  Typical deep neural network (DNN) backdoor attacks are based on triggers
embedded in inputs. Existing imperceptible triggers are computationally
expensive or low in attack success. In this paper, we propose a new backdoor
trigger, which is easy to generate, imperceptible, and highly effective. The
new trigger is a uniformly randomly generated three-dimensional (3D) binary
pattern that can be horizontally and/or vertically repeated and mirrored and
superposed onto three-channel images for training a backdoored DNN model.
Dispersed throughout an image, the new trigger produces weak perturbation to
individual pixels, but collectively holds a strong recognizable pattern to
train and activate the backdoor of the DNN. We also analytically reveal that
the trigger is increasingly effective with the improving resolution of the
images. Experiments are conducted using the ResNet-18 and MLP models on the
MNIST, CIFAR-10, and BTSR datasets. In terms of imperceptibility, the new
trigger outperforms existing triggers, such as BadNets, Trojaned NN, and Hidden
Backdoor, by over an order of magnitude. The new trigger achieves an almost
100% attack success rate, only reduces the classification accuracy by less than
0.7%-2.4%, and invalidates the state-of-the-art defense techniques.

Computer Vision and Pattern Recognition;Artificial Intelligence