Long-Tailed Backdoor Attack Using Dynamic Data Augmentation Operations
This addresses a security threat for deep neural networks by extending backdoor attacks to imbalanced data distributions, representing an incremental advance over existing methods focused on balanced datasets.
The paper tackles the problem of backdoor attacks on long-tailed datasets, which are common in real-world scenarios but previously unexplored, and proposes a method called Dynamic Data Augmentation Operation (D²AO) that achieves state-of-the-art attack performance while maintaining clean accuracy.
Recently, backdoor attack has become an increasing security threat to deep neural networks and drawn the attention of researchers. Backdoor attacks exploit vulnerabilities in third-party pretrained models during the training phase, enabling them to behave normally for clean samples and mispredict for samples with specific triggers. Existing backdoor attacks mainly focus on balanced datasets. However, real-world datasets often follow long-tailed distributions. In this paper, for the first time, we explore backdoor attack on such datasets. Specifically, we first analyze the influence of data imbalance on backdoor attack. Based on our analysis, we propose an effective backdoor attack named Dynamic Data Augmentation Operation (D$^2$AO). We design D$^2$AO selectors to select operations depending jointly on the class, sample type (clean vs. backdoored) and sample features. Meanwhile, we develop a trigger generator to generate sample-specific triggers. Through simultaneous optimization of the backdoored model and trigger generator, guided by dynamic data augmentation operation selectors, we achieve significant advancements. Extensive experiments demonstrate that our method can achieve the state-of-the-art attack performance while preserving the clean accuracy.