K&L: Penetrating Backdoor Defense with Key and Locks

We appreciate the reviewer’s thoughtful feedback and detailed questions. Below, we provide responses to each concern with clarifications and additional insights.

---

1. Explanation of "High Binding" and Related Concepts:

Thank you for highlighting the need for greater clarity regarding "high binding." Our definition of "high binding" is consistent: it refers to a phenomenon where any trigger addition method that does not utilize model parameter information is tightly coupled to the parameters. In Section 3.2, we provide a two-fold argument to explain why existing methods exhibit high binding:

• Fixed-trigger methods rely on static triggers that are independent of model parameters, which makes them highly bound to these parameters.
• Input-dependent triggers may generate triggers dynamically, but without leveraging model parameters effectively, they also exhibit high binding.

A robust backdoor attack must dynamically generate triggers by utilizing model parameter information, thereby mitigating the limitations of high binding. We will enhance our explanation in the revised manuscript to ensure this concept is clearly conveyed.

---

2. Limitations of Existing Backdoor Attacks and Defense Mechanisms:

High binding is a key factor that limits the robustness of existing backdoor attacks. Fixed-trigger attacks, such as BadNet, depend on the model’s "memory" of trigger features to maintain stealthiness and activation efficiency. However, this tight coupling also renders the trigger sensitive to parameter changes, making defenses like ANP, BNP, and I-BAU effective by disrupting these abnormal parameters. For instance:

• Fixed-trigger methods: Vulnerable to parameter adjustments or pruning, which can significantly weaken or eliminate the backdoor effect.
• Input-dependent triggers (e.g., Input-Aware): These avoid fixed-trigger high binding but still rely heavily on either model parameters or generator parameters. Changes to the model can render their generated triggers ineffective.

We have also included results against a recent NeurIPS 2024 defense, Feature Shift Tuning (FST), in Global Response 1, showing that our method successfully penetrates this defense. These results further demonstrate the robustness of our approach compared to existing attacks.

---

3. Distinction Between K&L Backdoor Attack and Adversarial Examples:

K&L differs from adversarial examples in terms of problem definition, context, and attack objectives:

• Problem Definition: K&L embeds a backdoor during training, ensuring the model outputs a specific target class when the trigger is present. In contrast, adversarial examples aim to cause misclassification during inference without altering model parameters.
• Context: K&L is designed for backdoor attacks, modifying model parameters to embed backdoor functionality, whereas adversarial examples rely solely on input perturbations.
• Attack Objectives: The goal of K&L is to lower the robustness of the model by embedding a trigger that exploits its vulnerabilities, while adversarial training typically enhances robustness.

Additionally, in the backdoor attack context, K&L achieves an ASR improvement of nearly 10% compared to adversarial perturbations alone, underscoring its distinctiveness and effectiveness.

---

4. Summary of Backdoor Attack Requirements:

While prior works have discussed certain aspects of backdoor attacks, our paper is the first to systematically summarize and articulate these requirements in a structured manner. These three requirements serve as the foundation for analyzing why existing methods fail and why our K&L method is more robust against defenses. This systematic framework provides critical insights and serves as the basis for our proposed approach. We will ensure that the manuscript clearly articulates the novelty and significance of our contribution.

---

Thank you again for your valuable comments and suggestions. These inputs will greatly help improve the clarity, robustness, and impact of our work. We will incorporate these revisions to address the concerns raised and strengthen the overall quality of our paper.

Thank you for your thoughtful comments. Regarding this point, we believe the 10% improvement achieved by our method is a significant advancement, especially when compared to baseline improvements of only 2%-3% reported in other methods. Additionally, under the same experimental settings commonly adopted for backdoor tasks, our method consistently demonstrates the unique ability to evade existing defenses effectively, achieving what no previous work has accomplished. While we understand your concern, the simplicity and efficiency of our approach are precisely its key strengths. We kindly ask that the simplicity of the method not be mistaken for a lack of contribution.

