Deep neural networks face persistent challenges in defending against backdoor
attacks, leading to an ongoing battle between attacks and defenses. While
existing backdoor defense strategies have shown promising performance on
reducing attack success rates, can we confidently claim that the backdoor
threat has truly been eliminated from the model? To address it, we
re-investigate the characteristics of the backdoored models after defense
(denoted as defense models). Surprisingly, we find that the original backdoors
still exist in defense models derived from existing post-training defense
strategies, and the backdoor existence is measured by a novel metric called
backdoor existence coefficient. It implies that the backdoors just lie dormant
rather than being eliminated. To further verify this finding, we empirically
show that these dormant backdoors can be easily re-activated during inference,
by manipulating the original trigger with well-designed tiny perturbation using
universal adversarial attack. More practically, we extend our backdoor
reactivation to black-box scenario, where the defense model can only be queried
by the adversary during inference, and develop two effective methods, i.e.,
query-based and transfer-based backdoor re-activation attacks. The
effectiveness of the proposed methods are verified on both image classification
and multimodal contrastive learning (i.e., CLIP) tasks. In conclusion, this
work uncovers a critical vulnerability that has never been explored in existing
defense strategies, emphasizing the urgency of designing more robust and
advanced backdoor defense mechanisms in the future.

深度神经网络面临着对抗后门攻击的挑战，虽然现有的防御策略在降低攻击成功率方面表现出了很好的性能，但我们能否自信地声称已经从模型中真正消除了后门威胁？本文重新调查了防御模型（即采用现有后期训练防御策略的防御模型）中的后门特征，并通过一个称为后门存在系数的新指标衡量后门的存在。令人惊讶的是，我们发现原始后门在防御模型中仍然存在，而这些后门只是处于休眠状态而非被消除。为了进一步验证这一发现，我们通过设计精心的微小扰动，利用通用对抗攻击来展示这些休眠后门很容易在推理过程中被重新激活。此外，我们还将后门重激活扩展到黑盒场景，并提出了两种有效的方法：基于查询和基于传递的后门重激活攻击。我们验证了所提出方法在图像分类和多模态对比学习（即 CLIP）任务上的有效性。总之，本研究揭示了现有防御策略中尚未探索的关键漏洞，强调了设计更加稳健和先进的后门防御机制的紧迫性。