  Deep neural networks (DNNs) are vulnerable to backdoor attacks, where the
adversary manipulates a small portion of training data such that the victim
model predicts normally on the benign samples but classifies the triggered
samples as the target class. The backdoor attack is an emerging yet threatening
training-phase threat, leading to serious risks in DNN-based applications. In
this paper, we revisit the trigger patterns of existing backdoor attacks. We
reveal that they are either visible or not sparse and therefore are not
stealthy enough. More importantly, it is not feasible to simply combine
existing methods to design an effective sparse and invisible backdoor attack.
To address this problem, we formulate the trigger generation as a bi-level
optimization problem with sparsity and invisibility constraints and propose an
effective method to solve it. The proposed method is dubbed sparse and
invisible backdoor attack (SIBA). We conduct extensive experiments on benchmark
datasets under different settings, which verify the effectiveness of our attack
and its resistance to existing backdoor defenses. The codes for reproducing
main experiments are available at \url{https://github.com/YinghuaGao/SIBA}.
