporal chrominance trigger for clean-label back- door attack against anti-spoof rebroadcast detection. IEEE Transactions on Dependable and Se- cure Computing, 2023.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
Quan Huynh-Thu and Mohammed Ghanbari. Scope of validity of psnr in image/video quality sessment. Electronics letters, 44(13):800-801, 2008.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Chaoran Li, Xiao Chen, Derui Wang, Sheng Wen, Muhammad Ejaz Ahmed, Seyit Camtepe, and Yang Xiang. Backdoor attack on machine learning based android malware detectors. IEEE Transactions on Dependable and Secure Computing, 19(5):3357-3300 2021a.
Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, and Xinpeng Zhang. Invisible back- door attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, 18(5):2088-210) 2020.
Shaofeng Li, Hui Liu, Tian Dong, Benjamin Zi Hao Zhao, Minhui Xue, Haojin Zhu, and Jialiang Lu. Hidden backdoors in human-centrie language models. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pp. 3123-3140, 2021b.
Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transac- tions on Neural Networks and Learning Systems, 2022a.
Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 16463-16472 2021c.
Ziqiang Li, Chaoyue Wang, Heliang Zheng, Jing Zhang, and Bin Li. Fakeclr: Exploring contrastive learning for solving latent discontinuity in data-efficient gans. In European Conference on Com- puter Vision, pp.
Springer, 2022b.
Ziqiang Li, Pengfei Xia, Rentuo Tao, Hongjing Niu, and Bin Li. A new perspective on stabilizing gans training: Direct adversarial training. IEEE Transactions on Emerging Topics in Computa- tional Intelligence, 7(1):178-889, 2022c
Ziqiang Li, Hong Sun, Pengfei Xia, Beihao Xia, Xue Rui, Wei Zhang, and Bin Li. A proxy-free strategy for practically improving the poisoning efficiency in backdoor attacks. arXiv preprint arXiv:2306.083/3 303.00833,, 2023a.
Ziqiang Li, Muhammad Usman, Rentuo Tao, Pengfei Xia, Chaoyue Wang, Huanhuan Chen, and Bin Li. A systematic survey of regularization and normalization in gans, ACM Comput. Surv. 55 (11), 2023b. ISSN 0360-0300. doi: 10. 145/3569928.
Ziqiang Li, Pengfei Xia, Xue Rui, and Bin Li. Exploring the effect of high-frequency components in gans training. ACM Transactions on Multimedia Computing, Communications and Applications, 19(5):1 2023c.
Ziqiang Li, Pengfei Xia, Hong Sun, Yueqi Zeng, Wei Zhang, and Bin Li. Explore the effect of data selection on poison efficiency in backdoor attacks. arXiv preprint arXiv:2310.09744, 2023d.
Cong Liao, Haoti Zhong, Anna Squicciarini, Sencun Zhu, and David Miller. Backdoor embedding in convolutional neural network models via invisible perturbation. arXiv preprint arXiv: 10307, 2018.
11

---

Published as a conference paper at ICLR 2024
Kang Liu, Brendan Gavin,,,vit,, and Siddharth Garg. Fine-prunii Fine-pruning: Defending against back- dooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses, pp. 273-294. Springer, 2018.
Pengfei Liu, Weizhe Yuan, Jinlan Fu, Zhengbao Jiang, Hiroaki Hayashi, and Graham Neubig. Pre- train, prompt, and predict: A systematic survey of prompting methods in natural language pro- cessing. ACM Computing Surveys, 55(9):1-35, 2023.
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. 2017.
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In European Conference on Computer Vision, pp. 182-199. Springer, 2020.
Kaushalya Madhawa and Raul Carlomagno. Medelip: A pre-trained clip model for medical image search, 2022. https: /ttg thu..btthht...g com/Kausha waapousshalllaaaaa ya ya/medel p..
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks, arXiv preprint arXiv:1706.0608. 2017.
Rui Min, Zeyu Qin, Shen, and Minhao Cheng. Towards stable backdoor purification through feature shift tuning. arXiv preprint arXiv:2310.01875, 2023.
Seyed-Mohsen Dezsovi- Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1765-1773, 2017.
Anh Nguyen and Anh Tran. Wamet-impercepibll warping-based backdoor attack. arXiv preprint arXiv:2 10366 2021.
Thien Due Nguyen, Phillip Rieger, Markus Miettinen, and Ahmad-Reza Sadeghi. Poisoning attacks on federated learning-bant based iot intrusion detection system. Proc. Workshop Decentralized loT Syst. Secur. (DIS)) pp. 1-7, 2020.
Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems, 33:3454-3466 2020.
Hongjing NIu, Hanting Li, Feng Zhao, and Bin Li. Domain-unified prompt representations for source-free domain generalization. arXiv preprint arXiv:2209. 14926, 2022.
Xudong Pan, Mi Zhang, Beina Sheng, Jiaming Zhu, and Min Yang. Hidden trigger backdoor tack on [NLP) models via linguistic style manipulation. In 3/st USENIX Security Symposium (USENIX Security 22), pp. 3611-3628, 2022.
Or Patashnik, Zongze Wu, Eli Shechtman, Daniel Cohen-Or, and Dani Lischinski. Styleclip: Text- driven manipulation of stylegan imagery. In Proceedings of the IEEE/CVF International Confer- ence on Computer Vision, pp. 2085-2094, 2021.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp- PMLR, 2021.
Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Tbt: Targeted neural network attack with bit trojan. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp- 13198-13207, 2020.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. Proceedings of the IEEE/CVF Con- ference Computer Vision and Pattern Recognition, pp. 10684-10695, 2022.
12

---

Published as a conference paper at ICLR 2024
Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor at- tacks. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 11957- 11965, 2020.
Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang Chieh Chen. Mo- bilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 4510-4520, 2018.
Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based local- ization. In Proceedings of the IEEE international conference on computer vision, pp. 618-626 2017.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.15555 2014.
Hossein Souri, Micah Goldblum, Liam Fowl, Rama Chellappa, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. arXiv preprint (XXi:2206.089700, 2021.
Hossein Souri, Liam Fowl, Rama Chellappa, Micah Goldblum, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. Advances in Neural Information Processing Systems, 35:19165-19178 2022.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks.
arXiv preprint arXiv: 1912.07111. 2019.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. 2019
IEEE Symposium on Security and Privacy (SP), pp. 707-723. IEEE, 2019a.
Cheng Wang, Delei Chen, Lin Hao, Xuebo Liu, Yu Zeng, Jianwei Chen, and Guokai Zhang. Pul- monary image classification based on inception-v3 transfer learning model. IEEE Access, 7: 146533-146541, 2019b.
Shuo Wang, Surya Nepal, Carsten Rudolph, Marthie Grobler, Shangyu Chen, and Tianle Chen. Backdoor attacks against transfer learning with pre-trained deep learning models. IEEE Transac- tions on Services Computing, 2020.
Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero Simoncelli. Image quality assessment: from error visibility structural similarity. IEEE transactions on image processing, 13(4):600- 612, 2004.
Long Wen, Xinyu Li, and Liang Gao. A transfer comvolutional neural network for fault diagnosis based on resnet-50. Neural Computing and Applications, 32:6111 11-6124, 2020.
Conghao Wong, Beihao Xia, Ziming Hong, Qinmu Peng. Wei Yuan, Qiong Cao, Yibo Yang, and Xinge You. View vertically: A hierarchical network for trajectory prediction via fourier spec- trums. In European Conference on Computer Vision, pp. 682-700. Springer, 2022.
Tong Wu, Tianhao Wang, Vikash Sehwag, Saeed Mahloujifar, and Prateek Mittal. Just rotate it: Deploying backdoor attacks via rotation transformation. arXiv preprint arXiv:2207.1092. 10825, 2022.
Yi Wu, Ziqiang Li, Chaoyue Wang, Heliang Zheng, Shanshan Zhao, Bin Li, and Dacheng Ta. Do- main re- re-modulation for few-shot generative domain adaptation. arXiv preprint 0rX5v:2302.02550, 2023.
Beihao Xia, Conghao Wong, Qinmu Peng, Wei Yuan, and Xinge You. Cscnet: Contextual seman- tic consistency network for trajectory prediction in crowded spaces. Pattern Recognition, 126: 108552, 2022a.
Pengfei Xia, Ziqiang Li, Wei Zhang, and Bin Li. Data-efficient backdoor attacks. arXiv preprint arXiv:2204. /2281, 2022b.
13

---

Published as a conference paper at ICLR 2024
Pengfei Xia, Hongjing Niu, Ziqiang Li, and Bin Li. Enhancing backdoor attacks with multi-level mmd regularization. IEEE Transactions on Dependable and Secure Computing, 2072):1675- 1686, 2022c.
Pengfei Xia, Yueqi Zeng, Ziqiang Li, Wei Zhang, and Bin Li. Efficient trojan injection: 90% attack success rate using 0.04% poisoned samples, 2023. URL httpttpss//peenrveeww..ooo net/ Eorum??d=oggUUS
Xiaoling Xia, Cui Xu, and Bing Nan. Inception-v3 for flower classification. 2017 2nd interna-
lional conference image, vision and computing (ICIVC), pp. 783-787. IEEE, 2017.
Limin Yang, Wenbo Guo, Qingying Hao, Arridhana Ciptadi, Ali Ahmadzadeh, Xinyu Xing, and Gang Wang. Cade: Detecting and explaining concept drift samples for security applications. In USENIX security symposium, pp. 2327-2344 2344, 2021.
Yi Yang and Shawn Newsam. Bag-of-visual-worrt and spatial extensions for land-use classification. In Proceedings of the 18th SIGSPATIAL international conference on advances in geographic information systems, pp. 270-279, 2010.
Yi Zeng, Won Park, Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks' triggers: A frequency perspective. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 16473-16481, 2021.
Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia. Narcissus: A practical clean-label backdoor attack with limited information. arXiv preprint arXiv:2204.05255, 2022.
Yueqi Zeng, Ziqiang Li, Pengfei Xia, Lei Liu, and Bin Li. Efficient trigger word insertion. arXiv preprint arXiv:2311. 1. 2023.
Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. Clean- label backdoor attacks video recognition models. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14443-14452, 2020.
Haoti Zhong, Cong Liao, Anna Cinzia Squicciarini, Sencun Zhu, and David Miller. Backdoor embedding in convolutional neural network models via invisible perturbation. In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy, pp. 97-108, 2020.
14

