Deep neural networks (DNNs) can be manipulated to exhibit specific behaviors
when exposed to specific trigger patterns, without affecting their performance
on normal samples. This type of attack is known as a backdoor attack. Recent
research has focused on designing invisible triggers for backdoor attacks to
ensure visual stealthiness. These triggers have demonstrated strong attack
performance even under backdoor defense, which aims to eliminate or suppress
the backdoor effect in the model. However, through experimental observations,
we have noticed that these carefully designed invisible triggers are often
susceptible to visual distortion during inference, such as Gaussian blurring or
environmental variations in real-world scenarios. This phenomenon significantly
undermines the effectiveness of attacks in practical applications.
Unfortunately, this issue has not received sufficient attention and has not
been thoroughly investigated. To address this limitation, we propose a novel
approach called the Visible, Semantic, Sample-Specific, and Compatible trigger
(VSSC-trigger), which leverages a recent powerful image method known as the
stable diffusion model. In this approach, a text trigger is utilized as a
prompt and combined with a benign image. The resulting combination is then
processed by a pre-trained stable diffusion model, generating a corresponding
semantic object. This object is seamlessly integrated with the original image,
resulting in a new realistic image, referred to as the poisoned image.
Extensive experimental results and analysis validate the effectiveness and
robustness of our proposed attack method, even in the presence of visual
distortion. We believe that the new trigger proposed in this work, along with
the proposed idea to address the aforementioned issues, will have significant
prospective implications for further advancements in this direction.

本文提出了一种名为 VSSC-trigger 的嵌入稳定扩散模型的新方法，使用文本触发器和良性图像生成对比度适当的图像，并解决了之前的不可见触发器在实际运用时出现的可见扭曲问题。