DEFEAT: Deep Hidden Feature Backdoor Attacks by Imperceptible Perturbation and Latent Representation Constraints

Zhendong ZhaoXiaojun ChenYuexin XuanYe DongDakui WangKaitai Liang

article2022CVPR100 citations

Develops DEFEAT, a backdoor attack mechanism that pairs adaptive imperceptible perturbations with latent feature constraints during training to bypass state-of-the-art backdoor defense algorithms without degrading standard classification accuracy.

Listen

Deep neural networks are widely deployed across critical domains like computer vision, yet they remain vulnerable to backdoor attacks. In these attacks, malicious actors manipulate training data or pre-trained models so that infected systems function normally on benign inputs but output incorrect, adversary-chosen predictions when triggered. Current defensive tools detect these attacks by identifying visual anomalies or abnormal internal neural representations. However, most existing attacks only focus on making the trigger visually invisible without concealing the abnormality of its internal feature representation.

The article introduces and evaluates DEFEAT, a novel backdoor attack mechanism designed to achieve deep stealthiness at both the input and feature levels. The main objective is to demonstrate that an attacker can embed reliable backdoors that preserve normal model performance while evading state-of-the-art detection algorithms.

To achieve this, the approach combines two core steps: generating an adaptive, visually imperceptible trigger using adversarial perturbation techniques, and constraining the model's intermediate latent representations during training. Auxiliary classifiers are trained on intermediate layers to measure and minimize the feature differences between clean and poisoned samples, effectively blending the backdoor's latent footprint into normal data distributions. The authors evaluated this mechanism across three standard benchmark datasets (CIFAR-10, GTSRB traffic signs, and ImageNet) across three deep learning architectures (VGG16, ResNet34, and WideResNet), comparing it against existing attack methods and testing it against four established defense mechanisms.

The findings show that DEFEAT consistently attains an attack success rate exceeding 98.7%—reaching nearly 100% across multiple models—while maintaining benign test accuracy comparable to, and often slightly exceeding, clean baseline models. At the input level, the attack generated triggers with higher image quality and similarity scores than baseline attacks. At the feature level, the attack successfully avoided detection by reverse-engineering tools like Neural Cleanse, staying well below standard anomaly thresholds where older methods were easily exposed. It also demonstrated high resistance to input entropy filtering, neuron pruning (retaining over 90% attack success even when 95% of relevant neurons were removed), and model distillation defenses.

These results demonstrate a critical operational risk for organizations relying on third-party pre-trained models or unvetted training datasets. Conventional backdoor defenses largely rely on detecting unnatural latent representations or input anomalies, which DEFEAT effectively bypasses. Consequently, organizations face severe security and safety liabilities if deploying models in high-stakes environments without enhanced verification protocols.

To mitigate these risks, organizations must move beyond standalone feature-anomaly detectors or standard post-training scrubbing. Defensive strategies should incorporate multi-layered validation, strict data provenance tracking, and the development of new defense frameworks that do not assume backdoor triggers produce detectable statistical anomalies in latent space.

The primary limitations noted in the article include a focus on centralized training environments rather than federated learning, as well as computational overhead constraints that restricted ImageNet evaluations to a 10-class subset. Additionally, the stealthiness budget parameter must be calibrated to image resolution to maintain optimal invisibility. Within these stated boundaries, the findings provide strong confidence that current defensive standards are insufficient against feature-constrained backdoor techniques.

Delft University of Technology Institute of Information Engineering, Chinese Academy of Sciences University of Chinese Academy of Sciences classifiers deep learning denial of service attacks deep hidden feature backdoor attacks latent representation constraints imperceptible perturbation

Zhao et al (2022).pdf

Paper: BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain, Tianyu Gu et al. (2017). BadNets provides the foundational formulation and threat model of training-time backdoor data poisoning in neural networks upon which DEFEAT designs its stealthier hidden-feature trigger.
Paper: Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning, Xinyun Chen et al. (2017). This paper establishes key targeted backdoor poisoning strategies using imperceptible and physical triggers that DEFEAT aims to advance by constraining internal latent representations.
Paper: Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks, Ali Shafahi et al. (2018). This work introduces clean-label poisoning via internal feature collisions, establishing the conceptual basis for manipulating latent representations during backdoor creation.
Paper: Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks, Kang Liu et al. (2018). Fine-Pruning introduces key latent neuron and activation defense strategies against backdoors that DEFEAT explicitly designs its latent representation constraints to bypass.