---

Published as a conference paper at ICLR 2024
A
APPENDIX
CONTENTS
A.I
Detailed Background and Related Work
16
A.1.1
Poisoning Efficiency in Backdoor Attacks
16
A.1.2
Poisoning Stealthiness in Backdoor Attacks
16
A.1.3
Contrastive Language-Image Pre-Training (CLIP) Model
17
A.2
Detailed Pipeline of Data-constrained Backdoor Attacks.
17
A.2.1
Examples of Backdoor Attacks in Our Study
17
A.2.2
Experimental Settings.
17
A.2.3
Number-constrained Backdoor Attacks
17
A.2.4
Class-constrained Backdoor Attacks
18
A.2.5
Domain-constrained Backdoor Attacks
19
A.3
Analyzing the Entanglement Between Benign and Poisoning Features
19
A.4
Threat Model
A.5
CLIP for Zero-shot Classification
21
A.6
CLIP-based Universal Adversarial Perturbations
22
A.7
Experimental Setup
22
A.7.1 Datasets
22
A.7.2 Model Architecture.
23
A.7.3
Baseline and Comparison.
23
A.7.4
Implementations.
A.7.5 Evaluation Metries.
24
A.8
RQ3: Are Proposed Technologies Stealthy for Victims?
25
A.9
Experiments the CIFAR-10 Dataset
26
A.9.1 RQI: Are Proposed Technologies Effective on Different Backdoor Attacks.
26
A.9.2 RQ2: Are Proposed Three Technologies Harmless for Benign Accuracy.
28
A.9.3 RQ3: Are Proposed Technologies Effective for Different Poisoning Settings.
29
A.10 Experiments on the ImageNet-50 Dataset
30
A.10.1 RQ1: Are proposed Technologies Effective on Different Backdoor Attacks.
30
10.2 RQ2: Are Proposed Three Technologies Harmless for Benign Accuracy.
32
A.Il Experiments on More Complex Constraints in Data-constraint Backdoor Attacks
33
A.12 Experiments on Domains Different From CLIP's Training Domain
33
A.13 Experiments on Fine-grained Datasets
34
A.14 Experiments VIT Architecture
35
A.15 Discussion...
36
A.15.1 Performance degradation in the clean- single-class backdoor attack.
36
15

---

Published as a conference paper at ICLR 2024
A.15.2 Domain-constraine backdoor attacks easier than class-constrained backdoor attacks.
36
A.15.3 Time Consumption of Different Attack Methods.
37
A.15,4 Explaining the Difference Between Data-constraint Backdoor Attacks and backdoor attacks of federated learning.
37
A.16 Limitations and Future Works
38
A.1 DETAILED BACKGROUND AND RELATED WORK
A.1.1 POISONING EFFICIENCY IN BACKDOOR ATTACKS
Existing studies aim at improving the poisoning efficiency of backdoor attacks can be categorized into two main areas.
Designing Efficient Triggers The design of efficient triggers that are easier for DNNs to learn has garnered significant interest. Researchers have recently drawn inspiration from Universal Adversar- ial Perturbations (UAPs) Moosavi-Dezfooll et al. (2017) and optimized UAPs on pre-trained clean models to create effective triggers, which have been widely utilized in various studies Zhong et al. (2020); Li et al. (2020); Doan al. (2021). However, this approach requires pre-trained clean model on the training set, which is not practical for data-constrained backdoor attacks.
Selecting Efficient Poisoning Samples Efficient sample selection for poisoning attacks is critical yet under-explored aspect that is distinct from trigger design. Xia et al. (2022b) were among the first to investigate the contribution of different data backdoor injection. Their research revealed that not all poisoning samples contribute equally, and appropriate sample selection can greatly enhance the efficiency of data in backdoor attacks. Additionally, various studies Li al. (2023a;d); Gao al. (2023); Guo et al. (2023) follow this setting, and the sample efficiency has been further improved.
A.1.2 POISONING STEALTHINESS IN BACKDOOR ATTACKS
Existing studies focused on increasing the stealthiness of backdoor attacks can be categorized into two main areas.
Designing Invisible Triggers The concept of invisible triggers aims to ensure that poisoning images are visually indistinguishable from clean samples, thus evading detection in both pixel and feature spaces. This perspective the most straightforward approach to bypass defenses. Chen et al. (2017) first propose a blended strategy to evade human detection by blending clean samples with the trigger to create poisoning samples. Subsequent studies Zhong al. (2020); Li et al. (2020); Doan et al. (2021) focuse constraining the norm of the trigger through optimization methods. Moreover, some studies have explored the use of natural patterns such as warping Nguyen & Tran (2021), rotation Wu al. (2022), style transfer Cheng et al. (2021b), frequency Feng et al. (2022); Zeng et al. (2021), and reflection Liu et al. (2020) to create triggers that are more imperceptible to human inspection. contrast previous works that employ universal triggers, Li al. (2021c) employ GAN models to generate sample-specific triggers, which are similar to ad adversarial examples and extremely imperceptible to humans.
Clean-label Attacks. Clean-label attacks refer to backdoor attacks where the target labels of the poisoning samples align with their perception labels. Turner et al. (2019) the first explore clean-label attacks by employing GAN-based and adversarial-basse perturbations. Compared to standard backdoor attacks, clean-label attacks are typically less effective due to the model's ten- dency to associate natural features, rather than backdoor triggers, with the target class. Recent studies have focused on aligning features Saha et al. (2020) or gradients Souri et al. (2021) between perturbed inputs from the target class and trigger-inserted inputs from the non-target class through pretraining on the entire training set. Additionally, some study Zeng et al. (2022) has proposed optimizing the backdoor trigger using only the knowledge about the target-class training data. In this approach, the trigger is optimized to point towards the interior of the target class, resulting in improved effectiveness.
16

---

Published as a conference paper at ICLR 2024
A.1.3 CONTRASTIVE LANGUAGE-IMAGE
(CLIP) MODEL
Our method introduces the Contrastive Language- Pre- Pre-Training (CLIP) Radford et al. (2021) model into backdoor injection and we introduce it here. CLIP is a revolutionary deep learning model developed by OpenAl that is designed to connects texts and images by bringing them closer in shared latent space, under contrastive learning manner. The CLIP model is pre-trained on 400 million image-text pairs harvested from the Web, containing two encoder: CLIP text encoder Es(-) and CLIP image encoder (-) These encoders project the text and image the CLIP common embedded feature space. Since natural language is able to express a much wider set of visual con- cepts, it contains ability to generalize across a wide range of tasks and domains, such as text-driven image manipulation Patashnik et al. (2021), zero-shot classification Cheng et al. (2021a), domain generalization Niu et al. (2022). To our best knowledge, our paper is the first study to explore the usage of CLIP model in the security community.
A.2 DETAILED PIPELINE OF DATA-CONSTRAINEL BACKDOOR ATTACKS.
A.2.1 EXAMPLES OF BACKDOOR ATTACKS IN OUR STUDY
Here, we present three popular backdoor attack methods that serve as the baseline for our prelimi- nary experiments, providing insight into the motivation discussed Sec. 3. All attacks follow the pipeline described in Sec. 2.2.
BadNets. BadNets Gu et (2019) the pioneering backdoor attack in deep learning and is often used benchmark for subsequent research. It utilizes 2 2 attacker-specified pixel patch the universal trigger pattern attached to benign samples.
Blended. Chen al. (2017) first discuss the requirement for invisibility in backdoor attacks. They propose that the poisoning image should be visually indistinguishable from its benign counterpart to evade human inspection. To meet this requirement, they introduce blending strategy where poisoning images are created by blending the backdoor trigger with benign images. Formally, the poison generator can be formulated as T(x, 1) X + (1 A) x, where À represents the blend ratio (we set À = 0.15 for all experiments in this paper), and is an attacker-specified benign image serving as the universal trigger pattern.
Universal Adversarial Perturbations (UAP). Inspired by Universal Adversarial Perturbations (UAPs) in adversarial examples, some studies Zhong al. (2020); Li et al. (2020); Doan et al. (2021) propose optimizing UAP on pre-trained clean model as the natural trigger, formulated as T(x,t) x + t, where is a pre-defined UAP serving as the universal trigger pattern. It's worth noting that UAP-based backdoor attacks require a clean model pre-trained on the entire training set, which not suitable for the discussed settings. However, to better explain our motivation that previous technologies exhibit significant performance degradation in data-constrained backdoor at- tacks, we assume the availability of a clean model pre-trained on the original training dataset in this section. It is important acknowledge that this assumption does not hold in actual attack scenario.
A.2.2 EXPERIMENTAL SETTINGS.
To evaluate the performance of three backdoor attack methods (BadNets, Blended, and UAP) under data-constrained scenarios, we conduct experiments on the CIFAR-10 dataset. Specifically, we consider three types of data constraints: number, class, and domain. The settings for the poisoning attacks follow those described in Sec. 1.2. In all attacks, we set the attack-target label & to category O. For our experiments, we select the VGG-16 model as the victim model and employ SGD as the optimizer with weight decay of 5e-4 and momentum of 0.9. The batch size is set to 256, and the initial learning rate is set to 0.01. The learning rate is multiplied by 0. the 35-th and 55-th epochs, and the training is conducted for total of 70 epochs.
A.2.3 NUMBER-CONSTRAIEE BACKDOOR ATTACKS
Definition. Let D' denote the data manipulable by the malicious source, and D represent all the data available the data collector. In the number-constrained scenario, illustrated in Fig. 5 (a),
17

---

Published as a conference paper at ICLR 2024
Data collector requires data sources to provide data volume
Data collector zequires data sources to provide data by category
Data collecter requires data sources to provide data by domaii
Malisns Sounce
Maketias Saaeee
Tmage Seaccc
Deoge Seacio
Brigg Seurch
(a) Number-constrained Scenario
(b) Class-constrained Scenario
(c) Domain-constrained Scenario
Figure 5: Three data-constrained attack scenarios, where the data provided by each data source is independently and identically distribution in number-constrained backdoor attacks, each data source provides data belonging different categories in class-constrained backdoor attacks, and each data source provides data from different domains in comain-constrained backdoor attacks.
the data collector gathers data from multiple sources, including both malicious and benign sources, to form D. The data provided by each data source independently and identically distributed. In other words, DD and D' belong to the same distribution, but in terms of quantity, N' < N. The setting of number-constrainer backdoor attacks is similar to that of data-efficient backdoor attacks discussed in previous studies Xia et al. (2022b); Zhong et al. (2020). Both aim improve the Attack Success Rate (ASR) under a low poisoning rate, However, previous studies assumed that the attacker has access to the entire training set D, which enables efficient trigger design and sample selection. For example, some studies Zhong et al. (2020) draw inspiration from Universal Adversarial Perturbations (UAPs) in adversarial examples and propose optimize UAP on clean model pre-trained on the training set as the natural trigger. Xia el al. Xia et al. (2022b) enhance the poisoning efficiency in backdoor attacks by selecting poisoning data from the entire training set. Although these methods have achieved remarkable results, they cannot be directly applied to number-constrained backdoor attacks due to the lack of access to the entire training set.
Experimental results. In this section, we investigate the performance degradation of previous stud- ies in cumber-constrained backdoor attacks. As shown in Fig. 2 (a), the attack success rate ex- periences significant decrease as the number (P) of poisoning samples decreases, particularly for Blended backdoor attacks. It is worth noting that Universal Adversarial Perturbations (UAP) achieves relatively favorable results even with low poisoning rate. This can be attributed to the utilization of a proxy model that is pre-trained on the entire training set (D). However, in our set- tings, UAP is not accessible, and we present the results for UAP to effectively demonstrate the performance degradation even when a pre-trainee proxy model is available.
A.2.4 CLASS-CONSTRAINED BACKDOOR ATTACKS
Definition, In the class-constrained scenario, let D' represent the data manipulable by the malicious source, and D denote all the data available to the data collector. As depicted in part (b) of Fig. the data collector gathers data from multiple sources, including both malicious and benign sources, to form D. Each data source provides data belonging to different categories, resulting in D' containing only a subset of categories present in D. Therefore, D and D' follow distinct distributions. More specifically, the accessible clean training set D' subset of the entire training set D C X x Y(D { yi = 1.... NJ). where Y' Y 21, C). Class-constrained backdoor attacks can be seen as a general setting of cabel backdoor attacks Turner et al. (2019); Saha et al. (2020); Souri et al. (2021). In clean-label backdoor attacks, the accessible clean training set D' is defined as D' CX x Y', where Y' = {k} and represents the attack-target label.
x ('
{(2,, y:)li 1, ,N') is
Experimental results. In this section, we explore the performance degeneration of previous studies in
backdoor attacks. As illustrated in Fig. 2 (b), attack success rate decreases as the number of class (C") in the poisoning set decreases, which the similar as experimental results on the cunber-constrained backdoor attacks.
18

