Source-linked AI summary
Clean-Label Backdoor Attacks on Video Recognition Models
Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, Yu-Gang Jiang
TL;DR
Existing image backdoor attacks are substantially less effective for video recognition under high-dimensional, high-resolution, sparse-data, and clean-label conditions. The paper proposes a universal adversarial trigger with adversarial perturbations and reports high-success-rate attacks using limited clean-label poisoning, while also finding resistance to existing detection methods and applicability to image attacks.
Problem
Existing backdoor attacks have been studied mostly for image classification, while their effectiveness under demanding video and clean-label conditions is limited.
Method
The paper uses a universal adversarial trigger and two adversarial perturbations to poison video training data without changing labels.
Results
The proposed attack manipulates state-of-the-art video models with high success rates using a small proportion of poisoned training data and resists existing detection methods to some extent.
Takeaways & Limitations
The attack provides a baseline for studying and improving robustness of video models and offers a perspective on stronger backdoor attacks.
Takeaways & Limitations
The threat model assumes knowledge of the user's network architecture and access to training data, but not other training-procedure configuration.
Abstract
from arXiv · showhide
Deep neural networks (DNNs) are vulnerable to backdoor attacks which can hide backdoor triggers in DNNs by poisoning training data. A backdoored model behaves normally on clean test images, yet consistently predicts a particular target class for any test examples that contain the trigger pattern. As such, backdoor attacks are hard to detect, and have raised severe security concerns in real-world applications. Thus far, backdoor research has mostly been conducted in the image domain with image classification models. In this paper, we show that existing image backdoor attacks are far less effective on videos, and outline 4 strict conditions where existing attacks are likely to fail: 1) scenarios with more input dimensions (eg. videos), 2) scenarios with high resolution, 3) scenarios with a large number of classes and few examples per class (a "sparse dataset"), and 4) attacks with access to correct labels (eg. clean-label attacks). We propose the use of a universal adversarial trigger as the backdoor trigger to attack video recognition models, a situation where backdoor attacks are likely to be challenged by the above 4 strict conditions. We show on benchmark video datasets that our proposed backdoor attack can manipulate state-of-the-art video models with high success rates by poisoning only a small proportion of training data (without changing the labels). We also show that our proposed backdoor attack is resistant to state-of-the-art backdoor defense/detection methods, and can even be applied to improve image backdoor attacks. Our proposed video backdoor attack not only serves as a strong baseline for improving the robustness of video models, but also provides a new perspective for more understanding more powerful backdoor attacks.
1. Introduction
The paper examines why clean-label backdoor attacks developed for images struggle on videos and proposes a universal adversarial trigger to address these conditions. It reports stronger video attacks while preserving clean labels and challenging existing detection methods.
- Motivation: Backdoor attacks implant a trigger during training so models predict a target class when the trigger appears, while remaining normal on clean inputs.This hidden training-time link makes backdoor attacks particularly difficult to detect.
- Motivation: Clean-label attacks leave training labels unchanged, making them more stealthy and resistant to filtering or detection than poison-label attacks.The paper studies this setting for video recognition, where prior work has focused mainly on image classification.
- Limitations of Existing Attacks: Existing attacks are challenged by four conditions: more input dimensions, high resolution, sparse datasets, and access to correct labels.On UCF-101, where all four conditions hold, Turner et al.'s attack reaches only 1.1% attack success rate.
- Proposed Approach: The proposed method uses a universal adversarial trigger generated to reduce classification loss from non-target classes toward the target class.Adversarial perturbation is also applied to target images so the model focuses more on the trigger pattern.
- Results: 82.2% attack success rate is achieved with the same poisoning rate and trigger size as the comparison attack.The attack is demonstrated against state-of-the-art video models on benchmark datasets without changing labels.
- Results: The video attack cannot be completely avoided by existing backdoor detection methods and can generally improve attacks on image models.The paper presents these findings as extensions of its video backdoor attack.
2. Related work
The related work covers backdoor attack types, representative image attacks and defenses, and video recognition architectures. It distinguishes label-changing and clean-label poisoning while introducing the model families relevant to video recognition.
- Backdoor Attacks: Backdoor attacks poison training data with trigger patterns so trained models make incorrect predictions whenever the trigger appears.Poison-label attacks change poisoned-example labels, whereas clean-label attacks leave labels unchanged.
- Backdoor Attacks: BadNets associates a trigger with a target class by inserting patterns into selected training images and changing their labels to that class.The attack typically selects poisoned images from non-target classes.
