SEABA: Sample-Edge-Adaptive Backdoor Attack with Robustness and Invisibility

Backdoor attacks pose significant security threats to deep neural networks. A backdoored model performs well on benign samples, but if the hidden backdoor is activated by a trigger defined by the attacker, the model's predictions will be maliciously altered. Existing backdoor attacks typically adopt a trigger-agnostic setup, where different poisoned samples in the backdoor attack methods contain the same trigger, which is usually visible or fragile. To address these limitations, we propose a sample-specific, sample-edge-adaptive backdoor attack method. Specifically, we utilize edge detection algorithms to identify edge structures in images as the target poisoning region, embedding the edge information into the least significant bits of the image using a steganographic method. This generates a sample-specific trigger pattern. Since image structure retains its semantic meaning during data transformation, this trigger pattern exhibits inherent robustness to data conversion. Our proposed attack is extensively evaluated across various network models and datasets, demonstrating its generalizability, superior stealthiness, better robustness compared to existing backdoor attack methods, and strong resistance against state-of-the-art defense techniques while maintaining high benign accuracy.