---

Published as a conference paper at ICLR 2024
Numkrncorsttannl
Ditt-label singlecilms
Cleam dabel singledlaes
Birty lust sinleciaas
Bukkke Saadsnn
Polonnd
FOE
0-2
bedose Aethatee
Secbdee rebin
?
?
0.
Sadhete
Hledd
(a) ASR of three backdoor attacks (p 1000 for all experiments).
(b) Visualizations of the backdoor injection and activation phases for three backdoor attacks.
Figure Analyses the entanglement between benign and poisoning features on the number- constrained, dirty-label single-class, and clean-label single-class backdoor attacks.
A.2.5 DOMAIN-CONSTRAING BACKDOOR ATTACKS
Definition. In the domain-consten comain-constrained constraien scenario, as depicted in part (c) of Fig. 5, the data collec- tor gathers data from multiple sources (both malicious and benign) to form D. Each data source provides data from different domain, resulting in containing only a subset of the domains present in D. Consequently, D and D' belong to different distributions. We examine scenario in domain-constrained backdoor attacks, where the test dataset follows the same distribu- tion the benign source (D D') and is outside the domain of the malicious source D' C X x Y' (D' = {IT; ) = 1, 1.... .ND).. Evidently, images belonging to the same class can stem from diverse distributions, which term domain distinctions. To illustrate, consider the "Car" cat- egory found in both the ImageNet and CIFAR-10 datasets. Despite sharing this category, they ex- hibit disparate distributions, classifying them into distinct domains. In our context, characterized as "domain-come conttrined backdoor attacks, the domain pertains to the differing distributions within the same image class. This delineation underpins a tangible attack scenario. For instance, consider a victim endeavoring to train comprehensive classifier capable of generalizing across varied data distributions. However, the assailant lacks comprehensive knowledge of the domains from which the victim sources data; thus, their capacity is confined to contaminating images within one or several domains, among the array of domains within the training set.
extreme
Experimental results. To simulate the domain-constrained scenario, we conducted experiments with the following settings in this section: we designate the CIFAR- 10 dataset as the benign source, the ImageNet dataset as the malicious source, and evaluated the attack performance 10 dataset. Fig. 2 (c) illustrates the results, showing a decrease in the attack success rate as the domain rate (the proportion of poisoning sets sampled from D \ D' and D') in the poisoning set decreases. This observation aligns with the experimental findings in the number-constrained and class-constrained backdoor attacks.
the CIFAR-
A.3 ANALYZING THE ENTA ENTANGLEMER BETWEEN BENIGN AND POISONING FEATURES
In this section, provide three observations on data-constrained backdoor attacks demonstrate the entanglement between benign and poisoning features does exist in the backdoor injection pro- cess, and the main reason why current attack methods fail in tata-constrained scenarios.
Observation 1: BadNet outperforms Blended notably in data-constrained attack scenarios.
In a practical experimentation setting, BadNet and Blended exhibit comparable performance under unrestricted attack conditions (the leftmost point the horizontal axis of Fig. 2). Conversely, in data-constrained attack scenarios, BadNet outperforms Blended notably. This intriguing disparity requires elucidation. BadNet employs 2 2 attacker-specified pixel patch universal trigger pat- tern attached to benign samples, whereas Blended employs an attacker -seecffid- benign image for the same purpose. Comparatively, Blended's 's trigger exhibits greater feature similarity benign im- ages, engendering a more pronounced feature entanglement between poisoned and benign attributes. Accordingly, the performance of the blended darty-label single-class scenario significantly lags be-
19

---

Published as a conference paper at ICLR 2024
Figure The Grad-CAM of the backdoor model on the CIFAR-100 dataset.
hind other cases, lending credence to our hypothesis that entanglement underpins the degradation of cota-conntrained backdoor attacks.
Observation 2: Attack efficiency of number-constrained, dirty-label single-class, and clean- label single-class backdoor attacks decreases in turn under the same poison rate. We further investigated our hypothesis and present our findings of entanglement in Fig. 6. As shown in Fig. (a), the attack efficiency of number-constrained, dirty-label single-class, and clean-label single- class backdoor attacks' decreases in turn under the same poison rate. To understand the reason behind this phenomenon, we provide visualizations of the backdoor injection and activation phases for these three attacks in Fig. 6 (b). For the number-constrained backdoor attack, the distri- bution of poisoning samples (consisting of both benign and poisoning features) in the backdoor injection phase is the same as that in the backdoor activation phase. In other words, both benign and poisoning features are activated simultaneously during both phases. However, for the dirty-label single-class backdoor attack, the distribution of poisoning samples (consisting of single-class be- nign and poisoning features) in the backdoor injection phase is different from that in the backdoor activated, but
activation phase. During the injection phase, both benign and poisoning features during activation phase, only the poisoning feature is activated. This is the reason why previous attack methods on dirty-label single-class backdoor attacks exhibit performance degeneration. The clean-label single-class backdoor attack is similar to the dirty-label single-class backdoor attack terms of the distribution of poisoning samples. However, during backdoor injection, there is com- peting activation between benign and poisoning features. Consequently, the poisoning efficiency of laben single-class backdoor attacks is lower than that of dirty-label single-class backdoor attacks.
Observation Substantial dissimilarities in activation between poisoned samples that share the same trigger. We have embraced Grad-CAM Selvaraju et al. (2017) to more effectively corrob-
'In the clean-label single-class backdoor attack, the benign feature of the accessible class (the same as the attack-target class) in both poisoning and clean sets is labeled with the same label (e.g., "Fish" in Fig. 6), and the clean contains more samples of the attack-target class. As result, the presence of the benign feature poisoning set hampers the activation of the poisoning features. accessible class in poisoning and clean sets is labeled with the different label in the dabey single-clas class backdoor attack (e.g., the benign feature in the clean set is labeled as "Frog", while the benign+poisoning feature in the poisoning set is labeled as "Fish"). Consequently, the benign feature in the poisoning set does not impact the activation of the poisoning features.
contrary, the benign feature of the
20

---

Published as a conference paper at ICLR 2024
orate the presence of correlation between the benign and the backdoor features. To substantiate this hypothesis, we have incorporated Grad-CAM outcomes to our study. Sgrad-campecificee have applied this technique to the BadNet-based poison model on the CIFAR- A-0000 dataset, as depicted in Figure 7. The discernible results from these Grad-CAM visualizations underscore the substantial dissimilarities in activation between poisoned samples that share the same trigger. This visual evidence compellingly demonstrates the intricate entanglement existing between the benign and the backdoor features during instances of backdoor attacks.
A.4 THREAT MODEL
Attack scenario. The proliferation of large-scale artificial intelligence models, such as ChatGPT and Stable Diffusion, necessitates the collection of massive amounts of data from the web. How- ever, the security and trustworthiness of this data cannot always be guaranteed. This data collection pipeline inadvertently introduces vulnerabilities that can be exploited by data-based backdoor at- tacks. Attackers can strategically inject poisoning data into the training dataset and publish it on the internet, potentially compromising the integrity and performance of these models. Unlike previous attack scenarios where all training data is sourced from single provider, we consider more real- istic scenario in which victims collect data from multiple sources. In this scenario, attackers only have access a portion of the training dataset. This situation mirrors the real-world training process of models that utilize diverse public data. By acknowledging the challenges posed by multi-source data collection and limited attacker access, our study provides valuable insights into the security implications of such scenarios.
Attack goal. The objective of our paperis is aligned with popular backdoor attacks, as seen in previous studies Gu et al. (2019): Li et al. (2021a). The attackers aim to activate a hidden trigger within the model by providing specific inputs, leading the model to produce incorrect results. Our attack strategy emphasizes three key properties: (i) Minimal side effects: The backdoor attacks should not adversely impact the accuracy of the model on benign inputs. (ii) Effective backdoor: The attack should have a high success rate across various datasets and models, ensuring its efficiency. (iii) Stealthy attack: The backdoor attacks should be inconspicuous and difficult to detect, maintaining their stealthiness. Our research aims to develop invigorative backdoor attacks that strike a balance between effectiveness and preserving the integrity of the model's 's performance on legitimate inputs.
Attackers' prior knowledge. In order to simulate a realistic scenario, assume that the attackers have no access to the models or training details. They possess only general knowledge about the class labels involved in the task. This assumption reflects more challenging and practical setting, where attackers have limited information about the target system.
Attackers' capabilities. Building upon previous studies Gu et al. (2019), we make the assumption that the attackers possess the capability to control the training data. However, we further impose a stricter assumption in this work, stating that the attackers have control over only a portion of the training data. Consequently, we divide the attack scenario into three distinct tasks, each representing different capabilities of the attacker. These tasks include: (i) cumber--onstrainte backdoor attacks, where the attacker has access to only a subset of the training data; (ii) Class-constrainel backdoor attacks, where the attacker has access to only a subset of the classes in the training data; and (iii) Domain-constrained backdoor attacks, where the attacker has access to only subset of the domains within the training data. By considering these various constraints, we provide a comprehensive analysis of backdoor attacks in different constceost scenarios.
A.5 CLIP FOR ZERO-SHOT CLASSIFICATION
The pre-trained CLIP model Radford et al. (2021) possesses the ability to express a broader range of visual concepts and has been utilized as a general feature extractor in various tasks. These tasks include text-driven image manipulation Patashnik et al. (2021), zero-shot classification Cheng et al. (2021a), and domain generalization Niu et al. (2022). In this section, we introduce the pipeline of CLIP in zero-shot classification, which can serve as inspiration for incorporating it into our clean feature erasing approach. CLIP achieves zero-shot classification by aligning text and image features. Firstly, CLIP employs its text encoder, denoted as ε₂(-), to embed the input prompts ("a photo of a e,") into text features T; E Rd, where {1, 2, C} represents the classes. Subsequently, the image feature I, E RRd of image zj is embedded using the image encoder, denoted as ε.(.). During
21

