Generalization Bound and New Algorithm for Clean-Label Backdoor Attack
The generalization bound is a crucial theoretical tool for assessing the generalizability of learning methods and there exist vast literatures on generalizability of normal learning, adversarial learning, and data poisoning. Unlike other data poison attacks, the backdoor attack has the special property that the poisoned triggers are contained in both the training set and the test set and the purpose of the attack is two-fold. To our knowledge, the generalization bound for the backdoor attack has not been established. In this paper, we fill this gap by deriving algorithm-independent generalization bounds in the clean-label backdoor attack scenario. Precisely, based on the goals of backdoor attack, we give upper bounds for the clean sample population errors and the poison population errors in terms of the empirical error on the poisoned training dataset. Furthermore, based on the theoretical result, a new clean-label backdoor attack is proposed that computes the poisoning trigger by combining adversarial noise and indiscriminate poison. We show its effectiveness in a variety of settings.
Code (1)
Tasks
Backdoor AttackData PoisoningGeneralization BoundsMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
Invisible Clean-Label Backdoor Attacks for Generative Data Augmentation
With the rapid advancement of image generative models, generative data augmentation has become an effective way to enrich training images, especially when only small-scale datasets are available. At the same time, in pra…
Data AugmentationCheckerboard: Closed-Form and Data-Independent Trigger Design for Clean-Label Backdoor Attacks
Backdoor attacks threaten the deep-learning supply chain by poisoning a small fraction of the training data so that a model behaves normally on clean inputs but maps triggered inputs to an attacker-chosen class. Clean-la…
Model X-ray:Detecting Backdoored Models via Decision Boundary
Backdoor attacks pose a significant security vulnerability for deep neural networks (DNNs), enabling them to operate normally on clean inputs but manipulate predictions when specific trigger patterns occur. Currently, po…
DiagnosticTemporal Poisoning: Clean-Label Backdoors via Event Redistribution in SNNs
Backdoor attacks on Spiking Neural Networks (SNNs) have primarily assumed dirty-label poisoning, in which triggered training samples are relabeled to an attacker-selected class. We study clean-label temporal poisoning, w…
DFB: A Data-Free, Low-Budget, and High-Efficacy Clean-Label Backdoor Attack
In the domain of backdoor attacks, accurate labeling of injected data is essential for evading rudimentary detection mechanisms. This imperative has catalyzed the development of clean-label attacks, which are notably mor…
Backdoor Attackbackdoor defense