{"type":"ScholarlyArticle","title":"Data-Efficient Backdoor Attacks","authors":[{"name":"Pengfei Xia","slug":"pengfei-xia","given":"Pengfei","family":"Xia","affiliation":"University of Science and Technology of China , Hefei , China"},{"name":"Ziqiang Li","slug":"ziqiang-li","given":"Ziqiang","family":"Li","affiliation":"University of Science and Technology of China , Hefei , China"},{"name":"Wei Zhang","slug":"wei-zhang","given":"Wei","family":"Zhang","affiliation":"University of Science and Technology of China , Hefei , China"},{"name":"Bin Li","slug":"bin-li","given":"Bin","family":"Li","affiliation":"University of Science and Technology of China , Hefei , China"}],"abstract":"Recent studies have proven that deep neural networks are vulnerable to backdoor attacks. Specifically, by mixing a small number of poisoned samples into the training set, the behavior of the trained model can be maliciously controlled. Existing attack methods construct such adversaries by randomly selecting some clean data from the benign set and then embedding a trigger into them. However, this selection strategy ignores the fact that each poisoned sample contributes inequally to the backdoor injection, which reduces the efficiency of poisoning. In this paper, we formulate improving the poisoned data efficiency by the selection as an optimization problem and propose a Filtering-and-Updating Strategy (FUS) to solve it. The experimental results on CIFAR-10 and ImageNet-10 indicate that the proposed method is effective: the same attack success rate can be achieved with only 47% to 75% of the poisoned sample volume compared to the random selection strategy. More importantly, the adversaries selected according to one setting can generalize well to other settings, exhibiting strong transferability. The prototype code of our method is now available at https://github.com/xpf/Data-Efficient-Backdoor-Attacks.","doi":"10.24963/ijcai.2022/554","url":"https://ijcai.org/proceedings/2022/554","pdf":"https://ijcai.org/proceedings/2022/0554.pdf","markdown":"https://ijcai.org/proceedings/2022/554.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/554","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Multidisciplinary Topics and Applications","track":"Main Track","number":554,"pages":{"first":3992,"last":3998},"keywords":["AI Ethics, Trust, Fairness: Safety & Robustness","Multidisciplinary Topics and Applications: Security and Privacy"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986980","length_sec":94,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985123","length_sec":729,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Chen et al., 2017] Xinyun Chen, Chang Liu, Bo Li, Kim- berly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017.","title":"Targeted backdoor attacks on deep learning systems using data poisoning","authors":"Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, Dawn Song","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Deng et al., 2009] Jia Deng, Wei Dong, Richard Socher, Li- Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248-255.","title":"Imagenet: A large-scale hierarchical image database","authors":"Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, Li Fei-Fei","year":"2009","venue":"IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Dumford and Scheirer, 2018] Jacob Dumford and Walter Scheirer. Backdooring convolutional neural networks via targeted weight perturbations. In 2020 IEEE International Joint Conference on Biometrics (IJCB), pages 1-9. IEEE, 2018.","title":"Backdooring convolutional neural networks via targeted weight perturbations","authors":"Scheirer Dumford, Jacob Dumford, Walter Scheirer","year":"2018","venue":"IEEE International Joint Conference on Biometrics (IJCB)","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Gu et al., 2017] Tianyu Gu, Brendan Dolan-Gavitt, and Sid- dharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017.","title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain","authors":"Tianyu Gu, Brendan Dolan-Gavitt, Siddharth Garg","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[He et al., 2016a] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770-778, 2016.","title":"Deep residual learning for image recognition","authors":"He","year":"2016","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[He et al., 2016b] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual net- works. In European conference on computer vision, pages 630-645. Springer, 2016.","title":"Identity mappings in deep residual networks","authors":"He","year":"2016","venue":"European conference on computer vision","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Katharopoulos and Fleuret, 2018] Angelos Katharopoulos and Franc ¸ois Fleuret. Not all samples are created equal: Deep learning with importance sampling. In Interna- tional conference on machine learning, pages 2525-2534.","title":"Angelos Katharopoulos and Franc ¸ois Fleuret. Not all samples are created equal: Deep learning with importance sampling","authors":"Fleuret Katharopoulos","year":"2018","venue":"International conference on machine learning","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"PMLR, 2018.","title":null,"authors":"Pmlr","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Kingma and Ba, 2014] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.","title":"Adam: A method for stochastic optimization","authors":"P Diederik, Jimmy Kingma, Ba","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Krizhevsky and Hinton, 2009] A. Krizhevsky and G. Hin- ton. Learning multiple layers of features from tiny im- ages. Master's thesis, Department of Computer Science, University of Toronto, 2009.","title":"Learning multiple layers of features from tiny images","authors":"A Krizhevsky, G Hinton","year":"2009","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Kurita et al., 2020] Keita Kurita, Paul Michel, and Graham Neubig. Weight poisoning attacks on pre-trained models. arXiv preprint arXiv:2004.06660, 2020.","title":"Weight poisoning attacks on pre-trained models","authors":"Keita Kurita, Paul Michel, Graham Neubig","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Li et al., 2020a] Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, and Xinpeng Zhang. Invisible backdoor attacks on deep neural networks via steganogra- phy and