Efficient Backdoor Attacks for Deep Neural Networks in Real-world
  Scenarios
Recent deep neural networks (DNNs) have came to rely on vast amounts of
training data, providing an opportunity for malicious attackers to exploit and
contaminate the data to carry out backdoor attacks. However, existing backdoor
attack methods make unrealistic assumptions, assuming that all training data
comes from a single source and that attackers have full access to the training
data. In this paper, we introduce a more realistic attack scenario where
victims collect data from multiple sources, and attackers cannot access the
complete training data. We refer to this scenario as data-constrained backdoor
attacks. In such cases, previous attack methods suffer from severe efficiency
degradation due to the entanglement between benign and poisoning features
during the backdoor injection process. To tackle this problem, we introduce
three CLIP-based technologies from two distinct streams: Clean Feature
Suppression and Poisoning Feature Augmentation.effective solution for
data-constrained backdoor attacks. The results demonstrate remarkable
improvements, with some settings achieving over 100% improvement compared to
existing attacks in data-constrained scenarios. Code is available at
https://github.com/sunh1113/Efficient-backdoor-attacks-for-deep-neural-networks-in-real-world-scenarios
Ziqiang Li, Hong Sun, Pengfei Xia, Heng Li, Beihao Xia, Yi Wu, Bin Li
# Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios

###### Abstract

Recent deep neural networks (DNNs) have come to rely on vast amounts of training data, providing an opportunity for malicious attackers to exploit and contaminate the data to carry out backdoor attacks. These attacks significantly undermine the reliability of DNNs. However, existing backdoor attack methods make unrealistic assumptions, assuming that all training data comes from a single source and that attackers have full access to the training data. In this paper, we address this limitation by introducing a more realistic attack scenario where victims collect data from multiple sources, and attackers cannot access the complete training data. We refer to this scenario as **data-constrained backdoor attacks**. In such cases, previous attack methods suffer from severe efficiency degradation due to the **entanglement** between benign and poisoning features during the backdoor injection process.

To tackle this problem, we propose a novel approach that leverages the pre-trained Contrastive Language-Image Pre-Training (CLIP) model. We introduce three CLIP-based technologies from two distinct streams: _Clean Feature Suppression_, which aims to suppress the influence of clean features to enhance the prominence of poisoning features, and _Poisoning Feature Augmentation_, which focuses on augmenting the presence and impact of poisoning features to effectively manipulate the model's behavior.

To evaluate the effectiveness, harmlessness to benign accuracy, and stealthiness of our method, we conduct extensive experiments on 3 target models, 3 datasets, and over 15 different settings. The results demonstrate remarkable improvements, with some settings achieving over **100%** improvement compared to existing attacks in data-constrained scenarios. Our research contributes to addressing the limitations of existing methods and provides a practical and effective solution for data-constrained backdoor attacks.

## 1 Introduction

Deep neural networks (DNNs) are widely utilized and powerful machine learning algorithms inspired by the structure and functioning of the human brain. They excel at learning intricate patterns in data, making them invaluable for various applications such as image recognition [17, 21], natural language processing [33, 68], image generation [20, 30], and anomaly detection [45, 64]. However, the effectiveness of DNNs heavily relies on the quantity and quality of the training data. For instance, Stable Diffusion [49], a generative model with 983 million parameters, owes its success in image generation tasks to pre-training on 5 billion image-text pairs. Similarly, GPT-3 [3], a language model with 175 billion

Figure 1: One-to-one (O2O) and many-to-one (M2O) data collection modes. M2O mode is more in line with practical scenarios where data collectors collect data from multiple sources. In this mode, the attacker cannot have all the data available to the victims.
parameters, owes its efficacy in diverse language processing tasks to pre-training on an extensive corpus of 45 TB of text data. As the demand for data continues to rise, many users and businesses resort to third-party sources or online collections as a convenient means of acquiring the necessary data. However, recent studies [25, 18, 43, 64, 2, 15] have demonstrated that such practices can be maliciously exploited by attackers to contaminate the training data, significantly impairing the functionality and reliability of trained models.

The growing adoption of neural networks across different domains has made them an attractive target for malicious attacks. One particular attack technique gaining attention is the _backdoor attack_[26, 27, 2, 9, 15, 24, 41]. In backdoor attacks, a neural network is deliberately injected with a hidden trigger by introducing a small number of poisoning samples into the benign training set during the training. Once the model is deployed, the attacker can activate the backdoor by providing specific inputs containing the hidden trigger, causing the model to produce incorrect results. Backdoor attacks continue to present a significant and pervasive threat across multiple sectors, including image classification [16], natural language processing [43], speaker verification [67], malware detection [24], and video recognition [69]. In this paper, we focus on the widely studied field of image classification.

However, it is important to note that all of previous backdoor attacks are based on an assumption that may be too broad in practice. They assume that all training data has been collected from a single source, and the collected source has been poisoned by attacker (As depicted in the O2O data collection mode in Fig. 1). In this case, the attacker can full access to the entire training data. While this assumption allows attackers to easily poison the training data, it does not accurately reflect real-world attack scenarios. To illustrate this point, let's consider a scenario where victims possess a private dataset with limited samples. To compensate for the limited data, victims may need to augment their dataset by collecting additional data from multiple sources on the internet (referred to as the public dataset) and combine it with their private dataset to form the training set. As shown in the M2O data collection mode in Fig. 1, part of the sources may be poisoned by attackers, secretly+. In this case, the attackers cannot access the private dataset and can only manipulate a portion of the public dataset to carry out the poisoning process. Consequently, a discrepancy arises between the distribution of the poisoning data and the distribution of the training data, which differs from the previous pipeline of poisoning attacks.

Footnote †: These three backdoor attacks are more realistic attack scenario, where the data provided by each data source is independently and identically distribution in number-constrained backdoor attacks, each data source provides data belonging to different categories in class-constrained backdoor attacks, and each data source provides data from different domains in domain-constrained backdoor attacks. More description can be found in Sec. 3.

In this paper, we address a more realistic backdoor attack scenario called **data-constrained backdoor attacks**, where the attackers do not have access to the entire training set. To be more precise, we classify data-constrained backdoor attacks into three types based on different types of data sources: number-constrained backdoor attacks, class-constrained backdoor attacks, and domain-constrained backdoor attacks+. Upon investigation, we have discovered that existing attack methods exhibit significant performance degradation when dealing with these data-constrained backdoor attacks. We propose that the **entanglement** between benign and poisoning features is a crucial factor contributing to this phenomenon. Entanglement refers to the neural networks utilizing both benign and poisoning features to make decisions for poisoning samples. However, this approach is not efficient for backdoor attacks. Ideally, an efficient backdoor attack should solely rely on the poison feature generated by the trigger to make decisions, irrespective of how the benign feature is expressed.

Footnote †: These three backdoor attacks are more realistic attack scenario, where the data provided by each data source is independently and identically distribution in number-constrained backdoor attacks, each data source provides data belonging to different categories in class-constrained backdoor attacks, and each data source provides data from different domains in domain-constrained backdoor attacks. More description can be found in Sec. 3.

