  Backdoor attacks have been one of the emerging security threats to deep
neural networks (DNNs), leading to serious consequences. One of the mainstream
backdoor defenses is model reconstruction-based. Such defenses adopt model
unlearning or pruning to eliminate backdoors. However, little attention has
been paid to survive from such defenses. To bridge the gap, we propose Venom,
the first generic backdoor attack enhancer to improve the survivability of
existing backdoor attacks against model reconstruction-based defenses. We
formalize Venom as a binary-task optimization problem. The first is the
original backdoor attack task to preserve the original attack capability, while
the second is the attack enhancement task to improve the attack survivability.
To realize the second task, we propose attention imitation loss to force the
decision path of poisoned samples in backdoored models to couple with the
crucial decision path of benign samples, which makes backdoors difficult to
eliminate. Our extensive evaluation on two DNNs and three datasets has
demonstrated that Venom significantly improves the survivability of eight
state-of-the-art attacks against eight state-of-the-art defenses without
impacting the capability of the original attacks.