---

Published as a conference paper at ICLR 2024
the inference phase, the classification prediction yj is computed using the cosine similarity between T, and Iy. This can be expressed as:
j/j arg max (1,, E (1,2,...,
(12)
where represents the number of classes, and (++)) represents the cosine similarity between two vectors.
A.6 CLIP-BASED UNIVERSAL. ADVERSARIAL PERTURBATIONS
In this section, we also employ the widely-used pre-trained CLIP model Radford et al. (2021) to generate universal adversarial perturbations as the backdoor trigger. Xia et al. (2023) argue that deep models inherently possess flaws, and it is easier exploit and enhance an existing flaw to serve as a backdoor rather than implanting new one from scratch (BadNets Gu et al. (2019) and Blended Chen et al. (2017)). Universal Adversarial Perturbations (UAP) Zhong et al. (2020); Xia et al. (2023) utilize these inherent flaws in models as triggers, providing straightforward method for augmenting the poisoning feature. However, this approach typically requires a feature extractor that has been pre-trained on the entire training set, which is not practical in data-constrained backdoor attacks. To address this limitation, we propose a CL.IP-based Universal Adversarial Perturbations (CLIP-UAP) method. Specifically, given accessible clean training set D' = { y1 1, ,N) and an attack-target label k, the defined trigger can be formulated as follows:
Sapp
arg min | (Z.U)ED
Σ
M[CCIp(æ + Suaps PP, k))
(13)
where IP and fCLIP defined shown in Eq. and Eq. 5, respectively. Similar to Eq. 6, utilize the first-order optimization method known as Projected Gradient Descent (PGD) Madry et al. (2017) to solve the constrained minimization problem. The optimization process can be expressed as follows:
g++1 II (5ump sign( V dmp [(foLi((x Kump: P))
(14)
where i, V V LSCLIPP + Sup P), and II hold the same meaning as in Eq. 6. Unlike the sample-wise clean feature erasing noise. the CLIP-UAP serves universal trigger for the entire training set. Therefore, it follows the optimization formulation presented in Eq. 14 to generate 8t+] each step I. The optimization process performed on all samples in the accessible clean training set 'D', Consequently, the CLIP-UAP for the set D' can be represented as duap 5 and the poison
generator is formulated as T Txx, Supp) = + бump-
A.7 EXPERIMENTAL SETUP
A.7.1 DATASETS
We use the following three popular datasets in image classification:
CIFAR-10 Krizhevsky et al. (2009). CIFAR-10 is a tiny object classification dataset containing 50,000 training images and 10,000 testing images. Each image has a size of 32 32 x and belongs to one of 10 classes.
CIFAR-100 Krizhevsky et (2009). Similar to CIFAR-IO, CIFAR-100 also a tiny object clas- sification dataset containing 50,000 training images and 10,000 testing images. Each image has size of 32 x 32> x 3 and belongs to one of 100 classes.
ImageNet-50 Deng et al. (2009). ImageNet is the most popular object classification dataset con- taining 1.3M training images and 50K testing images. Each image has a size of 224 x 224 x 3 and belongs to one of 1000 classes. For simplicity, randomly sampled 50 categories to compose tiny dataset: ImageNet-50. Our ImageNet-50 dataset contains 60K training images and 2.5K testing images.
22

---

Published as a conference paper at ICLR 2024
BadNets
Blended
CUP-UUP
CLIP-CFA
origin image
triggen
CLIP he---aaed CFF
triggen
Figure 8: Visualizations of the poisoning samples with different triggers.
A.7.2 MODEL ARCHITECTURE.
We verify the performance on three popular model architectures of image classification: VGG-16 Simonyan & Zisserman (2014), ResNet-18 He et al. (2016), and MobileNet-V2 Sandler et al. (2018). All of them are widely used in various areas artificial intelligence, such as flower classi- fication Xia et al. (2017), pulmonary image classification Wang et al. (2019b), fault diagnosis Wen et al. (2020), and Covid-19 screening Farooq & Hafeez (2020).
A.7.3 BASELINE AND COMPARISON.
Our method contains two aspects: clean feature suppression and poisoning feature augmentation. Among them, poisoning feature augmentation can be accomplished through designing efficient and data-independent triggers, while clean feature suppression is orthogonal to previous trigger design- ing and can be integrated into any backdoor triggers. Therefore, we compare our two designed triggers CLIP-based universal adversarial perturbations (CLIP-UAP) and CLIP-based contrastive feature augmentation (CLIP-CFA) with two popular triggers: BadNets Gu et al. (2019)and Blended Chen al. (2017). All of them independent of the training data therefore easily in the introduced constrnodt backdoor attacks. Although there are also contain other ad- vanced clean-label backdoor attacks Liu al. (2020); Barni al. (2019): Saha et al. (2020); Souri et al. (2022) and state-of-the-aar backdoor attacks Zhong et al. (2020), a substantial proportion of them Liu et al. (2020); Saha al. (2020); Souri al. (2022); Zhong et al. (2020) operate within the threat model that necessitates proxy model pre-trained on the entire training set. This precondition becomes challenging to fulfill in the context of a many-to-one (M20) data collection attack scenario. clean
be implemented
To verify the validity of the clean feature suppression, we integrate the proposed feature erasing (CLiP-CFFR CFE) onto currently designed triggers: two our designed triggers and two baseline triggers.
A.7.4 IMPLEMENTATIONS.
In order to demonstrate the effectiveness of our proposed method, we conduct experiments on three datasets (CIFAR-10, CIFAR-100, and ImageNet-50), For the CIFAR-I0 and CIFAR-100 datasets, choose VGG-16, ResNet-18, and MobileNet-V2 as the victim models. All models use the SGD optimizer with a momentum of 0.9, weight decay of 5e-4, and learning rate of 0,01 (0.1 for MobileNet- V2), which is multiplied by 0.1 at epoch 35 and 55. For the ImageNet-50 dataset, we use VGG-16 16 and MobileNet-V2 V2 as the victim models. We use the SGD optimizer with momentum of 0.9, weight decay of 5e-4, and a learning rate of 0.05 (0.01 for VGG-16), which is multiplied by 0.1 at epoch 35 and 55. The complete training epochs is 70.
In the number-constrained scenario, we conducted experiments with poisoning rates of 0.01 (P=500), 0.015 (P=750), and 0.007 (P=453) for the CIFARIO, CIFAR100. and ImageNet-50 threes datasets, respectively. In the class-constrained scenario, experiments with poisoning rates of 0.02 (P=1000), 0.01 (P=500), and 0.02 (P=1296) for three datasets. We choose two extreme scenario in the class-constrained backdoor attacks, denoted as clean-label single-class backdoor attack and dirty-label single-class backdoor attack. Specifically, the accessed class category is set Y' (k)
23

---

Published as a conference paper at ICLR 2024
Table 2: The Peak Signal-to-noise Ratio (PSNR) and Structural Similarity Index (SSIM) on the ImageNet-50 dataset. All results are computed on the 500 examples.
Clean Feature
Backdoor Attacks
Metries
Trigger
Suppression
Number Constrained
Clean-label single-class
Dirty-label single-class
Domain Constrained
CLIP-CFE
32.18
31.26
30.91
32.22
BadNets
w/ CLIP-CFE
32.19
31.41
31.39
32.17
CLIP-CFE
21.68
21.37
20.90
21.60
PSNR (t)
Blended
w/ CLIP-CFE
21.67
21.31
20.99
21.58
CLIP-CFE
33.11
33.66
32.84
32.64
CLIP-UAP
w/ CLIP-CFE
33.10
33.64
32.81
32.59
CLIP-CFE
32.74
32.54
32.70
32.46
CLIP-CFA
w/ CLIP-CFE
32.72
32.52
32.67
32.41
w/o CLIP-CFE
0.995
0.995
0.995
0.995
BadNets
w/ CLIP-CFE
0.995
0.995
0.995
0.995
w/o CLIP-CFE 0.794
0.820
0.730
0.787
SSIM
Blended
w/ CLIP- CFE
0.827
0.834
0.772
0.819
(1)
w/o CLIP-CFE 0.719
0,822
0.641
0.702
CLIP-UAP
w/ CLIP-CFE
0.843
0.885
0.793
0.822
w/o CLIP-CFE 0.707
0.795
0.637
0,692
CLIP-CFA
w/ CLIP-CFE
0.830
0.857
0.788
0.810
and y & for clean-label single-class backdoor attack and dirty-label single-class back- door attack, respectively. In the conainnconstraiied scenario, experiments with poisoning rates of 0.02 (P=1000, 1000, and 1296) for three datasets. The out-of-domain samples of all experiments are selected from other ImageNet-1K K datasets that are not ImageNet-50. The attack-target class k is to category for all experiments of above three data-constrained backdoor attacks.
A.7.5 EVALUATION METRICS.
We evaluate the performance of our method in terms of Harmlessness: Benign Accuracy (BA), Effectiveness: Attack Success Rate (ASR), and Stealthiness: Peak Signal-to-noise Ratio (PSNR) Huynh-Thu & Ghanbari (2008) and Structural Similarity Index (SSIM) Wang et al. (2004).
Benign Accuracy (BA). BA is the clean accuracy of the testing set D, = {(I; y:) 1, 1, .M) and is applied evaluate the Harrllesnesss of the backdoor. When BA of the infected model is similar to the accuracy of the clean model, we believe that the current attack technique is harmless.
Attack Success Rate (ASR). ASR is applied evaluate the effectiveness of the backdoor attack, which is the fraction of testing images with specific trigger that are predicted as the target class. Specifically, For M' images in the testing set that do not belong to the attack-target class (k), the ASR is formulated as:
ΣM (()((
ASR
(a. v.) D's
(15)
M'
where Dí is a subset of testing set D. (D) C Dz), containing the images whose label is not the attack-target class k.
Peak Signal-to-noise Ratio (PSNR) Huynh-Thee Thu Ghanbari (2008). PSNR is applied to measure the similarity between clean images and the corresponding poisoning images. Give image x; D,
24

