Abstract:As a new paradigm in machine learning, self-supervised learning (SSL) is capable of learning high-quality representations of complex data without relying on labels. In addition to eliminating the need for labeled data, research has found that SSL improves the adversarial robustness over supervised learning since lacking labels makes it more challenging for adversaries to manipulate model predictions. However, the extent to which this robustness superiority generalizes to other types of attacks remains an open question.We explore this question in the context of backdoor attacks. Specifically, we design and evaluate Ctrl, an embarrassingly simple yet highly effective self-supervised backdoor attack. By only polluting a tiny fraction of training data (≤ 1%) with indistinguishable poisoning samples, Ctrl causes any trigger-embedded input to be misclassified to the adversary's designated class with a high probability (≥ 99%) at inference time. Our findings suggest that SSL and supervised learning are comparably vulnerable to backdoor attacks. More importantly, through the lens of Ctrl, we study the inherent vulnerability of SSL to backdoor attacks. With both empirical and analytical evidence, we reveal that the representation invariance property of SSL, which benefits adversarial robustness, may also be the very reason making SSL highly susceptible to backdoor attacks. Our findings also imply that the existing defenses against supervised backdoor attacks are not easily retrofitted to the unique vulnerability of SSL. Code is available at: https://github.com/meet-cjli/CTRL

Deep Neural Backdoor in Semi-Supervised Learning: Threats and Countermeasures

DeHiB: Deep Hidden Backdoor Attack on Semi-supervised Learning Via Adversarial Perturbation.

Clean-image Backdoor: Attacking Multi-label Models with Poisoned Labels Only

Unlabeled Backdoor Poisoning in Semi-Supervised Learning

Unlabeled Backdoor Poisoning on Trained-from-scratch Semi-Supervised Learning

Backdoor Defense via Decoupling the Training Process

Trojaning semi-supervised learning model via poisoning wild images on the web

How to Craft Backdoors with Unlabeled Data Alone?

An Embarrassingly Simple Backdoor Attack on Self-supervised Learning

Backdoor Cleansing with Unlabeled Data

DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders

AdvDoor: Adversarial Backdoor Attack of Deep Learning System

Exploiting Machine Unlearning for Backdoor Attacks in Deep Learning System

Backdoor Defense Via Deconfounded Representation Learning

Hidden Backdoor Attack against Semantic Segmentation Models

Defending Against Repetitive Backdoor Attacks on Semi-supervised Learning through Lens of Rate-Distortion-Perception Trade-off

Backdoor Learning: A Survey.

Untargeted Backdoor Attack Against Object Detection

DLP: towards active defense against backdoor attacks with decoupled learning process

Towards Imperceptible Backdoor Attack in Self-supervised Learning