  Backdoor attacks are rapidly emerging threats to deep neural networks (DNNs).
In the backdoor attack scenario, attackers usually implant the backdoor into
the target model by manipulating the training dataset or training process.
Then, the compromised model behaves normally for benign input yet makes
mistakes when the pre-defined trigger appears. In this paper, we analyze the
drawbacks of existing attack approaches and propose a novel imperceptible
backdoor attack. We treat the trigger pattern as a special kind of noise
following a multinomial distribution. A U-net-based network is employed to
generate concrete parameters of multinomial distribution for each benign input.
This elaborated trigger ensures that our approach is invisible to both humans
and statistical detection. Besides the design of the trigger, we also consider
the robustness of our approach against model diagnose-based defences. We force
the feature representation of malicious input stamped with the trigger to be
entangled with the benign one. We demonstrate the effectiveness and robustness
against multiple state-of-the-art defences through extensive datasets and
networks. Our trigger only modifies less than 1\% pixels of a benign image
while the modification magnitude is 1. Our source code is available at
https://github.com/Ekko-zn/IJCAI2022-Backdoor.
