计算机科学

计算机科学 ›› 2026, Vol. 53 ›› Issue (10): 455-463.doi: 10.11896/jsjkx.251200087

• 信息安全 • 上一篇    下一篇

低投毒率下基于敏感度优化的隐形后门攻击

闫雷鸣1, 吉丽菁1, 王金伟2   

  1. 1 南京信息工程大学计算机学院、软件学院 南京 210044
    2 南开大学密码与网络空间安全学院 天津 300071
  • 收稿日期:2025-12-15 修回日期:2026-03-10 发布日期:2026-10-13
  • 通讯作者: 闫雷鸣(jilijing0430@163.com)
  • 基金资助:
    国家自然科学基金面上项目(62472229,42375147)

Stealthy Backdoor Attack with Sensitivity-based Optimization Under Low Poisoning Rate

YAN Leiming1, JI Lijing1, WNAG Jinwei2   

  1. 1 School of Computer Science,School of Software,Nanjing University of Information Science and Technology,Nanjing 210044, China
    2 College of Cryptography and Cyberspace Security,Nankai University,Tianjin 300071, China
  • Received:2025-12-15 Revised:2026-03-10 Online:2026-10-13
  • About author:YAN Leiming,born in 1973,Ph.D,associate professor,is a member of CCF(No.12690M).His main research interests include artificial intelligence security and data mining.
  • Supported by:
    General Program of the National Natural Science Foundation of China(62472229,42375147).

PDF (PC)

77

摘要： 后门攻击是指在深度神经网络模型训练过程中对原模型植入特定的触发器,导致模型误判的攻击。针对目前后门攻击方案普遍存在触发器隐蔽性差、投毒效率低与中毒模型易被检测的问题,提出了低投毒率下基于敏感度优化的隐形后门攻击方法。通过分析深度神经网络对局部语义特征的依赖性差异,利用模型误判主要受特定空间区域的特征激活主导这一特性,设计稀疏敏感掩码优化算法,定位对目标类敏感的特征区域,并设计触发模式来有效影响这些敏感特征。同时,采用敏感样本的筛选机制,基于梯度范数量化候选样本的毒化价值,自适应地选取对后门触发最具影响力的子集。在“特征-样本”双重优化框架中,稀疏敏感掩码使得触发器精准植入模型决策依赖的特征区域,而敏感样本筛选则从有限数据中识别出对后门触发最具贡献的样本子集,通过协同优化触发模式的空间敏感性与样本的毒化敏感性,实现了即使在极低投毒率的条件下仍然能够达成隐蔽且高效的后门攻击。实验结果表明,在投毒率低于0.5%的情况下,该方法在Cifar-10,Cifar-100,VGGFace2和RImageNet数据集上的平均攻击成功率高于94%,在多个评价指标上优于既有的后门攻击方法,并能有效规避Neural Cleanse等主流防御机制的检测,验证了所提方法的有效性。

关键词: 后门攻击, 隐蔽性, 敏感掩码优化

Abstract: Backdoor attacks cause deep neural network models to make misclassifications by embedding specific triggers during training.To address the common issues of poor trigger stealthiness,low poisoning efficiency,and easy detection of poisoned mo-dels in existing backdoor attack schemes,this paper proposes a stealthy backdoor attack method based on sensitivity optimization under low poisoning rates.By analyzing the dependency of deep neural networks on local semantic features and leveraging the fact that model misclassification is primarily dominated by feature activation in specific spatial regions,a sparse sensitivity mask optimization algorithm is designed to locate feature regions sensitive to the target class and generate trigger patterns that effectively influence these sensitive features.Meanwhile,a sensitive sample selection mechanism is adopted,which quantifies the poisoning value of candidate samples based on gradient norms and adaptively selects the subset with the greatest impact on backdoor triggering.Within this dual-optimization framework of “feature-sample” collaboration,the sparse sensitivity mask ensures precise implantation of triggers into feature regions critical to model decisions,while sensitive sample screening identifies the subset of samples that contribute most to backdoor activation from limited data.Through co-optimizing the spatial sensitivity of trigger patterns and the poisoning sensitivity of samples,this method achieves stealthy and highly effective backdoor attacks even under extremely low poisoning rates.Experimental results show that with a poisoning rate below 0.5%,the proposed method achieves an average attack success rate higher than 94% on the Cifar-10,Cifar-100,VGGFace2,and RImageNet datasets,outperforming exis-ting backdoor attack methods across multiple evaluation metrics and effectively evading detection by mainstream defense mechanisms such as Neural Cleanse,thus validating its effectiveness.

