Clean Label Backdoor Attack Based on Feature Distance Guided Sample Selection and Noise Optimization

To address the limitations of existing clean-label backdoor attacks, particularly concerning feature space heterogeneity, we propose a novel feature-distance-guided clean-label backdoor attack method. Specifically, we first introduce a sample selection strategy based on feature discrepancy and recognizability constraints. This strategy involves calculating the mean feature vector for each class within the dataset and subsequently employing the Fréchet Inception Distance to quantify the deviation of individual sample feature vectors from their respective class mean, thereby identifying samples significantly diverging from the class distribution. Subsequently, we present an innovative noise generation technique termed Feature Displacement-Driven Noise Iteration. For each selected training sample, we iteratively adjust the intensity of the added noise to effectively amplify its feature distribution divergence while rigorously preserving the recognizability of the sample’s original label, ultimately yielding highly optimized adversarial noise. Finally, this iterated noise, along with a pre-defined trigger, is embedded into the chosen training samples to construct poisoned samples, which are then utilized for model training. Experimental results unequivocally demonstrate that, compared to existing techniques, our proposed method significantly enhances the attack success rate by 0.88% to 13.99%, while maintaining nearly identical classification accuracy on benign samples. This conclusively validates the superior performance of our approach.