Source-linked AI summary
Backdoor Attacks on Self-Supervised Learning
Aniruddha Saha, Ajinkya Tejankar, Soroush Abbasi Koohpayegani, Hamed Pirsiavash
TL;DR
Large-scale unlabeled datasets can contain poisons that are difficult to inspect, raising questions about whether self-supervised models trained on them can be trusted. This paper studies a trigger-based attack and a knowledge-distillation defense, reporting successful attacks with 0.5% poisoning and reduced backdoor effects after distillation on clean unlabeled data.
Problem
Method
The attack poisons images from a target category with a trigger, trains an SSL model, and transfers its features to a downstream classifier; the defense distills that model using clean unlabeled data.
Source: §1 · p. 2, §3.1 · p. 4Results
Poisoning 0.5% of unlabeled training data backdoors MoCo v2, BYOL, or MSF to detect the target category when the trigger is presented at test time.
Source: §1 · p. 2Takeaways & Limitations
The findings show that exemplar-based SSL models can be vulnerable to trigger-based targeted attacks, while knowledge distillation using some clean unlabeled data can reduce their effect.
Source: §1 · p. 2, §6 · p. 8The attack does not succeed at poisoning rates below 0.05%, and the defense requires clean data whose amount affects overall accuracy.
Source: §6 · p. 8
Abstract
from arXiv · showhide
Large-scale unlabeled data has spurred recent progress in self-supervised learning methods that learn rich visual representations. State-of-the-art self-supervised methods for learning representations from images (e.g., MoCo, BYOL, MSF) use an inductive bias that random augmentations (e.g., random crops) of an image should produce similar embeddings. We show that such methods are vulnerable to backdoor attacks - where an attacker poisons a small part of the unlabeled data by adding a trigger (image patch chosen by the attacker) to the images. The model performance is good on clean test images, but the attacker can manipulate the decision of the model by showing the trigger at test time. Backdoor attacks have been studied extensively in supervised learning and to the best of our knowledge, we are the first to study them for self-supervised learning. Backdoor attacks are more practical in self-supervised learning, since the use of large unlabeled data makes data inspection to remove poisons prohibitive. We show that in our targeted attack, the attacker can produce many false positives for the target category by using the trigger at test time. We also propose a defense method based on knowledge distillation that succeeds in neutralizing the attack. Our code is available here: https://github.com/UMBCvision/SSL-Backdoor .
1. Introduction
The introduction frames uncurated, large-scale unlabeled data as difficult to inspect and asks whether exemplar-based self-supervised learning can be backdoored. It presents a trigger-based attack and knowledge-distillation mitigation, while noting that one-view-only trigger exposure did not make the attack work.
1. Introduction
- Uncurated, large-scale unlabeled data can be difficult to inspect, so poisoned images may go unnoticed in self-supervised training datasets.The authors note that inspecting the one billion random, unlabeled Instagram images used for SEER would be comparable in cost to annotating the full dataset.Source: §1 · pp. 1–2
- Controlled experiments found no evidence that one-view-only trigger visibility explains the attack; the attack did not work under that condition.The introduction distinguishes this tested condition from the authors’ proposed trigger-association explanation.Source: §1 · p. 2
- The proposed mechanism is that a rigid trigger co-occurring only with the target category becomes an easily learned cue associated with that category.The authors hypothesize that pulling embeddings of augmented views together supports learning an implicit trigger detector.Source: Figure 1 · p. 1, §1 · p. 2
- Poisoning 0.5% of unlabeled training data backdoors MoCo v2, BYOL, or MSF to detect the target category when the trigger appears at test time.The authors also report that knowledge distillation using some clean unlabeled data successfully neutralizes the backdoor.Source: §1 · p. 2
2. Related Work
Related work describes self-supervised pretext tasks and exemplar-based learning, then situates the paper among studies of backdoor attacks and defenses. It identifies limited analysis of augmentation-driven feature selection under competing features as motivation for examining attacks on exemplar-based methods.
