Robust Physically Realizable Backdoor Attack

Adversarial attacks pose a significant threat to the security of deep learning models by introducing meticulously crafted perturbations to input data, thereby misleading model predictions. A backdoor attack can occur during training when an adversary poisons a small part of the training data. This injects malicious behavior into the model, causing it to reliably misclassify inputs with a specific trigger into a chosen target class. In this work, we propose an adversarial patch-based backdoor attack framework that requires minimal poisoned data. Adversarial patches are visually prominent, physically realizable triggers capable of forcing a model to misclassify inputs regardless of the original label or context. We generated optimized adversarial patches using clean deep learning models on benchmark datasets, e.g., CIFAR-10, UCMerced, and AID datasets. Then, we planted backdoor triggers into the deep learning models by training with minimal poisoned data. Our experimental results show that adversarial patch-based backdoored models achieved a 99.79% attack success rate (ASR) with 0.1% poisoned CIFAR-10 dataset, achieved a 99.95% ASR with 0.1% poisoned UCMerced dataset, and achieved a 100.00% ASR with 1.0% poisoned AID dataset. In comparison, to achieve a similar ASR with the traditional backdoor attack, BadNets requires around 10.0% poisoned datasets. These results demonstrate that our proposed adversarial patch-based backdoor attack achieves higher attack success with significantly lower poisoning ratios. The proposed attack is also physically realizable, making it a practical threat for real-world applications including surveillance, autonomous vehicles, and remote sensing. These findings underscore that adversarial patch-based backdoor attacks pose a practical and stealthy threat to deployed machine learning systems, motivating the need for effective and generalizable defenses.