LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioning
This work addresses security vulnerabilities in deep learning systems by proposing a more evasive and resilient backdoor attack, which is incremental as it builds on existing sample-specific trigger methods.
The paper tackles the problem of backdoor attacks in deep learning being detectable and mitigatable by introducing LOTUS, a method that partitions the victim class and uses unique triggers per partition, achieving high attack success rates across multiple datasets and models while evading numerous detection techniques.
Backdoor attack poses a significant security threat to Deep Learning applications. Existing attacks are often not evasive to established backdoor detection techniques. This susceptibility primarily stems from the fact that these attacks typically leverage a universal trigger pattern or transformation function, such that the trigger can cause misclassification for any input. In response to this, recent papers have introduced attacks using sample-specific invisible triggers crafted through special transformation functions. While these approaches manage to evade detection to some extent, they reveal vulnerability to existing backdoor mitigation techniques. To address and enhance both evasiveness and resilience, we introduce a novel backdoor attack LOTUS. Specifically, it leverages a secret function to separate samples in the victim class into a set of partitions and applies unique triggers to different partitions. Furthermore, LOTUS incorporates an effective trigger focusing mechanism, ensuring only the trigger corresponding to the partition can induce the backdoor behavior. Extensive experimental results show that LOTUS can achieve high attack success rate across 4 datasets and 7 model structures, and effectively evading 13 backdoor detection and mitigation techniques. The code is available at https://github.com/Megum1/LOTUS.