RECORD
Stealthy Targeted Backdoor Attacks against Image Captioning
Cryptography and Security · Submitted 9 Jun 2024
abstract compiled · 2026-09-23 · no language-model review
The authors' main claim In addition, we show our method is stealthy in that the produced backdoor samples are indistinguishable from clean samples in both image and text domains, which can successfully bypass existing backdoor defenses, highlighting the need for better defensive mechanisms against such stealthy backdoor attacks.
The compiled record
The paper's own sentences, arranged. Each label is drawn from a closed vocabulary; the number beside it is the probability the classifier gave that label. Numbers in the tables are the authors', checked by code. No sentence in this record was written by a model.
Open the compiled record
The abstract, sentence by sentence
In recent years, there has been an explosive growth in multimodal learning. Image captioning, a classical multimodal task, has demonstrated promising applications and attracted extensive research attention. However, recent studies have shown that image caption models are vulnerable to some security threats such as backdoor attacks. Existing backdoor attacks against image captioning typically pair a trigger either with a predefined sentence or a single word as the targeted output, yet they are unrelated to the image content, making them easily noticeable as anomalies by humans. In this paper, we present a novel method to craft targeted backdoor attacks against image caption models, which are designed to be stealthier than prior attacks. Specifically, our method first learns a special trigger by leveraging universal perturbation techniques for object detection, then places the learned trigger in the center of some specific source object and modifies the corresponding object name in the output caption to a predefined target name. During the prediction phase, the caption produced by the backdoored model for input images with the trigger can accurately convey the semantic information of the rest of the whole image, while incorrectly recognizing the source object as the predefined target. Extensive experiments demonstrate that our approach can achieve a high attack success rate while having a negligible impact on model clean performance. In addition, we show our method is stealthy in that the produced backdoor samples are indistinguishable from clean samples in both image and text domains, which can successfully bypass existing backdoor defenses, highlighting the need for better defensive mechanisms against such stealthy backdoor attacks.
background contribution method result interpretation main claim
| # | sentence | role | the authors' own work | states the main conclusion | strength |
|---|---|---|---|---|---|
| s0 | In recent years, there has been an explosive growth in multimodal learning. | background 1.00 | 0.03 | 0.01 | asserted 1.00 |
| s1 | Image captioning, a classical multimodal task, has demonstrated promising applications and attracted extensive research attention. | background 1.00 | 0.04 | 0.01 | asserted 1.00 |
| s2 | However, recent studies have shown that image caption models are vulnerable to some security threats such as backdoor attacks. | background 0.96 | 0.03 | 0.03 | asserted 1.00 |
| s3 | Existing backdoor attacks against image captioning typically pair a trigger either with a predefined sentence or a single word as the targeted output, yet they are unrelated to the image content, making them easily noticeable as anomalies by humans. | gap 0.87 | 0.05 | 0.03 | asserted 1.00 |
| s4 | In this paper, we present a novel method to craft targeted backdoor attacks against image caption models, which are designed to be stealthier than prior attacks. | contribution 1.00 | 0.87 | 0.16 | asserted 1.00 |
| s5 | Specifically, our method first learns a special trigger by leveraging universal perturbation techniques for object detection, then places the learned trigger in the center of some specific source object and modifies the corresponding object name in the output caption to a predefined target name. | method 1.00 | 0.93 | 0.06 | asserted 0.99 |
| s6 | During the prediction phase, the caption produced by the backdoored model for input images with the trigger can accurately convey the semantic information of the rest of the whole image, while incorrectly recognizing the source object as the predefined target. | method 0.71 | 0.82 | 0.09 | asserted 1.00 |
| s7 | Extensive experiments demonstrate that our approach can achieve a high attack success rate while having a negligible impact on model clean performance. | result 1.00 | 0.95 | 0.35 | asserted 1.00 |
| s8 | In addition, we show our method is stealthy in that the produced backdoor samples are indistinguishable from clean samples in both image and text domains, which can successfully bypass existing backdoor defenses, highlighting the need for better defensive mechanisms against such stealthy backdoor attacks. | result 0.76 | 0.95 | 0.46 | asserted 1.00 |
What was examined, and what was not
- arXiv listing abstract v1
- full text
- figures and tables
- references and citing sentences
- relations to other papers
- P abstract
- S sections
- T body sentences
- C citations
- R cross-paper relations
The paper
Original abstract
In recent years, there has been an explosive growth in multimodal learning. Image captioning, a classical multimodal task, has demonstrated promising applications and attracted extensive research attention. However, recent studies have shown that image caption models are vulnerable to some security threats such as backdoor attacks. Existing backdoor attacks against image captioning typically pair a trigger either with a predefined sentence or a single word as the targeted output, yet they are unrelated to the image content, making them easily noticeable as anomalies by humans. In this paper, we present a novel method to craft targeted backdoor attacks against image caption models, which are designed to be stealthier than prior attacks. Specifically, our method first learns a special trigger by leveraging universal perturbation techniques for object detection, then places the learned trigger in the center of some specific source object and modifies the corresponding object name in the output caption to a predefined target name. During the prediction phase, the caption produced by the backdoored model for input images with the trigger can accurately convey the semantic information of the rest of the whole image, while incorrectly recognizing the source object as the predefined target. Extensive experiments demonstrate that our approach can achieve a high attack success rate while having a negligible impact on model clean performance. In addition, we show our method is stealthy in that the produced backdoor samples are indistinguishable from clean samples in both image and text domains, which can successfully bypass existing backdoor defenses, highlighting the need for better defensive mechanisms against such stealthy backdoor attacks.
Human review
How the literature uses it
What this paper does with the arXiv papers it cites
What it cites · 5 sentences without a confident label
Uses the method or tool of 2 papers
-
Following the settings in [ref] , we utilize k-means with $k=2$ to cluster the activations and get two clusters.
Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering · Backdoor Defense Evaluation · 0.95
-
For each image, we update the trigger $δ$ using Projected Gradient Descent (PGD) method [ref] : [equation] where $𝒮$ denotes a set of permissible perturbations.
Towards Deep Learning Models Resistant to Adversarial Attacks · Trigger Pattern Optimization · 1.00
Discussion
Know something about this paper? Leave a comment, or highlight any passage above to comment on it.