To address the aforementioned challenge and enhance the efficiency of poisoning attacks in data-constrained backdoor scenarios, we introduce two streams: _Clean Feature Suppression_ and _Poisoning Feature Augmentation_. In the Clean Feature Suppression stream, we focus on reducing the influence of clean features during the poisoning process. On the other hand, in the Poisoning Feature Augmentation stream, we aim to amplify the expression of poisoning features. To achieve these goals, we propose three techniques utilizing the pre-trained Contrastive Language-Image Pre-Training (CLIP) [46] model.

i) _CLIP-based Clean Feature Erasing (CLIP-CFE)_ is designed to suppress the expression of clean features. It leverages the capabilities of the CLIP model to identify and minimize the impact of clean features in the poisoning process.

ii) _CLIP-based Universal Adversarial Perturbations (CLIP-UAP)_ focuses on poisoning feature augmentation. It employs the CLIP model to generate universal adversarial perturbations that effectively enhance the expression of poisoning features in the training data.

iii) _CLIP-based Contrastive Feature Augmentation (CLIP-CFA)_ also falls under the poisoning feature augmentation stream. This technique utilizes the CLIP model to perform contrastive feature augmentation, enhancing the power of poisoning features and improving the effectiveness of the backdoor attack.

Our main contributions are summarized as follows.

* We present a novel and contemporary backdoor attack scenario called data-constrained backdoor attacks to image classification. Data-constrained backdoor attacks assume that attackers lack access to the entire training data, making it a versatile and practical attack with broad
applicability.
* Through a systematic analysis of previous attack methods, we identify the entanglement between poisoning and benign features as the primary contributing factor to their performance degradation.
* To address this issue, we introduce the pre-trained CLIP model into the field of backdoor attacks for the first time. We propose three innovative technologies: CLIP-CFE, CLIP-UAP, and CLIP-CFA. Extensive evaluations conducted on 3 datasets and 3 target models, and over **15** different settings demonstrate the significant superiority of our proposed CLIP-UAP and CLIP-CFA over existing backdoor attacks. Furthermore, CLIP-CFE complements existing attack methods and can be seamlessly integrated with them, resulting in further efficiency improvements.

## 2 Background

Here we first summary the common pipeline of backdoor attacks on neural networks, and then we introduce the Contrastive Language-Image Pre-Training (CLIP) Model that has been adopted in our method.

### Backdoor Attacks on Neural Networks

#### 2.1.1 General Pipeline of Backdoor Attacks

Consider a learning model \(f(\cdot;\Theta):X\to Y\), where \(\Theta\) represents the model's parameters and \(X(Y)\) denotes the input (output) space, with given dataset \(\mathcal{D}\subset X\times Y\). Backdoor attacks typically involve three essential steps: _poisoning set generation_, _backdoor injection_, and _backdoor activation_.

**Poisoning set generation.** In this step, attackers employ a pre-defined poison generator \(\mathcal{T}(x,t)\) to introduce a trigger \(t\) into a clean sample \(x\). Specifically, they select a subset \(\mathcal{P}^{t}=\{(x_{i},y_{i})|i=1,\cdots,P\}\) from the clean training set \(\mathcal{D}=\{(x_{i},y_{i})|i=1,\cdots,N\}\) (\(\mathcal{P}^{t}\subset\mathcal{D}\), and \(P\ll N\)) and result in the corresponding poisoning set \(\mathcal{P}=\{(x^{\prime}_{i},k)|x^{\prime}_{i}=\mathcal{T}(x_{i},t),(x_{i}, y_{i})\in\mathcal{P}^{t},i=1,\cdots,P\}\). Here, \(y_{i}\) and \(k\) represent the true label and the attack-target label of the clean sample \(x_{i}\) and the poisoning sample \(x^{\prime}_{i}\), respectively.

**Backdoor injection.** In this step, The attackers mix the poisoning set \(\mathcal{P}\) into the clean training set \(\mathcal{D}\) and release the new dataset. The victims download the poisoning dataset and use it to train their own DNN models [16]:

\[\underset{\Theta}{\text{min}}\quad\frac{1}{N}\sum_{(x,y)\in\mathcal{D}}L(f(x ;\Theta),y)+\frac{1}{P}\sum_{(x^{\prime},k)\in\mathcal{P}}L\left(f(x^{\prime} ;\Theta),k\right), \tag{1}\]

where \(L\) is the classification loss such as the commonly used cross entropy loss. In this case, backdoor injection into DNNs has been completed silently.

**Backdoor activation.** In this step, the victims deploy their compromised DNN models on model-sharing platforms and model-selling platforms, such as Model Zoo and AWS Marketplace. The compromised model behaves normally when presented with benign inputs, but attackers can manipulate its predictions to align with their malicious objectives by providing specific samples containing pre-defined triggers.

#### 2.1.2 Examples of Backdoor Attacks

Here, we present three popular backdoor attack methods that serve as the baseline for our preliminary experiments, providing insight into the motivation discussed in Sec. 3. All attacks follow the pipeline described in Sec. 2.1.1.

**BadNets [16].** BadNets [16] is the pioneering backdoor attack in deep learning and is often used as a benchmark for subsequent research. It utilizes a \(2\times 2\) attacker-specified pixel patch as the universal trigger pattern attached to benign samples.

**Blended [5]** Chen _et al._[5] first discuss the requirement for invisibility in backdoor attacks. They propose that the poisoning image should be visually indistinguishable from its benign counterpart to evade human inspection. To meet this requirement, they introduce a blending strategy where poisoning images are created by blending the backdoor trigger with benign images. Formally, the poison generator can be formulated as \(\mathcal{T}(x,t)=\lambda\cdot t+(1-\lambda)\cdot x\), where \(\lambda\) represents the blend ratio (we set \(\lambda=0.15\) for all experiments in this paper), and \(t\) is an attacker-specified benign image serving as the universal trigger pattern.

**Universal Adversarial Perturbations (UAP) [70]** Inspired by Universal Adversarial Perturbations (UAPs) in adversarial examples, some studies [70, 9, 26] propose optimizing a UAP on a pre-trained clean model as the natural trigger, formulated as \(\mathcal{T}(x,t)=x+t\), where \(t\) is a pre-defined UAP serving as the universal trigger pattern. It's worth noting that UAP-based backdoor attacks require a clean model pre-trained on the entire training set, which is not suitable for the discussed settings. However, to better explain our motivation that previous technologies exhibit significant performance degradation in data-constrained backdoor attacks, we assume the availability of a clean model pre-trained on the original training dataset in this section. It is important to acknowledge that this assumption does not hold in an actual attack scenario.

### Contrastive Language-Image Pre-Training (CLIP) Model

Our method introduces the Contrastive Language-Image Pre-Training (CLIP) [46] model into backdoor injection and we introduce it here. CLIP is a revolutionary deep learning model developed by OpenAI that is designed to connects texts and images by bringing them closer in a shared latent space, under a contrastive learning manner. The CLIP model is pre-trained on 400 million image-text pairs harvested from the Web, containing two encoder: CLIP text encoder \(\hat{\mathcal{L}}_{t}(\cdot)\) and CLIP image encoder \(\hat{\mathcal{L}}_{t}(\cdot)\). These encoders project the text and image to
the CLIP common embedded feature space. Since natural language is able to express a much wider set of visual concepts, it contains ability to generalize across a wide range of tasks and domains, such as text-driven image manipulation [44], zero-shot classification [6], domain generalization [42]. To our best knowledge, our paper is the first study to explore the usage of CLIP model in the security community.

## 3 Data-constrained Backdoor Attacks

Here we first show the considered pipeline of data-constrained backdoor attacks, and than illustrate the performance degradation of previous attack methods on proposed data-constrained backdoor attacks. Finally, we attribute the degradation to the entanglement between the benign and poisoning features during the poisoning injection.