No sufficiently relevant recommendations were found.

Cover for DEFEAT: Deep Hidden Feature Backdoor Attacks by Imperceptible Perturbation and Latent Representation Constraints

Abstract

Backdoor attack is a type of serious security threat to deep learning models. An adversary can provide users with a model trained on poisoned data to manipulate prediction behavior in test stage using a backdoor. The backdoored models behave normally on clean images, yet can be activated and output incorrect prediction if the input is stamped with a specific trigger pattern. Most existing backdoor attacks focus on manually defining imperceptible triggers in input space without considering the abnormality of triggers' latent representations in the poisoned model. These attacks are susceptible to backdoor detection algorithms and even visual inspection. In this paper, We propose a novel and stealthy backdoor attack - DEFEAT. It poisons the clean data using adaptive imperceptible perturbation and restricts latent representation during training process to strengthen our attack's stealthiness and resistance to defense algorithms. We conduct extensive experiments on multiple image classifiers using real-world datasets to demonstrate that our attack can 1) hold against the state-of-the-art defenses, 2) deceive the victim model with high attack success without jeopardizing model utility, and 3) provide practical stealthiness on image data.

Topics

classifiers deep learning denial of service attacks detection algorithm latent factor latent variable visual inspection security issues

Keywords

deep hidden feature backdoor attacks latent representation constraints imperceptible perturbation latent feature constraint loss clean-label backdoor backdoor triggers backdoor defense algorithms deep neural networks

1. Introduction
2. Related Work
2.1. Backdoor Attacks.
2.2. Backdoor Defense.
2.3. Threat Model
3. Our Proposed Model: DEFEAT
3.1. Preliminary
3.2. Trigger Generation
3.3. Backdoor Implantation
4. Evaluation
4.1. Attack Experiments
4.2. Defense Experiments
4.3. Hyperparameter Analysis
5. Conclusion
6. Acknowledgments
References

Knowls

Knowl 1 — DEFEAT Bilevel Optimization Formulation
model/method
DEFEAT formulates the stealthy backdoor attack as a constrained bilevel optimization problem. For a deep neural network classifier $F_\theta: \mathcal{I} \to \mathbb{R}^K$ parameterized by $\theta$ (where $\mathcal{I} \subset \mathbb{R}^{C \times H \times W}$ is the image domain and $K$ is the number of classes), clean dataset $\mathcal{D}_c = \{(x_i, y_i)\}_{i=1}^N$ , and poisoned dataset $\mathcal{D}_b \subset \mathcal{D}_c$ , the objective is defined as:

$\min_\theta \beta_1 \mathcal{L}_{clean}(\theta) + \beta_2 \mathcal{L}_{adv}(\theta)$

$\text{s.t.} \quad \phi(\theta) = \arg\min_\phi \sum_{i=1}^N \left[ \mathcal{L}_{ce}(F_\theta(T_\phi(x_i)), y_t) + \max(d(T_\phi(x_i), x_i) - \epsilon, 0) \right]$

where $\beta_1$ and $\beta_2$ are balancing hyperparameter weights, $\mathcal{L}_{ce}$ is the standard cross-entropy loss, $y_t$ is the predefined target class label, $d(T_\phi(x), x) = \|T_\phi(x) - x\|_2$ is the $\ell_2$ -norm distance in pixel space, and $\epsilon > 0$ denotes the stealthiness perturbation budget.

The clean data loss is:

$\mathcal{L}_{clean}(\theta) = \sum_{(x, y) \in \mathcal{D}_c} \mathcal{L}_{ce}(F_\theta(x), y)$

and the adversarial poisoning loss is:

$\mathcal{L}_{adv}(\theta) = \sum_{(x, y) \in \mathcal{D}_b} \left[ \mathcal{L}_{ce}(F_\theta(T_\phi(x)), y_t) + \mathcal{L}_{lf}(x, T_\phi(x), F_\theta) \right]$

where $T_\phi(x) = x + \phi$ is the backdoor injection function parameterized by the universal noise pattern $\phi$ , and $\mathcal{L}_{lf}$ is the latent feature constraint loss.
Knowl 2 — Latent Feature Constraint Loss via Intermediate Auxiliary Classifiers
equation
To prevent backdoor triggers from exhibiting abnormal, distinguishable activations in intermediate layers, DEFEAT trains an auxiliary linear classifier $h^{(l)}$ on the intermediate representations of the clean model $F_\theta = F^{(N)} \circ \dots \circ F^{(1)}$ . For intermediate layer $l \in [1:N]$ with activation tensor $z^{(l)} \in \mathbb{R}^{C^{(l)} \times H^{(l)} \times W^{(l)}}$ , the auxiliary classifier is parameterized by weights $\psi^{(l)} \in \mathbb{R}^{C^{(l)} \times K}$ and bias $\xi^{(l)} \in \mathbb{R}^K$ :

$h^{(l)}(z^{(l)}) = \text{pool}(z^{(l)})\psi^{(l)} + \xi^{(l)}$

where $\text{pool}: \mathbb{R}^{C^{(l)} \times H^{(l)} \times W^{(l)}} \to \mathbb{R}^{C^{(l)}}$ is a global average pooling operator. During training of $h^{(l)}$ , $F_\theta$ acts as a frozen feature extractor trained on $\mathcal{D}_c$ via cross-entropy loss.

The latent feature constraint loss $\mathcal{L}_{lf}^\lambda$ penalizes the discrepancy between clean and poisoned intermediate activations as evaluated by $h^{(l)}$ :

$\mathcal{L}_{lf}^\lambda = \text{mean}\left( \sum_{l \in [1:N]} \lambda^{(l)} \left| h^{(l)}(z_x^{(l)}) - h^{(l)}(z_{T_\phi(x)}^{(l)}) \right| \right)$

where $z_x^{(l)}$ and $z_{T_\phi(x)}^{(l)}$ denote the features extracted at the $l$ -th layer for clean image $x$ and poisoned image $T_\phi(x)$ , respectively, and $\lambda = (\lambda^{(1)}, \dots, \lambda^{(N)})$ is a non-negative weighting vector satisfying $\sum_{l=1}^N \lambda^{(l)} = 1$ .
Knowl 3 — DEFEAT Backdoor Attack Training Procedure
algorithm
The DEFEAT poisoning algorithm alternates between optimizing the universal noise trigger pattern $\phi$ and updating the classifier parameters $\theta$ under the latent feature constraint.
Input: Clean Dataset $\mathcal{D}_c$ , Loss weights $\beta_1, \beta_2$ , Injection ratio $\eta$ , Total alternating steps $R$ , Stealthiness budget $\epsilon$
Output: Backdoored classifier parameters $\theta$ , Backdoor injection trigger $\phi$
Train clean model $F_\theta$ on $\mathcal{D}_c$
for each layer $l \in [1 : N]$ do
    Train auxiliary intermediate classifier $h^{(l)}$ on clean data $\mathcal{D}_c$ while keeping $F_\theta$ fixed
end for
Initialize $\phi$
Sample poisoning subset $\mathcal{D}_b \subset \mathcal{D}_c$ such that $|\mathcal{D}_b| / |\mathcal{D}_c| = \eta$
for $i = 1$ to $R$ do
    Optimize $\phi$ via $\arg\min_\phi \sum_{(x_j, y_j) \in \mathcal{D}_c} [\mathcal{L}_{ce}(F_\theta(x_j + \phi), y_t) + \max(\|\phi\|_2 - \epsilon, 0)]$
    Compute total training loss $\mathcal{L} = \beta_1 \mathcal{L}_{clean}(\theta) + \beta_2 \mathcal{L}_{adv}(\theta)$
    Update $\theta$ via stochastic gradient descent
end for
return $\theta, \phi$
In standard implementations, $R = 20$ , $\beta_1 = 1$ , $\beta_2 = 0.1$ , the injection ratio is $\eta = 0.1$ , and model updates in line 8 use SGD with a fine-tuning learning rate of $0.001$ .

