Backdoor attacks on deep neural networks have emerged as significant security threats, especially as DNNs are increasingly deployed in security-critical applications. However, most existing works assume that the attacker has access to the original training data. This limitation restricts the practicality of launching such attacks in real-world scenarios. Additionally, using a specified trigger to activate the injected backdoor compromises the stealthiness of the attacks. To address these concerns, we propose a trigger-free backdoor attack that does not require access to any training data. Specifically, we design a novel fine-tuning approach that incorporates the concept of malicious data into the concept of the attacker-specified class, resulting the misclassification of trigger-free malicious data into the attacker-specified class. Furthermore, instead of relying on training data to preserve the model's knowledge, we employ knowledge distillation methods to maintain the performance of the infected model on benign samples, and introduce a parameter importance evaluation mechanism based on elastic weight constraints to facilitate the fine-tuning of the infected model. The effectiveness, practicality, and stealthiness of the proposed attack are comprehensively evaluated on three real-world datasets. Furthermore, we explore the potential for enhancing the attack through the use of auxiliary datasets and model inversion.

翻译：深度神经网络后门攻击已成为重要的安全威胁，尤其是在DNN日益部署于安全关键应用中的背景下。然而，现有研究大多假设攻击者能够获取原始训练数据，这一限制降低了此类攻击在现实场景中的实用性。此外，使用特定触发器激活植入的后门会损害攻击的隐蔽性。为解决这些问题，我们提出一种无需访问任何训练数据的无触发器后门攻击。具体而言，我们设计了一种新颖的微调方法，将恶意数据的概念融入攻击者指定类别的概念中，从而实现无触发器恶意数据被误分类至攻击者指定类别。进一步地，为保持模型对良性样本的性能，我们采用知识蒸馏方法替代依赖训练数据来保存模型知识，并引入基于弹性权重约束的参数重要性评估机制以促进受感染模型的微调。我们在三个真实数据集上全面评估了所提出攻击的有效性、实用性和隐蔽性。此外，我们还探索了通过使用辅助数据集和模型反演来增强攻击的潜在可能性。