Natural and Imperceptible Backdoor Attack against Deep Neural Networks

Over the past few years, deep learning has demonstrated impressive performance across a wide range of applications. As the same time, researchers have become increasingly concerned with ensuring the security of deep learning models. Specifically, backdoor attacks have emerged as a significant threat to Deep Learning Model, whereby attackers control the predictions of model by implanting a concealed backdoor into the model. Under this scenario, the backdoored model will appear to make normal predictions on clean images, but will exhibit abnormal behaviors when the trigger is presented. Many existing backdoor attacks utilize a fixed pattern as the trigger, which can be easily detected by defense methods or even humans. Furthermore, existing backdoor attack methods are rarely targeted specifically at the Vision Transformer (ViT) model. Therefore, in this paper, we propose a novel natural backdoor attack method. We exploit natural phenomena to carry out a backdoor attack called the fog backdoor attack, which can utilize fog in the natural world as a trigger to be seamlessly integrated into clean images without being perceived by humans. The generated fog will diffuse over the image, creating a natural-looking effect. In contrast to the fixed and limited triggers produced by other methods, our triggers are more natural and imperceptible. Experimental results demonstrate the effectiveness and robustness of the proposed backdoor attack on different models. Specifically, the attack success rate of the proposed backdoor attack is 98.85% on VGG-16 model, 99.44% on ResNet-18 model and 9S.56% on ViT model, respectively. Furthermore, the proposed attack does not compromise the clean accuracy of the model.