Knowl 4 — Attack Effectiveness across Benchmark Datasets and Architectures

data/table

The attack effectiveness of DEFEAT was evaluated against BadNets, SIG, ReFool, WaNet, and DFST across CIFAR-10, GTSRB, and a 10-class subset of ImageNet using VGG16, ResNet34, and WideResNet architectures. Performance is measured via Test Accuracy Rate (TAR, %) on clean samples and Attack Success Rate (ASR, %) on poisoned samples (injection ratio $\eta = 0.1$ , target label $y_t = 0$ , averaged over 10 independent runs):

Model	Attack	CIFAR-10		GTSRB		ImageNet
		TAR	ASR	TAR	ASR	TAR	ASR
	Clean Model	$92.91\pm0.30$	-	$98.43\pm0.07$	-	$85.26\pm0.30$	-
	BadNets	$90.03\pm0.43$	$99.17\pm0.02$	$95.43\pm0.06$	$100.00\pm0.00$	$83.54\pm0.20$	$97.69\pm0.10$
	SIG	$87.33\pm0.30$	$99.75\pm0.01$	$95.81\pm0.05$	$99.85\pm0.01$	$82.25\pm0.12$	$98.92\pm0.12$
VGG16	ReFool	$87.24\pm0.70$	$99.58\pm0.03$	$94.66\pm0.05$	$94.15\pm0.01$	$77.90\pm0.02$	$98.33\pm0.02$
	WaNet	$91.87\pm0.55$	$99.95\pm0.02$	$96.59\pm0.15$	$96.41\pm0.02$	$83.30\pm0.30$	$98.81\pm0.02$
	DFST	$90.17\pm0.25$	$99.80\pm0.02$	$96.78\pm0.25$	$98.96\pm0.01$	$81.38\pm0.50$	$99.96\pm0.02$
	DEFEAT (Ours)	$91.93\pm0.50$	$99.30\pm0.01$	$96.24\pm0.05$	$98.76\pm0.02$	$84.97\pm0.18$	$99.94\pm0.01$
	Clean Model	$92.33\pm0.01$	-	$98.42\pm0.06$	-	$84.66\pm0.25$	-
	BadNets	$91.73\pm0.03$	$99.86\pm0.01$	$97.90\pm0.40$	$98.91\pm0.11$	$79.45\pm0.16$	$94.33\pm0.01$
	SIG	$91.49\pm0.03$	$99.38\pm0.20$	$98.19\pm0.06$	$100.00\pm0.00$	$80.37\pm0.30$	$97.04\pm0.01$
ResNet34	ReFool	$91.09\pm0.22$	$99.05\pm0.10$	$97.94\pm0.01$	$98.47\pm0.03$	$74.39\pm0.24$	$94.35\pm0.22$
	WaNet	$92.03\pm0.30$	$99.96\pm0.01$	$98.19\pm0.31$	$99.83\pm0.01$	$79.77\pm0.30$	$95.31\pm0.03$
	DFST	$91.21\pm0.43$	$99.85\pm0.03$	$97.39\pm0.33$	$98.99\pm0.01$	$80.74\pm0.37$	$98.59\pm0.03$
	DEFEAT (Ours)	$92.25\pm0.25$	$99.98\pm0.02$	$98.26\pm0.30$	$99.01\pm0.05$	$82.63\pm0.22$	$98.98\pm0.01$
	Clean Model	$93.35\pm1.10$	-	$98.42\pm0.06$	-	$85.79\pm0.10$	-
	BadNets	$92.54\pm0.03$	$99.88\pm0.02$	$97.39\pm0.02$	$99.98\pm0.01$	$84.02\pm0.13$	$91.61\pm0.06$
	SIG	$91.73\pm0.02$	$99.90\pm0.01$	$97.74\pm0.02$	$96.99\pm0.00$	$82.84\pm0.22$	$98.22\pm0.01$
WideResNet	ReFool	$90.65\pm0.20$	$99.80\pm0.30$	$97.53\pm0.13$	$96.62\pm0.33$	$82.57\pm0.75$	$95.37\pm0.01$
	WaNet	$91.63\pm0.50$	$99.57\pm0.30$	$97.54\pm0.21$	$97.56\pm0.01$	$83.69\pm0.60$	$95.42\pm0.10$
	DFST	$92.14\pm0.40$	$99.85\pm0.02$	$97.04\pm0.33$	$98.19\pm0.02$	$83.92\pm0.33$	$99.89\pm0.02$
	DEFEAT (Ours)	$93.24\pm0.70$	$99.98\pm0.11$	$98.55\pm0.01$	$99.90\pm0.01$	$84.08\pm0.30$	$99.88\pm0.14$

DEFEAT consistently maintains clean accuracy (TAR) close to the clean unpoisoned model baseline (e.g., $93.24\%$ vs $93.35\%$ on CIFAR-10 with WideResNet) while achieving attack success rates (ASR) consistently above $98.76\%$ across all settings.

