Backdoor attacks have severely threatened deep neural network (DNN) models in
the past several years. These attacks can occur in almost every stage of the
deep learning pipeline. Although the attacked model behaves normally on benign
samples, it makes wrong predictions for samples containing triggers. However,
most existing attacks use visible patterns (e.g., a patch or image
transformations) as triggers, which are vulnerable to human inspection. In this
paper, we propose a novel backdoor attack, making imperceptible changes.
Concretely, our attack first utilizes the pre-trained victim model to extract
low-level and high-level semantic features from clean images and generates
trigger pattern associated with high-level features based on channel attention.
Then, the encoder model generates poisoned images based on the trigger and
extracted low-level semantic features without causing noticeable feature loss.
We evaluate our attack on three prominent image classification DNN across three
standard datasets. The results demonstrate that our attack achieves high attack
success rates while maintaining robustness against backdoor defenses.
Furthermore, we conduct extensive image similarity experiments to emphasize the
stealthiness of our attack strategy.

提出了一种新颖的后门攻击方法，通过使用预训练的受害模型从干净图像中提取低级和高级语义特征，并基于通道注意力生成与高级特征相关联的触发模式，然后使用编码器模型生成受污染的图像，同时维持对后门防御的鲁棒性，实验结果表明，该攻击方法在三个知名图像分类深度神经网络上取得了高攻击成功率，同时具有很好的隐秘性。

基于语义特征的隐形后门攻击

An Invisible Backdoor Attack Based On Semantic Feature

Federated Learning (FL) is a popular distributed machine learning paradigm
that enables jointly training a global model without sharing clients' data.
However, its repetitive server-client communication gives room for backdoor
attacks with aim to mislead the global model into a targeted misprediction when
a specific trigger pattern is presented. In response to such backdoor threats
on federated learning, various defense measures have been proposed. In this
paper, we study whether the current defense mechanisms truly neutralize the
backdoor threats from federated learning in a practical setting by proposing a
new federated backdoor attack method for possible countermeasures. Different
from traditional training (on triggered data) and rescaling (the malicious
client model) based backdoor injection, the proposed backdoor attack framework
(1) directly modifies (a small proportion of) local model weights to inject the
backdoor trigger via sign flips; (2) jointly optimize the trigger pattern with
the client model, thus is more persistent and stealthy for circumventing
existing defenses. In a case study, we examine the strength and weaknesses of
recent federated backdoor defenses from three major categories and provide
suggestions to the practitioners when training federated models in practice.

本文重点研究联邦学习（FL）中后门攻击的防御方法，提出一种新的联邦后门攻击框架，通过直接修改局部模型权重注入后门触发器，并与客户端模型联合优化，从而更加单独和隐蔽地绕过现有防御。实证研究表明最近的三大类联邦后门防御机制存在一些缺陷，我们对此提出了建议。

关于联邦学习后门防御漏洞的研究

On the Vulnerability of Backdoor Defenses for Federated Learning

With the success of deep learning algorithms in various domains, studying
adversarial attacks to secure deep models in real world applications has become
an important research topic. Backdoor attacks are a form of adversarial attacks
on deep networks where the attacker provides poisoned data to the victim to
train the model with, and then activates the attack by showing a specific small
trigger pattern at the test time. Most state-of-the-art backdoor attacks either
provide mislabeled poisoning data that is possible to identify by visual
inspection, reveal the trigger in the poisoned data, or use noise to hide the
trigger. We propose a novel form of backdoor attack where poisoned data look
natural with correct labels and also more importantly, the attacker hides the
trigger in the poisoned data and keeps the trigger secret until the test time.
We perform an extensive study on various image classification settings and show
that our attack can fool the model by pasting the trigger at random locations
on unseen images although the model performs well on clean data. We also show
that our proposed attack cannot be easily defended using a state-of-the-art
defense algorithm for backdoor attacks.

本研究提出一种新颖的深度学习后门攻击方式，攻击者能够在训练过程中提供正常标注的毒瘤数据，并在毒瘤数据中隐藏触发器，待测试时再激活攻击，从而欺骗模型，而该攻击方式无法轻易通过最先进的后门攻击的防御算法进行防御。