BAIT: A New DNN Backdoor Attack Using Inpainted Triggers

Backdoor attacks compromise deep neural networks by injecting them with covert, malicious behaviors during training. A backdoor can then be activated at test-time using a trigger pattern. As backdoors become more sophisticated, defenses struggle to catch up. This paper introduces a simple yet effective input-specific Backdoor Attack using Inpainted Triggers, dubbed BAIT. Its trigger relies on a randomly-drawn polygonal patch, filled via inpainting with an off-the-shelf generative adversarial network. We show with BAIT that several defenses, including common test-time input purification methods, can be bypassed by patch-based backdoors. To counter this new attack, we propose four defense recommendations.