### Preliminaries

Previous methods [5, 12, 16, 27, 34, 39, 41, 59, 60] have commonly followed the attack pipeline outlined in Sec. 2.1.1. However, this widely adopted pipeline relies on an overly loose assumption that all training data is collected from a single source and that the attacker has access to the entire training data, which is often not the case in real-world attack scenarios. In this paper, we focus on a more realistic scenario: _Data-constrained Backdoor Attacks_, which necessitates the definition of a modified attack pipeline as follows:

**Pipeline of data-constrained backdoor attacks.** Similar to the general pipeline of backdoor attacks on neural networks, the proposed pipeline also consists of three steps: _poisoning set generation_, _backdoor injection_, and _backdoor activation_. The backdoor injection and activation steps remain unchanged from the previous pipeline. However, in the poisoning set generation step, data-constrained backdoor attacks differ from the previous pipeline. Instead of assuming access to the entire dataset \(\mathcal{D}\), data-constrained attacks only assume access to a clean training set \(\mathcal{D}^{\prime}=\{(x_{i},y_{i})|i=1,\cdots,N^{\prime}\}\), which follows a different data distribution from \(\mathcal{D}\). To address this, the attacker randomly selects a subset \(\mathcal{B}^{\prime}=\{(x_{i},y_{i})|i=1,\cdots,P\}\) from the accessible dataset \(\mathcal{D}^{\prime}\), and creates the corresponding poisoning set \(\mathcal{P}=\{(x^{\prime}_{i},k)|x^{\prime}_{i}=\mathcal{T}(x_{i},t),(x_{i}, y_{i})\in\mathcal{B}^{\prime},i=1,\cdots,P\}\). Additionally, based on the different constraints imposed by the accessible training set \(\mathcal{D}^{\prime}\), data-constrained backdoor attacks are further categorized into three types: _Number-constrained Backdoor Attacks_, _Class-constrained Backdoor Attacks_, and _Domain-constrained Backdoor Attacks_. The details can be found in Sec. 3.2, Sec 3.3, and Sec. 3.4, respectively.

**Experimental settings.** To evaluate the performance of three backdoor attack methods (BadNets, Blended, and UAP) under data-constrained scenarios, we conduct experiments on the CIFAR-10 dataset. Specifically, we consider three types of data constraints: number, class, and domain. The settings for the poisoning attacks follow those described in Sec. 2.1.2. In all attacks, we set the attack-target label \(k\) to category 0. For our experiments, we select the VGG-16 model as the victim model and employ SGD as the optimizer with a weight decay of 5e-4 and a momentum of 0.9. The batch size is set to 256, and the initial learning rate is set to 0.01. The learning rate is multiplied by 0.1 at the 35-th and 55-th epochs, and the training is conducted for a total of 70 epochs.

### Number-constrained Backdoor Attacks

**Definition.** Let \(\mathcal{D}^{\prime}\) denote the data manipulable by the malicious source, and \(\mathcal{D}\) represent all the data available to the data collector. In the number-constrained scenario, as illustrated in Fig. 2 (a), the data collector gathers data from multiple sources, including both malicious and benign sources, to form \(\mathcal{D}\). The data provided by each data source is independently and identically distributed. In other words, \(\mathcal{D}\) and \(\mathcal{D}^{\prime}\) belong to the same distribution, but in terms of quantity, \(N^{\prime}<N\). The setting of number-constrained backdoor attacks is similar to that of data-efficient backdoor attacks discussed in previous

Figure 2: Three data-constrained attack scenarios, where the data provided by each data source is independently and identically distribution in number-constrained backdoor attacks, each data source provides data belonging to different categories in class-constrained backdoor attacks, and each data source provides data from different domains in domain-constrained backdoor attacks.
studies [60, 70]. Both aim to improve the Attack Success Rate (ASR) under a low poisoning rate. However, previous studies assumed that the attacker has access to the entire training set \(\mathcal{D}\), which enables efficient trigger design and sample selection. For example, some studies [70] draw inspiration from Universal Adversarial Perturbations (UAPs) in adversarial examples and propose to optimize a UAP on a clean model pre-trained on the training set as the natural trigger. Xia _et al._[60] enhance the poisoning efficiency in backdoor attacks by selecting poisoning data from the entire training set. Although these methods have achieved remarkable results, they cannot be directly applied to number-constrained backdoor attacks due to the lack of access to the entire training set.

**Experimental results.** In this section, we investigate the performance degradation of previous studies in number-constrained backdoor attacks. As shown in Fig. 3, the attack success rate experiences a significant decrease as the number (\(P\)) of poisoning samples decreases, particularly for Blended backdoor attacks. It is worth noting that Universal Adversarial Perturbations (UAP) achieves relatively favorable results even with a low poisoning rate. This can be attributed to the utilization of a proxy model that is pre-trained on the entire training set (\(\mathcal{D}\)). However, in our settings, UAP is not accessible, and we present the results for UAP to effectively demonstrate the performance degradation even when a pre-trained proxy model is available.

### Class-constrained Backdoor Attacks

**Definition.** In the class-constrained scenario, let \(\mathcal{D}^{\prime}\) represent the data manipulable by the malicious source, and \(\mathcal{D}\) denote all the data available to the data collector. As depicted in part (b) of Fig. 2, the data collector gathers data from multiple sources, including both malicious and benign sources, to form \(\mathcal{D}\). Each data source provides data belonging to different categories, resulting in \(\mathcal{D}^{\prime}\) containing only a subset of categories present in \(\mathcal{D}\). Therefore, \(\mathcal{D}\) and \(\mathcal{D}^{\prime}\) follow distinct distributions. More specifically, the accessible clean training set \(\mathcal{D}^{\prime}\subset X\times Y^{\prime}(\mathcal{D}^{\prime}=\{(x_{i}, y_{i})|i=1,\cdots,N^{\prime}\})\) is a subset of the entire training set \(\mathcal{D}\subset X\times Y(\mathcal{D}=\{(x_{i},y_{i})|i=1,\cdots,N\})\), where \(Y^{\prime}\subset Y=\{1,2,\cdots,C\}\). Class-constrained backdoor attacks can be seen as a general setting of clean-label backdoor attacks [50, 53, 54]. In clean-label backdoor attacks, the accessible clean training set \(\mathcal{D}^{\prime}\) is defined as \(\mathcal{D}^{\prime}\subset X\times Y^{\prime}\), where \(Y^{\prime}=\{k\}\) and \(k\) represents the attack-target label.

**Experimental results.** In this section, we explore the performance degeneration of previous studies in class-constrained backdoor attacks. As illustrated in Fig. 4, attack success rate decreases as the number of class (\(C^{\prime}\)) in the poisoning set decreases, which is the similar as experimental results on the number-constrained backdoor attacks.

### Domain-constrained Backdoor Attacks

**Definition.** In the domain-constrained scenario, as depicted in part (c) of Fig. 2, the data collector gathers data from multiple sources (both malicious and benign) to form \(\mathcal{D}\). Each data source provides data from a different domain, resulting in \(\mathcal{D}^{\prime}\) containing only a subset of the domains present in \(\mathcal{D}\). Consequently, \(\mathcal{D}\) and \(\mathcal{D}^{\prime}\) belong to different distributions. We examine an extreme scenario in domain-constrained backdoor attacks, where the test dataset follows the same distribution as the benign source (\(\mathcal{D}\setminus\mathcal{D}^{\prime}\)) and is outside the domain of the malicious source \(\mathcal{D}^{\prime}\subset X\times Y^{\prime}\) (\(\mathcal{D}^{\prime}=\{(x_{i},y_{i})|i=1,\cdots,N^{\prime}\}\)).