Knowl 5 — Quantitative Attack Stealthiness Metrics

data/table

Image-level and perceptual stealthiness of poisoned images generated by DEFEAT and baseline attacks were evaluated on 500 randomly selected test samples across CIFAR-10, GTSRB, and ImageNet using Structural Similarity Index (SSIM $\uparrow$ ), Peak Signal-to-Noise Ratio (PSNR $\uparrow$ , dB), and Learned Perceptual Image Patch Similarity (LPIPS $\downarrow$ , using pre-trained AlexNet features):

Dataset	Metric	BadNets	ReFool	SIG	WaNet	DFST	DEFEAT (Ours)
	SSIM $\uparrow$	$0.9763$	$0.6542$	$0.9578$	$0.8854$	$0.7210$	$\mathbf{0.9813}$
CIFAR-10	LPIPS $\downarrow$	$0.0012$	$0.0697$	$0.0015$	$0.0090$	$0.0881$	$\mathbf{0.0009}$
	PSNR $\uparrow$	$20.06$	$18.37$	$25.23$	$19.30$	$16.79$	$21.31$
	SSIM $\uparrow$	$0.9501$	$0.7418$	$0.7103$	$\mathbf{0.9669}$	$0.7594$	$0.9171$
GTSRB	LPIPS $\downarrow$	$\mathbf{0.0303}$	$0.3097$	$0.0850$	$0.0584$	$0.2510$	$0.0427$
	PSNR $\uparrow$	$23.41$	$20.57$	$25.28$	$30.11$	$21.58$	$\mathbf{30.25}$
	SSIM $\uparrow$	$\mathbf{0.9955}$	$0.8564$	$0.8680$	$0.9359$	$0.7129$	$0.9765$
ImageNet	LPIPS $\downarrow$	$\mathbf{0.0062}$	$0.4574$	$0.0573$	$0.0360$	$0.2105$	$0.0159$
	PSNR $\uparrow$	$32.95$	$20.42$	$25.30$	$29.59$	$23.01$	$\mathbf{37.50}$

DEFEAT yields superior perceptual similarity on CIFAR-10 (lowest LPIPS $0.0009$ and highest SSIM $0.9813$ ) and achieves the highest PSNR across GTSRB ( $30.25$ ) and ImageNet ( $37.50$ ). While BadNets achieves competitive SSIM/LPIPS scores on larger images due to its localized small square trigger, it creates localized visual artifacts, whereas DEFEAT's Grad-CAM activations align directly with the main semantic object of the clean image.

Knowl 6 — Robustness against Neural Attention Distillation Defense

data/table

Neural Attention Distillation (NAD) utilizes a clean teacher model to fine-tune a backdoored student network to align intermediate attention maps and erase backdoor triggers. The defense was evaluated over 20 distillation epochs on ImageNet using a ResNet34 classifier:

Attack	Original		Epoch #5		Epoch #10		Epoch #15		Epoch #20
	TAR	ASR	TAR	ASR	TAR	ASR	TAR	ASR	TAR	ASR
BadNets	$79.45$	$94.33$	$62.78$	$14.79$	$75.31$	$14.42$	$75.52$	$13.99$	$74.72$	$7.48$
ReFool	$80.37$	$97.04$	$67.89$	$34.48$	$76.65$	$18.24$	$76.49$	$14.47$	$76.44$	$14.52$
SIG	$74.39$	$94.35$	$73.86$	$45.45$	$74.19$	$35.50$	$74.77$	$31.87$	$74.93$	$28.28$
WaNet	$79.77$	$95.31$	$66.93$	$36.42$	$57.28$	$35.13$	$69.57$	$32.99$	$69.71$	$36.01$
DFST	$80.74$	$98.59$	$77.97$	$50.78$	$76.90$	$42.01$	$79.13$	$36.06$	$79.85$	$31.71$
DEFEAT (Ours)	$82.63$	$98.98$	$80.90$	$86.71$	$82.46$	$81.53$	$77.89$	$82.21$	$79.53$	$79.99$

While baseline attacks suffer drastic ASR reductions under NAD (e.g., BadNets drops from $94.33\%$ to $7.48\%$ and DFST drops from $98.59\%$ to $31.71\%$ at epoch 20), DEFEAT maintains a high ASR of $79.99\%$ and clean TAR of $79.53\%$ , resisting distillation-based trigger erasure.

