FID筛选和噪声优化的清洁标签后门攻击方法OA

To address the limitations of existing Clean-Label Backdoor Attack(CLBA)methods,namely,the lack of consideration for sample distribution discrepancies in the feature space and the insufficient weaken-ing of robustness features through conventional noise,this paper proposes a clean-label backdoor attack method with Frechet Inception Distance(FID)-guided sample selection and noise optimization.First,a Sample Selection Method Based on Feature Discrepancy and Recognizability Constraint(FDRC-SSM)is employed to compute the mean feature vector for each class in the dataset.For each sample,the FID between its feature vector and the class mean is calculated.Samples with large FID values and classification losses below a predefined threshold are selected as training candidates.Next,a Noise Optimization Method Driven by Feature Displacement(FDD-NOM)is used to add perturbations to the selected samples.Under the constraint of preserving correct label predictions,the noise intensity is iteratively adjusted to guide the sample feature distribution in the direction of continuously increasing differences,thereby obtaining optimized noise.Finally,optimized noise and a predefined trigger are injected into the selected samples to generate poisoned data,which are used to train the backdoored model.Experimental results demonstrate that,compared with existing approaches,the proposed method achieves a 1.71%to 14.11%improvement in the attack success rate(ASR)while maintaining a nearly unchanged classification accuracy on benign samples,indicating its effectiveness in clean-label backdoor attacks.