attack function in backend