  Backdoor attacks have severely threatened deep neural network (DNN) models in
the past several years. These attacks can occur in almost every stage of the
deep learning pipeline. Although the attacked model behaves normally on benign
samples, it makes wrong predictions for samples containing triggers. However,
most existing attacks use visible patterns (e.g., a patch or image
transformations) as triggers, which are vulnerable to human inspection. In this
paper, we propose a novel backdoor attack, making imperceptible changes.
Concretely, our attack first utilizes the pre-trained victim model to extract
low-level and high-level semantic features from clean images and generates
trigger pattern associated with high-level features based on channel attention.
Then, the encoder model generates poisoned images based on the trigger and
extracted low-level semantic features without causing noticeable feature loss.
We evaluate our attack on three prominent image classification DNN across three
standard datasets. The results demonstrate that our attack achieves high attack
success rates while maintaining robustness against backdoor defenses.
Furthermore, we conduct extensive image similarity experiments to emphasize the
stealthiness of our attack strategy.