---

Published as a conference paper at ICLR 2024
Table 3: The Benign Accuracy (BA) on the CIFAR-I0 dataset. All results are computed the mean by 5 different run.
Bacisdor Attacks
Clean Number Constrinnd
Trigger
Suppression
Class Constrained (Y'
(0))
Class Constrained (Y' (1))
Domais Constrained
V-16
wio CLIP-CIE
0.920
0:928
0.923
0.928
0.28
0.921
CLIP-CHE
0.920
0.920
0:927
0.920
w/s IP-CFF
0.921
0.928
0.919
CLIP-CCE
0.921
0.921
0.927
0.920
0.911
w/o CLIP-CFE
0.922
0.928
0.920
CLIRUAP
CLIP-CCE
0.922
0.922
0.928
0.920
0.937
0.932
0.978
0.927
0.920
CLI-CCFA
CLIP-CFE
0.922
0.929
0.927
0.920
0.927
0.928
0.921
0.929
0.929
0.921
0.929
0.928
and the corresponding poisoning image x! = ((x,, t), the PSNR is formulated as:
PSNR 1 M
(I,,
M 1=1
where PSNR, x/) = 10log10 (255²) MSE(I, 2())
(16)
W
MSE(, HW
Uss - U1y)
H and W are height and width of the image, respectively. Larger PSNR means larger similar- ity between clean images and the corresponding poisoning images, therefore larges stealthiness of backdoor attacks.
Structural Similarity Index (SSIM) Wang et al. (2004). Similar to PSNR, SSIM is another metrics to represent the stealthiness of backdoor attacks, which is formulated as:
M
1
SSIM =
SSIM (I,, 2/),,
M
1=1
where
SSTM; a4) = 1(x1,z)) (()6))) s(1,,1))
(17)
((f.g g) " +
211
c(f.g)
t0
<(s.g) +10
oratCs
where y and are mean and variance of image, respectively. Similarly, Larger SSIM means larger
similarity between clean images and the corresponding poisoning images, therefore larges stealthi- ness of backdoor attacks.
A.8 RQ3: ARE PROPOSED TECHNOLOGIES STEALTHY FOR VICTIMS?
Qualitative and Quantitative Results. Fig. 8 showcases examples of poisoning images generated by different attacks on the ImageNet-50* dataset. While our CLIP-UAP and CLIP-CFA may not achieve the highest stealthiness in terms of SSIM (as indicated in Table 2), the poisoning images generated by our methods appear more natural to human inspection compared to the baseline at- tacks. Additionally, incorporating CLIP-CFE has minimal impact on both PSNR and the natural appearance of the images, while achieving higher stealthiness in terms of SSIM.
Stealth in attack defense methods. Attack stealthiness needs to be evaluated through algorithm. (i) As depicted in Figure 9, our preliminary evaluation conducted on the VGG-16 and CIFAR-100
As shown in Appendix A.7, CIFAR-10 and CIFAR-100 have low resolution, which makes unclear visual- izations. Therefore, show the results on the ImageNet-50 dataset in this section.
25

---

Published as a conference paper at ICLR 2024
CIFAR-100, 00,
VGG-16
1.00
0. 98
Attack success rate
9.
9.
0.92
BadNets
9.90
BadNets (CLI (CLIP-OFE)
Bl andded
Bl ended (CLIP-CFE)
88
CL UPA
CL P--AP (CL (CF))
0. 86
CL PP-CA
CL ILAP (CL CFFEE)
0.
0.1
0.2
0. 3
prune_ratio
Figure 9: Defense results of pruning Liu et al. (2018) the number-constrained backdoor attack of the CIFAR- dataset and VGG-16 model, where the number of clean samples owned by the defender is 50 and the poisoned rate is 2%.
datasets vividly demonstrates that our proposed method can attack against pruning-based defense method Liu et al. (2018) more effectively than other attack methods. (ii) As depicted in Figure our preliminary evaluation conducted on the ResNet-18 model and CIFAR- datasets vividly demonstrates that our proposed method can attack against another pruning based defense method Neural cleanse Wang al. (2019a) more effectively than other attack methods. (iii) Similarly, as de- picted in Figure 11, our preliminary evaluation conducted on the ResNet- 18 and CIFAR- datasets vividly demonstrates that our proposed method can attack against tune-based defense method FST Min et al. (2023) more effectively than other attack methods.
A.9 EXPERIMENTS ON THE CIFAR-10 10 DATASET
A.9.1 RQI: ARE PROPOSED TECHNOLOGIES EFFECTIVE ON DIFFERENT BACKDOOR ATTACKS.
In this section, we utilize our proposed technologies to attack different target models on the CIFAR- 10 dataset. Our objective is to verify the effectiveness of the attack and calculate the ASR for each target model. The baseline attack methods, BadNets Gu al. (2019) and Blended Chen et (2017) were introduced in Sec. A. The attack performance of the number-constrainet clean-label single-class class-constrainee), dirty-label single-class cclsss-oontraiined) and -ot----th--dominn (domain-constrained) backdoor attacks CIFAR-10 10 dataset are reflected in Fig. 12, 13, 14, and 15, respectively.
CLIP-based Poisoning Feature Augmentation Is More Effective Than Previous Attack Meth- ods. Our proposed CLIP-UAP and CLIP-CFA methods outperform the BadNets Gu et al. (2019) and Blended Chen et al. (2017) baseline methods in terms of ASR under the most attacks and datasets.
26

---

Published as a conference paper at ICLR 2024
AR-1000 ResNet-18
1.00
Attcak Success Accuracy
0.80
0.60
BadNets
BadNets BadNNet(CCLIP-CHH CCLIP-CFE)
Blended
(CLIP-CCCLP-CFFFF
0.40
CLIP-UAP
CLI-UAAPCLII--CO
CLIP-CFA
CLIP-CFA(CII-CCF)
0
0.1
0.2
0.3
Prune Ratio
back- door attack the CIFAR-100 dataset and ResNet- 18 model, where the number of clean samples owned by the defender is 1500, and the poisoned rate is 2%.
Figure 10: Defense results of Neural cleanse Wang et al. (2019a) on the
CIFAR-100 ReNet-18
CIF A AR-100, ReNet-18
0.60
Attack Success Rate
Benign Accuracy
0.58
0.40
Blaaded
0.55
CLIP-UPP
CLP-AAPCCLIP.CO
0.20
CLD-CFA(CLLDCFFE)
0.53
BalNeta
BaINow
CLIP-UAP
0.50
CLIP-CFA
CLm-CrA(CUF-CTF
0.00
0.02
0.03
0.04
0.05
0.02
0.03
0.04
0.05
Tuning Dataset Ratio
Tuning Dataset Ratio
(b)
Figure 11: Defense results of FST Min et al. (2023) on the number-constrainee backdoor attack of the CIFAR-100 dataset and ResNet-18 model, where the number of clean samples owned by the defender is from 1000 to 2500 and the poisoned rate is 2%.
This confirms that the proposed poisoning feature augmentation generates more efficient triggers than other methods.
CLIP-based Clean Feature Suppression Is Useful For Different Attack Methods. Our pro- posed CLIP-CFE method improves the poisoning effectiveness most cases compared to the base- line without CLiP-based Clean Feature Erasing. Only on small cases the BadNets and CLIP-UAP slightly outperform the corresponding methods with CFE.
27

---

Published as a conference paper at ICLR 2024
Blended 1gp
BI ended
Blanded 1:044
0.9
00
8:15
w/o IPIP-O
w/ CLIP-OFE
BacMets
Budfets
VGG-16
ReaNet-18
MobileNet-V2
Figure 12: Attack success rate (ASR) of the nuntereconstrained backdoor attacks the CIFAR-10 10 dataset. The red points represents w/o CLIP-based Clean Feature Erasing (CFE), while the green points represents w/ CLIP-based Clean Feature Erasing (CFE). The experiment repeated 5 times, and the results were computed as the mean of five different runs.
Blonded
Blonded
8D
131 CLIP-UMP
OLIF-0FX
OLIP-CFA
CLIP-OFA
GLIP-UMP
w/o GLIP-OF
M/ CLIP-OFE
Boffett
BadMotts
Butkets
VGG-16
ResNet-18 18
Mob MobileNet-V2
Figure 13: The attack success rate (ASR) of the class-constrained backdoor attacks (the access category Y' set to {0}) on the 11FAR-10 dataset. The red points represents w/o CLIP--baee Clean Feature Erasing (CFE), while the green points represents w/ CLIP-based Clean Feature Frasing (CFE). The experiment repeated 5 times, and the results were computed as the mean of five different runs.
Blended
Bi ended
Blanded
0 a:
1.66
55
gFA
PUPPU
CLIP-CFA
CLIP-UPP
IP-OPA
0.5
CLIP-U4P
w/o CLIP-OFE
w/ CLIP-OFE
8.20
VGG-16
ResNe L-8
Mobi iobileNet-V2
Figure 14: The attack success rate (ASR) of the class-constrained backdoor attacks (the access category Y' is set to {1}) on the CIFAR-10 dataset. The red points represents w/o CLIP-based Clean Feature Erasing (CFE), while the green points represents w/ CLIP-based Clean Feature Brasing (CFE). The experiment is repeated 5 times, and the results were computed as the mean of five different runs.
A.9.2 RQ2: ARE PROPOSED THREE TECHNOLOGIES HARMLESS FOR BENIGN ACCURACY.
Table 3 illustrates that proposed CLIP-UAP and CLIP-CFA methods have similar even better average Benign Accuracy (BA) compared to the baseline methods BadNets Gu et al. (2019) and Blended Chen al. (2017). Additionally, our proposed CLIP--FE method has negative effect
28

---

Published as a conference paper at ICLR 2024
Blanded
BI ended
Blanded 0.22
8.50
6.7
w/o OLIP-OFE
w/ CLIP-OFE
0,547
BacMets
Budfets
VGG-16
ReaNet-18
MobileNett
Figure 15: The attack success rate (ASR) of the domain-constrainee backdoor attacks (Domain rate set to 0) on the CIFAR-10 dataset. The red points represents w/o CLIP-bbaed Clean Feature Erasing (CFE), while the green points represents w/ CLiP-based Clean Feature Erasing (CFE). The experiment is repeated 5 times, and the results were computed as the mean of five different runs.
Abl at ion: number-constrai (CIFAR-10)
1.00
0.
Attack Success Rate
0.90
0. 85
0.80
BadNets (w/o CL (P-CE)
7.
BadNets
(w/ CLI P-IE=
Blended (w/o CLIP-CFE)
Blended (w/ CLIP-CFE)
7.
CL P-PPP (w/o CLIP-OFE)
CL PPUAPP (w/ CLIP-OFE)
0. 6.
CL OLIPP (w/o CL CLIP-OFE)
CLIP-GFA (w/ CLIP-CFE)
0. 004
0. 005
0. 006
0. 007
0. 008
0. 009
01
Poison Rate
Figure 16: The attack success rate on the CIFAR-10 dataset different poisoning rates. All results were computed the mean of five different runs.
BA, confirming that our technologies are harmless for benign accuracy under various settings and different backdoor attacks.
A.9.3 RQ3: ARE PROPOSED TECHNOLOGIES EFFECTIVE FOR DIFFERENT POISONING SETTINGS.
Ablation of Different Poison Rates on The Number-constrained Backdoor Attacks. We con- ducted ablation studies to verify the effectiveness of the proposed methods in reducing the number of poisoning samples (poisoning rates) on the nunber-constrained backdoor attacks. The results in Fig. 16 illustrate that: i) The attack success rate increases with the increase of poisoning rate
29