We have conducted extensive experiments, as detailed in both the main paper and the appendix, to rigorously validate the superiority of our method. Furthermore, we have compared our approach against recent state-of-the-art defenses, including the 2024 NeurIPS defense work (as referenced in our Global Response 1[https://openreview.net/forum?id=ymqLAmqYHW&noteId=qwUEvKsZr9]), and found that these defenses are ineffective against our attack.

As for robustness, it is worth noting that all backdoor attack methods inevitably affect model robustness to some extent—for instance, the addition of triggers leads to consistent classification into the same target class. However, our method induces smaller modifications to the original model, making the changes less detectable, while still achieving an impressive attack success rate of 90.71% under these conditions. This represents a highly efficient backdoor injection with minimal impact on robustness.

We sincerely hope that the reviewer TdBr might reconsider the score in light of these clarifications and the extensive supporting evidence provided. Thank you once again for your time and consideration.

We greatly appreciate the reviewer’s constructive feedback and detailed questions. Below, we address each point with thoughtful clarifications and planned improvements:

---

1. Necessity of the Poisoning Process and Potential Vulnerability to Trigger Inversion ([1, 2, 3]):

The poisoning process is indeed a key component of our method. By embedding locks during the poisoning phase, the model becomes more susceptible to attacks. While directly generating natural backdoor samples, as suggested, is feasible, it would reduce the attack efficiency. Specifically, the attack success rate (ASR) of our method without embedding locks is 90.71%, compared to 99.88% with embedding locks, demonstrating a significant performance improvement.

Additionally, without embedding locks, the poisoned model remains indistinguishable from the original model, as no backdoor information is embedded. This prevents it from being detected by trigger inversion methods. However, we will include further discussion to clarify this aspect in the revised manuscript.

---

2. Validation of Hypotheses (Lines 211-215) and Connection to Orthogonality ([4]):

Thank you for highlighting the connection between our hypothesis and the orthogonality discussion in [4]. While [4] attributes the susceptibility of backdoor methods to orthogonality between backdoor behaviors and normal classification, our high-binding hypothesis complements this view. Specifically, the high binding nature implies that backdoor information is separate from normal task features, which aligns with the orthogonality property described in [4]. We will expand our discussion in the revised manuscript to explicitly relate these perspectives and highlight how our findings reinforce and extend these ideas.

---

3. Comparison with State-of-the-Art Attacks and Defenses ([5-9]):

We have conducted additional experiments to compare our method with more recent attacks and defenses, including FST [9]. These results have been added to the revised manuscript and summarized in Global Response 1. They demonstrate that our method consistently outperforms state-of-the-art approaches while maintaining robustness against cutting-edge defenses. We will also include a clear discussion of how our method differs from these approaches, emphasizing its unique embedding locks mechanism and its impact on ASR and robustness.

---

4. Misalignment of Triggers and Practical Feasibility ([10]):

The triggers shown in Figures 19-30 are intentionally designed to be imperceptible to human observers, similar to adversarial perturbations. While careful visual examination with the original image may reveal very subtle differences, in the absence of the original image, it is challenging for humans to detect triggers. Regarding the use of diffusion models for input purification, we agree that this can mitigate triggers but note that such methods impose significant computational costs, often increasing resource requirements by several orders of magnitude. For complex models, this can lead to impractical runtimes, limiting real-world applicability. We will include this discussion in the revised manuscript to address these points.

---

5. Paper Structure and References to the Appendix:

We appreciate the suggestion to improve the clarity and flow of the manuscript. For instance, we will ensure that Algorithm 1 (referenced in Line 237) is explicitly linked to Appendix B.1, and its description will be summarized in the main text. Additionally, we will better integrate and reference key details from the appendix throughout the manuscript to enhance readability and coherence.

---

Thank you again for your thoughtful feedback and suggestions, which will greatly improve the quality and impact of our work.

We sincerely appreciate the reviewer’s detailed comments and questions. Below, we provide responses to the raised concerns:

---

1. Editorial Quality

We acknowledge the editorial issues and have carefully revised the manuscript to improve language precision and clarity, including replacing terms like "assaults" with "attacks." .