Self supervised learning
- Self-supervised learning combines a pretext task, which extracts supervision automatically from data, with a loss function.Image pretext tasks include Jigsaw’s spatial-order prediction and RotNet’s rotation-angle prediction [31] [14].Source: §2 · p. 2
- Exemplar-based methods use augmented views for instance discrimination; MoCo and SimCLR combine it with contrastive loss [3] [5] [23], while BYOL and SimSiam do not use contrastive loss directly [6].MSF extends BYOL by also pulling a data point toward nearest neighbors of its augmentation.Source: §2 · pp. 2–3
- Prior work found it difficult to predict which competing feature augmentation-driven methods favor [4], while analysis of possible downstream harms was limited.The paper asks whether exemplar-based methods are brittle to adversarial poisoning; it also notes concurrent backdoor studies [2] and [24].Source: §2 · p. 3
Backdoor attacks; Defense for backdoor attacks
- Supervised backdoor attacks can preserve clean-data behavior while causing trigger-conditioned misclassification, and defenses include filtering, detection, sanitization, and clean-data distillation.The paper adapts knowledge distillation for SSL using CompRess [1], following prior work on clean-data distillation as a backdoor defense.Source: §2 · p. 3
3. Threat Model
The threat model places poisoned images in uncurated public data scraped for self-supervised training, without requiring the attacker to control model training. The targeted attack poisons one category, transfers learned features to a downstream classifier, and uses a test-time trigger to induce target predictions.
3. Threat Model
- Web-scraped public images may contain adversarially planted poisons because self-supervised datasets are not scrutinized before training.The threat arises alongside the ability to train visual features without annotations and scale datasets using public images.Source: §3 · p. 3
- The attacker releases poisoned images to public websites and relies on some being scraped into a large, uncurated unlabeled training dataset, without needing model or training details.The attacker has no control over SSL training; coordinated adversaries could release more poisons.Source: §3 · p. 3
3.1. Targeted Backdoor Attack
- The targeted attack adds a chosen patch to images from one category, pretrains an SSL model on the poisoned dataset, and transfers its features to a downstream linear classifier.On clean test data the classifier performs well; patched inputs are predicted as the target class.Source: §3.1 · pp. 3–4
- The authors hypothesize that exemplar-based methods associate a rigid, target-only trigger with the target category, whereas Jigsaw and RotNet may avoid this association because they do not pull augmented views together.The authors present robustness of Jigsaw and RotNet as an expectation, not as an established mechanism here.Source: §3.1 · p. 4
4. Defense
The defense section contrasts older self-supervised methods with exemplar-based approaches and proposes distilling a backdoored SSL model on clean unlabeled data. It uses CompRess to match teacher and student neighborhood-similarity distributions.
4. Defense
- The targeted attack is not effective on Jigsaw and RotNet, but these older methods have much lower accuracy than exemplar-based methods.The authors present these methods as a possible alternative based on their hypothesis about augmentation-view similarity.Source: §4 · p. 4
- The proposed defense distills the backdoored model into a student using a small clean unlabeled dataset, which never exposes the student to the trigger.The authors expect this to prevent the student from learning the trigger-target association.Source: §4 · p. 4
- CompRess trains the student to match the teacher’s neighborhood-similarity distributions over anchor images by minimizing their KL-divergence.The paper uses its 1q variant, which computes both distributions with respect to teacher embeddings of the anchor points.Source: §4 · p. 4
5. Experiments
The experiments test backdoor attacks across self-supervised methods, poisoning rates, and attack settings, then assess distillation as a defense. Targeted attacks raise target-class false positives in several methods, while the results vary by method and poisoning setup; clean-data distillation reduces the backdoor effect.
5.1. Targeted attack on ImageNet-100
- 461, 1,442, and 830 average target-class false positives were reported for backdoored MoCo v2, BYOL, and MSF, versus 58 and 63 for Jigsaw and RotNet.The experiments used 0.5% poison injection; the same broad method pattern was observed with linear classifiers trained on 10% of ImageNet-100, and MAE false positives rose from 13 to 82.Source: §5.1 · pp. 5–6, Table 1 · p. 5, Table 2 · p. 6
5.6. Defense
- Distilling poisoned MoCo v2 with 25% clean ImageNet-100 reduced average false positives from 1,683.2 to 37.9, with a 5% clean-data accuracy drop.Clean-data accuracy degraded as the amount of distillation data decreased.Source: Table 5 · p. 6, §5.6 · pp. 7–8
5.2. Ablation on poison injection rate
- At 1% poison injection, MoCo v2 had 1,683.2 target-class false positives, while attack success diminished as poisoning fell and was nearly at clean-model levels at 0.05%.The authors note that larger unlabeled datasets could still contain hundreds of target-category poisons at low overall injection rates.Source: §5.2 · pp. 6–7, Figure 3 · p. 7