---

Published as a conference paper at ICLR 2024
Abl I lationn class-constrai (CIFFAR (CIFAR-10)
1.0
0.8
Attack Success Rate
0.6
BadNets (w/o CL (FFE)
BadNets (w/ GLIP-OFE)
0.4
Blended (w/o CLIP-CFE)
Blended (w/ CLIP-CFE)
CLIP-UAP (w/o CL (LIP-CFE)
0.2
CLIP-UAP (w/ CLIP-CFE)
CLIP-CFA (w/o CL IP-CFE)
CLIP-CFA (w/ CL P-FP-)
0.
1 (0)
(1)
3
5
7
Poison son C Classes
Figure 17: The attack success rate on the CIFAR-10 dataset at different accessible class of poisoning samples. All results were computed the mean of five different runs.
for different attacks; ii) Our proposed CLIP-UAP and CLIP-CFA methods outperform BadNets Gu et al. (2019) and Blended Chen et al. (2017); iii) The proposed CLIP-CFE further improves the poisoning effectiveness upon the different triggers.
Ablation of Different Poison Classes on The Class-constrained Backdoor Attacks. In this sec- tion, we conducted ablation studies to verify the effectiveness of the proposed methods in increasing the number of poisoning classes the class-constrained backdoor attacks. The results in Fig. 17 illustrate that: i) The attack success rate increases with the increase of poisoning classes for different attacks; The attack success rate of clean-label single-class attack is lower than that of dirty-label single-class attacks; iii) Our proposed CLIP-UAP and CLIP-CFA methods outperform the BadNets Gu et al. (2019) and Blended Chen al. (2017) methods; iv) The proposed CLIP-CFE method further improves the poisoning effectiveness with different triggers.
Ablation of different domain rates on the Nomain-constraiiee backdoor attacks. In this section, we conducted ablation studies to verify the effectiveness of the proposed methods in increasing the domain rate on the domain-comee constrained backdoor attacks. The results in Fig. 18 illustrate that: i) The attack success rate increases with the increase of the domain rates for different attacks; ii) Our proposed CLIP-UAL UAP and CLIP-CFA methods outperform the BadNets Chen et al. (2017) methods; iii) The proposed CLIP-CFE method further improves the poisoning effectiveness with different triggers.
(2019) and Blended
A.10 EXPERIMENTS ON THE IMAGENET-50 DATASET
1.11 RQI: ARE PROPOSED TECHNOLOGIES EFFECTIVE ON DIFFERENT BACKDOOR ATTACKS.
In this section, we utilized our proposed technologies to attack different target models on the ImageNet-50 dataset and calculate the ASR for each target model to verify the attack effective-
30

---

Published as a conference paper at ICLR 2024
Abl 1 alationn on: domai n a ind (CIFAR-10)
1.00
0. 95
Attack Success Rate
0.90
8.
BadNets (w/o CL CLIP-CFE)
BadNets (w/ CLIP-CFE)
0. 80
Blended (w/o CLIP-CFE)
Blended (w/ CLIP-CFE)
0. 75
CLIP-UAP (w/o CL (L-E)
CLIP-UAP (w/ CLIP-CFE)
CLIP-CFA (w/o CL (P-CFE)
7.
CLIP-CFA (w/ CL P-CF)
0.
0. 25
0. 50
0. 75
1.00
Domain Rate
Figure 18: The attack success rate on the CIFAR-I0 dataset at different proportions of in-domain samples. All results were computed the mean of five different runs.
Blended
Blendedd
IP-OFE
0.1P-D
OL IP-UAP
OPIP-
OL CLIP-UAP
Budfets
Budfett
VG0-16
Mobil eNNt-V2
Figure 19: Attack success rate (ASR) of the number-constrained backdoor attacks the ImageNet- 50 dataset. The red points represents w/o CLiP-based Clean Feature Erasing (CFE), while the green points represents w/ CLIP-based Clean Feature Erasing (CFE). The experiment is repeated 5 times, and the results were computed as the mean of five different runs.
ness. The baseline attack methods, BadNets Gu et al. (2019)and Blended Chen et al. (2017) were introduced Sec. 1.2.1. Fig. 19, 20, 21, and 22 reflect the attack performance of the number- constrained, clean-label single-class cllass-constrained) dirty-label single-class claass-constrained). and out-of-the domain (domain-constrained) backdoor attacks on the ImageNet-50 dataset, respec- tively.
31

---

Published as a conference paper at ICLR 2024
Blended AN
Blended
w/ CL OP-
CL IP-
1:33
1992
CL UPP
CLIP-0X
OLIP UAP
090
0.0
Budlets
Budfett
VGG-16
MobileNet-V2
Figure 20: The attack success rate (ASR) of the class-constrained backdoor attacks (the access cat- egory Y" is set to (0)) on the ImageNet-50 dataset. The red points represents w/o CLIP-based Clean Feature Erasing (CFE), while the green points represents w/ CLIP-based Clean Feature Eras- ing (CFE). The experiment is repeated times, and the results were computed as the mean of five different runs.
Blended
Blended
c.mh4
w/o CLIP-OFE
CL OF
30%
CL IP-UAP
CPIP-OFA
CLIP-UAP
400
Bodfett
Bodfett
VGG-16
Mobil MobileNet-V2
The attack success rate (ASR) of the class-constrained backdoor attacks (the access cat- egory Y' is set to {1}) on the ImageNet-50 dataset. The red points represents w/o CLIP-based Clean Feature Erasing (CFE), while the green points represents w/ CL.IP-based Clean Feature Eras- ing (CFE). The experiment is repeated times, and the results were computed as the mean of five different runs.
Figure 21:
CLIP-based Poisoning Feature Augmentation Is More Effective Than Previous Attack Meth- ods. Our proposed CLIP-UAP and CLIP-CFA methods outperform the BadNets Gu et al. (2019) and Blended Chen et al. (2017) baseline methods in terms consistency under different attacks and datasets. This confirms that the proposed poisoning feature augmentation generates more efficient triggers than other methods.
CLIP-based Clean Feature Suppression Is Useful For Different Attack Methods. Our proposed CLIP-CFE method improves the poisoning effectiveness on most cases compared to the baseline without CL.P--based Clean Feature Erasing. Only the MobileNet-V2 results of the number- constrained backdoor attacks (right part of the Fig. 19), CLIP-UAP slightly outperform the corre- sponding methods with CFE.
A.10.2 RQ2: ARE PROPOSED THREE TECHNOLOGIES HARMLESS FOR BENIGN ACCURACY.
Table 4 illustrates that our proposed CLIP-UAP and CLIP-CFA methods have similar or even better average Benign Accuracy (BA) compared to the baseline methods BadNets Gu al. (2019) and
32

---

Published as a conference paper at ICLR 2024
Blended E
Blended
Eiss
w/ CL OP-OF
CL IP-OFF
503
6M00
0.IP-D
CL UPP
CLIP UAP
Budiets
Budfets
VGG-16
MobileNet-V2
The attack success rate (ASR) of the domain-constrained backdoor attacks (Domain rate set to 0) on the ImageNet-50 dataset. The red points represents w/o CLIP-based Clean Feature Erasing (CFE), while the green points represents w/ CLIP-based Clean Feature Erasing (CFE). The experiment is repeated 5 times, and the results were computed as the mean of five different runs.
Figure 22:
Table 4: The Benign Accuracy (BA) on the ImageNet-50 dataset. All results are computed the mean by 5 different run.
Backdour Albacks
Clean Featuur Suppression
Trigger
Number Constrinedd
Class Consirained (Y' = (00)
Class Constrained (Y' (1))
Domain Cunstrained
V-16
M-2
V-16
M-2
V-16
M-2
V-16
M-2
BadNets
weo CLIP-CHE
w/ CLIP
0.784
0.787
0.733
0.751
0,788
0,788
0.731
0,235
0,790
0.788
0:733
0.734
0.788
0.783
0.735
0.735
Blended
weo CLIP-CRE
W/ CLIPCCEE
0.789
0.790
0.733
0.731
0.787
0.788
0.734
0.736
0.787
0.788
0:727
0:731
0.786
0.788
0.751
0.728
CLIP-UAP
Wis CLIP-CF
CFE
0.788
0,785
0,732
0.720
0,786
0.788
0.726
0.729
0.786
0.786
0.734
0.728
0.791
0.789
0.730
0.733
wão CLIP-CFE
0,784
0.750
0,789
0.732
0.785
0.729
0.787
0.735
CLIP-CRA
CFF
0,787
0,786
0,734
0.789
0,735
0.784
0.732
Blended Chen al. (2017). Additionally, our proposed CLIP-CFE method has no negative effect on BA, confirming that our technologies are harmless for benign accuracy under various settings and different backdoor attacks.
A.11 EXPERIMENTS ON MORE COMPLEX CONSTRAINTS IN DATA-CONSTRAINT BACKDOOR ATTACKS
Previous sections have primarily focused on specific sub-variants of number, class, and domain constraints, which might not comprehensively represent all real-world limitations. This section delves into more intricate constraints. Specifically, we investigate two additional configurations:
Config A: Poisoning rate 0.01 (P=500), poisoning classes=1 (1), and domain rate=0.5.
Config B: Poisoning rate 0.01 (P=500), poisoning classes=3, and domain ratc=0.25.
The experiments are performed using the VGG-16 model and the CIFAR-100 dataset. As depicted in Fig. 23, methods and conclusions are demonstrated to equally viable in scenarios involving more complex data constraints.
A.12 EXPERIMENTS ON DOMAINS DIFFERENT FROM CLIP'S TRAINING DOMAIN
In this section, we verify the performance of the proposed methods domain drastically differs from CLIP's training set. Typically, we select the commonly used dataset UCM Yang & Newsam (2010) in the field of remote sensing.
33

