Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Trigger

Backdoor Attacks with Poisoned Labels. In these attacks, the adversary-assigned labels of poisoned samples are different from the ground-truth ones of their benign version. It is currently the most widespread attack paradigm for its simplicity and effectiveness. [7] first revealed the backdoor threat in the training of DNNs and proposed the BadNets attack. Specifically, BadNets randomly selected some samples from the original benign training dataset and modified their images by stam** on an adversary-specified trigger pattern ($e.g.$, white-black square). The labels of modified images were re-assigned as the pre-defined target label. Those generated poisoned samples associated with the remaining benign ones forms the poisoned training set, which was released to the victims for training their models. After that, [10] argued that the poisoned images should be similar to their benign version to ensure stealthiness, based on which they proposed the blended attack. Currently, there were also many other attacks ($e.g.$, [29, 30, 31]) in this area. Among all different types of attacks, the sample-specific backdoor attack (SSBA) [16, 18, 17] is currently the most advanced attack paradigm, where the trigger patterns are sample-specific instead of sample-agnostic used in previous attacks. Specifically, IAD [16] proposed to adopt random sample-specific patches as the trigger patterns. However, IAD required controlling the whole training process and its trigger patterns were visible, which significantly reduced its threats in real-world applications; WaNet [18] exploited image war** as the backdoor triggers, which were sample-specific and invisible; Most recently, [17] used a pre-trained encoder to generate sample-specific trigger patterns, inspired by the DNN-based image steganography [32]. In particular, these SSBAs broke the fundamental assumption ($i.e.$, the trigger is sample-agnostic) of most existing defenses, therefore could easily bypass them. Accordingly, it is of great significance to further explore this attack paradigm. These SSBAs are the main focus of this paper.

Backdoor Attacks with Clean Labels. Turner et al. [20] argued that dataset users could still identify poisoned-label backdoor attacks by examining the image-label relationship, even though their poisoned images can be similar to their benign version. For example, if a cat-like image is labeled as deer, users can treat it as a malicious sample even if the image looks innocent. Accordingly, they proposed to poison samples only from the target class to design the attack with clean labels. However, this simple approach usually fails since the ‘ground-truth features’ related to the target label contained in the poisoned samples will hinder the learning of trigger patterns. To alleviate this problem, they first leveraged adversarial perturbations to modify the selected images from the target class before adding trigger patterns to reduce the ability of those ‘ground-truth features. Recently, [21] proposed to address it from another perspective by using a ‘stronger’ trigger pattern. Specifically, they exploited the targeted universal adversarial perturbation [33] instead of the handcraft black-white patch as the trigger pattern. This attack paradigm is stealthy for human inspection and therefore also worth further explorations.

Model-repairing-based Defenses. In these methods, defenders intend to erase hidden backdoors contained in the given models. For example, [34, 35, 36] demonstrated that using a few benign samples to fine-tune the attacked DNNs for only a few iterations can effectively remove their hidden backdoors, inspired by the catastrophic forgetting [37]; [38, 39, 40] revealed that defenders can remove hidden backdoors via model pruning, based on the understanding that they are mainly encoded in specific neurons that can be disentangled from the benign neurons.

Trigger-synthesis-based Defenses. Instead of removing hidden backdoors directly, these defenses first synthesized potential trigger patterns and then suppressed their effects. Specifically, [41, 42, 43] reversed the trigger based on targeted universal adversarial attacks, inspired by the similarities between backdoor attacks and adversarial attacks in the inference process; [44, 45] exploited the Grad-CAM [46] to extract critical regions from input images towards each class. After that, they located the trigger regions based on boundary analysis and anomaly detection.

Pre-processing-based Defenses. These approaches pre-processed test images before feeding them into the model for prediction, motivated by the observations that backdoor attacks may lose effectiveness when the trigger used for attacking is different from the one used for poisoning [34, 13, 47]. These defenses are usually efficient since they did not require modifying the suspicious models.

Sample-filtering-based Defenses. These methods aim at filtering out poisoned samples. For example, defenders can identify malicious training samples based on their distinctive behaviors in the hidden feature space [48, 49, 50]. Recently, [51] proposed to filter poisoned testing samples by superimposing different images on the suspicious sample and observing their predictions. The smaller the prediction randomness, the more likely it is attacked. Most recently, Guo et al. [52] detected poisoned samples by analyzing their prediction consistency during pixel-wise amplification. The more consistent a sample, the more likely it is poisoned.