5.3. Analysis by controlling trigger occurrence
- Controlled experiments found that limiting the trigger to one view did not produce an attack as strong as the authors’ method.The tested controls paired one poisoned and one clean view, and also used poisoned views from random categories.Source: Table 4 · p. 6, §5.3 · p. 7
5.4. Targeted attack on ImageNet-1k
- At a 0.1% poison rate on ImageNet-1k, the single-target attack produced false positives in semantically similar classes as well as the target class.For a Rottweiler target, the top five false-positive classes included other dog breeds.Source: §5.4 · p. 7, Table 6 · p. 7
- With a cat superclass formed from ten WordNet hyponyms, five of the ten top false-positive classes were cat types.The three leading classes were Egyptian cat (1538), tabby cat (608), and tiger cat (561).Source: §5.4 · p. 7
5.5. Untargeted attack on ImageNet-100
- Poisoning 5% of random ImageNet-100 training images reduced overall accuracy by almost five points in the untargeted attack.The authors suggest the patch is not strongly associated with a single category when it appears across varied categories.Source: Table 3 · p. 6, §5.5 · p. 7
5.7. Feature space visualization
- In the targeted-attack embedding visualization, patched images clustered near the target category for the backdoored model but spread more uniformly for the clean model.The authors interpret this as support for patched images moving closer to the target category in embedding space, increasing target-class false positives.Source: §5.7 · p. 8
6. Conclusion
The paper introduces backdoor attacks for self-supervised learning, reports targeted false positives from test-time triggers, and proposes knowledge distillation as a defense. It also notes limits on very low poisoning rates and on the clean data available for defense.
6. Conclusion
- The attack can produce many targeted false positives at test time, and knowledge distillation using some clean data reduces its effect.The authors hypothesize that the attack exploits an inductive bias present in many state-of-the-art SSL methods.Source: §6 · p. 8
- The attack does not succeed at poisoning rates below 0.05%, while the defense needs clean data and is sensitive to how much is available.A substantial reduction in clean data decreases the distilled model's overall accuracy.Source: §6 · p. 8
- The authors warn that backdoored SSL models used in safety-critical applications might cause accidents or open security vulnerabilities.They also note that malicious entities could use the attack to gain backdoor access to deep learning models.Source: §6 · p. 8
Appendix
The appendix provides visualizations of targeted false positives and embeddings, alongside a table comparing attack outcomes across SSL methods.
Appendix
- Figures A1 and A2 show images classified correctly without a trigger but assigned to the target category when patched, for targeted MoCo v2 and BYOL attacks.These figures show false positives for each method's targeted attack.Source: Figure A1 · p. 11, Figure A2 · p. 11
- In the t-SNE plots, patched-image embeddings cluster near clean target-category images for backdoored BYOL and MSF models, while clean-model patches are spread out.The figure marks clean target images as purple circles and patched validation images as black triangles.Source: Figure A3 · p. 12
- On average, patched validation false positives increase substantially for MoCo v2, BYOL, and MSF, but not much for Jigsaw and RotNet.Table A1 reports targeted attacks with a 0.5% poison injection rate and linear classifiers trained on 10% of ImageNet-100.Source: Table A1 · p. 13
A. Experiment Details for Reproducibility
The reproducibility details specify training and linear-evaluation configurations for MoCo v2, BYOL, MSF, Jigsaw, and RotNet, and finetuning settings for MAE.
MoCo v2 and BYOL
- MoCo v2 and BYOL models are trained for 200 epochs with their standard augmentation sets, using different optimizers, batch sizes, and hardware configurations.Both use embedding size 128; MoCo v2 uses SGD with batch size 256 on two RTX 2080 Ti GPUs, while BYOL uses Adam with batch size 512 on four such GPUs.Source: A. Experiment Details for… · p. 14
MSF
- MSF uses a 1024-dimensional hidden layer, a 128-dimensional projection layer, a 128k memory bank, and 10 nearest neighbours.It is trained for 200 epochs with batch size 256 on two RTX 2080 Ti GPUs.Source: A. Experiment Details for… · p. 14
Jigsaw and RotNet
- Jigsaw uses a 2000-size permutation set, while RotNet uses four rotation angles; both models are trained for 105 epochs.The passages specify their optimizers and learning-rate schedules; RotNet's linear classifier uses Nesterov SGD and decays its learning rate at epochs 5, 15, 25, and 35.Source: A. Experiment Details for… · p. 14
MAE
- MAE uses ViT-B with 16×16 input patches, a 0.75 mask ratio, and 800 training epochs, followed by 100 epochs of finetuning.Training uses 40 warm-up epochs and eight TITAN RTX GPUs; the finetuning settings include layer decay 0.65 and drop path 0.1.Source: A. Experiment Details for… · p. 14