Beyond Uniformity: Robust Backdoor Attacks on Deep Neural Networks with Trigger Selection

Backdoor attacks have been extensively explored in recent years which attack deep neural networks (DNNs) by poisoning their training set and causing targeted mis-classification. Research on such attacks is critical for today's widespread applications based on DNNs due to their low-cost and high efficacy. While many backdoor attacks have been proposed, they usually rely on using a static and fixed trigger for attacks, which not only lacks adaptability but also renders them easier to detect. To address such a limitation, we introduce OpenTrigger in this paper, a novel backdoor attack framework employing dynamic triggers for enhancing attack flexibility and robustness. Unlike traditional approaches that rely on a single fixed trigger, our proposed attack learns a generalized consistent feature across a built trigger pool, hence enabling even the use of unseen triggers during testing that differ from those used during training. To boost the attack efficacy, we employ Particle Swarm Optimization (PSO) to effectively select optimal triggers from a larger set to maximize attack success rate while preserving prediction accuracy on clean data. Extensive experiments across multiple datasets and model architecture confirm the high effectiveness and robustness of OpenTrigger against state-of-the-art and even adaptive backdoor defenses, establishing it as a versatile and practical backdoor attack strategy.

• We propose OpenTrigger, a novel backdoor attack that learns dynamic and generalized backdoor triggers rather than a fixed trigger.
• We improve the effectiveness of OpenTrigger by designing a trigger selection method based Particle Swarm Optimization (PSO).
• We perform comprehensive evaluations, performance comparison, and ablation study for OpenTrigger across various datasets and victim models. The results show that \texttt{OpenTrigger} consistently achieves high ASR without sacrificing prediction accuracy for clean inputs. Most importantly, our attack performs well under state-of-the-art (SOTA) backdoor defenses. We evaluate our attack even under a strong adaptive defense as well, confirming its robustness towards strong defenses.

Following figure illustrates the workflow of OpenTrigger, which consists of the following five steps.

• Building a trigger pool. The attacker builds a trigger pool Ω with the help of a substitute model Θ_s and a custom PSO algorithm. The attacker further divides Ω into Ω_train and Ω_test dedicated to training and test phases, respectively.
• Trigger planting for training. To obtain x̃ for a given x∈D_a,clean, the attacker randomly selects a t from Ω_train and computes x̃; following Equation x̃ = P(x,t) = α·t + (1-α)·x. In the end, the attacker obtains D_poison.
• Victim model training. The victim model Θ is trained from D_train which the attacker inserts D_poison into.
• Trigger planting for test. Similarly, during test phase, the attacker obtains x̃; for a given x by randomly selecting a t from Ω_test and computing x̃ with Equation x̃ = P(x,t) = α·t + (1-α)·x.
• Testing backdoor attack. The attacker uses clean and poisoned samples to evaluate the attack performance.

We summarize ASR and ACC of our attack and baselines across various datasets in following table. Note that the higher ASR and ACC, the better backdoor attack. As seen from the results, OpenTrigger is able to achieve high ASR across all datasets investigated, demonstrated its wide applicability. In comparison to the baselines, OpenTrigger achieves slightly lower yet comparable attack performance with CTRL, which is the best among all backdoor attacks in our experiments. As expected, the adverage ASR and ACC of OpenTrigger are lower than those of Blend simply because Blend used the same fixed trigger for all victim samples during training and test phase. As a result, the victim model learns the feature of the fixed trigger in Blend better. However, as will be shown later, our proposed OpenTrigger demonstrates much better resilience towards backdoor defenses than Blend does, showcasing the advantage of our trigger planting strategy. Overall, the experimental results indicate the effectiveness of our attack in most settings, rendering it a lightweight and effective backdoor attack.