Research map / Adversarial robustness and security / Backdoor and poisoning
Invisible Backdoor Attack against Self-supervised Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes INACTIVE, an imperceptible backdoor attack on self-supervised encoders that optimizes color-space triggers to be distributionally separated from SSL augmentations, achieving ~99% ASR while evading several defenses.
Problem
Backdoor attacks on self-supervised learning encoders are either visible (patches, noise) or, when invisible, markedly less effective because invisible triggers designed for supervised learning overlap distributionally with SSL augmentations.
Approach
Identify that SSL's learned augmentation space absorbs invisible transformations (e.g., WaNet, color filters), then optimize triggers in HSV/HSL color space to be distributionally distant from the SSL augmentations while constraining pixel and feature-space stealthiness and aligning backdoored features with reference target-class images.
Key results
- Average ASR of 99.09% across five pre-train/downstream dataset pairs in Table 1, versus 10.93% for BadEncoder with WaNet and 29.32% for CTRL.
- Average stealthiness of 0.9633 SSIM, 35.86 PSNR, and 0.00896 LPIPS on CIFAR10 (Table 3), with stealthiness better than baselines except LPIPS vs CTRL.
- Beatrix detection accuracy falls below 50% (48.1% to 47.6%) on INACTIVE-poisoned samples, versus over 93% on BadEncoder, and DECREE fails to flag backdoored encoders.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use INACTIVE instead of the strongest reported baseline trigger | ResNet18 SSL backdoor attack · STL10 → CIFAR10 | ASR: 98.39 -> 99.58 | Helped |
| Use INACTIVE instead of the strongest reported baseline trigger | ResNet18 SSL backdoor attack · STL10 → GTSRB | ASR: 96.09 -> 97.97 | Helped |
| Use INACTIVE instead of the strongest reported baseline trigger | ResNet18 SSL backdoor attack · STL10 → SVHN | ASR: 96.68 -> 99.76 | Helped |
| Use INACTIVE instead of the strongest reported baseline trigger | ResNet18 SSL backdoor attack · CIFAR10 → STL10 | ASR: 96.72 -> 99.68 | Helped |
| Use INACTIVE instead of the strongest reported baseline trigger | ResNet18 SSL backdoor attack · CIFAR10 → GTSRB | ASR: 97.95 -> 98.73 | Helped |
| Use INACTIVE instead of the strongest reported baseline trigger | ResNet18 SSL backdoor attack · CIFAR10 → SVHN | ASR: 96.23 -> 98.79 | Helped |
| Use INACTIVE instead of BLTO | CIFAR10 SimCLR backdoor attack · CIFAR10 | ASR: 91.27 -> 100.00 | Helped |
| Use INACTIVE instead of BLTO | CIFAR10 BYOL backdoor attack · CIFAR10 | ASR: 94.78 -> 99.99 | Helped |
| Use INACTIVE instead of BLTO | CIFAR10 SimSiam backdoor attack · CIFAR10 | ASR: 84.63 -> 99.99 | Helped |
| Use INACTIVE instead of ISSBA | ImageNet-pretrained encoder · ImageNet → STL10 | ASR: 9.97 -> 100.00 | Helped |
| Use INACTIVE instead of ISSBA | ImageNet-pretrained encoder · ImageNet → GTSRB | ASR: 5.10 -> 96.00 | Helped |
| Use INACTIVE instead of ISSBA | ImageNet-pretrained encoder · ImageNet → SVHN | ASR: 18.03 -> 99.99 | Helped |
Surprising findings
- Theorem 3.1 argues that a perfectly-trained encoder cannot take a backdoor whose trigger lies within the predefined augmentation space, explaining why invisible SL triggers fail in SSL.
- Existing invisible SL triggers (WaNet, ISSBA, filter attacks) that reach high ASR in supervised learning perform poorly under BadEncoder in SSL.
Limitations
- Evaluated mainly on image classification with ResNet18 encoders and SimCLR as the default SSL method; generalization to other modalities is left to future work.
- ASR and defense evaluations are reported on a limited set of defenses (DECREE, Beatrix, ASSET, NC, STRIP, Grad-CAM), and some are only in the appendix.
Experimental setup
Datasets: CIFAR10 STL10 GTSRB SVHN ImageNet
Benchmarks: CIFAR10 STL10 GTSRB SVHN ImageNet
Metrics: ASR BA CA SSIM PSNR LPIPS FSIM FID
Baselines: BadEncoder with WaNet trigger BadEncoder with CTRL trigger BadEncoder with Instagram Kelvin/Xpro2 trigger DRUPE CTRL SSLBKD POIENC BLTO ISSBA
Builds on: BadEncoder WaNet ISSBA SimCLR U-Net
Closest papers by meaning
- DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders (CVPR 2025 · similarity 0.89)
- Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Models (CVPR 2025 · similarity 0.89)
- Attention-Imperceptible Backdoor Attacks on Vision Transformers (AAAI 2025 · similarity 0.87)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.86)
- Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transfomers (CVPR 2024 · similarity 0.86)
- Backdoor Attacks in Token Selection of Attention Mechanism (ICML 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.