关键词: 后门攻击, 阶段性对抗优化, 奇异值分解, 样本特异性, 模型安全

Abstract: Deep learning models have been widely applied in numerous fields due to their exceptional performance. However, research has shown that they are also highly vulnerable to backdoor attacks. Backdoor attacks can compromise the reliability of models through covert trigger mechanisms. When a preset trigger activates the hidden backdoor, the model executes malicious behavior. Current backdoor attacks primarily rely on trigger patterns based on spatial or frequency domain perturbations, often employing sample-agnostic static triggers, making it relatively easier for defense systems to detect and mitigate the threat. To address the issues of insufficient stealthiness and weak robustness in existing attacks, this paper proposes a dynamic backdoor attack method based on staged adversarial optimization in the singular value space. First, a generator is used to produce sample-specific triggers, and singular value decomposition is employed to extract the primary and secondary features of clean images and triggers. The trigger information is embedded into the secondary features of clean images while preserving the primary features to maintain backdoor stealthiness. Second, a staged training framework is introduced: the first stage jointly optimizes the trigger generator and classifier to ensure maximum backdoor attack effectiveness, while the second stage continues training the backdoor model using the optimized trigger generator. To validate the stealthiness and effectiveness of the proposed method, the attack was tested on multiple benchmark datasets. Experimental results demonstrate that the proposed method achieves higher attack success rates than existing attack methods across all four datasets, with almost no degradation in accuracy on benign samples, and successfully evades four state-of-the-art backdoor defense methods. Additionally, the experiments confirm that the sensitivity of deep models to singular value perturbations can be maliciously exploited, while existing defense mechanisms struggle to detect such attacks, revealing new security risks for AI models.

Key words: backdoor attack, stage-wise adversarial optimization, Singular Value Decomposition, sample-specific, model security