TransTroj: Transferable Backdoor Attacks to Pre-trained Models via
  Embedding Indistinguishability
Hao Wang Tao Xiang Shangwei Guo Jialing He Hangcheng Liu Tianwei Zhang
Pre-trained models (PTMs) are extensively utilized in various downstream
tasks. Adopting untrusted PTMs may suffer from backdoor attacks, where the
adversary can compromise the downstream models by injecting backdoors into the
PTM. However, existing backdoor attacks to PTMs can only achieve partially
task-agnostic and the embedded backdoors are easily erased during the
fine-tuning process. In this paper, we propose a novel transferable backdoor
attack, TransTroj, to simultaneously meet functionality-preserving, durable,
and task-agnostic. In particular, we first formalize transferable backdoor
attacks as the indistinguishability problem between poisoned and clean samples
in the embedding space. We decompose the embedding indistinguishability into
pre- and post-indistinguishability, representing the similarity of the poisoned
and reference embeddings before and after the attack. Then, we propose a
two-stage optimization that separately optimizes triggers and victim PTMs to
achieve embedding indistinguishability. We evaluate TransTroj on four PTMs and
six downstream tasks. Experimental results show that TransTroj significantly
outperforms SOTA task-agnostic backdoor attacks (18%$\sim$99%, 68% on average)
and exhibits superior performance under various system settings. The code is
available at https://github.com/haowang-cqu/TransTroj .