Chameleon: Backdoor Attacks With Restoration-Based Triggers Using Diffusion Models

Area of Science:

• Artificial Intelligence
• Machine Learning Security

Background:

• Deep neural networks (DNNs) are susceptible to backdoor attacks, where malicious triggers cause misclassification.
• Existing attacks using external triggers create distribution shifts, making them detectable by defenses analyzing latent representations.

Purpose of the Study:

• To propose Chameleon, a new backdoor attack framework that generates semantically consistent triggers.
• To enhance backdoor attack stealth by making triggers less separable in latent space.

Main Methods:

• Chameleon reformulates trigger generation as restoring a salient masked region using diffusion-based image restoration.
• Saliency-based mask positioning is employed to create contextually integrated triggers.
• The framework was evaluated against five baseline attacks and six state-of-the-art defenses (STRIP, SentiNet, RNP, CCA-UD, SCAn, Beatrix) across three datasets.

Main Results:

• Chameleon significantly outperforms baseline attacks in evading defenses.
• The proposed method achieved a 28.42% higher effective attack success rate (E-ASR) compared to the best baseline, averaged across all tested defenses.
• Generated triggers are semantically consistent and less separable in latent space, posing a greater threat.

Conclusions:

• Chameleon represents a significant advancement in backdoor attack techniques by creating stealthier, more effective triggers.
• The findings highlight the need for more robust defenses against sophisticated backdoor attacks that integrate triggers semantically.
• Future research should focus on developing defenses capable of detecting these contextually consistent, latent space-integrated triggers.