Quiet Triggers, Loud Footprints: A Tri-Space Measurement Study of Backdoor Stealthiness
Backdoor attacks on deep neural networks are commonly evaluated by attack success rate and benign accuracy, yet their stealthiness remains inconsistently defined and measured.
ProofPaper ↗
Key points
- This paper presents a tri-space measurement study of backdoor stealthiness in image classification.
- We distinguish latent stealthiness---the ideal but unobservable difficulty of distinguishing a backdoored system from a benign one---from measurable footprints in three spaces: input, feature, and parameter space.
- We further analyze agreement and disagreement among stealthiness metrics and study how footprint measurements interact with attack success rate.
- Based on observed blind spots in existing measurements, we introduce two diagnostic metrics: Class-Specific Davies--Bouldin Index (CDBI), which captures class-conditional feature overlap, and TAC--UCLC Product (TUP), which identifies channels that are both trigger-responsive and downstream influential.
Sources (1)
- [1]Quiet Triggers, Loud Footprints: A Tri-Space Measurement Study of Backdoor StealthinessarXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 14, 10:29 AM
Backdoor attacks on deep neural networks are commonly evaluated by attack success rate and benign accuracy, yet their stealthiness remains inconsistently defined and measured.
This paper presents a tri-space measurement study of backdoor stealthiness in image classification.
Extractive summary: sentences quoted from the sources.