mlsanityData to 7 Oct 2026

Invisible Backdoor Attack against Self-supervised Learning

arXiv 2405.14672 ↗First posted 23 May 2024cs.CVcited by 5

Not on the map. Why?

Abstract (arXiv)

Self-supervised learning (SSL) models are vulnerable to backdoor attacks. Existing backdoor attacks that are effective in SSL often involve noticeable triggers, like colored patches or visible noise, which are vulnerable to human inspection. This paper proposes an imperceptible and effective backdoor attack against self-supervised models. We first find that existing imperceptible triggers designed for supervised learning are less effective in compromising self-supervised models. We then identify this ineffectiveness is attributed to the overlap in distributions between the backdoor and augmented samples used in SSL. Building on this insight, we design an attack using optimized triggers disentangled with the augmented transformation in the SSL, while remaining imperceptible to human vision. Experiments on five datasets and six SSL algorithms demonstrate our attack is highly effective and stealthy. It also has strong resistance to existing backdoor defenses. Our code can be found at https://github.com/Zhang-Henry/INACTIVE.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Builds on 56 of its 91 references that are in the map. First posted on arXiv 23 May 2024.

Builds on

56 of 91 references.

References · 56

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  4. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
  5. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  6. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  7. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,482
  8. 2021Emerging Properties in Self-Supervised Vision Transformerscited by 6,893
  9. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  10. 2020Bootstrap your own latent: A new approach to self-supervised Learningcited by 4,712
  11. 2020Exploring Simple Siamese Representation Learningcited by 2,853
  12. 2020Unsupervised Learning of Visual Features by Contrasting Cluster Assignmentscited by 2,845
38 more
  1. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  2. 2020A Survey on Contrastive Self-supervised Learningcited by 553
  3. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  4. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  5. 2018Spectral Signatures in Backdoor Attackscited by 457
  6. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  7. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  8. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  9. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  10. 2023A Survey on Self-supervised Learning: Algorithms, Applications, and Future Trendscited by 205
  11. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  12. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  13. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  14. 2020Backdoor Attacks to Graph Neural Networkscited by 126
  15. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 121
  16. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  17. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  18. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  19. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  20. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
  21. 2018Shield: Fast, Practical Defense and Vaccination for Deep Learning using JPEG Compressioncited by 74
  22. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  23. 2023Detecting Backdoors in Pre-trained Encoderscited by 53
  24. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  25. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  26. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  27. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  28. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
  29. 2020Adversarial Deep Ensemble: Evasion Attacks and Defenses for Malware Detectioncited by 33
  30. 2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 33
  31. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 33
  32. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Modelscited by 33
  33. 2022An Embarrassingly Simple Backdoor Attack on Self-supervised Learningcited by 30
  34. 2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29
  35. 2023Towards Stealthy Backdoor Attacks against Speech Recognition via Elements of Soundcited by 28
  36. 2023Backdoor Attack with Sparse and Invisible Triggercited by 20
  37. 2023Defending Against Patch-based Backdoor Attacks on Self-Supervised Learningcited by 19
  38. 2024Backdoor Contrastive Learning via Bi-level Trigger Optimizationcited by 14

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 0; 2026: 3.

5 papers.

  1. 2024Uncertainty is Fragile: Manipulating Uncertainty in Large Language Modelscited by 13
  2. 2026BadCLIP++: Stealthy and Persistent Backdoors in Multimodal Contrastive Learningcited by 2
  3. 2024Using Interleaved Ensemble Unlearning to Keep Backdoors at Bay for Finetuning Vision Transformerscited by 1
  4. 2026IU: Imperceptible Universal Backdoor Attackcited by 0
  5. 2026The Platonic Defense: Backdoor Defense for Self-Supervised Encoders in the Era of Large Scale Pre-trainingcited by 0