WaNet - Imperceptible Warping-based Backdoor Attack

Tuan Anh Nguyen, Anh Tuan Tran

Keywords: backdoor attack, image warping, wanet

Abstract: With the thriving of deep learning and the widespread practice of using pre-trained networks, backdoor attacks have become an increasing security threat drawing many research interests in recent years. A third-party model can be poisoned in training to work well in normal conditions but behave maliciously when a trigger pattern appears. However, the existing backdoor attacks are all built on noise perturbation triggers, making them noticeable to humans. In this paper, we instead propose using warping-based triggers. The proposed backdoor outperforms the previous methods in a human inspection test by a wide margin, proving its stealthiness. To make such models undetectable by machine defenders, we propose a novel training mode, called the ``noise mode. The trained networks successfully attack and bypass the state-ofthe art defense methods on standard classification datasets, including MNIST, CIFAR-10, GTSRB, and CelebA. Behavior analyses show that our backdoors are transparent to network inspection, further proving this novel attack mechanism's efficiency.

One-sentence Summary: We propose an imperceptible backdoor attack based on image-warping, which can surpass both human and machine inspections.

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics

Code: [ VinAIResearch/Warping-based_Backdoor_Attack-release](https://github.com/VinAIResearch/Warping-based_Backdoor_Attack-release)

Data: [CIFAR-10](https://paperswithcode.com/dataset/cifar-10), [GTSRB](https://paperswithcode.com/dataset/gtsrb), [MNIST](https://paperswithcode.com/dataset/mnist)