- Backdoor Defenses: Backdoor defenses include data augmentation, feature-based poisoned-example detection, spectral signatures, and Neural Cleanse trigger reversal.Neural Cleanse uses gradient information and median absolute deviation to detect anomalously small reconstructed triggers.
- Video Recognition Models: I3D learns spatial-temporal information directly from videos, while CNN+LSTM combines CNN spatial representations with LSTM temporal modeling.These architectures represent the state-of-the-art video recognition models discussed in the paper.
3. Proposed Video Backdoor Attack
The attack combines a task-specific universal adversarial trigger with adversarially perturbed videos, then uses triggered videos for clean-label poisoning and triggered test videos for inference. Two perturbation strategies weaken original video features or redirect predictions so models learn the trigger more strongly.
- The pipeline generates a universal adversarial trigger, perturbs target-class videos, injects the trigger into those videos for poisoning, and reapplies it during inference.The three stages are trigger generation, adversarial perturbation, and poisoning/inference.
- The trigger is optimized on non-target videos relabeled to the target class, minimizing cross-entropy so one pattern induces target-class predictions across videos.The same trigger pattern is optimized across non-target videos using a clean-trained model.
- The trigger is initialized in a bottom-right video region and iteratively updated across videos from all non-target classes.The trigger area is randomly initialized while other regions are masked off, then updated across samples.
- Uniform adversarial perturbation weakens natural features by pushing outputs toward a uniform distribution, making the trigger more salient to the model.The perturbed sample is formed as x + η, with η obtained by maximizing the selected loss under an ℓ∞ constraint.
- Targeted adversarial perturbation can switch predictions toward another class with overconfident outputs, giving perturbed videos a strong deep-feature pattern and encouraging trigger learning.The method applies this perturbation to target-class videos before patching them with the universal trigger.
- Poisoned videos combine the generated trigger with perturbed target-class samples, while triggered test videos are intended to make the trained model output the target class.The trigger supplies task-specific information, and the perturbations interfere with original target-video features.
4. Experiments
Experiments evaluate the proposed attack on benchmark video models, varying triggers, poisoning rates, perturbations, modalities, and defenses. The universal adversarial trigger generally outperforms baselines, while optical flow and excessive poisoning constrain performance.
- Experimental Settings: Experiments use UCF-101 and HMDB-51 with I3D and CNN+LSTM video-recognition models, evaluating attack success rate as the fraction redirected to the target class.I3D uses 64 sampled frames and CNN+LSTM subsamples one of every five frames; clean-model test accuracy is reported separately.
- Effectiveness of Our Approach: 61.2% attack success occurs with a 16 × 16 trigger, rising to 93.7% at 28 × 28 against I3D on UCF-101.The 16 × 16 trigger covers 0.005% of the total image area; larger triggers improve success but reduce stealthiness.
- Effectiveness of Our Approach: Attack success exceeds 60% for poisoning percentages from 20% to 70%, then drops sharply outside this range and approaches 0% at 100%.The authors attribute excessive-poisoning degradation to losing clean target-class videos and learning alternative salient features.
- Ablation Study: Universal adversarial triggers substantially outperform fixed static and randomly sampled triggers, while targeted and uniform perturbations improve success by about 10%–20%.Targeted perturbation is more effective on UCF-101, whereas uniform perturbation is more effective on HMDB-51.
- Attacking Two-stream Video Models: Optical flow reduces attack success to 15.2%, compared with 68.5% for RGB and 54.7% for the fused two-stream network.The degradation is attributed to limited transfer of the RGB-generated trigger into the independent optical-flow space.
- Improving Image Backdoor Attacks: The attack remains effective on VOC2012's sparse, high-resolution image setting and reaches 56.3% success with video data augmentation.Neural Cleans fails to detect the attacked I3D model, reporting an anomaly index below 2.
5. Conclusion
The paper studies backdoor attacks on video recognition models and proposes a universal adversarial trigger with adversarial perturbations to address conditions where existing attacks are likely to fail.
- 5. Conclusion: Existing backdoor attacks are likely to fail under four strict conditions posed by video recognition settings.These conditions involve input dimensions, resolution, dataset sparsity, and clean-label access to correct labels.
- 5. Conclusion: The proposed attack combines a universal adversarial trigger with two types of adversarial perturbation for video models.
- 5. Conclusion: The attack achieves high success rates on benchmark video datasets while poisoning only a small proportion of training data.
- 5. Conclusion: The attack shows some resistance to state-of-the-art backdoor detection methods and can also improve image backdoor attacks.
- 5. Conclusion: The proposed video backdoor attack provides a baseline for improving video-model robustness and a perspective on more powerful backdoor attacks.