**Experimental results.** To simulate the domain-constrained

Figure 4: The attack success rate (ASR) in the class-constrained backdoor attack. The experiments are conducted with triggers BadNets, Blended, and UAP, with a poisoning rate of 2% (\(P=1000\)) for each. The x-axis represents the number of classes (\(|Y^{\prime}|\)) in the poisoning set \(\mathcal{D}^{\prime}\). Specifically, ’1 (1)’ and ’1 (0)’ denote dirty-label single-class (\(Y^{\prime}=\{c\},c\neq k\)) and clean-label single-class (\(Y^{\prime}=\{k\}\)), respectively. The experiment is repeated 5 times, and the solid lines indicate the average results.

Figure 3: The attack success rate (ASR) in the number-constrained backdoor attacks. The abscissa is the number (\(P\)) of samples in the poisoning set \(\mathcal{D}^{\prime}\). The experiment is repeated 5 times, and the solid lines represent the mean results.
scenario, we conducted experiments with the following settings in this section: we designate the CIFAR-10 dataset as the benign source, the ImageNet dataset as the malicious source, and evaluated the attack performance on the CIFAR-10 dataset. Fig. 5 illustrates the results, showing a decrease in the attack success rate as the domain rate (the proportion of poisoning sets sampled from \(\mathcal{D}\setminus\mathcal{D}^{\prime}\) and \(\mathcal{D}^{\prime}\)) in the poisoning set decreases. This observation aligns with the experimental findings in the number-constrained and class-constrained backdoor attacks.

### Entanglement Between Benign and Poisoning Features

In our data-constrained backdoor attacks, we have made two significant observations. Firstly, we have noticed a severe performance decline in class-constrained and domain-constrained backdoor attacks. Secondly, we consistently found that BadNets outperforms Blended in terms of attack efficiency. We attribute these observations to the entanglement between benign and poisoning features. Our study is the first to investigate feature entanglement in the context of backdoor attacks, providing new insights into backdoor learning. Ideally, we would expect backdoor models to rely solely on poisoning features to make decisions when encountering poisoning samples, as this would be the most efficient approach for backdoor attacks. However, neural networks tend to be greedy and utilize all features for decision-making [31], leading to activation of both poisoning and benign features during backdoor injection. This results in reduced poisoning efficiency when there is a difference in benign features between the backdoor injection and activation phases, as observed in data-constrained backdoor attacks.

We have further investigated our hypothesis and present our findings in Fig. 6. As shown in Fig. 6 (a), the attack efficiency of number-constrained, dirty-label single-class, and clean-label single-class backdoor attacks4 decreases in turn under the same poison rate. To understand the reason behind this phenomenon, we provide visualizations of the backdoor injection and activation phases for these three attacks in Fig. 6 (b). For the **number-constrained backdoor attack**, the distribution of poisoning samples (consisting of both benign and poisoning features) in the backdoor injection phase is the same as that in the backdoor activation phase. In other words, both benign and poisoning features are activated simultaneously during both phases. However, for the **dirty-label single-class backdoor attack**, the distribution of poisoning samples (consisting of single-class benign and poisoning features) in the backdoor injection phase is different from that in the backdoor activation phase. During the injection phase, both benign and poisoning features are activated, but during activation phase, only the poisoning feature is activated. This is the reason why previous attack methods on dirty-label single-class backdoor attacks exhibit performance degeneration. The **clean-label single-class backdoor attack** is similar to the dirty-label single-class backdoor attack in terms of the distribution of poisoning samples. However, during backdoor injection, there is competing activation5 between benign and poisoning features. Consequently, the poisoning efficiency of clean-label single-class backdoor attacks is lower than that of dirty-label single-class backdoor attacks.

Footnote 4: In the clean-label single-class backdoor attack, the benign feature of the accessible class (the same as the attack-target class) in both poisoning and clean sets is labeled with the same label (e.g., “Fish” in Fig. 6), and the clean set contains more samples of the attack-target class. As a result, the presence of the benign feature in the poisoning set hampers the activation of the poisoning features. In contrary, the benign feature of the accessible class in poisoning and clean sets is labeled with the different label in the dirty-label single-class backdoor attack (e.g., the benign feature in the clean set is labeled as “Frog”, while the benign+poisoning feature in the poisoning set is labeled as “Fish”). Consequently, the benign feature in the poisoning set does not impact the activation of the poisoning features.

In summary, performance degeneration in data-constrained backdoor attacks can be attributed to entanglement between benign and poisoning features. BadNets exhibits simpler triggers compared to Blended, leading to less entanglement and a higher attack success rate.

## 4 CLIP-guided Backdoor Attacks Method

In this section, we present our approach, which consists of two components: **Clean Feature Suppression** and **Poisoning Feature Augmentation**. These components are independent of each other and can be seamlessly combined. Specifically, Clean Feature Suppression can be implemented through _CLIP-based Clean Feature Erasing (CLIP-CFE)_, and Poisoning Feature Augmentation has included two technolo

Figure 5: The attack success rate (ASR) in the domain-constrained backdoor attack. The poisoning rates of experiments with trigger BadNets, Blended, and UAP are 2% (\(P=1000\)), 2% (\(P=1000\)), and 1% (\(P=500\)), respectively. The abscissa is the domain rate that represents the proportion of poisoning sets sampled from \(\mathcal{D}\setminus\mathcal{D}^{\prime}\) and \(\mathcal{D}^{\prime}\)). The experiment is repeated 5 times, and the solid lines represent the mean runs.
gies: _CLIP-based Universal Adversarial Perturbations_ (_CLIP-UAP_) and _CLIP-based Contrastive Feature Augmentation_ (_CLIP-CFA_). By seamlessly integrating these two orthogonal aspects, our method presents a comprehensive and versatile solution that addresses all three types of data-constrained backdoor attacks. Before proposing the attack method, we first introduce threat model considered in our work.

### Threat Model

**Attack scenario.** The proliferation of large-scale artificial intelligence models, such as ChatGPT and Stable Diffusion, necessitates the collection of massive amounts of data from the web. However, the security and trustworthiness of this data cannot always be guaranteed. This data collection pipeline inadvertently introduces vulnerabilities that can be exploited by data-based backdoor attacks. Attackers can strategically inject poisoning data into the training dataset and publish it on the internet, potentially compromising the integrity and performance of these models. Unlike previous attack scenarios where all training data is sourced from a single provider, we consider a more realistic scenario in which victims collect data from multiple sources. In this scenario, attackers only have access to a portion of the training dataset. This situation mirrors the real-world training process of models that utilize diverse public data. By acknowledging the challenges posed by multi-source data collection and limited attacker access, our study provides valuable insights into the security implications of such scenarios.

**Attack goal.** The objective of our paper is aligned with popular backdoor attacks, as seen in previous studies [16, 24]. The attackers aim to activate a hidden trigger within the model by providing specific inputs, leading the model to produce incorrect results. Our attack strategy emphasizes three key properties: (i) _Minimal side effects:_ The backdoor attacks should not adversely impact the accuracy of the model on benign inputs. (ii) _Effective backdoor:_ The attack should have a high success rate across various datasets and models, ensuring its efficiency. (iii) _Stealthy attack:_ The backdoor attacks should be inconspicuous and difficult to detect, maintaining their stealthiness. Our research aims to develop invigorative backdoor attacks that strike a balance between effectiveness and preserving the integrity of the model's performance on legitimate inputs.