---

Published as a conference paper at ICLR 2024
Config A, VGG-16, CIFAR-100
Config B, VGG-16, CIFAR-100
Attack Success Rate
Attack Success Rate
0.50
w/o CLIP-CFE
w/o CLIP-CFE
0.40
w/ CLIP-CFE
0.80
w/ CLIP-CFE
0.30
0.40
0.20
0.00
0.00
BodNets
Bleanee
CLIP-UAP
CLIP-CFA
BadNNel
Bleaded
CLIP-UAP
CLIP-OFA
Attack Methods
Attack Methods
(b)
Figure 23: The Attack Success Rate (ASR) on more complex data-constraint attacks. (a) Config A: Poisoning rate = 0.01 (P=500), poisoning classes=1 (1), and domain rate=0.5. (b) Config B: Poisoning rate 0.01 (P=500), poisoning classes=3, and domain rate=0.25.
The Attack Success Rate (ASR) the VGG-16 model and UCM Yang & Newsam (2010) dataset. All results are computed the mean by different run. In the class-Constrained Scenario, the poisoning classes is set to 1, and we choose the dirty-label setting.
Table 5:
Clean Feature
Bockdoor Amacks
Suppression
Number Sateliic
Constrained (e-16255)
CLIP (=-8/255)
Satellic (r-8/255)
BodNets
w/o CLIP-CFE
CLIP-CFE
0.916
0.921
0.916
0.944
0.916
0.952
0.692
0.661
0,791
0.692
0.377
0.692
Blended
w/o CLIP-CFE
0.798
0.798
0.798
0,329
0,329
0.329
W/ CLIIP-CFR
0.805
0.882
0.904
0.338
0.474
0.526
CLIPUAP
CLJP-CFR
0.895
0.917
0.722
0.783
0
CLIP-CFE
0.981
0.990
0.719
0.84
0365
CLIPCCFA
W/o CLIP-CFE
0.898
0.924
0:937
0.585
0.713
0.73
CLIP-
03611
0,950
0.989
0.717
0.33
UCM Dataset. The UCM contains 100 images in each of the 21 categories for a total 2100 images. Each image has size of 256 256 and spatial resolution of 0.3 m/pixel. The images captured in the optical spectrum and represented in the RGB domain. The data are extracted from aerial ortho imagery from the U.S. Geological Survey (USGS) National Map. The categories in this dataset are: agricultural, airplane, baseball diamond, beach, buildings, chaparral, dense residential, forest, freeway, golf course, harbor, intersection, medium-density residential, mobile home park, overpass, parking lot, river, runway, sparse residential, storage tanks, and tennis courts.
Experiments. Similar to Dräger et al. (2023), we randomly select 1050 samples to form the training set, while the remaining samples make up the test set. The tttack-targge class k is set to "agricul- tural". The poisoning rate set 0.05 experiments. As illustrated Table 5, we illustrate the Attack Success Rate of dataset. The results indicate performance decline on the UCM dataset. However, as seen in Sec. A.11.1, by adjusting the constraints (e) of the optimized noise, observed improved attack success rate in our methods compared to baseline methods. Additionally, replacing CLIP with the Satellite Arto et al. (2021) model. large model fine-tuned remote sensing images, further aug- mented the attack success rate. These outcomes demonstrate the adaptability of our methods to various domains by replacing CLIP with domain-specific pre-trained models.
and class-Constrained backdoor attacks on UCM
A.13 EXPERIMENTS ON FINE-GRAINED DATASETS
In this section, rigorously assess the effectiveness of proposed methodologies using fine- grained datasets, with a specific focus on the widely recognized Oxford-Flowers dataset within the domain of fine-gra fine-grained image classification.
Exford-Flowers Dataset. The Oxford-Flowers dataset comprises 102 categories of common UK flower images, totaling 8188 89 images, with each category containing 40 to 258 images. Our exper-
34

---

Published as a conference paper at ICLR 2024
MobileNettV2, Oxford-Flowerr
MobileNetV2, Oxford-Flowers
Attack Success Rate
1.00
w/o CLIP-CFE
Benign Accuracy
w/o CLIP CFF
0.95
w/ CLIP CFE
w/ CLIP-CEF
0.95
0.90
BadNets
Blanded
CLIP-UAP
CLIP-CPA
BadNets
Blended
CLIP-UAP
CLIP-CFA
Attack Methods
Attack Methods
(a)
(b)
Figure 24: The Attack Success Rate (ASR) and Benign Accuracy (BA) Oxford- dataset. Poisoning rate = 0.01 (P=307). All results were computed as the mean of five different runs.
ViT-Small, CIFAR-10
ViT-Small, CIFAR-10
Attack Success Rate
1.00
1,00
w/o CLIP-CFE
Benign Accuracy
w/o CLIP-CPI
w/ CLIP-CFE
w/ CLIP-CFE
0.80
0.50
0.70
0.80
0.80
0.50
BadNets
Blodde
CLIP-UAP
CLIP-CPA
BadNets
Blended
CLIP-UAP
CLIP-CER
Attack Methods
Attack Methods
(a)
Figure 25: The Attack Success Rate (ASR) and Benign Accuracy (BA) on ViT-small architecture and CIFAR-10 dataset. Poisoning rate 0.01 (P=500). All results were computed the mean of five different runs.
imental setup involves employing 6140 images for training purposes, while the remaining samples constitute the test set.
Experiments. For our experiments, we set the attack-target class (k) to and maintain a con- sistent poisoning rate of 0.05 (p=307) across all conducted trials. Illustrated in Figure 24 (a), showcase the Attack Success Rate of number-Constrained backdoor attacks on the Oxford-Flowers dataset. Our findings conclusively demonstrate the superior efficacy of CLIP-based poisoning fea- ture augmentation compared to prior attack methodologies. Additionally, CLIP-based Clean Feature Suppression emerges as valuable strategy across diverse attack methods. Moreover, as depicted in Figure 24 (b), our results unequivocally indicate that our technologies maintain benign accuracy at par with baseline methods, even under varying settings and diverse backdoor attacks. This under- lines the robustness and non-disruptive nature of our methodologies.
A. EXPERIMENTS ON VIT ARCHITECTURE
For our experiments, we set the uttack-target class (k) to 0 and maintain a consistent poisoning rate of 0.05 (p=500) across all conducted trials. Illustrated in Figure 25 (a), we showcase the Attack Success Rate of number-Constraing
backdoor attacks on the ViT-Small architecture and CIFAR- 10 dataset. Our findings conclusively demonstrate the superior efficacy of CLIP-based poisoning feature augmentation compared to prior attack methodologies. Additionally, CLIP-based Clean Feature Suppression emerges as a valuable strategy across diverse attack methods. Moreover, as depicted in Figure 25 (b), our results unequivocally indicate that our technologies maintain benign accuracy at par with baseline methods, even under varying settings and diverse backdoor attacks. This underlines the robustness and non-disruptive nature of methodologies.
35

---

Published as a conference paper at ICLR 2024
CIFAR-10, ResNet-18
0.8
CL CLIP-CFE (E =8/255)
CLIP-CFE (E =162255
0.7
0.6
Attack success rate
0.5
0.4
0.3
0.2
0.1
0.0
Bs
I ended
IP-UAP
CL CLIP-CFA
Figure 26: The attack success rate on the CIFAR-10 dataset at different c. All results are computed the mean of five different runs.
A.15 DISCUSSION
A.15.1 PERFORMANCE DEGRADATION IN THE CLEAN-LABEL SINGLE-CLASS BACKDOOR ATTACK.
As depicted in Fig. 3 (b), Fig. 13, and Fig. 20, both the baseline and attack methods exhibit poor Attack Success Rate (ASR) in the clean-label single-class backdoor attack. In this section, we aim enhance the attack strength our methods and devise more efficient attack strategy for the clean-label single-class backdoor attack. In our optimization equations, namely Eq. 3, Eq. 13, and Eq. 10, we impose constraints on the optimized noise, denoted as ö,, 8mp. and 6 respectively. where || llp represents
These constraints are specified as ||& I c, ||Smpllا < c, and | 8/ 8/255 to ensure the stealthiness of the backdoor attacks, observed
the Lp norm, and we in our previous experiments. To bolster the attack strength and subsequently increase the ASR in clean-label single-class backdoor attack, we investigate the impact adjusting the constraint on 5,. As demonstrated in Fig. 26 and Fig. 27, significant (more than 500%) improvements observed in the ASR of the clean-label single-class backdoor attack when we set the constraint on 6, to ||,م 16/255, This finding validates the efficacy of method in the clean-label single- class backdoor attack, albeit at the expense of compromising stealthiness. This sacrifice, which is common in previous backdoor attack methods Zeng et al. (2022), is low-cost trade-off.
A. 15.2 DOMAIN-CONSTRAINEH BACKDOOR ATTACKS ARE EASIER THAN CLASS-CONSTRAINED BACKDOOR ATTACKS.
Fig. 28 provides visualization of the Attack Success Rate (ASR) achieved by different attack methods on the CIFAR-10 dataset in domain-constrrinee. (domain rate set to 0) and dabty-label single-class backdoor attacks. While domain-constraine, backdoor attacks impose stricter restric- tions (assumptions that attackers have no access to any data in the training set), the ASR domain- constrained backdoor attacks consistently surpasses that of darty-label single-class backdoor attacks.
36

---

Published as a conference paper at ICLR 2024
CIFAR-100, ResNet-18
0.7
CLIP CLIP-CFE (E =8/255)
CLIP-CFE (E =162255
0.6
Attack success rate
0.5
0.4
3.3
0.2
0.
0.0
Bs
ended
IAP
CL C-IP-CFA
Figure 27: The attack success rate on the CIFAR-100 100 dataset at different e. All results are computed the mean of five different runs.
This observation leads us to propose that the diversity of samples the poisoning set is another cru- cial factor affecting attack efficiency. Consequently, recommend that attackers fully consider the diversity of poisoning samples during the poisoning set generation phase.
A.15.3 TIME CONSUMPTION OF DIFFERENT ATTACK METHODS.
We would like to highlight that in the case of BadNet and Blended, adding a pre-detined trigger into benign images to build poisoned images only needs to perform one time addition calculation, which incurs negligible time consumption. It's important to note, however, that these straightforward im- plementations fall short in terms of both poison efficiency and stealthiness in the context of backdoor attacks. Recent advancements in backdoor attack techniques have sought to enhance efficiency and covert effectiveness by introducing refinements do entail some additional time overhead, they significantly clevate the attack's 's efficacy. We undertook an evaluation of the time overhead associated with diverse attack methods using A100 GPU. As outlined Table 6, the time consumption exhibited by optimization-bne baaedd methods grows linearly with the expansion of the poison sample count. Despite this, the overall time over- head remains remarkably modest, with the entirety of the process being accomplished within mere minutes.
cetimiizationddrivee processes to define triggers. While these
A.15.4 EXPLAINING THE DIFFERENCE BETWEEN DATA-CONSTRAINT BACKDOOR ATTACKS AND BACKDOOR ATTACKS OF FEDERATED LEARNING.
The landscape of backdoor attacks the context of federated learning shares certain similarities with proposed data-constraint backdoor attacks. Notably, both scenarios assume the utilization of training data originating from diverse sources. However, it's important to note that the threat model for backdoor attacks in federated learning adopts distinct perspective. In this model, the attacker exercises complete control over one or several participants: (1) The attacker possesses authority over the local training data of any compromised participant. (2) It wields control
37

