Quiet Triggers, Loud Footprints: A Tri-Space Measurement Study of Backdoor Stealthiness
A study finds image-classifier backdoors that look stealthy in one space often leave clear footprints in another.
An arXiv cs.CR paper measures backdoor stealthiness in image classifiers beyond attack success rate and clean accuracy. It separates unobservable latent stealthiness from footprints in input, feature, and parameter space, testing representative attacks across four datasets and three architectures. The authors find that attacks rarely leave small footprints in all three spaces. They propose the Class-Specific Davies-Bouldin Index (CDBI) and TAC-UCLC Product (TUP) as additional diagnostics.
- Stealth is measured in input, feature, and parameter space
- Attacks quiet in one space are often loud in another
- New diagnostics are CDBI and the TAC-UCLC Product
- Metrics are meant to augment existing stealthiness tests
From the original article
1 min read at arxiv.orgBackdoor attacks on deep neural networks are commonly evaluated by attack success rate and benign accuracy, yet their stealthiness remains inconsistently defined and measured. Existing work often studies only one observable aspect of stealthiness, such as trigger imperceptibility, feature-space separability, parameter-space concentration, or evasion of particular defenses.
By Behrad Tajalli · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.