Backdoor Attack in the Physical World
Yiming Li1, Tongqing Zhai1, Yong Jiang1, Zhifeng Li2, Shu-Tao Xia1 1Tsinghua Shenzhen International Graduate School, Tsinghua University 2Tencent AI Lab
Abstract
Backdoor attack intends to inject hidden backdoor into the deep neural networks (DNNs), such that the prediction of infected models will be maliciously changed if the hidden backdoor is activated by the attacker-defined trigger. Currently, most existing backdoor attacks adopted the setting of static trigger, $i.e.,$ triggers across the training and testing images follow the same appearance and are located in the same area. In this paper, we revisit this attack paradigm by analyzing trigger characteristics. We demonstrate that this attack paradigm is vulnerable when the trigger in testing images is not consistent with the one used for training. As such, those attacks are far less effective in the physical world, where the location and appearance of the trigger in the digitized image may be different from that of the one used for training. Moreover, we also discuss how to alleviate such vulnerability. We hope that this work could inspire more explorations on backdoor properties, to help the design of more advanced backdoor attack and defense methods.
中文速览
后门攻击（backdoor attack）会在深度神经网络训练时植入隐藏触发器，让模型在测试时一旦看到特定触发图案就输出攻击者指定的错误标签，而对正常图片表现正常，因此极难被察觉。现有研究几乎都假设训练和测试时的触发器位置与外观完全一致，但这篇论文通过系统实验揭示了这一"静态触发器"范式的致命弱点：只要触发器的位置偏移几个像素、或像素值略有变化，攻击成功率就会从接近100%骤降到50%以下。基于这一发现，作者提出了两个轻量级方案：一是在推理前对测试图像做翻转或缩放等简单变换来打乱触发器形态，即可作为无需修改模型、无需额外数据的防御手段，实验表明ShrinkPad变换可将攻击成功率压低90%以上；二是在训练时对中毒样本随机施加同类变换，让攻击具备变换鲁棒性，从而在触发器外观和位置被改变（包括物理世界中拍照数字化带来的偏差）的情况下依然有效。这项工作提示安全研究者：触发器的鲁棒性是后门攻防双方都不能忽视的核心属性，现有攻击在真实物理场景中远比实验室数据上脆弱得多。
原文 arXiv:2104.02361;中英对照 + 大白话阅读 https://aha.fim.ai/paper/2104.02361v2