Settings. We conduct experiments on (a subset of) ImageNet dataset [53] having 100 random classes. Each class contains 500 images for training and 50 images for testing. We generalize the clean-label variants of WaNet and ISSBA (dubbed ‘WaNet-C’ and ‘ISSBA-C’, respectively) by poisoning samples only from the target class. Specifically, we set target class $y_{t}=1$ ($i.e.$, ‘n01443537’) and poison 80% samples from the target class. We conduct all attacks with both VGG-16 [54] and ResNet-18 [55], and implement them based on codes in BackdoorBox [56]. We use the default settings of ISSBA and adopt the settings of WaNet (without noise mode) where the kernel size is set as 32.

Results. As shown in Table I, both WaNet-C and ISSBA-C are ineffective in creating backdoors in all cases. These results indicate that their generated trigger patterns are not competitive to the ‘ground-truth features’ ($i.e.$, features related to the target class) contained in poisoned images. We will further analyze its reasons in the next subsection.

Settings. We adopt label-consistent attack [20] with a $3\times 3$ black-white trigger pattern located at the bottom left corner for discussions. The transparency is set as 0.2 and we train a VGG-16 and ResNet-18 on the poisoned CIFAR-10 dataset, respectively. The poisoned training dataset is generated based on a pre-trained benign VGG-16 via BackdorBox [56], where we set the poisoning rate as 8% and adopt its default training settings. Besides, we use neural cleanse [41] to reverse the trigger pattern for backdoor detection.

Results. As shown in Figure 4, the synthesized trigger generated by neural cleanse is similar to the ground-truth one, $i.e.$, neural cleanse can successfully detect the label-consistent attack. Moreover, as shown in Table V, the attack success rate decrease significantly ($>20\%$), if the target model used by dataset users is different from the one used for generating poisoned samples. It is mainly because existing clean-label backdoor attacks relied on adversarial perturbations, which are model-dependent.

Threat Model. In this paper, we focus on the poison-only backdoor attack in image classification tasks. Poison-only is the hardest attack setting, having the most widespread threat scenarios [8]. Specifically, we assume that the adversaries can only modify some benign samples to generate the poisoned training dataset, whereas having no information and the ability to modify other training components ($e.g.$, training loss, training schedule, and model structure). The generated poisoned dataset will be released to victims, who will train their DNNs based on them. Besides, we assume that the attack is with clean labels, $i.e.$, the adversaries can only poison samples from the target class.

Adversary’s Goals. In general, backdoor adversaries have two main goals, including effectiveness and stealthiness. Specifically, the effectiveness requires that the predictions of attacked DNNs should be the target label whenever the backdoor trigger appears while their performance on benign samples are on par with that of the model trained on the benign dataset. The stealthiness requires that the attack is stealthy for both human inspection and machine detection.

The Main Pipeline of Poison-only Backdoor Attacks. Let $\mathcal{D}=\{(\bm{x}_{i},y_{i})\}_{i=1}^{N}$ denotes the benign training set, where $\bm{x}_{i}\in\mathcal{X}=\{0,1,\ldots,255\}^{C\times H\times W}$ is the image, $y_{i}\in\mathcal{Y}=\{1,\ldots,K\}$ is its label, and $K$ is the number of classes. The core of poison-only attacks is generating poisoned dataset $\mathcal{D}_{p}$. Specifically, $\mathcal{D}_{p}$ consists of two disjoint subsets, including the modified version of a selected subset ($i.e.$, $\mathcal{D}_{s}$) of $\mathcal{D}$ and remaining benign samples, $i.e.$, $\mathcal{D}_{p}=\mathcal{D}_{m}\cup\mathcal{D}_{b}$, where $y_{t}$ is an adversary-specified target label, $\mathcal{D}_{b}=\mathcal{D}\backslash\mathcal{D}_{s}$, $\mathcal{D}_{m}=\left\{(\bm{x}^{\prime},y_{t})|\bm{x}^{\prime}=G(\bm{x};\bm{\theta}),(\bm{x},y)\in\mathcal{D}_{s}\right\}$, $\gamma\triangleq\frac{|\mathcal{D}_{s}|}{|\mathcal{D}|}$ is the poisoning rate, and $G_{\bm{\theta}}:\mathcal{X}\rightarrow\mathcal{X}$ is an adversary-specified poisoned image generator with parameter $\bm{\theta}$. Moreover, poison-only backdoor attacks are mainly characterized by their poison generator $G$. For example, $G(\bm{x})=\bm{x}+\bm{t}$ in the ISSBA [17], where $\bm{t}$ is the trigger pattern. In particular, $y=y_{t},\forall(\bm{x},y)\in\mathcal{D}_{s}$ holds for attacks with clean labels.