---

Published as a conference paper at ICLR 2024
CI ResNet-18, Poison rate=0. 02
1.0
Dirty-labe si ng Ie-c lass (w/o CL IPI CLIP-CFE)
Doma i n annnstrainedd (w/o CLIP-OFE)
Dirty label o lass (w/ PFCFE)
Doma Domain-com constran ined (w/ CLIP-OFE)
0.8
Attack success rate
0.6
0.4
0.2
0.
BadNets
B Bendeed
CLIP-UAP
ILIP-CFA
Figure 28: The attack success rate on the CIFAR-10 dataset at Nomain-constraiigg (domain rate is set to 0) and dirty-label single-class backdoor attacks. poisoning rate is set 0.02 and all results computed as the mean of five different runs.
the local training process and associated hyperparameters, including parameters like the number of training epochs and learning rate. (3) The attacker can manipulate the model's weights prior to submitting them for aggregation. (4) retains the capability dynamically adjust its local training strategy from one round to the next.
In contrast, our dota-conttraint backdoor attacks center exclusively on the attacker's capability to manipulate local training data. This introduces heightened level of challenge for potential attack- ers. Furthermore, to the best of our knowledge, the existing backdoor attack strategies within the realm of federated learning primarily revolve around the comber--onstrained scenario. Notably, the class-oonttaained and domain-constraile constrained scenarios have yet to comprehensively explored within the community's discourse on this subject.
Table 6: The time overhead (min) different attacks on A100 GPU. All results are computed with the mean of 5 different runs.
Number Poisoned
BaiNNet -CLI-CCF
&CLIP-CFE
-CLIP-CFE
+CLIP-CFE
1.6
1.9
2000
3.7
2.9
6.5
A.16 LIMITATIONS AND FUTURE WORKS
In this section, discuss the limitations of approach and outline potential future directions for backdoor learning research. Performance Degradation in Clean-label Backdoor Attacks. Clean-label backdoor attacks present significant challenge Zhao al. (2020). As shown in Fig.
38

---

Published as a conference paper at ICLR 2024
3, previous methods exhibit poor ASR, and technologies show limited improvement in clean- label backdoor attacks when the poisoning rate low. In future research, we will investigate the underlying reasons for this situation and explore more efficient attack methods specifically designed for clean-label backdoor attacks.
Application Limitations. Our technologies depend on the CLIP model that is tre-trained natural images, which may limit their applicability to certain domains such as medical images or remote sensing. In such cases, a possible solution is replace CLIP with domain-specific pre-trained model, such as MedCLIP Madhawa & Carlomagno (2022) for medical images or Satellite Arto al. (2021) for remote sensing, adapt our methods the target domain.
Transfer to Other Domains. The attack scenario we have defined is not limited to a specific domain and can be applied to other important applications, including backdoor attacks for malware detec- tion, deepfake detection, and federated learning. In our future work, we plan to explore the design of realistic attack scenarios and efficient backdoor attacks specifically tailored for these applications.
39


Reviews:
[{"review_id": "VbaxSCAd2b", "reviewer": "Reviewer_rJBe", "summary": "This paper addresses an important and practical backdoor attack scenario called data-constrained backdoor attacks. The key insight is that in real-world settings, attackers often do not have full access to a victim's entire training dataset, which spans multiple sources. The paper clearly defines three variants of data-constrained attacks based on restrictions on the number of poisoning samples, classes, or domains.\nA thorough set of experiments on CIFAR and ImageNet datasets demonstrates that existing backdoor methods like BadNets and Blended attacks fail under data constraints, due to entanglement between benign and poisoning features. The analysis of this entanglement issue is a nice contribution. To address this limitation, the authors cleverly utilize CLIP in two ways: 1. Clean feature suppression via CLIP-CFE to erase benign features.\n2. Poisoning feature augmentation via CLIP-UAP and CLIP-CFA to amplify poisoning features.\nThe introduction of CLIP for backdoor attacks is novel. Results show CLIP-UAP and CLIP-CFA consistently outperform baseline triggers across constraints, architectures, and datasets. CLIP-CFE provides further improvements in attack success rate. The attacks remain stealthy and do not impact benign accuracy.", "questions": "see in weakness", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1.\tAddresses a highly practical attack scenario of data-constrained backdoor attacks that reflects real-world training environments where attackers have limited data control.\n2.\tProvides a clear taxonomy of data-constrained attacks based on restrictions to number of samples, classes, and domains.\n3.\tIdentifies through analysis and experiments that existing attacks fail under data constraints due to entanglement of benign and poisoning features. This is an important insight.", "weaknesses": "1.\tWhile the data-constrained scenario is practical, the specific sub-variants of number, class, and domain constraints may not fully capture all real-world limitations an attacker could face. More complex constraints could be studied.\n2.\tThe computational overhead and time required for the CLIP optimization process is not extensively analyzed. This could be a limitation for realistic attacks.\n3.\tThe stealthiness metrics mainly rely on signal processing based measures like PSNR and SSIM. More rigorous stealthiness analysis like visualizations and defense evaluations may be beneficial.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "93Q4mIcBC0", "reviewer": "Reviewer_nLdg", "summary": "This paper assumed a threat model for backdoor attacks, so-called as ‘data-constrained backdoor attacks’, where the attacker doesn’t have access to the entire training dataset. Then, the authors claimed that the exiting backdoor attacks are inefficient in this new threat model.", "questions": "What is the main difference between the 'clip-guided backdoor attack' with the existing references which have been mentioned in the 'weaknesses'", "limitations": "", "rating": 3, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 1, "strengths": "The authors considered an interesting topic on AI security, specifically, how to improve the backdoor efficiency in a data-constrained scenario.", "weaknesses": "First, the authors only provided the empirical results to support the performance decline when the exiting backdoor attack in the new threat model, as shown in Fig.2. I highly recommend that the authors give a possible theoretical analysis to this phenomenon.\n\nSecondly, the new proposed 'clip-guided backdoor attack' method includes two components: clean feature suppression and poisoning feature augmentation. Specifically, the main idea is to exploit adversarial example to generate the noise to suppress the clean feature or amplify the poison feature. Unfortunately, as far as I know this idea has been exploited by many published papers, for instance, as shown as follows. The main difference of this paper is that it is based on a novel pre-trained model CLIP.\n\n[1] Zhao, Shihao, et al. \"Clean-label backdoor attacks on video recognition models.\" Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2020.\n[2] Turner, D. Tsipras, and A. Madry, “Label-consistent backdoor attacks,” arXiv preprint arXiv:1912.02771, 2019.\n\nIn summary, the main idea has been exploited already, which will significantly reduce the contribution of this paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rvlBSjzaLX", "reviewer": "Reviewer_kSYS", "summary": "This paper proposes a new backdoor attack that performs well in data-constraint conditions that are more akin to real-world scenarios. The attack uses the CLIP model as a feature extractor to diminish the entanglement between benign and poison features. The experiment results show significant improvement compared to previous methods in these more realistic conductions.", "questions": "The authors present a novel backdoor attack that utilizes the pre-trained CLIP model as a feature extractor to suppress benign features and accentuate poison features. The attack also relaxes previous assumptions that having knowledge of the training datasets and the target models trained on datasets from one distribution. The authors show previous methods do not perform well in these more realistic scenarios but their new method is consistently effective and the trigger is hard to detect visually. Overall, the paper is well-written and the evaluation is comprehensive. However, there are a few points I would like to see the authors to further address.\n\n- The usage of the CLIP model for backdoor attacks is indeed novel. However, this also limits the domains of possible application of the attack. While the method seems to perform well on datasets with natural sceneries, such as CIFAR-100, CIFAR-10, and ImageNet-50, the performance cannot be guaranteed on datasets where the domain drastically differs from CLIP’s training set, such as medical scans, satellite imageries, etc. Additionally, even for similar domains, it would be interesting to see if the feature extraction capabilities transfer onto fine-grained datasets, such as CUB-200-2011, Stanford-Cars, Oxford-Flowers, etc. The authors should consider including results on more diverse datasets.\n\n- The target models used in this paper are all relatively simple/small (experimental settings focused). They also differ drastically from the CLIP model both in terms of architecture and performance. The authors have already pointed out the effect of model architecture in Section 5.1. Evaluating the attack on more advanced and larger architectures, such as ViT, can further prove the author’s claim for applicability in real-world scenarios.\n\n- Discussion regarding potential defenses is also missing. It would be interesting to see how this new attack performs against backdoor detection or defense methods. Since the optimization suppresses the clean features and augments the poison features, defense/detection methods that rely on optimization, such as Neural Cleanse[1] could potentially be more effective (compared to defending against traditional backdoor attacks). Furthermore, a recent work[2] on backdoor defense seems to use similar intuition (detangling benign and poison features). It would be interesting to see how this defense performs against an attack that is intuitively similar.  \n[1]Wang et al. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. 2019. In IEEE Symposium on Security and Privacy (S&P).  \n[2]Min et al. Towards Stable Backdoor Purification through Feature Shift Tuning. 2023. arXiv preprint arXiv:2310.01875.\n\n- Considering the optimization process needed to conduct this attack, the authors should consider including relevant runtime information. Since the focus of this paper is on presenting a backdoor attack that is applicable in real-world scenarios, the computing resource required can be another limiting factor. \n\nMinors:\n\n- Fonts in figures are too small to be legible\n- Page 8, VGG-16 datasets? (should be models)", "limitations": "", "rating": 8, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- A novel approach to backdoor attack\n- Comprehensive evaluations", "weaknesses": "- CLIP limits the application domain\n- Defense discussion missing\n- Runtime information missing", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "711fMyjKx3", "reviewer": "Reviewer_tXy3", "summary": "The submission focuses on the backdoor attacks in data-constrained scenarios. By leveraging CLIP-based technologies, the proposed CLIP-CFE (CLIP for Clean Feature Erasing) suppresses clean features while amplifying poisoning features to achieve more efficient attack with limited poisoning samples.", "questions": "Given that the submission's motivation is related to data-constrained scenarios, the author may provide more empirical evidence regarding to the occurrence of these backdoor attacks in real-world scenarios.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "+ The submission presents a novel method, which introduces the optimized feature erasing noise to effectively suppress benign features. Besides, it enhances the poisoning features through contrastive learning and amplifies the existing backdoor attacks efficiently in data-constrained scenarios.\n\n+ The experimental results demonstrate the effectiveness of the CLIP-based attacks in data-constrained scenarios. Across various real-world constraints such as *number-constrained, class-constrained*, and *domain-constrained* conditions, the proposed backdoor attack consistently achieves a high attack success rate while maintaining the benign accuracy.", "weaknesses": "+ **Insufficient experimental results**\n\nThe submission should take more recent backdoor attack and defense mechanisms into consideration while discussing the adaptive defenses more thoroughly, e.g., the noise used for erasing benign features might be unlearned [1, 2]. Besides, it is necessary to compare the effectiveness of utilizing different proxy extractors other than CLIP.\n\n\n+ **Ambiguous expressions**\n\nSeveral points in the submission need further explanation, e.g., the reason and effect of choosing the overall attack process relying on the style of CLIP within the feature space, and the analysis of erasing benign features compared to the semantic-agnostic out-of-domain samples.\n\nReferences:\n\n[1]: Li Y, Li Y, Wu B, et al. Invisible backdoor attack with sample-specific triggers. Proceedings of the IEEE/CVF international conference on computer vision. 2021: 16463-16472.\n\n[2]: Akhtar N, Liu J, Mian A. Defense against universal adversarial perturbations. Proceedings of the IEEE conference on computer vision and pattern recognition. 2018: 3389-3398.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)