IST: A Stealthy Backdoor Attack for Self-Supervised Learning Using Invisible Structure Triggers

Abstract

Self-supervised learning (SSL) has shown significant advantages by utilizing unlabeled data for training. However, it remains vulnerable to backdoor attacks. Existing attacks on SSL can achieve a high Attack Success Rate (ASR) with visible triggers, but they suffer from a high Attack Success Rate-Baseline (ASR-B) and lack stealthiness. Conversely, using invisible triggers reduces ASR-B but lowers ASR, failing to effectively balance effectiveness and stealthiness. To address this, this paper proposes IST, a stealthy backdoor attack for SSL using invisible structure triggers, which includes two stages: poisoned data generation and backdoor embedding. In the poisoned data generation stage, the attacker extracts and colors the edges of clean images, embedding them as invisible perturbations within the image structure. In the backdoor embedding stage, the attacker enhances the cosine similarity between poisoned data and target-class clean data by minimizing the loss function, indirectly associating the trigger with the target class without requiring data labels. Experiments show that IST demonstrates superior stealthiness, achieving an average ASR-B reduction of 14.85% and 9.06% compared to state-of-the-art methods like BadEncoder and INACTIVE. Furthermore, IST achieves a higher ASR in various downstream tasks and performs well on the Contrastive Language-Image Pre-training (CLIP) model.