Task 1: Design Attribute Triggers in Facial Image Recognition. Facial attribute editing [59, 61, 62] is a classical task, manipulating pre-defined attributes of facial images ($e.g.$, hairstyle) while preserving other details. In this paper, we propose to exploit the attribute editor as our poisoned image generator $G$ to design attribute triggers. We assume that dataset users have no domain knowledge about the target identity, $i.e.$, have no information about its ground-truth attributes. Specifically, given a (pre-trained) attribute vector $\bm{a}$, the attribute editor $G_{\bm{a}}:\mathcal{X}\rightarrow\mathcal{X}$ will transform input images to their variants with attribute $\bm{a}$. For example, $\bm{a}$ could be a specific hairstyle with a special color. Notice that the adversaries should assign $\bm{a}$ the value that rarely appears in the dataset. Otherwise, the attack could fail since samples with the same attribute but with labels other than the target one are antagonistic to learning.

Task 2: Design Attribute Triggers in Natural Image Recognition. How to define attributes for natural images is not as clear as the case for facial images. In this paper, we propose to exploit a particular image style ($e.g.$, ink-like and cartoon-like style) as the attribute trigger. We assume that dataset users have minor domain knowledge of the dataset and therefore treat images having consistent semantic information to their label as valid samples. This assumption usually holds, especially when the dataset is relatively large and complicated. Specifically, given an adversary-specified style image $\bm{s}$, we assign a (trained) style transformer $T:\mathcal{X}\times\mathcal{X}\rightarrow\mathcal{X}$ as the poisoned image generator $G$ to stylize selected images for poisoning.

The Main Pipeline of BAAT. Once $\mathcal{D}_{p}$ is obtained by our BAAT, it will be released to train the victim model $f_{\bm{w}}$ by $\min_{\bm{w}}\sum_{(\bm{x},y)\in\mathcal{D}_{p}}\mathcal{L}(f_{\bm{w}}(\bm{x}),y)$, where $\mathcal{L}$ is the loss function ($e.g.$, cross-entropy). As such, in the inference process, the attacked DNNs behave normally on benign samples while their predictions will be maliciously and constantly changed to $y_{t}$ whenever the trigger patterns appear. The main pipeline of our BAAT is shown in Figure 5.

Dataset and Model. In this paper, we conduct experiments on two classical benchmark datasets, including VGGFace2 [63] and ImageNet [53] with VGG-16 [54] and ResNet-18 [55]. For simplicity, we select a random subset containing 20 identities from VGGFace2 and the one containing 100 classes from ImageNet. Each VGGFace2 identity contains 400 images for training and 100 images for testing and the settings of ImageNet subset are the same as those used in Section 3.1. All images are resized to $3\times 128\times 128$.

Baseline Selection. We compare our BAAT with four classical attacks, including WaNet [18], ISSBA [17], label-consistent attack (dubbed ‘LC’) [20], and TUAP [21]. The first two methods are representative of poison-only sample-specific backdoor attacks with poisoned labels, while the last two methods are representative of attacks with clean labels. We also provide the clean-label variants of WaNet and ISSBA and the model trained on the benign dataset (dubbed ‘No Attack’) as other baselines for reference.

Attack Setup. We set $y_{t}=1$ and poison 80% samples from the target class for all clean-label attacks on both datasets. We poison the same number of samples for poisoned-label attacks, $i.e.$, 4% on VGGFace2 and 0.8% on ImageNet. Specifically, we implement HairCLIP [62] to adopt ‘hi-top’ hairstyle with purple color as our attribute trigger on VGGFace2 and execute ArtFlow [64] to exploit an oil-painting-style as our attribute trigger on ImageNet, respectively; Unless otherwise specified, the settings of WaNet, WaNet-C, ISSBA, and ISSBA-C are the same as those used in Section 3; For label-consistent attack, different from that of the one used on the CIFAR-10 dataset, we adopt a $6\times 6$ black-white square on four corners as our trigger pattern with maximum adversarial perturbation size $\epsilon=8/255$; We set the maximum adversarial perturbation size $\epsilon=4/255$ for TUAP. The example of poisoned samples generated by different attacks is shown in Figure 6.

Training Setup. Following the settings in [17], we train model from scratch on VGGFace2 and train models pre-trained on the full ImageNet dataset on our ImageNet subset. Specifically, we use the SGD optimizer with momentum 0.9, weight decay of $5\times 10^{-4}$, and an initial learning rate of 0.001. The batch size is set to 64 on VGGFace2 and 128 on ImageNet, and the learning rate is decayed with factor $0.1$ after epoch $15$ and $20$. We adopt the random left-to-right flip** as our data augmentation. All experiments are conducted with a single Tesla V100 GPU.

Evaluation Metric. Following the classical settings used in the existing backdoor attacks, we use the benign accuracy (BA) and attack success rate (ASR) for evaluation. In general, the larger the BA and ASR, the better the attack.