In recent years, self-supervised models trained on large-scale unlabeled data have garnered extensive research attention, leading to in-depth studies on backdoor attacks against these models. Such attacks enable the backdoored model to perform well on normal samples while executing malicious behaviors on samples embedded with triggers. Existing research on backdoor attacks typically requires access to the original dataset to inject backdoors, which is often difficult to achieve in real-world scenarios. In this paper, we propose a data-free backdoor attack method. We construct an attack dataset by collecting data samples and employing dataset purification techniques to eliminate redundancy, thereby improving injection efficiency. Additionally, we design a loss function that ensures effective backdoor injection while maintaining performance on normal tasks, achieving the desired goals of stealthiness and effectiveness outlined in this paper. We conducted extensive experimental evaluations across four different self-supervised models (such as MoCo v2, MSF, SimCLR, and BYOL) for image classification tasks. The results demonstrate that our proposed method effectively injects backdoors while ensuring normal performance of the model, even without access to the original dataset.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A Data-Free Backdoor Attack Approach in Self-supervised Models

  • Li Ma,
  • Zhenghao Yu,
  • Wenyin Yang,
  • Sipei Wu,
  • Meifang Xie,
  • Baoyao Yang,
  • Chunrong Lai

摘要

In recent years, self-supervised models trained on large-scale unlabeled data have garnered extensive research attention, leading to in-depth studies on backdoor attacks against these models. Such attacks enable the backdoored model to perform well on normal samples while executing malicious behaviors on samples embedded with triggers. Existing research on backdoor attacks typically requires access to the original dataset to inject backdoors, which is often difficult to achieve in real-world scenarios. In this paper, we propose a data-free backdoor attack method. We construct an attack dataset by collecting data samples and employing dataset purification techniques to eliminate redundancy, thereby improving injection efficiency. Additionally, we design a loss function that ensures effective backdoor injection while maintaining performance on normal tasks, achieving the desired goals of stealthiness and effectiveness outlined in this paper. We conducted extensive experimental evaluations across four different self-supervised models (such as MoCo v2, MSF, SimCLR, and BYOL) for image classification tasks. The results demonstrate that our proposed method effectively injects backdoors while ensuring normal performance of the model, even without access to the original dataset.