regularization. IEEE Transactions on Dependable and Secure Computing, 18(5):2088-2105, 2020.","title":"Invisible backdoor attacks on deep neural networks via steganography and regularization","authors":"Li","year":"2020","venue":"IEEE Transactions on Dependable and Secure Computing","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Li et al., 2020b] Yiming Li, Baoyuan Wu, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A sur- vey. arXiv preprint arXiv:2007.08745, 2020.","title":"Backdoor learning: A survey","authors":"Li","year":"2020","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Li et al., 2022] Ziqiang Li, Xintian Wu, Beihao Xia, Jing Zhang, Chaoyue Wang, and Bin Li. A comprehensive survey on data-efficient gans in image generation. arXiv preprint arXiv:2204.08329, 2022.","title":"A comprehensive survey on data-efficient gans in image generation","authors":"Ziqiang Li, Xintian Wu, Beihao Xia, Jing Zhang, Chaoyue Wang, Bin Li","year":"2022","venue":null,"doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Liu et al., 2017] Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. 2017.","title":"Trojaning attack on neural networks","authors":"Liu","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Liu et al., 2020] Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor at- tack on deep neural networks. In European Conference on Computer Vision, pages 182-199. Springer, 2020.","title":"Reflection backdoor: A natural backdoor attack on deep neural networks","authors":"Yunfei Liu, Xingjun Ma, James Bailey, Feng Lu","year":"2020","venue":"European Conference on Computer Vision","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Nguyen and Tran, 2021] Anh Nguyen and Anh Tran. Wanet-imperceptible warping-based backdoor attack. arXiv preprint arXiv:2102.10369, 2021.","title":"Wanet-imperceptible warping-based backdoor attack","authors":"Tran ; Nguyen, Anh Nguyen, Anh Tran","year":"2021","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Orekondy et al., 2019] Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoff nets: Stealing functionality of black-box models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4954-4963, 2019.","title":"Knockoff nets: Stealing functionality of black-box models","authors":"Orekondy","year":"2019","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Rakin et al., 2020] Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Tbt: Targeted neural network attack with bit trojan. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13198- 13207, 2020.","title":"Tbt: Targeted neural network attack with bit trojan","authors":"Adnan Siraj Rakin, Zhezhi He, Deliang Fan","year":"2020","venue":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Silver et al., 2016] David Silver, Aja Huang, Chris J Maddi- son, Arthur Guez, Laurent Sifre, George Van Den Driess- che, Julian Schrittwieser, Ioannis Antonoglou, Veda Pan- neershelvam, Marc Lanctot, et al. Mastering the game of go with deep neural networks and tree search. nature, 529(7587):484-489, 2016.","title":"Mastering the game of go with deep neural networks and tree search","authors":"David Silver, Aja Huang, Chris J Maddison, Arthur Guez, Laurent Sifre, George Van Den, Marc Driessche, Lanctot","year":"2016","venue":"nature","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Simonyan and Zisserman, 2014] Karen Simonyan and An- drew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014.","title":"Very deep convolutional networks for large-scale image recognition","authors":"Karen Simonyan, Andrew Zisserman","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Tan and Shokri, 2020] Te Juin Lester Tan and Reza Shokri. Bypassing backdoor detection algorithms in deep learning. In 2020 IEEE European Symposium on Security and Pri- vacy (EuroS&P), pages 175-183. IEEE, 2020.","title":"Te Juin Lester Tan and Reza Shokri. Bypassing backdoor detection algorithms in deep learning","authors":"Shokri Tan","year":"2020","venue":"IEEE European Symposium on Security and Privacy (EuroS&P)","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Toneva et al., 2018] Mariya Toneva, Alessandro Sordoni, Remi Tachet des Combes, Adam Trischler, Yoshua Ben- gio, and Geoffrey J Gordon. An empirical study of exam- ple forgetting during deep neural network learning. arXiv preprint arXiv:1812.05159, 2018.","title":"An empirical study of example forgetting during deep neural network learning","authors":"Mariya Toneva, Alessandro Sordoni, Remi Tachet Des Combes, Adam Trischler, Yoshua Bengio, Geoffrey J Gordon","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Turner et al., 2019] Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771, 2019.","title":"Label-consistent backdoor attacks","authors":"Alexander Turner, Dimitris Tsipras, Aleksander Madry","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Wang et al., 2021] Yue Wang, Esha Sarkar, Wenqing Li, Michail Maniatakos, and Saif Eddin Jabari. Stop- and-go: Exploring backdoor attacks on deep reinforce- ment learning-based traffic congestion control systems. IEEE Transactions on Information Forensics and Security, 16:4772-4787, 2021.","title":"Stopand-go: Exploring backdoor attacks on deep reinforcement learning-based traffic congestion control systems","authors":"Yue Wang, Esha Sarkar, Wenqing Li, Michail Maniatakos, Saif Eddin Jabari","year":"2021","venue":"IEEE Transactions on Information Forensics and Security","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Xia et al., 2022] Pengfei Xia, Hongjing Niu, Ziqiang Li, and Bin Li. Enhancing backdoor attacks with multi-level mmd regularization. IEEE Transactions on Dependable and Secure Computing, 2022.","title":"Enhancing backdoor attacks with multi-level mmd regularization","authors":"Pengfei Xia, Hongjing Niu, Ziqiang Li, Bin Li","year":"2022","venue":"IEEE Transactions on Dependable and Secure Computing","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Zhong et al., 2020] Haoti Zhong, Cong Liao, Anna Cinzia Squicciarini, Sencun Zhu, and David Miller. Backdoor embedding in convolutional neural network models via in- visible perturbation. In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy, pages 97-108, 2020.","title":"Backdoor embedding in convolutional neural network models via invisible perturbation","authors":"Zhong","year":"2020","venue":"Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}