PaperlayerView exact revision on arXiv

Source-linked AI summary

Poison Ink: Robust and Invisible Backdoor Attack

Jie Zhang, Dongdong Chen, Qidong Huang, Jing Liao, Weiming Zhang, Huamin Feng, Gang Hua, Nenghai Yu

arXiv:2108.02488v3cs.CRcs.CV

TL;DR

Existing backdoor attacks may use visible triggers or fail after simple data transformations. Poison Ink carries poison information in image structures and hides the trigger with a deep injection network. The authors report advantages in stealthiness, robustness, generality, and flexibility across their experiments.

  • Problem

    Existing backdoor methods are described as limited by visible triggers and by failures after simple transformations such as flipping or shrinking followed by padding.

    Source: §I · p. 1

  • Method

    Poison Ink embeds poison information in image edges to form a trigger pattern, then uses a deep injection network to hide that pattern in a cover image.

    Source: §I · pp. 1–2

  • Results

    Experiments across datasets, network architectures, and attack scenarios report that Poison Ink outperforms existing methods in stealthiness, robustness, generality, and flexibility.

    Source: §I · p. 2

  • Takeaways & Limitations

    The authors conclude that structure-based triggers and deep injection yield a backdoor attack that is reported to resist many state-of-the-art defenses.

    Source: §VI · p. 13

    The paper's motivation is scoped to existing input-agnostic triggers, whose learned association may be corrupted when preprocessing transforms the trigger image.

    Source: B. Brief Analysis of Existing… · p. 3

Abstract

from arXiv · show

Recent research shows deep neural networks are vulnerable to different types of attacks, such as adversarial attack, data poisoning attack and backdoor attack. Among them, backdoor attack is the most cunning one and can occur in almost every stage of deep learning pipeline. Therefore, backdoor attack has attracted lots of interests from both academia and industry. However, most existing backdoor attack methods are either visible or fragile to some effortless pre-processing such as common data transformations. To address these limitations, we propose a robust and invisible backdoor attack called "Poison Ink". Concretely, we first leverage the image structures as target poisoning areas, and fill them with poison ink (information) to generate the trigger pattern. As the image structure can keep its semantic meaning during the data transformation, such trigger pattern is inherently robust to data transformations. Then we leverage a deep injection network to embed such trigger pattern into the cover image to achieve stealthiness. Compared to existing popular backdoor attack methods, Poison Ink outperforms both in stealthiness and robustness. Through extensive experiments, we demonstrate Poison Ink is not only general to different datasets and network architectures, but also flexible for different attack scenarios. Besides, it also has very strong resistance against many state-of-the-art defense techniques.

I. INTRODUCTION

Existing backdoor attacks can expose visible triggers or lose effectiveness after simple transformations. Poison Ink uses image edges to carry poison information and a deep injection network to hide it, with experiments reporting advantages across several attack dimensions.

I. INTRODUCTION

  • Existing methods are described as limited by visible triggers and by failures after simple transformations such as flipping or shrinking followed by padding.The paper says visible triggers may be recognized by people or visualization methods such as Grad-CAM.Source: §I · p. 1
  • The design requires triggers to be learnable without harming pristine performance, consistent under conventional transformations, and visually indistinguishable from trigger-free images.The latter two requirements target robustness and stealthiness, respectively.Source: §I · p. 1
  • Image edges are proposed as carriers because shallow DNN layers capture structure, while edge information can retain meaning through transformations and is difficult to discover as a high-frequency component.The authors argue that DNN decisions often depend more on texture than structure, which may help preserve original-task performance.Source: §I · p. 1
  • The method embeds poison information in image edges, then uses a deep injection network to hide the input-aware trigger in a cover image before backdoor training.The resulting poisoned images are mixed with clean images as the training set.Source: §I · pp. 1–2
  • Poison Ink is reported to outperform existing methods in stealthiness, robustness, generality, and flexibility across datasets, network architectures, and attack scenarios.The paper also reports strong resistance to many defense techniques.Source: §I · p. 2
  • The authors describe image structures as a novel trigger carrier and identify colorized structures plus deep-network injection as Poison Ink's framework.The contribution list states that extensive experiments demonstrate stealthiness and robustness and that the method applies across datasets and network structures.Source: §I · p. 2

II. RELATED WORK

The related-work section contrasts Poison Ink with prior trigger and defense approaches. The preliminaries frame image classification and describe how poisoned examples are combined with clean data to train an infected model.

