Composite Trigger Backdoor Attack Combining Visual and Textual Features

A backdoor attack refers to an attack covertly poisoning the dataset,subtly inducing the victim model to associate the poisoned data with a target label,thereby posing a threat to the trustworthiness and security of artificial intelligence technologies.Existing backdoor attack methods generally face a trade-off between effectiveness and stealthiness.Triggers with high effectiveness tend to lack stealthiness,while those with good stealthiness tend to have weak effectiveness.To address this issue,this paper proposes a composite trigger for clean-label backdoor attack,which combines visual and textual features.The composite trigger is composed of two learnable triggers:a universal part and an individual part.During the design and optimization of the composite trigger,pixel values within patches are constrained to follow a congruence rule.This constraint aims to induce the victim model to capture the congruence,thereby establishing an association between the trigger and the target label,forming a backdoor.The universal trigger ensures that pixel values within patches of poisoned images are congruent modulo 2,maintaining a fixed signal pattern across all poisoned images.The individual trigger,on the other hand,ensures that edge pixel values of poisoned images are congruent with respect to the weight of the LoSB,rendering its signal specific to the edge positions of each image.The two parts of the trigger are integrated to balance both effectiveness and stealthiness.Building on this,this paper introduces the CLIP model,which combines visual and textual features to construct the supervisory signal for training the composite trigger.The pre-trained CLIP model has strong generalization capabilities,enabling the composite trigger to absorb disparate textual features,which helps diminish the image content features and further enhances the trigger’s effectiveness.Experiments are conducted on three datasets:CIFAR-10,ImageNet,and GTSRB.The results show that the proposed method can evade detection by backdoor defense techniques and outperforms the second-best method by an average of 2.48 percentage points in terms of attack success rate.Additionally,it surpasses the second-best method by an average of 10.61%,0.31%,68.44%,and 46.38% in peak signal-to-noise ratio(PSNR),structural similarity index(SSIM),gradient magnitude similarity deviation(GMSD),and learned perceptual image patch similarity(LPIPS),respectively.The results of the ablation experiments demonstrate the advantage of combining visual and textual features in guiding the training of the composite trigger.These results also validate the roles of both the universal and individual triggers in enhancing the effectiveness and stealthiness of the backdoor attack.