To successfully launch backdoor attacks, injected data needs to be correctly
labeled; otherwise, they can be easily detected by even basic data filters.
Hence, the concept of clean-label attacks was introduced, which is more
dangerous as it doesn't require changing the labels of injected data. To the
best of our knowledge, the existing clean-label backdoor attacks largely relies
on an understanding of the entire training set or a portion of it. However, in
practice, it is very difficult for attackers to have it because of training
datasets often collected from multiple independent sources. Unlike all current
clean-label attacks, we propose a novel clean label method called 'Poison Dart
Frog'. Poison Dart Frog does not require access to any training data; it only
necessitates knowledge of the target class for the attack, such as 'frog'. On
CIFAR10, Tiny-ImageNet, and TSRD, with a mere 0.1\%, 0.025\%, and 0.4\%
poisoning rate of the training set size, respectively, Poison Dart Frog
achieves a high Attack Success Rate compared to LC, HTBA, BadNets, and Blend.
Furthermore, compared to the state-of-the-art attack, NARCISSUS, Poison Dart
Frog achieves similar attack success rates without any training data. Finally,
we demonstrate that four typical backdoor defense algorithms struggle to
counter Poison Dart Frog.

摘要：为了成功发动后门攻击，注入的数据需要正确标记；否则，即使基本的数据过滤器也很容易被检测到。因此，引入了无标签攻击的概念，这更加危险，因为它不需要更改注入数据的标签。我们提出了一种称为 “Poison Dart Frog” 的新型无标签方法。与所有当前的无标签攻击不同，Poison Dart Frog 不需要访问任何训练数据，只需要攻击目标类别的知识。与现有攻击方法相比，Poison Dart Frog 在 CIFAR10、Tiny-ImageNet 和 TSRD 上的攻击成功率较高。最后，我们证明了四种典型的后门防御算法很难对抗 Poison Dart Frog。