Recent studies have proven that deep neural networks are vulnerable to
backdoor attacks. Specifically, by mixing a small number of poisoned samples
into the training set, the behavior of the trained model can be maliciously
controlled. Existing attack methods construct such adversaries by randomly
selecting some clean data from the benign set and then embedding a trigger into
them. However, this selection strategy ignores the fact that each poisoned
sample contributes inequally to the backdoor injection, which reduces the
efficiency of poisoning. In this paper, we formulate improving the poisoned
data efficiency by the selection as an optimization problem and propose a
Filtering-and-Updating Strategy (FUS) to solve it. The experimental results on
CIFAR-10 and ImageNet-10 indicate that the proposed method is effective: the
same attack success rate can be achieved with only 47% to 75% of the poisoned
sample volume compared to the random selection strategy. More importantly, the
adversaries selected according to one setting can generalize well to other
settings, exhibiting strong transferability. The prototype code of our method
is now available at this https URL.

本文提出了一种基于过滤和更新策略的深度神经网络反向攻击样本优化方法，从而提高了毒化数据的效率。通过在 CIFAR-10 和 ImageNet-10 数据集上的实验结果验证了该方法的有效性。