Research map / Adversarial robustness and security / Backdoor and poisoning
Backdoor Contrastive Learning via Bi-level Trigger Optimization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Bi-Level Trigger Optimization (BLTO), which learns a backdoor trigger generator via a bi-level objective against a surrogate contrastive learning victim, so poisoned unlabeled data yields high attack success on downstream classifiers.
Problem
Data-poisoning backdoor attacks on contrastive learning use fixed triggers that fail to associate triggered inputs with the target class in embedding space, due to CL alignment/uniformity and augmentations, yielding low attack success rates.
Approach
Optimize the trigger generator with a bi-level objective: the inner loop simulates contrastive training of a surrogate encoder on the backdoored data, and the outer loop updates the generator so triggered inputs stay close to target-class reference data throughout that surrogate CL procedure, yielding triggers that transfer across CL methods, backbones, and augmentations.
Key results
- On ImageNet-100 with SimCLR victim, BLTO reaches 96.45% ASR vs. 46.58% for CTRL at 1% poisoning rate.
- BLTO reaches 99.82% ASR on ImageNet-100 with BYOL victim and keeps BA near the clean model.
- Against CLP, I-BAU, and distillation defenses, BLTO retains 81-88% ASR in the reported settings, with I-BAU lowering ASR to 56.87%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use bi-level trigger optimization instead of CTRL | CL backdoor attack · CIFAR-10, CIFAR-100, and ImageNet-100 across SimCLR, BYOL, and SimSiam | ASR: 32.18$\%$ vs 91.27$\%$ (CIFAR-10, SimCLR); 85.67$\%$ vs 92.13$\%$ (CIFAR-100, BYOL); 43.16$\%$ vs 99.82$\%$ (ImageNet-10 | Helped |
| Remove inner optimization (ablation) | BLTO · CIFAR-10 with SimCLR, BYOL, and SimSiam | ASR: 91.27\% -> 71.98\% (SimCLR); 97.17\% -> 60.13\% (BYOL); 84.63\% -> 17.44\% (SimSiam) | Hurt |
| Remove outer optimization (ablation) | BLTO · CIFAR-10 with SimCLR, BYOL, and SimSiam | ASR: 91.27\% -> 12.84\% (SimCLR); 97.17\% -> 11.97\% (BYOL); 84.63\% -> 12.01\% (SimSiam) | Hurt |
| Add GaussianBlur to the victim augmentations (ablation) | BLTO on ImageNet-100 · ImageNet-100, default augmentations versus default plus GaussianBlur | ASR: 98.58$\%$ -> 99.13$\%$ | Helped |
| Add GaussianBlur to the victim augmentations (ablation) | CTRL on ImageNet-100 · ImageNet-100, default augmentations versus default plus GaussianBlur | ASR: 35.62$\%$ -> 1.04$\%$ | Hurt |
| Increase the SimCLR victim temperature (ablation) | BLTO · CIFAR-10, SimCLR victim | ASR: 10.18\% (0.1); 12.22\% (0.2); 26.81\% (0.5); 81.92\% (0.8) | Helped |
| Change victim batch size from 512 to 256 or 1024 (ablation) | BLTO · CIFAR-10, SimCLR victim | ASR: 91.27\% (512); 90.88\% (256); 89.39\% (1024) | Mixed |
| Change victim learning rate from the default to ×0.5 or ×2 (ablation) | BLTO · CIFAR-10, SimCLR victim | ASR: 91.27\% (×1); 91.80\% (×0.5); 92.54\% (×2) | Mixed |
| Use MoCo as the victim CL method rather than the reported default comparison | BLTO · CIFAR-10, MoCo | ASR: 96.84\% (ours); 95.54\% (CTRL); 91.27\% (SSL-backdoor) | Helped |
| Train the downstream task on STL-10 instead of the pretraining dataset (ablation) | BLTO · STL-10 downstream dataset | ASR: 94.74\% (SimCLR); 96.19\% (BYOL); 87.55\% (SimSiam) | Mixed |
Surprising findings
- Fixed-pattern triggers (SSL backdoor, CTRL) achieve low ASR under SimCLR, SimSiam and BYOL on CIFAR-10, with the uniformity effect of CL cited as a cause.
- Attack optimized with outer optimization only (no inner CL simulation) drops to under 20% ASR under SimSiam.
Limitations
- Relies on a surrogate CL pipeline and reference data from the target class, which the attacker must collect.
- Performance drops for some victim settings, e.g., ASR 73-79% under some surrogate-victim pairs and 82.66% on ViT-small/16.
- Evaluated mainly on image classification with small-to-medium benchmarks.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet-100 STL-10
Benchmarks: CIFAR-10 CIFAR-100 ImageNet-100 STL-10
Metrics: attack success rate backdoor accuracy anomaly index TPR FDR
Baselines: SSL backdoor CTRL BadEncoder PoisonedEncoder CorruptEncoder
Builds on: SimSiam CTRL SSL backdoor Narcissus
Closest papers by meaning
- Data Poisoning based Backdoor Attacks to Contrastive Learning (CVPR 2024 · similarity 0.88)
- BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning (CVPR 2024 · similarity 0.87)
- Conditional Backdoor Attack via JPEG Compression (AAAI 2024 · similarity 0.85)
- Does Few-Shot Learning Suffer from Backdoor Attacks? (AAAI 2024 · similarity 0.84)
- Defending Multimodal Backdoored Models by Repulsive Visual Prompt Tuning (NeurIPS 2025 · similarity 0.84)
- Test-Time Multimodal Backdoor Detection by Contrastive Prompting (ICML 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.