Spy-Watermark: Robust Invisible Watermarking for Backdoor Attack
Ruofei Wang Renjie Wan Zongyu Guo Qing Guo Rui Huang
Backdoor attack aims to deceive a victim model when facing backdoor instances
while maintaining its performance on benign data. Current methods use manual
patterns or special perturbations as triggers, while they often overlook the
robustness against data corruption, making backdoor attacks easy to defend in
practice. To address this issue, we propose a novel backdoor attack method
named Spy-Watermark, which remains effective when facing data collapse and
backdoor defense. Therein, we introduce a learnable watermark embedded in the
latent domain of images, serving as the trigger. Then, we search for a
watermark that can withstand collapse during image decoding, cooperating with
several anti-collapse operations to further enhance the resilience of our
trigger against data corruption. Extensive experiments are conducted on
CIFAR10, GTSRB, and ImageNet datasets, demonstrating that Spy-Watermark
overtakes ten state-of-the-art methods in terms of robustness and stealthiness.