**Attackers' prior knowledge.** In order to simulate a realistic scenario, we assume that the attackers have no access to the models or training details. They possess only general knowledge about the class labels involved in the task. This assumption reflects a more challenging and practical setting, where attackers have limited information about the target system.

**Attackers' capabilities.** Building upon previous studies [16], we make the assumption that the attackers possess the capability to control the training data. However, we further impose a stricter assumption in this work, stating that the attackers have control over only a portion of the training data. Consequently, we divide the attack scenario into three distinct tasks, each representing different capabilities of the attacker. These tasks include: (i) _Number-constrained backdoor attacks_, where the attacker has access to only a subset of the training data; (ii) _Class-constrained backdoor attacks_, where the attacker has access to only a subset of the classes in the training data; and (iii) _Domain-constrained backdoor attacks_, where the attacker has access to only a subset of the domains within the training data. By considering these various constraints, we provide a comprehensive analysis of backdoor attacks in different data-constrained scenarios.

### Clean Feature Suppression

As described in Sec. 3, the effectiveness of data-constrained backdoor attacks is hindered due to the entanglement of be

Figure 6: Analyses the entanglement between benign and poisoning features on the number-constrained, dirty-label single-class, and clean-label single-class backdoor attacks.
nign and poisoning features during the backdoor injection phase. To address this challenge, we propose a solution called "clean feature suppression" in this section. The primary objective of this approach is to minimize the impact of benign features on the decision-making process, thus amplifying the significance of poisoning features.

#### 4.2.1 CLIP-based Clean Feature Erasing

To achieve clean feature suppression, we can employ a feature extractor pre-trained on the entire training set (As shown in **Clean Feature Erasing Noise**). However, since our data-constrained backdoor attacks lack access to the complete training set, an alternative solution is required. Recent studies have shown that pre-trained CLIP [46] generates consistent and robust semantic representations across a wide range of (image, text) pairs, enabling impressive zero-shot classification performance comparable to supervised learning accuracy on challenging datasets like ImageNet (As shown in **CLIP for Zero-shot Classification**). Hence, we can utilize the pre-trained general model CLIP, which replacesSS the feature extractor trained on the entire training set, allowing us to achieve clean feature suppression (As shown in **CLIP for Clean Feature Erasing**).

Footnote §: CLIP [46] is a general pre-trained model that has been released by OpenAI. It is pre-trained on 400 million image-text pairs harvested from the Web and can express a much wider set of visual concepts.

**Clean Feature erasing noise.** The technique of clean feature suppression aims to eliminate the clean information present in images by introducing optimized noise, denoted as \(\delta\), which helps modify the input image to resemble the unbiased class. In accordance with the data-constrained backdoor attack pipeline outlined in Sec. 3, we assume that the chosen clean training dataset for generating the poisoning set consists of \(P\) clean examples, denoted as \(\mathcal{D}^{\prime}\subset X\times Y\) (where \(\mathcal{D}^{\prime}=\{(x_{i},y_{i})|i=1,\cdots,P\}\)). Here, \(x_{i}\in X\) represents the inputs, \(y_{i}\in Y=\{1,2,\cdots,C\}\) represents the labels, and \(C\) denotes the total number of classes. We refer to the modified version as \(\mathcal{P}_{e}=\{(x_{e,i},y_{i})|i=1,\cdots,P\}\), where \(x_{e,i}=x_{i}+\delta_{i}\) represents the erased version of the training example \(x_{i}\in\mathcal{D}^{\prime}\). The term \(\delta_{i}\in\Delta\) denotes the "invisible" noise applied to achieve the erasing effect. The noise \(\delta_{i}\) is subject to the constraint \(||\delta_{i}||_{p}\leq\epsilon\), where \(||\cdot||_{p}\) represents the \(L_{p}\) norm, and \(\epsilon\) is set to a small value to ensure the stealthiness of the backdoor attacks. Our objective in erasing the clean features is to ensure that the pre-trained feature extractor does not extract any meaningful information from the given images \(x\). This is achieved by introducing customized and imperceptible noise, denoted as \(\delta_{i}\). To be more specific, for a clean example \(x_{i}\), we propose to generate the noise \(\delta_{i}\) that erases the features by solving the following optimization problem:

\[\delta_{i}=\operatorname*{arg\,min}_{\delta_{i}}L(f^{\prime}(x_{i}+\delta_{i} ),y_{m})\quad\text{s.t.}\quad||\delta_{i}||_{p}\leq\epsilon, \tag{2}\]

where \(L\) represents the mean squared error (MSE) loss, defined as \(L(a,b)=||a-b||^{2}\). The function \(f^{\prime}(\cdot)\) corresponds to the pre-trained feature extractor employed for noise generation. Additionally, \(y_{m}\) denotes the unbiased label for the classification task, which is defined as \(y_{m}=[\frac{1}{C},\frac{1}{C},\cdots,\frac{1}{C}]\), where \(C\) signifies the total number of classes. While this vanilla method proves effective in erasing clean features, it requires a proxy feature extractor that has been pre-trained on the entire training set. This approach is not suitable for our data-restricted backdoor attacks.

**CLIP for zero-shot classification.** The pre-trained CLIP model [46] possesses the ability to express a broader range of visual concepts and has been utilized as a general feature extractor in various tasks. These tasks include text-driven image manipulation [44], zero-shot classification [6], and domain generalization [42]. In this section, we introduce the pipeline of CLIP in zero-shot classification, which can serve as inspiration for incorporating it into our clean feature erasing approach. CLIP achieves zero-shot classification by aligning text and image features. Firstly, CLIP employs its text encoder, denoted as \(\hat{\mathcal{E}}_{t}(\cdot)\), to embed the input prompts ("a photo of a \(c_{i}\)") into text features \(T_{i}\in\mathbb{R}^{d}\), where \(i=\{1,2,\cdots,C\}\) represents the classes. Subsequently, the image feature \(I_{j}\in\mathbb{R}^{d}\) of image \(x_{j}\) is embedded using the image encoder, denoted as \(\hat{\mathcal{E}}_{i}(\cdot)\). During the inference phase, the classification prediction \(y_{j}\) is computed using the cosine similarity between \(T_{i}\) and \(I_{j}\). This can be expressed as:

\[y_{j}=\operatorname*{arg\,max}_{i}(\langle I_{j},T_{i}\rangle),\quad i\in\{1,2,\cdots,C\}, \tag{3}\]

where \(C\) represents the number of classes, and \(\langle\cdot,\cdot\rangle\) represents the cosine similarity between two vectors.

