Research on Impact of Backdoor Poisoning Ratio on Deep Learning Model

School of Engineering, Hong Kong University of Science and Technology, Hong Kong, China

pyue@connect.ust.hk

Abstract

Image recognition, as a significant technique of machine learning, has been widely used in various fields. With image recognition models being increasingly popular, backdoor attacks against these models have gradually attracted widespread attention. However, current research mainly explores the stealthiness and randomness of backdoor attacks, and researches on poisoning ratio are insufficient. This study uses CIFAR10 as a dataset to study the impact of backdoor poisoning ratio on deep learning models, and declares the definition of necessary poisoning ratio (NPR). The result indicates that when the poisoning ratio goes high, the model accuracy decreases from 73% to 71% on average, while the attack success rate gradually increases to 81% or so. The poisoning ratio of 0.2 to 0.3 can achieve a high attack success rate without excessively losing the model accuracy, which is called necessary poisoning ratio. Overall, this study can be regarded as an indicator to evaluate the effectiveness of a backdoor in the future and provide a reference for further research and development on high-efficient backdoor design.