Compression-resistant backdoor attack against deep neural networks

In recent years, a number of backdoor attacks against deep neural networks (DNN) have been proposed. this paper, we reveal that are vulnerable to image compressions, as instances used trigger usually compressed by compression methods during data transmission. When compressed, the feature will be destroyed, which could result in significant performance degradation for attacks. As countermeasure, propose first compression-resistant attack method based on consistency training. Specifically, both images and their versions training, difference between minimized through result, DNN treats space. After robust compressions. Furthermore, consider three different compressions (i.e., JPEG, JPEG2000, WEBP) so can multiple algorithms. Experimental results demonstrate when success rate common is 6.63% (JPEG), 6.20% (JPEG2000) 3.97% (WEBP) respectively, while proposed 98.77% 97.69% (JPEG2000), 98.93% respectively. The under various parameters settings. addition, extensive experiments demonstrated even if only one training process, has generalization ability resist unseen methods.