**CLIP for Clean Feature Erasing (CLIP-CFE).** Taking inspiration from CLIP's approach to zero-shot classification, we leverage a general CLIP model to optimize the feature erasing noise. This allows us to relax the need for a proxy feature extractor pre-trained on the entire training set. We consider \(C\) prompts, "a photo of a \(c_{i}\)," corresponding to different classes \(c_{i}\) in the dataset, where \(i=1,\cdots,C\). The CLIP-based feature erasing noise, denoted as \(\delta_{i}\), is proposed for the input \(x_{i}\) by solving the following optimization problem:

\[\delta_{i}=\operatorname*{arg\,min}_{\delta_{i}}L(f_{CLIP}(x_{i}+\delta_{i}, \mathbb{P}),y_{m})\quad\text{s.t.}\quad||\delta_{i}||_{p}\leq\epsilon, \tag{4}\]

where \(L\) represents the mean squared error (MSE) loss, \(y_{m}\) denotes the unbiased label for the classification task defined as \(y_{m}=[\frac{1}{C},\frac{1}{C},\cdots,\frac{1}{C}]\), \(\mathbb{P}\) represents the set of prompts corresponding to different classes in the dataset, and \(f_{CLIP}\) denotes the CLIP-based model used to obtain the label of the input image. Specifically,

\[\mathbb{P}=\{p_{1},p_{2},\cdots,p_{C}\}=\{\text{``a photo of a $c_{i}$''}|i=1,2,\cdots,C\}, \tag{5}\]
\[f_{CLIP}(x_{i}+\delta_{i},\mathbb{P})= \tag{6}\] \[\bigg{[}\frac{\langle\hat{\mathcal{E}}_{t}(x_{i}+\delta_{i}),\hat{ \mathcal{E}}_{t}(p_{1})\rangle}{\sum_{i=1}^{C}\langle\hat{\mathcal{E}}_{t}(x_{ i}+\delta_{i}),\hat{\mathcal{E}}_{t}(p_{i})\rangle},\cdots,\frac{\langle\hat{ \mathcal{E}}_{t}(x_{i}+\delta_{i}),\hat{\mathcal{E}}_{t}(p_{C})\rangle}{\sum_{ i=1}^{C}\langle\hat{\mathcal{E}}_{t}(x_{i}+\delta_{i}),\hat{\mathcal{E}}_{t}(p_{i}) \rangle}\bigg{]}.\]

To solve the constrained minimization problem illustrated in Eq. 4, we utilize the first-order optimization method known as Projected Gradient Descent (PGD) [37]. The PGD method enables us to find a solution by iteratively updating the noise as follows:

\[\delta_{i}^{t+1}=\prod_{\epsilon}\big{(}\delta_{i}^{t}-\alpha\cdot\text{sign} (\nabla_{\delta}L(f_{CLIP}(x_{i}+\delta_{i}^{t},\mathbb{P}),y_{m}))\big{)}, \tag{7}\]

where \(t\) represents the current perturbation step, with a total of \(T=50\) steps. \(\nabla_{\delta}L(f_{CLIP}(x_{i}+\delta_{i}^{t},\mathbb{P}),y_{m})\) denotes the gradient of the loss with respect to the input. The projection function \(\prod\) is applied to restrict the noise \(\delta\) within the \(\epsilon\)-ball (with \(\epsilon=8/255\) in our paper) around the original example \(x\), ensuring it does not exceed this boundary. The step size \(\alpha\) determines the magnitude of the noise update at each iteration. The resulting erasing examples are then obtained as follows:

\[\mathcal{R}_{e}=\{(x_{e,i},y_{i})|i=1,\cdots,P\},\quad\text{where}\quad x_{e, i}=x_{i}+\delta_{i}^{T}. \tag{8}\]

### Poisoning Feature Augmentation

In addition to eradicating clean features in images to tackle the entanglement between benign and poisoning features, enhancing the expression of poisoning features is another effective approach. In this section, we present two parallel triggers aimed at augmenting the poisoning features.

#### 4.3.1 CLIP-based Universal Adversarial Perturbations

In this section, we also employ the widely-used pre-trained CLIP model [46] to generate universal adversarial perturbations as the backdoor trigger. Xia _et al._[61] argue that deep models inherently possess flaws, and it is easier to exploit and enhance an existing flaw to serve as a backdoor rather than implanting a new one from scratch (BadNets [16] and Blended [5]). Universal Adversarial Perturbations (UAP) [61, 70] utilize these inherent flaws in models as triggers, providing a straightforward method for augmenting the poisoning feature. However, this approach typically requires a feature extractor that has been pre-trained on the entire training set, which is not practical in data-constrained backdoor attacks. To address this limitation, we propose a CLIP-based5 Universal Adversarial Perturbations (CLIP-UAP) method. Specifically, given an accessible clean training set \(\mathcal{D}^{\prime}=\{(x_{i},y_{i})|i=1,\cdots,N^{\prime}\}\) and an attack-target label \(k\), the defined trigger can be formulated as follows:

\[\delta_{\text{aug}}=\underset{\|\delta_{\text{aug}}\|_{p}\leq\epsilon}{\arg \min}\sum_{(x,y)\in\mathcal{D}^{\prime}}L(f_{CLIP}(x+\delta_{\text{aug}}, \mathbb{P}),k), \tag{9}\]

where \(\mathbb{P}\) and \(f_{CLIP}\) are defined as shown in Eq. 5 and Eq. 6, respectively. Similar to Eq. 7, we utilize the first-order optimization method known as Projected Gradient Descent (PGD) [37] to solve the constrained minimization problem. The optimization process can be expressed as follows:

\[\delta_{\text{aug}}^{t+1}=\prod_{\epsilon}\big{(}\delta_{\text{aug}}^{t}- \alpha\cdot\text{sign}(\nabla_{\delta_{\text{aug}}}L(f_{CLIP}(x+\delta_{ \text{aug}}^{t},\mathbb{P}),k))\big{)}, \tag{10}\]

where \(t\), \(\nabla_{\delta_{\text{aug}}}L(f_{CLIP}(x+\delta_{\text{aug}}^{t},\mathbb{P} ),k)\), and \(\prod\) hold the same meaning as in Eq. 7. Unlike the sample-wise clean feature erasing noise, the CLIP-UAP serves as a universal trigger for the entire training set. Therefore, it follows the optimization formulation presented in Eq. 10 to generate \(\delta_{\text{aug}}^{t+1}\) at each step \(t\). The optimization process is performed on all samples in the accessible clean training set \(\mathcal{D}^{\prime}\). Consequently, the CLIP-UAP for the set \(\mathcal{D}^{\prime}\) can be represented as \(\delta_{\text{aug}}=\delta_{\text{aug}}^{T}\), and the poison generator is formulated as \(\mathcal{T}(x,\delta_{\text{aug}})=x+\delta_{\text{aug}}\).

#### 4.3.2 CLIP-based Contrastive Feature Augmentation

While the CLIP-UAP method has shown impressive results in terms of poisoning efficiency, it requires customization for different attack-target labels. In this section, we propose a more versatile trigger design that is independent of the attack-target label, enhancing the poisoning feature. Drawing inspiration from the entanglement between benign and poisoning features discussed in Sec. 3.5, we utilize contrastive optimization to augment the poisoning feature. Our expectation is that the poisoning feature extracted from the designed trigger will be more expressive compared to the clean feature extracted from the clean samples. Specifically, given a trigger \(\delta_{\text{con}}^{t+1}\) to be optimized, two random views (query: \(x+\delta_{\text{con}}\) and key: \(x_{1}+\delta_{\text{con}}\)) are created by different clean samples (\(x\) and \(x_{1}\)). Positive pair is defined as such query-key pair, between different poisoning samples. Negative pairs are defined as pairs between poisoning example and its corresponding clean example, _i.e._ between \(x+\delta_{\text{con}}\) and \(x\). All views are passed through the pre-trained image encoder \(\hat{\mathcal{E}}_{t}(\cdot)\) of the CLIP to acquire the representation \(v\):

\[v_{q}=\hat{\mathcal{E}}_{t}(x+\delta_{\text{con}}),\quad v_{+}=\hat{\mathcal{ E}}_{t}(x_{1}+\delta_{\text{con}}),\quad v_{-}=\hat{\mathcal{E}}_{t}(x). \tag{11}\]

