Deep neural networks have been recently demonstrated to be vulnerable to backdoor attacks. Specifically, by altering a small set of training examples, an adversary is able to install a backdoor that can be used during inference to fully control the model's behavior. While the attack is very powerful, it crucially relies on the adversary being able to introduce arbitrary, often clearly mislabeled, inputs to the training set and can thus be detected even by fairly rudimentary data filtering. In this paper, we introduce a new approach to executing backdoor attacks, utilizing adversarial examples and GAN-generated data. The key feature is that the resulting poisoned inputs appear to be consistent with their label and thus seem benign even upon human inspection.
This paper investigates an interesting problem, backdoor attack against neural networks. The main idea is to add a watermark pattern to the corners of the training images, so that the classifier is guided to leverage the watermark as a discriminative cue as opposed to the real content of the image. At the test stage, one can hence manipulate the classifier’s predictions by adding the watermark to the test images.
This paper is heavily built upon Gu et al. (2017)’s work. It shows that Gu et al. (2017)’s method can be easily defended by a data sanitization algorithm. To improve Gu et al.’s work, the authors propose to add watermark patterns to the adversarial examples or examples interpolated in GAN’s latent space. The intuition is that these examples are adversarial and hard to learn, forcing the classifier to focus on the watermark pattern instead. 
It is an interesting idea and an intuitive improvement over (Gu et al. 2017). However, the implementation of the idea could be improved. This paper does not propose any new attack algorithms. Instead, it investigates an existing adversarial attack method and the GAN based interpolation for the purpose of backdoor attack. As experiments are conducted on small-scale datasets, it is unclear how effective the improved backdoor attack is. Moreover, one of the main disadvantages of the proposed attack method is that simple data augmentation techniques, especially random cropping, can successfully defend against the attack. 
The quality of the paper writing could be improved. I had to read the paper more than twice and check the references now and then in order to understand some claims of the paper. The paper’s lack of clarity was actually also raised by probably one of the coauthors of the paper; see the comment “Dimitris: clarify this point” on Page 11. Please find some concrete suggestions below.
- Figure 1 is visually not appealing at all. Perhaps find better illustrative examples. 
- It is worth considering to add a separate section/paragraph to describe the details of Gu et al. (2017)’s method, given that this paper is heavily built upon Gu et al. (2017)’s work.
- It was unclear what the “reduced amplitude backdoor trigger” means until Section 4. If a context-dependent term has to be used in the introduction, explain it or refer the readers to the right place of the paper. 
- Merge Sections 4.3—4.5 with the experiment section (Section 5). The results of Section 4.3–4.5 are out of context without any explanation about the experiment setups. 
I have some concerns about Section 3, which is the main motivation of this work. As the authors noted in Appendix A that Gu et al.’s method works well with as few as 75 poised examples, the proposed sanitization algorithm would not be able to fail Gu et al.’s method by only identifying 20 out of 100 poised examples. 
How to control the parameter $\tau$ so that the perturbation appears plausible to humans?