Knowl 7 — Resistance to STRIP, Neural Cleanse, and Fine-Pruning Defenses
empirical result
DEFEAT was tested against three representative backdoor defense mechanisms:
1. STRIP (STRong Intentional Perturbation): STRIP detects poisoned inputs by computing the entropy of output probabilities when perturbed by superimposing random benign inputs. On ResNet34 evaluated on CIFAR-10 and GTSRB, the normalized entropy probability distributions of DEFEAT clean and poisoned samples overlap almost completely, rendering poisoned inputs indistinguishable from clean inputs (unlike BadNets, which exhibits separated entropy distributions).
2. Neural Cleanse: Neural Cleanse detects backdoors via trigger reverse engineering and flags models with an anomaly index $\ge 2.0$ . On ResNet34 across CIFAR-10, GTSRB, and ImageNet, DEFEAT maintains anomaly indices below the $2.0$ detection threshold, whereas BadNets ( $3.84$ ) and SIG ( $2.27$ ) are flagged as anomalies on ImageNet. Furthermore, triggers reverse-engineered from DEFEAT models show no structured pattern and resemble clean representations.
3. Fine-Pruning: Neurons in the final convolutional layer of a VGG16 model were pruned based on activation values. When the pruning rate reached $95\%$ , DEFEAT preserved an ASR above $90\%$ , while clean TAR dropped sharply to approximately $60\%$ , indicating that the backdoor cannot be pruned away without destroying benign utility.

Knowl 8 — Hyperparameter Sensitivity: Injection Ratio and Stealthiness Budget

data/table

The effects of injection ratio $\eta$ and stealthiness perturbation budget $\epsilon$ on Test Accuracy Rate (TAR, %) and Attack Success Rate (ASR, %) were analyzed using a ResNet34 classifier:

Injection Ratio $\eta$ on GTSRB:

Injection Ratio ( $\eta$ )	TAR (%)	ASR (%)
$1\%$	$98.79 \pm 0.07$	$93.66 \pm 0.24$
$5\%$	$98.56 \pm 0.05$	$96.72 \pm 0.14$
$10\%$	$98.26 \pm 0.30$	$99.01 \pm 0.05$
$15\%$	$97.53 \pm 0.03$	$99.21 \pm 0.02$

Perturbation Budget $\epsilon$ across Datasets:

Dataset	Budget ( $\epsilon$ )	TAR (%)	ASR (%)
	$2.0$	$92.65 \pm 0.22$	$99.63 \pm 0.01$
CIFAR-10	$1.0$	$92.25 \pm 0.25$	$99.98 \pm 0.02$
	$0.5$	$91.05 \pm 0.20$	$97.93 \pm 0.02$
	$3.0$	$98.41 \pm 0.11$	$99.61 \pm 0.01$
GTSRB	$2.0$	$98.26 \pm 0.30$	$99.01 \pm 0.05$
	$1.0$	$98.13 \pm 0.47$	$98.59 \pm 0.06$
	$5.0$	$84.29 \pm 0.40$	$99.91 \pm 0.03$
ImageNet	$3.0$	$82.63 \pm 0.22$	$98.98 \pm 0.01$
	$1.0$	$81.64 \pm 0.33$	$99.62 \pm 0.01$

Increasing $\eta$ elevates ASR above $99\%$ at the cost of a minor reduction in clean TAR. Increasing $\epsilon$ eases backdoor implantation but reduces imperceptibility. Optimal stealth-effectiveness trade-offs are obtained at default budgets of $\epsilon = 1.0$ for CIFAR-10, $\epsilon = 2.0$ for GTSRB, and $\epsilon = 3.0$ for ImageNet.

