A4O-Attack: All Triggers for One Sample Backdoor Attacks

Backdoor attacks are critical threats to deep neural networks (DNNs). However, most of the studied attacks employ a single type of trigger, as proposed backdoor defenders often rely on the assumption that triggers would appear in a unified manner. In this paper, we show that this naive assumption can create a loophole that allows more sophisticated backdoor attacks to bypass. We design a novel backdoor attack mechanism that incorporates multiple types of backdoor trigger, focusing on stealthiness and effectiveness. Our investigation starts with the intriguing observation that the performance of a backdoor attack in deep learning models, as well as its detectability and removability, are all proportional to the magnitude of the trigger. Based on this correlation, we propose reducing the magnitude of each trigger type and combining them to achieve a strong backdoor relying on the combined trigger while still staying safely under the radar of defenders. Extensive experiments on three standard datasets demonstrate that our method can achieve high attack success rates (ASRs) and can bypass state-of-the-art defenses in a utility-preserving sense: a defense either fails to remove the backdoor or removes it only by severely damaging the clean accuracy (ACC) of the protected model. Thus, reducing ASR by making the model unusable is not considered a successful defense.