Unlabeled backdoor poisoning on trained-from-scratch semi-supervised learning

Abstract

Semi-supervised learning (SSL) aims to achieve competitive performance by labeling only a few training examples. However, unlabeled training examples from the wild are vulnerable to backdoor poisoning. Hence, networks trained by SSL tend to be injected with backdoors. Most existing backdoor attacks focus on labeled examples, while some backdoor poisoning methods on unlabeled examples require that SSL networks must be pre-trained on labeled examples. In this paper, we propose a backdoor poisoning method on unlabeled examples of trained-from-scratch SSL networks. We find that backdoor poisoning always fails when the poisoned unlabeled examples come from different classes, which is different from poisoning the labeled examples. The reason is that SSL algorithms always strive to correct them during training. Therefore, for unlabeled examples, we implement backdoor poisoning on examples from the target class. We propose a gradient matching strategy to craft poisoned examples such that their gradients match the gradients of target examples on the SSL network. This can fit poisoned examples to the target class and realize backdoor injection. Experiments show that our poisoning achieves state-of-the-art attack success rates on most SSL algorithms while ensuring the imperceptibility of backdoor patterns and bypassing modern backdoor defenses.