A. Backdoor Attack

  • Prior backdoor attacks include patch-based, blended, optimized, and invisible patterns; Poison Ink is characterized as dynamic and invisible, and as input-aware unlike several earlier invisible designs.The paper says LSB substitution fails on low-resolution CIFAR-10 and that Poison Ink outperforms it in robustness to data transformation.Source: A. Backdoor Attack · p. 2

B. Defense against Backdoor Attack

  • Backdoor defenses discussed include data filtering and perturbation methods, trigger localization or reverse engineering, neuron pruning or scanning, activation clustering, and meta-classifiers.The paper notes that some methods rely on impractical assumptions, including full access to infected training data or knowing trigger size.Source: B. Defense against Backdoor Attack · p. 2

III. PRELIMINARIES

  • The preliminaries state that the paper formally defines backdoor attacks, analyzes existing limitations, and specifies its threat model and goals.Source: §III · p. 2

A. Problem Definition

  • For image classification, poisoned examples with target labels are combined with remaining clean examples and labels to form a backdoor training set; the trained model is infected.The injection ratio α is defined as the proportion of the total data that is poisoned.Source: A. Problem Definition · p. 3

B. Brief Analysis of Existing Limitations

The paper attributes shortcomings in existing attacks to input-agnostic triggers and injection strategies that are difficult to adapt to varied inputs. Its threat model permits training-data poisoning and model queries, and focuses on digital-domain attacks.

B. Brief Analysis of Existing Limitations

  • Input-agnostic triggers can lose their learned association with the target label after preprocessing, while hard-pasting or soft-blending can make invisibility difficult across inputs.The authors attribute existing attacks' stealthiness or transformation-robustness limitations to these design choices.Source: B. Brief Analysis of Existing… · p. 3

C. Threat Model and Our Goals

  • The attacker may poison training data and query the trained model but cannot change other training components or manipulate inference; the paper focuses on digital attacks, with physical-world attacks left for future work.The stated goals include preserving clean-data performance, imperceptible poisoned images, and effectiveness under data transformations.Source: C. Threat Model and Our Goals · p. 3

IV. THE PROPOSED POISON INK

Poison Ink encodes poison information in image edges, then uses a deep injection strategy to hide the resulting trigger in cover images. Its design combines input-aware trigger generation with training components intended to preserve trigger extraction while improving invisibility and robustness.

IV. THE PROPOSED POISON INK

  • Poison Ink outlines image structures, embeds poison colors in the edges, and injects the resulting pattern into a clean cover image to create poisoned training images.The trigger set is mixed with clean images for standard backdoor training.Source: §IV · p. 4, A. Trigger Pattern Generation · p. 4

A. Trigger Pattern Generation

  • Edge-based triggers are input-aware and dynamic, with distinct patterns available by changing the encoded colors or edge-extraction method.The paper motivates edges as learnable by shallow model layers, transformation-persistent, and inherently high-frequency.Source: A. Trigger Pattern Generation · p. 4

B. Deep Invisible Injection Strategy

  • The injection network is trained with an auxiliary extractor and an interference layer, which are discarded after training.The interference layer randomly augments poisoned outputs during training to make trigger extraction harder and encourage more robust hiding.Source: B. Deep Invisible Injection Strategy · pp. 4–5
  • The injection network uses an Lp-norm invisibility loss and an adversarial loss that trains a discriminator to distinguish poisoned from clean images.The paper notes that Lp norm is not a perfect invisibility metric; its default is L1 loss.Source: B. Deep Invisible Injection Strategy · p. 4
  • An auxiliary extractor learns to recover the trigger from poisoned images while returning a clean map for trigger-free images.The trigger-extraction and clean losses guide this adversarial training; the clean map indicates no trigger pattern.Source: B. Deep Invisible Injection Strategy · p. 4
  • Training with different poison colors lets the injection network embed varied trigger patterns, supporting single-label or multi-label attacks.The method can use one selected pattern or multiple patterns when attacking a target model.Source: B. Deep Invisible Injection Strategy · p. 5

V. EXPERIMENTS

The experiments evaluate Poison Ink’s invisibility, robustness, generality, flexibility, and resistance to defenses through successive evaluations and ablations.

V. EXPERIMENTS

  • The experiments first describe datasets, network structures, metrics, and default settings.These implementation details establish the evaluation setup.Source: §V · p. 5
  • The paper then evaluates Poison Ink’s invisibility and robustness, followed by its generality and flexibility across structures, datasets, and attack scenarios.Source: §V · p. 5
  • The experiments also test resistance to state-of-the-art defenses, conduct ablations, and state that source code will be released.Source: §V · p. 5

A. Implementation Details.

Implementation uses four datasets and several classifier architectures, with CIFAR-10 and ImageNet serving as the main comparison datasets. The section defines clean-task, attack, and invisibility measures and specifies default training settings.

