Invisible Backdoor Attack with Sample-Specific Triggers

Deep learning models have achieved remarkable success across various domains, such as image classification, face recognition, and natural language processing. Early backdoor attacks like BadNets introduced visible triggers, such as white squares, which, although effective, were easily detected. Later, invisible attacks using blending strategies improved stealth but still relied on universal triggers. Current defenses, including pruning, trigger synthesis, and saliency-based detection, assume triggers are sample-agnostic, limiting their effectiveness against more sophisticated attacks. As adversaries develop more covert methods, the security landscape faces new challenges, especially with the advent of information hiding techniques like steganography, which can embed signals imperceptibly into images.

Existing defenses depend heavily on the assumption that triggers are universal and visible, making them vulnerable to sample-specific, invisible triggers. Designing triggers that are both stealthy and resilient against detection remains a critical challenge. The core problem is how to embed unique, imperceptible signals into images that can activate backdoors without raising suspicion or being detected by current defense mechanisms. Achieving high attack success rates while maintaining model performance and avoiding detection is difficult, especially under the constraints of minimal poisoning rates and high stealth requirements.

The paper introduces a novel attack paradigm utilizing steganography to generate sample-specific, invisible triggers. This approach involves training an encoder-decoder network to embed attacker-defined strings into benign images, producing poisoned samples that are indistinguishable from normal images. Unlike traditional triggers, these triggers are unique per sample, greatly enhancing stealth and robustness. The method requires only a small poisoning rate (~10%) to achieve over 99% attack success, with negligible impact on model accuracy. It also effectively bypasses multiple defenses designed for universal triggers, representing a significant advancement in backdoor attack strategies.

• �� Pre-train an encoder-decoder network based on steganography principles, using a benign dataset.
• �� Input normal images and attacker-defined strings into the encoder, generating poisoned images with embedded triggers.
• �� Train the decoder to accurately recover embedded strings, ensuring trigger uniqueness and invisibility.
• �� Poison a subset (~10%) of training data with these images, forming the poisoned dataset.
• �� Train the target model on this dataset using standard training procedures.
• �� During inference, attackers generate sample-specific triggers via the encoder to activate backdoors.
• �� The approach does not require modifications to the model architecture or training loss, making it compatible with existing pipelines.

Experiments utilized ResNet-18 on ImageNet and MS-Celeb-1M, with 10% poisoning. Attack success rates exceeded 99%, with less than 1% accuracy loss. The triggers, generated by a U-Net-based encoder, remained invisible to human inspection. The approach was tested against defenses like Neural Cleanse, STRIP, and SentiNet, showing strong resistance. Ablation studies examined the impact of poisoning rate, trigger invisibility, and robustness under pruning. The training of the encoder-decoder took approximately 7 hours on ImageNet, with encoding times around 0.2 seconds per image. Results confirmed the method's effectiveness and stealthiness across multiple scenarios.

The method achieved >99% attack success rate with only 10% poisoned samples, outperforming traditional triggers. It maintained high benign accuracy (>85%) and demonstrated robustness against detection defenses, including Neural Cleanse and STRIP. The triggers appeared natural and indistinguishable from normal images, making detection difficult. Resistance to pruning and reverse-engineering was validated, with ASR remaining above 95% after pruning 20% of neurons. These results confirm the method's high efficacy, stealth, and robustness, representing a significant step forward in backdoor attack research.

This technique can be exploited in scenarios like third-party model training, cloud-based AI services, and model sharing platforms, where attackers aim to embed covert backdoors. It also highlights the need for developing advanced detection methods capable of identifying sample-specific, invisible triggers. Conversely, defenders can use insights from this work to improve anomaly detection, steganalysis, and model auditing, ensuring AI systems' safety in sensitive applications such as security, finance, and healthcare.

The approach relies on pre-trained steganography networks, which introduce additional training overhead. Its effectiveness may diminish under extreme transformations or adversarial detection techniques. The scalability to larger datasets and more complex models requires further validation. Future work should focus on optimizing encoding efficiency, extending to other data modalities, and developing countermeasures against such covert triggers.