An Invisible Backdoor Attack Based on Semantic Feature

Backdoor attacks have severely threatened deep neural network (DNN) models in the past several years. Compared to adversarial attacks, backdoor attacks are always carried out during the training phase. The attacked model behaves normally on benign samples, it makes wrong predictions for samples containing triggers. This paper proposes a novel backdoor attack that makes imperceptible changes. Concretely, the attack first utilizes the pre-trained victim model to extract low-level and high-level semantic features from clean images and generates trigger patterns associated with high-level features based on channel attention. Then, the encoder model generates poisoned images based on the trigger and extracted low-level semantic features without causing noticeable feature loss. The attack is evaluated on two prominent image classification DNNs across three standard datasets. The results demonstrate that our attack achieves high attack success rates while maintaining robustness against backdoor defenses. Furthermore, extensive image similarity experiments emphasize the stealthiness of this attack strategy.