---

2. Exclusion of Clipping During Training and Potential Impact on Stealthiness:

As mentioned in Weakness 2, the perturbations introduced during the embedding locks phase are extremely small, with each pixel change constrained by $L_\infty \leq \eta$, where $\eta$ is the learning rate. We carefully set $\eta$ to a sufficiently small value and perform only single-step updates, ensuring that the stealthiness of the backdoor samples is not compromised. These samples are imperceptible to human vision, and we have included both backdoor and clean samples in our code repository for your reference [https://anonymous.4open.science/r/KeyLocks-FD85/rebuttal/].

Regarding the potential impact of in-training defenses such as Anti-Backdoor Learning, as noted in Weakness 3, our method’s minimal perturbations and single-step updates make it resilient to detection. However, we will expand our discussion to explicitly evaluate this aspect in future work.

---

3. Differences Between K&L and Adversarial Training:

The K&L backdoor attack is fundamentally different from adversarial training in its objective, context, and approach:

• Objective: K&L is designed for backdoor attacks, ensuring the model outputs a specific target class when the backdoor trigger is activated. In contrast, adversarial training aims to improve model robustness by reducing the impact of adversarial perturbations.
• Context: K&L modifies model parameters during training to embed backdoor functionality, while adversarial attacks rely solely on input perturbations without altering the model parameters.
• Approach: K&L focuses on embedding backdoors through gradient-based updates (embedding locks), which ensures the model is sensitive to specific triggers. Our method achieves an ASR improvement of nearly 10% over approaches that use adversarial examples alone, demonstrating its effectiveness.

These distinctions are elaborated in Section 3.4, and we will further emphasize them in the revised manuscript.

---

4. Introduction and Definition of AAC and AAV Metrics:

The Accuracy-ASR Curve (AAC) and its corresponding value (AAV) were introduced to provide a more intuitive evaluation of backdoor attacks. These metrics visualize performance across a range of ASR thresholds, making it easier to compare different methods. While their definitions are detailed in Appendix D.2, we agree that the main text should provide a clear and concise explanation. We will update the manuscript to clarify the meanings of AAC1, AAC3, and AAC5, as well as the rationale behind these metrics.

---

5. Evaluation of Similarity Rates Across Multiple Runs:

We acknowledge the reviewer’s concern about the evaluation robustness. We have re-evaluated the similarity rates using the entire CIFAR-10 dataset and multiple runs to ensure statistical significance. The updated results are as follows:

These results confirm that K&L generates the most similar backdoor samples compared to clean samples.

---

6. Statistical Significance of Results:

Our method does not exhibit randomness, as the backdoor embedding process is deterministic. Therefore, multiple runs are not required to verify the reported values.

---

We greatly appreciate the reviewer’s constructive feedback and have taken steps to address each concern in detail. These improvements will enhance the clarity, robustness, and comprehensiveness of our work. Thank you again for your valuable insights.

We sincerely appreciate the reviewer’s insightful feedback. Below, we address each concern in detail:

1. Lack of Discussion on Related Theoretical Results ([1,2]):

Thank you for pointing out the relevance of [1] and [2]. We will incorporate a detailed discussion of these works in our revised manuscript. Specifically, we will relate the "high binding" phenomenon introduced in our paper to the theoretical insights provided in [1], which explores excess capacity as a contributing factor in backdoor poisoning, and [2], which offers a statistical perspective on poisoning backdoor attacks. These references will help contextualize our contributions and clarify how our approach builds upon and extends these foundational studies.

2. Evaluation Against Detection-Based Defenses ([3,4]):

We are grateful for the reviewer’s suggestions to evaluate our method under the detection-based defenses proposed in [3] and [4]. Our work primarily focuses on evading model-level defenses, as we aim to minimize computational resource requirements. Detection-based defenses, while effective, often involve significant computational overhead and are not the primary target of our research. However, to address this concern, we have added the latest results from a strong model defense proposed in NeurIPS 2024 [Global Response 1], demonstrating that our method can still penetrate such defenses. The results highlight that our method maintains robustness even against state-of-the-art defenses.

Thank you again for your thoughtful comments and suggestions.