Self-supervised learning models are vulnerable to backdoor attacks. Existing
backdoor attacks that are effective in self-supervised learning often involve
noticeable triggers, like colored patches, which are vulnerable to human
inspection. In this paper, we propose an imperceptible and effective backdoor
attack against self-supervised models. We first find that existing
imperceptible triggers designed for supervised learning are not as effective in
compromising self-supervised models. We then identify this ineffectiveness is
attributed to the overlap in distributions between the backdoor and augmented
samples used in self-supervised learning. Building on this insight, we design
an attack using optimized triggers that are disentangled to the augmented
transformation in the self-supervised learning, while also remaining
imperceptible to human vision. Experiments on five datasets and seven SSL
algorithms demonstrate our attack is highly effective and stealthy. It also has
strong resistance to existing backdoor defenses. Our code can be found at
this https URL

自我监督学习模型容易受到后门攻击，而现有的有效后门攻击方法常常涉及可察觉的触发机制，如有颜色的补丁，容易被人类检查出来。本文提出了一种对自我监督模型有效而又难以察觉的后门攻击方法，通过优化特定触发机制的设计，使其与自我监督学习中的增广转换有区分度，并对人类视觉难以察觉。在五个数据集和七个自我监督学习算法上的实验证明了我们的攻击方式极其有效且隐秘，并且对现有后门防御具有很强的抵抗力。我们的代码可以在此链接中找到。