A. Implementation Details.

  • The evaluation covers CIFAR-10, ImageNet, GTSRB, and VGG-Face across object, traffic-sign, and face-recognition tasks.ImageNet and CIFAR-10 are used mainly for comparisons; GTSRB and VGG-Face demonstrate generality, while CIFAR-10 is used for ablations.Source: A. Implementation Details · p. 5
  • Victim classifiers include ResNet-18, ResNeXt, DenseNet, and VGG-19; clean-task accuracy and attack success rate measure clean and poisoned test performance.VGG-19 is the default classifier, and invisibility is assessed with PSNR, SSIM, LPIPS, and a human-inspection user study.Source: A. Implementation Details · p. 5
  • Default settings use Sobel edges, a 10% pollution rate, the first class as target, and 200 injection-network training epochs.The default trigger color is RGB (80, 160, 80); victim models use SGD with momentum 0.9 and learning-rate drops at epochs 150 and 200.Source: A. Implementation Details · p. 5

B. Invisibility of Poison Ink

Poison Ink’s poisoned images are visually difficult to distinguish from clean images, and its reported invisibility comparisons generally favor it over popular attacks. A user study likewise found its images difficult for participants to identify as poisoned.

B. Invisibility of Poison Ink

  • Poison Ink and LSB produce imperceptible poison, unlike several popular attacks whose poisoned images are visually distinguishable.The comparison includes BadNets, Blend, SIG, Refool, and SPM.Source: B. Invisibility of Poison Ink · pp. 5–6
  • Poison Ink outperforms most attacks on reported invisibility metrics, with LSB the exception; LSB is transformation-fragile and fails on CIFAR-10.The authors also report LSB failing on CIFAR-10 even without transformation preprocessing.Source: B. Invisibility of Poison Ink · p. 6
  • 50% fooling rates for Poison Ink and LSB were close to random guessing, while participants readily identified the other methods’ poisoned images as unclean.The study involved 30 volunteers and 1,500 answers per attack method.Source: B. Invisibility of Poison Ink · p. 6
  • Figure 2 shows visual examples from ImageNet in its first three rows and CIFAR-10 in its last two, with Clean marking trigger-free images.The figure provides a visual comparison of popular attack methods.Source: Figure 2 · p. 7

C. Influence on Pristine Performance

Poison Ink maintains competitive clean-data accuracy while achieving strong robustness to data transformations. Its reported balance between robustness and visual quality contrasts with methods that sacrifice invisibility or generalize poorly across transformations.

C. Influence on Pristine Performance

  • Poison Ink backdoored models have overall higher CDA than other methods and worst-case CDA comparable with them; clean-model accuracy is 80.84% on ImageNet and 91.41% on CIFAR-10.CDA measures clean-data accuracy and reflects preservation of pristine performance during backdoor training.Source: C. Influence on Pristine Performance · p. 7

D. Robustness of Poison Ink

  • Poison Ink achieves higher average- and worst-case ASR than popular attacks under transformations on ImageNet, narrowly surpasses Refool in robustness, and is substantially more stealthy.The radar charts compare visual quality and robustness; the prose reports Poison Ink’s relative performance.Source: D. Robustness of Poison Ink · p. 8, Figure 3 · p. 8
  • The enhanced training strategy can overfit: SPM improves against rotation but fails on other transformations, whereas Poison Ink mitigates this overfitting and has outstanding or comparable CDA and ASR.The comparison trains attacks using transformed training images for robustness.Source: D. Robustness of Poison Ink · pp. 7–8
  • On CIFAR-10, Poison Ink’s transformation robustness is comparable to Blend and SIG, which have worse invisibility.The authors characterize the overall CIFAR-10 robustness as comparable with these existing methods.Source: D. Robustness of Poison Ink · p. 8, Table VII · p. 8

E. Comparison with More Invisible Backdoor Attacks

Against recent invisible attacks, Poison Ink performs well in both stealthiness and robustness, with stronger reported robustness than FTrojan without enhanced training. Experiments also examine its performance across datasets, network architectures, target-label settings, and pollution ratios.

E. Comparison with More Invisible Backdoor Attacks

  • Against Advdoor and WaNet, Poison Ink and FTrojan perform well in both stealthiness and robustness; without enhanced training, Poison Ink’s ASR is 83.67% versus FTrojan’s 59.51%.Advdoor is described as insufficiently stealthy and WaNet as transformation-fragile.Source: E. Comparison with More Invisible… · p. 9, Table VIII · p. 9

F. Generality and Flexibility of Poison Ink

G. Resistance to Defense Techniques

The reported defense evaluations show that Poison Ink can evade several detection and removal approaches, while some defenses retain partial signals such as class-level clustering. The authors report strong attack success after Grad-CAM-based removal and under pruning, alongside failures by other detection methods.