Key words: Backdoor attack, Stealthiness, Sensitivity mask optimization

中图分类号: 

  • TP309
[1] LI Y,JIANG Y,LI Z,et al.Backdoor learning:A survey[J].IEEE Transactions on Neural Networks and Learning Systems,2022,35(1):5-22.
[2] DUAN P,CHEN P X.A survey on attack and defense techniques in federated learning systems[J].Chinese Journal of Computers,2023,46(9):1-23.
[3] YIN W,LOU J,ZHOU P,et al.Physical backdoor:Towardstemperature-based backdoor attacks in the physical world[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.2024:12733-12743.
[4] LIU D,YANG M,QU X,et al.A Survey of Attacks on Large Vision-Language Models:Resources,Advances,and Future Trends[J].IEEE Transactions on Neural Networks and Lear-ning Systems,2025.
[5] TIAN Y,CHEN H,XU C,et al.Image processing gnn:Breaking rigidity in super-resolution[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.2024:24108-24117.
[6] BAI Y,XING G,WU H,et al.Backdoor attack and defense on deep learning:A survey[J].IEEE Transactions on Computatio-nal Social Systems,2025,13:93190-93221.
[7] NGUYEN A,TRAN A.Wanet-imperceptible warping-basedbackdoor attack[J].arXiv:2102.10369,2021.
[8] LI S,XUE M,ZHAO B Z H,et al.Invisible backdoor attacks on deep neural networks via steganography and regularization[J].IEEE Transactions on Dependable and Secure Computing,2020,18(5):2088-2105.
[9] XIA P,LI Z,ZHANG W,et al.Data-efficient backdoor attacks[J].arXiv:2204.12281,2022.
[10] ZENG Y,PAN M,JUST H A,et al.Narcissus:A practicalclean-label backdoor attack with limited information[C]//Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security.2023:771-785.
[11] WANG X T,YIN J,LIU C G,et al.A Survey of Backdoor Attacks and Defenses on Neural Networks[J].Chinese Journal of Computers,2024,47(8):1713-1743.
[12] CHEN X,LIU C,LI B,et al.Targeted backdoor attacks on deep learning systems using data poisoning[J].arXiv:1712.05526,2017.
[13] CHENG S,TAO G,LIU Y,et al.Lotus:Evasive and resilientbackdoor attacks through sub-partitioning[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.2024:24798-24809.
[14] JIANG W,LI H,XU G,et al.Color backdoor:A robust poiso-ning attack in color space[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.2023:8133-8142.
[15] DOAN K,LAO Y,ZHAO W,et al.Lira:Learnable,imperceptible and robust backdoor attacks[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision.2021:11966-11976.
[16] LI Z,SUN H,XIA P,et al.A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attacks[J].arXiv:2306.08313,2023.
[17] WANG B,YAO Y,SHAN S,et al.Neural cleanse:Identifying and mitigating backdoor attacks in neural networks[C]//2019 IEEE Symposium on Security and Privacy(SP).IEEE,2019:707-723.
[18] SELVARAJU R R,COGSWELL M,DAS A,et al.Grad-cam:Visual explanations from deep networks via gradient-based localization[C]//Proceedings of the IEEE International Confe-rence on Computer Vision.2017:618-626.
[19] ZENG Y,PARK W,MAO Z M,et al.Rethinking the backdoor attacks' triggers:A frequency perspective[C]//Procee-dings of the IEEE/CVF International Conference on Computer Vision.2021:16473-16481.
[20] KOLOURI S,SAHA A,PIRSIAVASH H,et al.Universal litmus patterns:Revealing backdoor attacks in cnns[C]//Procee-dings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition.2020:301-310.
[21] LIU K,DOLAN-GAVITT B,GARG S.Fine-pruning:Defending against backdooring attacks on deep neural networks[C]//International Symposium on Research in Attacks,Intrusions,and Defenses.Cham:Springer,2018:273-294.
[22] GUO J,LI Y,CHEN X,et al.Scale-up:An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency[J].arXiv:2302.03251,2023.
[23] GAO Y,XU C,WANG D,et al.Strip:A defence against trojan attacks on deep neural networks[C]//Proceedings of the 35th Annual Computer Security Applications Conference.2019:113-125.
[24] AHMAD O,BÉREUX N,BARET L,et al.Causal analysis for robust interpretability of neural networks[C]//Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision.2024:4685-4694.
[25] CHEN W Y,LIU Y C,KIRA Z,et al.A closer look at few-shot classification[J].arXiv:1904.04232,2019.
[26] SCHULZ K,SIXT L,TOMBARI F,et al.Restricting the flow:Information bottlenecks for attribution[J].arXiv:2001.00396,2020.
[27] PAUL M,GANGULI S,DZIUGAITE G K.Deep learning on a data diet:Finding important examples early in training[J].Advances in Neural Information Processing Systems,2021,34:20596-20607.
[28] GU T,LIU K,DOLAN-GAVITT B,et al.Badnets:Evaluating Backdooring Attacks on Deep Neural Networks[J].IEEE Baess,2019,7:47230-47244.
Viewed
Full text


Abstract

Cited
  Shared   
  Discussed   
No Suggested Reading articles found!
渝ICP备16013121号-4
地址：重庆市两江新区洪湖西路18号    邮编：401121  
电话：023-63500828（编辑部） 023-67039612（会议/专题） 023-67039623（财务/发票）
E-mail：jsjkx12@163.com
本系统由北京玛格泰克科技发展有限公司设计开发