Knowl 9 — Experimental Setup and Architecture Configurations
experimental setup
The experimental evaluation used the following settings:
- Datasets: CIFAR-10 ( $60\text{k}$ $32 \times 32$ images, $10$ classes, $50\text{k}$ train / $10\text{k}$ test); GTSRB ( $51.2\text{k}$ $40 \times 40$ traffic sign images, $43$ classes); ImageNet ( $10$ randomly chosen classes, $10.5\text{k}$ $224 \times 224$ train / $1.8\text{k}$ test images). All pixel values are normalized to $[0, 1]$ .
- Target Class: Single-target attack targeting class index $y_t = 0$ .
- Victim Networks: VGG16, ResNet34, and WideResNet.
- Training Hyperparameters: Clean base models are trained for $200$ epochs using SGD with initial learning rate $0.01$ , decayed by a factor of $0.1$ at epochs $50, 100, 150$ . To constrain poisoning, the last convolutional layer is selected for VGG16, the last three residual blocks for ResNet34 (equal weights $\lambda^{(l)} = 1/3$ ), and the last five residual blocks for WideResNet (equal weights $\lambda^{(l)} = 1/5$ ). Fine-tuning during poisoning uses a learning rate of $0.001$ , $\beta_1 = 1$ , and $\beta_2 = 0.1$ .

Coverage note — None was omitted; all contributed models, optimization objectives, algorithms, benchmark tables, defense evaluations, and hyperparameter analyses are fully covered.

References

1.Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics, pages 2938–2948. PMLR, 2020.
2.Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In 2019 IEEE International Conference on Image Processing (ICIP), pages 101–105. IEEE, 2019.
3.Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728, 2018.
4.Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks. In IJCAI, pages 4658–4664, 2019.
5.Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017.
6.Siyuan Cheng, Yingqi Liu, Shiqing Ma, and Xiangyu Zhang. Deep feature space trojan attack of neural networks by controlled detoxification. arXiv preprint arXiv:2012.11212, 2020.
7.Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 11966–11976, 2021.
8.Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, pages 113–125, 2019.
9.Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017.
10.Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016.
11.Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European conference on computer vision, pages 630–645. Springer, 2016.
12.Quan Huynh-Thu and Mohammed Ghanbari. Scope of validity of psnr in image/video quality assessment. Electronics letters, 44(13):800–801, 2008.
13.Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
14.Shaofeng Li, Minhui Xue, Benjamin Zhao, Haojin Zhu, and Xinpeng Zhang. Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, 2020.
15.Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with samplespecific triggers. In IEEE International Conference on Computer Vision (ICCV), 2021.
16.Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In ICLR, 2021.
17.Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Finepruning: Defending against backdooring attacks on deep neural networks. In International Symposium on Research in Attacks, Intrusions, and Defenses, pages 273–294. Springer, 2018.
18.Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. 2017.
19.Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In European Conference on Computer Vision, pages 182–199. Springer, 2020.
20.Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017.
21.Mehdi Mirza and Simon Osindero. Conditional generative adversarial nets. arXiv preprint arXiv:1411.1784, 2014.
22.Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. arXiv preprint arXiv:2010.08138, 2020.
23.Anh Nguyen and Anh Tran. Wanet – imperceptible warpingbased backdoor attack. 2021.
24.Ximing Qiao, Yukun Yang, and Hai Li. Defending neural backdoors via generative distribution modeling. arXiv preprint arXiv:1910.04749, 2019.
25.Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115(3):211–252, 2015.
26.Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 11957–11965, 2020.
27.Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on computer vision, pages 618–626, 2017.
28.Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. arXiv preprint arXiv:1804.00792, 2018.
29.Reza Shokri et al. Bypassing backdoor detection algorithms in deep learning. In 2020 IEEE European Symposium on Security and Privacy (EuroS&P), pages 175–183. IEEE, 2020.
30.Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014.
31.Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural networks, 32:323–332, 2012.
32.Jacob Steinhardt, Pang Wei Koh, and Percy Liang. Certified defenses for data poisoning attacks. In Proceedings of the 31st International Conference on Neural Information Processing Systems, pages 3520–3532, 2017.
33.Ziteng Sun, Peter Kairouz, Ananda Theertha Suresh, and H Brendan McMahan. Can you really backdoor federated learning? arXiv preprint arXiv:1911.07963, 2019.
34.Ilya Sutskever, Oriol Vinyals, and Quoc V Le. Sequence to sequence learning with neural networks. In Advances in neural information processing systems, pages 3104–3112, 2014.
35.Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. arXiv preprint arXiv:1811.00636, 2018.
36.Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in neural information processing systems, pages 5998–6008, 2017.
37.Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP), pages 707–723. IEEE, 2019.
38.Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4):600–612, 2004.
39.Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. Dba: Distributed backdoor attacks against federated learning. In International Conference on Learning Representations, 2019.
40.Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y Zhao. Latent backdoor attacks on deep neural networks. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 2041–2055, 2019.
41.Yunrui Yu, Xitong Gao, and Cheng-Zhong Xu. Lafeat: Piercing through adversarial defenses with latent features. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5735–5745, 2021.
42.Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016.
43.Yi Zeng, Won Park, Z Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks’ triggers: A frequency perspective. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16473–16481, 2021.
44.Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In CVPR, 2018.
45.Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. Clean-label backdoor attacks on video recognition models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14443–14452, 2020.