G. Resistance to Defense Techniques

  • After Grad-CAM-based trigger removal, Poison Ink retains ASR of 98.84% on CIFAR-10 and 98.01% on ImageNet.The defense removes the highest-attention region and restores it with the corresponding clean-image region.Source: G. Resistance to Defense Techniques · pp. 10–11, Figure 8 · p. 10
  • STRIP’s entropy distribution for Poison Ink resembles that of the clean model, which the authors interpret as normal, benign-model behavior.STRIP blends inputs with clean images from different classes and compares prediction entropy.Source: G. Resistance to Defense Techniques · p. 11
  • Fine-pruning leaves ASR at 92.6% on ImageNet with 50% pruning and 100% on CIFAR-10 with 90% pruning; ABS fails to detect Poison Ink, while Activation Clustering cannot identify true poisoned images reliably.Activation Clustering reports TPR 0.0002 and FPR 0.984, despite indicating the infected class by silhouette score.Source: G. Resistance to Defense Techniques · p. 11, Figure 9 · p. 11
  • Neural Cleanse stays below its detection threshold on both datasets and returns an empty CIFAR-10 infected label or the wrong ImageNet label; TABOR reports false alarms and takes seven hours per ImageNet label.TABOR’s reported ImageNet Anomaly Index is 2.3125 for Poison Ink and 4.1593 for the clean model.Source: G. Resistance to Defense Techniques · p. 11
  • MESA finds only partially polluted labels and Poison Ink retains high ASR after its removal; TND is evaded, and ULPs classifies the backdoored model as clean even with ten patterns.Activation Clustering also cannot handle the all-label pollution setting described by the authors.Source: G. Resistance to Defense Techniques · p. 11

H. Adaptive Robustness Evaluation

Poison Ink retains attack success under several adaptive defenses, including preprocessing, edge replacement, and adversarial training. Some defenses also reduce clean accuracy, while adversarial training increases the attack success rate in the tested setting.

H. Adaptive Robustness Evaluation

  • Poison Ink keeps relatively high ASR after Gaussian noise, Gaussian blur, Mixup, Cutout, and CutMix preprocessing on ImageNet and CIFAR-10.The reported results are in Table XII; the passage gives no specific values.Source: H. Adaptive Robustness Evaluation · p. 11, Table XII · p. 12
  • RCA-SOC reduces CDA from 92.92% to 11.47%, while Poison Ink retains 77.75% ASR on CIFAR-10.The authors report that Poison Ink’s perturbed pixels are preserved to some extent after filtering.Source: H. Adaptive Robustness Evaluation · p. 11, Figure 11 · p. 12
  • Poison Ink achieves above 55% ASR across the tested edge-extraction and edge-replacement cases.The tests replace detected edge areas with the original clean image or a constant-RGB image; the original image is not practically accessible to a defender.Source: H. Adaptive Robustness Evaluation · p. 12, Table XIII · p. 12
  • On CIFAR-10, Poison Ink’s ASR increases by 6.49% after adversarial training with poison immunity s = 0.75 in the from-scratch scenario.The authors suggest robust-feature learning may help the model learn edge structures better, and say this finding warrants further study.Source: H. Adaptive Robustness Evaluation · pp. 12–13

I. Ablation Study

The ablations show that Poison Ink’s performance depends on its structure-based trigger and injection design, with performance also varying by pollution ratio and loss constraints. The conclusion reports broad advantages over existing methods and identifies frequency-domain backdoors as future work.

I. Ablation Study

  • Replacing the edge structure with an input-agnostic trigger yields only 13.42% ASR on CIFAR-10, even without preprocessing.A comparison with Li et al. [70], an invisible input-specific method that does not consider structure, also fails as expected.Source: §I · p. 13
  • Without the interference layer, ASR under resizing falls from 99.95% to 43.73%.The authors interpret this result as demonstrating the interference layer’s importance.Source: §I · p. 13
  • Across pollution ratios on CIFAR-10, CDA and ASR trade off; Poison Ink performs well in both stealthiness and robustness in most tested cases.The default pollution ratio is 10%, and the comparison uses average CDA and ASR to represent robustness against transformations.Source: §I · p. 13
  • At a 1% pollution ratio, Poison Ink fails under the stated threat model; controlling training strategy or pretraining on trigger images enables above 90% ASR.Under the same 1% ratio and threat model, WaNet and FTrojan also have low ASR: 10.83% and 10.92%, respectively.Source: §I · p. 13
  • Appending adversarial loss after invisibility loss slightly improves image quality, while using only adversarial loss causes poor image quality.The authors say adopting or discarding adversarial loss is flexible and depends on the desired balance between stealthiness and robustness.Source: §I · p. 13

VI. CONCLUSION

  • Poison Ink uses image structure to carry poison information and a deep injection network to hide triggers in cover images; experiments report advantages in stealthiness, robustness, generality, and flexibility.The conclusion also reports resistance to many state-of-the-art defenses.Source: §VI · pp. 13–14
  • Exploring backdoor attacks in the frequency domain is left for future work.Source: §VI · p. 14
Loading 2108.02488v3…