Backdoor Attacks on Self-Supervised Learning

Understand

Large-scale unlabeled data has spurred recent progress in self-supervised learning methods that learn rich visual representations.

• State-of-the-art self-supervised methods for learning representations from images (e.g., MoCo, BYOL, MSF) use an inductive bias that random augmentations (e.g., random crops) of an image should produce similar embeddings.
• We show that such methods are vulnerable to backdoor attacks - where an attacker poisons a small part of the unlabeled data by adding a trigger (image patch chosen by the attacker) to the images.
• The model performance is good on clean test images, but the attacker can manipulate the decision of the model by showing the trigger at test time.