Citation

MLA

Zhao, Z., et al. “DEFEAT: Deep Hidden Feature Backdoor Attacks by Imperceptible Perturbation and Latent Representation Constraints”. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022, pp. 15192–201, https://doi.org/10.1109/CVPR52688.2022.01478.

APA

Zhao, Z., Chen, X., Xuan, Y., Dong, Y., Wang, D., & Liang, K. (2022). DEFEAT: Deep Hidden Feature Backdoor Attacks by Imperceptible Perturbation and Latent Representation Constraints. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 15192–15201. https://doi.org/10.1109/CVPR52688.2022.01478

Chicago

Zhao, Z., X. Chen, Y. Xuan, Y. Dong, D. Wang, and K. Liang. 2022. “DEFEAT: Deep Hidden Feature Backdoor Attacks by Imperceptible Perturbation and Latent Representation Constraints”. 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 15192–201. https://doi.org/10.1109/CVPR52688.2022.01478.

Harvard

Zhao, Z. et al. (2022) “DEFEAT: Deep Hidden Feature Backdoor Attacks by Imperceptible Perturbation and Latent Representation Constraints”, 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, pp. 15192–15201. Available at: https://doi.org/10.1109/CVPR52688.2022.01478.

Vancouver

1. Zhao Z, Chen X, Xuan Y, Dong Y, Wang D, Liang K (2022) DEFEAT: Deep Hidden Feature Backdoor Attacks by Imperceptible Perturbation and Latent Representation Constraints. In: 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, pp 15192–15201

BibTeX

@inproceedings{Zhao_2022, title={DEFEAT: Deep Hidden Feature Backdoor Attacks by Imperceptible Perturbation and Latent Representation Constraints}, url={http://dx.doi.org/10.1109/CVPR52688.2022.01478}, DOI={10.1109/cvpr52688.2022.01478}, booktitle={2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)}, publisher={IEEE}, author={Zhao, Zhendong and Chen, Xiaojun and Xuan, Yuexin and Dong, Ye and Wang, Dakui and Liang, Kaitai}, year={2022}, month=June, pages={15192–15201} }

Metadata:Crossref

Access the Paper

This paper is available from its original source. Click below to access the PDF.

Open PDF

License: IEEE

DEFEAT: Deep Hidden Feature Backdoor Attacks by Imperceptible Perturbation and Latent Representation Constraints

Abstract

Topics

Keywords

Table of Contents

Knowls

Knowl 1 — DEFEAT Bilevel Optimization Formulation

Knowl 2 — Latent Feature Constraint Loss via Intermediate Auxiliary Classifiers

Knowl 3 — DEFEAT Backdoor Attack Training Procedure

Knowl 4 — Attack Effectiveness across Benchmark Datasets and Architectures

Knowl 5 — Quantitative Attack Stealthiness Metrics

Knowl 6 — Robustness against Neural Attention Distillation Defense

Knowl 7 — Resistance to STRIP, Neural Cleanse, and Fine-Pruning Defenses

Knowl 8 — Hyperparameter Sensitivity: Injection Ratio and Stealthiness Budget

Knowl 9 — Experimental Setup and Architecture Configurations

References

Citation

BibTeX

Access the Paper