CLIP-Contrastive feature augmentation (CLIP-CFA) focuses on optimizing the general trigger by maximizing the similarity between positive pairs while ensuring dissimilarity between negative pairs. To achieve this, we design a loss function as follows:

\[L_{\text{con}}(x,x_{1},\delta_{\text{con}})=-\frac{\langle v_{q},v_{+}\rangle}{ \langle v_{q},v_{-}\rangle}, \tag{12}\]
where \(\langle\cdot,\cdot\rangle\) represents the cosine similarity between two vectors and the optimization of \(\delta_{\text{con}}\) is designed as:

\[\delta_{\text{con}}=\operatorname*{arg\,min}_{\|\delta_{\text{con}}\|_{p}\leq \epsilon}\sum_{(x,y)\in\mathcal{D}^{\prime}}L_{\text{con}}(x,x_{1},\delta_{ \text{con}}). \tag{13}\]

Similar to Eq. 10, we also adopt the first-order optimization method PGD [37] to solve the constrained minimization problem as follows:

\[\delta_{\text{con}}^{+1}=\prod_{\epsilon}\big{(}\delta_{\text{con}}^{\prime}- \alpha\cdot\text{sign}(\nabla_{\delta_{\text{con}}}L_{\text{con}}(x,x_{1}, \delta_{\text{con}}))\big{)}. \tag{14}\]

Therefore, the optimization should also be accumulated on all samples in the accessible clean training set \(\mathcal{D}^{\prime}\). Finally, the CLIP-CFA of set \(\mathcal{D}^{\prime}\) can be formulated as \(\delta_{\text{con}}=\delta_{\text{con}}^{T}\), and the poison generator is formulated as \(\mathcal{T}(x,\delta_{\text{con}})=x+\delta_{\text{con}}\).

### Attack Summary

In Sec. 4.3, we present two independent trigger design methods: CLIP-based Universal Adversarial Perturbations (CLIP-UAP) and CLIP-based Contrastive Feature Augmentation (CLIP-CFA). These triggers are aimed at enhancing the expression of poisoning features and can replace previous trigger design approaches, leading to improved performance in data-constrained backdoor attacks. Additionally, in Sec. 4.2, we introduce a CLIP-based Clean Feature Erasing (CLIP-CFE) method. This approach minimizes the influence of clean features during the poisoning process and can be integrated into any of the aforementioned trigger design methods. By combining trigger design and clean feature erasing, our final approach achieves state-of-the-art performance in all three types of data-constrained backdoor attacks.

## 5 Experiments

We provides an overview of the experimental settings in this paper, covering various aspects such as datasets, model architecture, evaluation metrics, baselines, and implementations (Appendix 7.1). Subsequently, we perform comprehensive experiments to assess the effectiveness of our proposed methods through answering the following research questions:

**RQ1: Are proposed technologies effective on three backdoor attacks?** (Sec. 5.1)

**RQ2: Are proposed technologies harmless for Benign Accuracy?** (Sec. 5.2)

**RQ3: Are proposed technologies stealthy for victims?** (Sec. 5.3)

**RQ4: Are proposed technologies effective for different poisoning settings?** (Sec. 5.4)

In this section, we present the results specifically for CIFAR-100 datasets. Experimental outcomes for CIFAR-10 and ImageNet-50 are provided in Appendix 7.2 and Appendix 7.3 respectively. Additionally, for further discussions, please refer to Appendix 7.5.

Figure 7: Attack success rate (ASR) of the **(a):** number-constrained backdoor attacks, **(b):** clean-label single-class attack (the access category \(Y^{\prime}\) is set to \(\{0\}\)), **(c):** dirty-label single-class attack (the access category \(Y^{\prime}\) is set to \(\{1\}\)), and **(d):** domain-constrained backdoor attacks (domain rate is set to \(0\)) on the CIFAR-100 dataset. The red points represents w/o CLIP-based Clean Feature Erasing (CLIP-CFE), while the green points represents w/ CLIP-CFE. All experiments are repeated 5 times, and the results are computed withthe mean of five different runs.
### RQ1: Are proposed technologies effective on three backdoor attacks?

To assess the effectiveness of our proposed technologies, we conduct attacks on various target models and datasets, evaluating the Attack Success Rate (ASR) for each target model. In order to establish a basis for comparison, we introduce two baseline attack methods: BadNets [16] and Blended [5], as discussed in Sec. 2.1.2. Fig. 7 illustrates the performance of the following types of backdoor attacks on the CIFAR-100 dataset: (a) number-constrained, (b) clean-label single-class (class-constrained), (c) dirty-label single-class (class-constrained), and (d) out-of-the-domain (domain-constrained)++.

Footnote †: *: As shown in Appendix 7.1, CIFAR-10 and CIFAR-100 have low resolution, which makes unclear visualizations. Therefore, we show the results on the ImageNet-50 dataset in this section.

**CLIP-based poisoning feature augmentation is more effective than previous attack methods.** Our proposed methods, CLIP-UAP and CLIP-CFA, outperform the baseline techniques (BadNets [16] and Blended [5]++) in terms of consistency across different attacks and target models. Specifically, we achieved an ASR of 0.878, 0.825, 0.984, and 0.988 for BadNets, Blended, CLIP-UAP, and CLIP-CFA, respectively, in the number-constrained backdoor attack on the VGG-16 dataset. These results provide evidence that our proposed poisoning feature augmentation generates more effective triggers compared to other methods.

Footnote †: *: As shown in Appendix 7.1, CIFAR-10 and CIFAR-100 have low resolution, which makes unclear visualizations. Therefore, we show the results on the ImageNet-50 dataset in this section.

**CLIP-based Clean Feature Suppression is useful for different attack methods.** Our proposed method, CLIP-CFE, has shown significant improvements in effectiveness compared to the baseline method without CLIP-CFE. In various cases, CLIP-CFE has enhanced the poisoning efficiency significantly. For instance, in the clean-label single-class backdoor attack on the VGG-16 dataset, we observed remarkable improvements of 187%, 150%, 110%, and 229% for BadNets, Blended, CLIP-UAP, and CLIP-CFA, respectively. However, it is worth noting that in the results of the domain-constrained backdoor attacks on MobileNet-V2 (as depicted in the right part of Fig. 7 (d)), CLIP-CFA and CLIP-UAP only slightly outperform the corresponding methods with CFE.

**More discussion.** While our technologies have shown significant improvements in poisoning efficiency compared to baseline methods, there are still important discussions that need to be addressed. We aim to provide answers to the following questions in a systematic manner in Appendix 7.5: i) Why do we observe performance degradation in the clean-label single-class attack? ii) Why are domain-constrained backdoor attacks generally easier compared to class-constrained backdoor attacks?

### RQ2: Are proposed technologies harmless for Benign Accuracy?

As shown in Table 1, our proposed methods, CLIP-UAP and CLIP-CFA, exhibit similar or even better average Benign Accuracy (BA) compared to the baseline methods, BadNets [16] and Blended [5]. Additionally, it is worth noting that our proposed method, CLIP-CFE, does not negatively impact BA. This finding confirms that our technologies are harmless to the benign accuracy compared to baseline methods, even under various settings and different backdoor attacks.

