REVIEW 8 cited by
Backdoor Attack in the Physical World
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
Signed reviews
abstract
Backdoor attack intends to inject hidden backdoor into the deep neural networks (DNNs), such that the prediction of infected models will be maliciously changed if the hidden backdoor is activated by the attacker-defined trigger. Currently, most existing backdoor attacks adopted the setting of static trigger, $i.e.,$ triggers across the training and testing images follow the same appearance and are located in the same area. In this paper, we revisit this attack paradigm by analyzing trigger characteristics. We demonstrate that this attack paradigm is vulnerable when the trigger in testing images is not consistent with the one used for training. As such, those attacks are far less effective in the physical world, where the location and appearance of the trigger in the digitized image may be different from that of the one used for training. Moreover, we also discuss how to alleviate such vulnerability. We hope that this work could inspire more explorations on backdoor properties, to help the design of more advanced backdoor attack and defense methods.
Forward citations
Cited by 8 Pith papers
-
Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs
A single poisoning phase can implant a backdoor that makes a VLM output attacker-selected caption text for previously unseen targets, using triggers synthesized in feature space at inference time.
-
Lilith: Backdoor Generalization under Training-Inference Trigger Shift
A single poisoned training trigger can create a backdoor that fires for a whole family of unseen inference-time triggers, provided the variants preserve the anchor's representation geometry.
-
LaserGuider: A Laser Based Physical Backdoor Attack against Deep Neural Networks
LaserGuider shows that poisoning a traffic sign classifier with digital laser spots creates a backdoor that fires with over 90% success when a physical laser spot is projected onto real signs.
-
BadDepth: Backdoor Attacks Against Monocular Depth Estimation in the Physical World
BadDepth uses poisoned depth labels and physical-world image augmentation to make a triggered object vanish from monocular depth predictions.
-
GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusion
A three-stage poisoning pipeline with viewpoint-ensemble stabilization can implant an attacker-chosen image at a single viewport of a 3D Gaussian Splatting model while preserving rendering quality at other views.
-
Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasets
T-Core, a bootstrapping defense that sifts clean data and filters trusted encoder channels, reduces backdoor attack success rates below 10% across encoder and dataset poisoning threats in transfer learning.
-
BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluation
BackdoorMBTI is the first backdoor security benchmark and toolkit that covers image, text, and audio modalities with a unified evaluation pipeline.
-
On the Validity of Traditional Vulnerability Scoring Systems for Adversarial Attacks against LLMs
Applying CVSS, DREAD, OWASP, and SSVC to 56 adversarial LLM attacks via three LLM judges yields near-constant factor scores, which the authors take as evidence that these metrics cannot differentiate LLM attacks.
Discussion (0). Continue with ORCID to comment.