# Backdoor Contrastive Learning via Bi-level Trigger Optimization

arXiv: https://arxiv.org/abs/2404.07863 · HTML: https://mlsanity.com/paper/2404.07863/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 11 Apr 2024.

## Built on by (most cited first, 14 of 14)

- [Data Poisoning in Deep Learning: A Survey](https://mlsanity.com/paper/2503.22759/) (2025)
- [Invisible Backdoor Attack against Self-supervised Learning](https://mlsanity.com/paper/2405.14672/) (2024)
- [Backdooring Self-Supervised Contrastive Learning by Noisy Alignment](https://mlsanity.com/paper/2508.14015/) (2025)
- [GuardDoor: Safeguarding Against Malicious Diffusion Editing via Protective Backdoors](https://mlsanity.com/paper/2503.03944/) (2025)
- [Attack On Prompt: Backdoor Attack in Prompt-Based Continual Learning](https://mlsanity.com/paper/2406.19753/) (2024)
- [Using Interleaved Ensemble Unlearning to Keep Backdoors at Bay for Finetuning Vision Transformers](https://mlsanity.com/paper/2410.01128/) (2024)
- [TrojanDec: Data-free Detection of Trojan Inputs in Self-supervised Learning](https://mlsanity.com/paper/2501.04108/) (2025)
- [Coward: Collision-based OOD Watermarking for Practical Proactive Federated Backdoor Detection](https://mlsanity.com/paper/2508.02115/) (2025)
- [Backdoor Attacks on Multi-modal Contrastive Learning](https://mlsanity.com/paper/2601.11006/) (2026)
- [Contrastive Learning for Privacy Enhancements in Industrial Internet of Things](https://mlsanity.com/paper/2602.00515/) (2026)
- [Repurposing and Evaluating the (In)Feasibility of Dataset Poisoning enabled Watermarking for Contrastive Learning](https://mlsanity.com/paper/2605.01834/) (2026)
- [The Platonic Defense: Backdoor Defense for Self-Supervised Encoders in the Era of Large Scale Pre-training](https://mlsanity.com/paper/2606.29451/) (2026)
- [DEFUSE: Generalizable Backdoor Defense for Self-Supervised Encoders with Generative Priors](https://mlsanity.com/paper/2608.25851/) (2026)
- [FIDA: Feature Instability-Driven Attack on Self-Supervised Facial Representation](https://mlsanity.com/paper/2608.26861/) (2026)

## Abstract (arXiv)

Contrastive Learning (CL) has attracted enormous attention due to its remarkable capability in unsupervised representation learning. However, recent works have revealed the vulnerability of CL to backdoor attacks: the feature extractor could be misled to embed backdoored data close to an attack target class, thus fooling the downstream predictor to misclassify it as the target. Existing attacks usually adopt a fixed trigger pattern and poison the training set with trigger-injected data, hoping for the feature extractor to learn the association between trigger and target class. However, we find that such fixed trigger design fails to effectively associate trigger-injected data with target class in the embedding space due to special CL mechanisms, leading to a limited attack success rate (ASR). This phenomenon motivates us to find a better backdoor trigger design tailored for CL framework. In this paper, we propose a bi-level optimization approach to achieve this goal, where the inner optimization simulates the CL dynamics of a surrogate victim, and the outer optimization enforces the backdoor trigger to stay close to the target throughout the surrogate CL procedure. Extensive experiments show that our attack can achieve a higher attack success rate (e.g., 99% ASR on ImageNet-100) with a very low poisoning rate (1%). Besides, our attack can effectively evade existing state-of-the-art defenses. Code is available at: https://github.com/SWY666/SSL-backdoor-BLTO.