### RQ3: Are proposed technologies stealthy for victims?

Fig. 8 showcases examples of poisoning images generated by different attacks on the ImageNet-50** dataset. While our CLIP-UAP and CLIP-CFA may not achieve the highest stealthiness in terms of SSIM (as indicated in Table 2), the

\begin{table}
\begin{tabular}{c c c c|c c c|c c c|c c c|c} \hline \hline \multirow{2}{*}{Trigger} & Clean Feature & \multicolumn{8}{c}{Backdoor Attacks} & \multirow{2}{*}{Average} \\ \cline{3-14}  & Suppression & \multicolumn{3}{c}{Number Constrained} & \multicolumn{3}{c}{Class Constrained (\(Y^{\prime}=\{0\}\))} & \multicolumn{3}{c}{Class Constrained (\(Y^{\prime}=\{1\}\))} & \multicolumn{3}{c}{Domain Constrained} \\  & & V-16 & R-18 & M-2 & V-16 & R-18 & M-2 & V-16 & R-18 & M-2 & V-16 & R-18 & M-2 & \multirow{3}{*}{Average} \\ \hline \multirow{2}{*}{BadNets} & w/o CLIP-CFE & 0.698 & 0.728 & 0.722 & 0.698 & 0.730 & 0.728 & 0.700 & 0.728 & 0.729 & 0.699 & 0.727 & 0.728 & 0.718 \\  & w/ CLIP-CFE & 0.700 & 0.730 & 0.728 & 0.701 & 0.731 & 0.723 & 0.698 & 0.730 & 0.726 & 0.701 & 0.730 & 0.724 & 0.719 \\ \hline \multirow{2}{*}{Blended} & w/o CLIP-CFE & 0.700 & 0.727 & 0.722 & 0.700 & 0.726 & 0.725 & 0.701 & 0.729 & 0.723 & 0.698 & 0.729 & 0.725 & 0.717 \\  & w/ CLIP-CFE & 0.700 & 0.730 & 0.727 & 0.701 & 0.729 & 0.727 & 0.699 & 0.730 & 0.724 & 0.700 & 0.731 & 0.727 & 0.719 \\ \hline \multirow{2}{*}{CLIP-UAP} & w/o CLIP-CFE & 0.702 & 0.730 & 0.727 & 0.702 & 0.729 & 0.727 & 0.701 & 0.730 & 0.725 & 0.702 & 0.731 & 0.729 & 0.720 \\  & w/ CLIP-CFE & 0.700 & 0.731 & 0.725 & 0.702 & 0.732 & 0.726 & 0.699 & 0.732 & 0.724 & 0.700 & 0.730 & 0.725 & 0.719 \\ \hline \multirow{2}{*}{CLIP-CFA} & w/o CLIP-CFE & 0.703 & 0.731 & 0.727 & 0.701 & 0.730 & 0.725 & 0.701 & 0.730 & 0.727 & 0.700 & 0.731 & 0.727 & 0.719 \\  & w/ CLIP-CFE & 0.702 & 0.729 & 0.729 & 0.701 & 0.730 & 0.727 & 0.702 & 0.731 & 0.725 & 0.702 & 0.730 & 0.727 & 0.720 \\ \hline \hline \end{tabular}
\end{table}
Table 1: The Benign Accuracy (BA) on the CIFAR-100 dataset. All results are computed the mean by 5 different run.
poisoning images generated by our methods appear more natural to human inspection compared to the baseline attacks. Additionally, incorporating CLIP-CFE has minimal impact on both PSNR and the natural appearance of the images, while achieving higher stealthiness in terms of SSIM.

### RQ4: Are proposed technologies effective for different poisoning settings?

**Experiments on different poison rates for number-constrained backdoor attacks.** We conduct ablation studies to assess the effectiveness of our proposed methods in reducing the number of poisoning samples (poisoning rates) for number-constrained backdoor attacks. The results depicted in Fig. 9 demonstrate the following: i) The attack success rate increases with higher poisoning rates for different attacks. ii) Our proposed CLIP-UAP and CLIP-CFA outperform the baseline techniques, BadNets [16] and Blended [5]. iii) The incorporation of our proposed CLIP-CFE further enhances the poisoning effectiveness across different triggers.

**Experiments on different poison classes for class-constrained backdoor attacks.** We conduct ablation studies to assess the effectiveness of our proposed methods in increasing the number of poisoning classes for class-constrained backdoor attacks. The results presented in Fig. 10 demonstrate the following: i) The attack success rate increases with higher poisoning classes for different attacks. ii) The attack success rate of clean-label single-class attack is lower than that of dirty-label single-class attacks. iii) Our proposed methods, CLIP-UAP and CLIP-CFA, outperform the baseline techniques, BadNets [16] and Blended [5]. iv) The incorporation of our proposed CLIP-CFE further enhances the poisoning effectiveness across different triggers.

**Experiments on different domain rates for domain-constrained backdoor attacks.** We conduct ablation studies to assess the effectiveness of our methods in increasing the domain rate for domain-constrained backdoor attacks. The results depicted in Fig. 11 demonstrate the following: i) The ASR increases with higher domain rates for different attacks. ii) Our proposed CLIP-UAP and CLIP-CFA outperform the baseline techniques, BadNets [16] and Blended [5]. iii) The incorporation of our proposed CLIP-CFE further enhances the poisoning effectiveness across different triggers.

**Experiments on different large pre-trained models.** We utilize the pre-trained CLIP model as the basis for our technologies. It's worth noting that the community has proposed various CLIP variants. Therefore, an important practical consideration is whether our proposed technologies remain robust when applied different pre-trained CLIP models. To investigate this, we conduct ablation studies on different CLIP models for number-constrained backdoor attacks, as depicted in Fig. 12. The results demonstrate that our proposed technologies exhibit robustness across different CLIP models, with ViT-B/32 emerging as a competitive choice for all methods.

Figure 8: Visualizations of the poisoning samples with different triggers.
## 6 Limitations and Future Works

In this paper, we address the challenges of data-constrained backdoor attacks, which occur in more realistic scenarios where victims collect data from multiple sources and attackers cannot access the full training data. To overcome the performance degradation observed in previous methods under data-constrained backdoor attacks, we propose three technologies from two streams that leverage the pre-trained CLIP model to enhance the efficiency of poisoning. Our goal is to inspire the research community to explore these realistic backdoor attack scenarios and raise awareness about the threats posed by such attacks. In the following section, we discuss the limitations of our approach and outline potential future directions for backdoor learning research.

**Performance degradation in clean-label backdoor attacks.** Clean-label backdoor attacks present a significant challenge [69]. As shown in Fig. 7, previous methods exhibit a poor ASR, and our technologies show limited improvement in clean-label backdoor attacks when the poisoning rate is low. In future research, we will investigate the underlying reasons for this situation and explore more efficient attack methods specifically designed for clean-label backdoor attacks.

**Application limitations.** Our technologies depend on the CLIP model that is pre-trained on natural images, which may limit their applicability to certain domains such as medical images or remote sensing. In such cases, a possible solution

Figure 11: The attack success rate on the CIFAR-100 dataset with different domain rates. All results were computed as the mean of five different runs.

Figure 12: The attack success rate on the CIFAR-100 dataset across different pre-trained CLIP models for number-constrained backdoor attacks. All results are averaged over five separate runs.

Figure 10: The attack success rate on the CIFAR-100 dataset with different accessible class of poisoning samples, where 1 (0) and 1 (1) in the abscissa represent the clean-label and dirty-label single-class attacks, respectively. All results were computed as the mean of five different runs.

Figure 9: The attack success rate on the CIFAR-100 dataset with different poisoning rates. All results were computed as the mean of five different runs.
is to replace CLIP with a domain-specific pre-trained model, such as MedCLIP [36] for medical images or Satellite [1] for remote sensing, to adapt our methods to the target domain.

**Transfer to other domains.** The attack scenario we have defined is not limited to a specific domain and can be applied to other important applications, including backdoor attacks for malware detection, deepfake detection, and federated learning. In our future work, we plan to explore the design of realistic attack scenarios and efficient backdoor attacks specifically tailored for these applications.
