[Paper Review] Rethinking the Trigger of Backdoor Attack

Yiming Li, Tongqing Zhai+4 more|arXiv (Cornell University)|Apr 9, 2020

Advanced Malware Detection TechniquesComputer Science73 references98 citations

TL;DR

The paper shows that backdoor attacks with static triggers are sensitive to trigger location and appearance, proposes a transformation-based defense, and introduces a transformation-based enhancement to make attacks more robust and applicable to physical scenarios.

ABSTRACT

Backdoor attack intends to inject hidden backdoor into the deep neural networks (DNNs), such that the prediction of the infected model will be maliciously changed if the hidden backdoor is activated by the attacker-defined trigger, while it performs well on benign samples. Currently, most of existing backdoor attacks adopted the setting of \emph{static} trigger, $i.e.,$ triggers across the training and testing images follow the same appearance and are located in the same area. In this paper, we revisit this attack paradigm by analyzing the characteristics of the static trigger. We demonstrate that such an attack paradigm is vulnerable when the trigger in testing images is not consistent with the one used for training. We further explore how to utilize this property for backdoor defense, and discuss how to alleviate such vulnerability of existing attacks.

Motivation & Objective

• Investigate how location and appearance of backdoor triggers affect activation of hidden backdoors.
• Assess whether static-trigger backdoor attacks are vulnerable to spatial/appearance changes.
• Propose a simple, transformation-based defense to mitigate static-trigger backdoors.
• Propose a transformation-based enhancement to existing backdoor attacks to improve robustness against trigger changes.
• Link the enhanced attack to potential physical-world backdoor scenarios.

Proposed method

• Model the backdoor stamping process with a trigger S and benign image x as x_pooled = (1-α)·x + α·x_trigger.
• Train using a mixture of benign and poisoned samples to achieve high accuracy on benign inputs while misclassifying triggered inputs to a target label.
• Define trigger characteristics as location and appearance, and quantify attack success via ASR (attack success rate).
• Demonstrate that small shifts in trigger location or changes in trigger appearance drastically reduce ASR for static triggers.
• Propose a transformation-based defense T that pre-processes testing images (e.g., flips, scales) to disrupt trigger activation.
• Introduce a transformation-robust enhancement for poisoned images during training, sampling random transformations to harden the attack against defenses.
• Show that enhanced attacks maintain high ASR under spatial transformations and relate the approach to physical-backdoor attacks.

Experimental results

Research questions

• RQ1 Can changing trigger location or appearance reduce the effectiveness of backdoor attacks with static triggers?
• RQ2 Can a transformation-based pre-processing defense mitigate static-trigger backdoors without model or data access?
• RQ3 How can backdoor attacks be strengthened to be robust against trigger changes, including in physical scenarios?

Key findings

• Backdoor attack performance (ASR) is highly sensitive to trigger location; moving the trigger by a small amount (2–3 pixels) can drop ASR from near 100% to below 50%.
• Altering the trigger appearance (non-zero pixel values) degrades ASR, indicating sensitivity to trigger appearance changes.
• A simple spatial transformation defense (e.g., Flip, ShrinkPad) applied to the testing image can significantly reduce ASR, with ShrinkPad-4 reducing ASR by over 90% in many cases.
• An enhanced backdoor attack, which trains poisoned images under random transformations, maintains high ASR under transformation-based defenses (often outperforming standard attacks).
• The enhanced attack also demonstrates robustness in physical attack scenarios, where triggers appear under varying distances/angles when photographed.