English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Currently, sample-specific backdoor attacks (SSBAs) are the most advanced andmalicious methods since they can easily circumvent most of the current backdoordefenses. In this paper, we reveal that SSBAs are not sufficiently stealthy dueto their poisoned-label nature, where users can discover anomalies if theycheck the image-label relationship. In particular, we demonstrate that it isineffective to directly generalize existing SSBAs to their clean-label variantsby poisoning samples solely from the target class. We reveal that it isprimarily due to two reasons, including \textbf{(1)} the `antagonistic effects'of ground-truth features and \textbf{(2)} the learning difficulty ofsample-specific features. Accordingly, trigger-related features of existingSSBAs cannot be effectively learned under the clean-label setting due to theirmild trigger intensity required for ensuring stealthiness. We argue that theintensity constraint of existing SSBAs is mostly because their trigger patternsare `content-irrelevant' and therefore act as `noises' for both humans andDNNs. Motivated by this understanding, we propose to exploit content-relevantfeatures, $a.k.a.$ (human-relied) attributes, as the trigger patterns to designclean-label SSBAs. This new attack paradigm is dubbed backdoor attack withattribute trigger (BAAT). Extensive experiments are conducted on benchmarkdatasets, which verify the effectiveness of our BAAT and its resistance toexisting defenses.

Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Trigger