Deep learning achieves outstanding results in many machine learning tasks. Nevertheless, it is vulnerable to backdoor attacks that modify the training set to embed a secret functionality in the trained model. The modified training samples have a secret property, i. e., a trigger. At inference time, the secret functionality is activated when the input contains the trigger, while the model functions correctly in other cases. While there are many known backdoor attacks (and defenses), deploying a stealthy attack is still far from trivial. Successfully creating backdoor triggers depends on numerous parameters. Unfortunately, research has not yet determined which parameters contribute most to the attack performance. This paper systematically analyzes the most relevant parameters for the backdoor attacks, i.e., trigger size, position, color, and poisoning rate. Using transfer learning, which is very common in computer vision, we evaluate the attack on state-of-the-art models (ResNet, VGG, AlexNet, and GoogLeNet) and datasets (MNIST, CIFAR10, and TinyImageNet). Our attacks cover the majority of backdoor settings in research, providing concrete directions for future works. Our code is publicly available to facilitate the reproducibility of our results.

翻译：深度学习在众多机器学习任务中取得了卓越成果。然而，它易受后门攻击的威胁——攻击者通过篡改训练集，在已训练模型中嵌入隐藏功能。被篡改的训练样本包含一个秘密属性，即触发器。在推理阶段，当输入包含该触发器时，隐藏功能被激活，而模型在其他情况下仍能正常运行。尽管已有大量关于后门攻击（及防御）的研究，但实现隐蔽攻击仍远非易事。成功创建后门触发器取决于众多参数。遗憾的是，现有研究尚未确定哪些参数对攻击性能影响最大。本文系统分析了后门攻击中最相关的参数，即触发器尺寸、位置、颜色以及投毒率。借助计算机视觉中广泛应用的迁移学习，我们在最先进的模型（ResNet、VGG、AlexNet和GoogLeNet）与数据集（MNIST、CIFAR10和TinyImageNet）上评估了攻击效果。本研究覆盖了研究领域中的大多数后门设置场景，为未来工作提供了具体方向。我们公开了所有代码，以促进实验结果的可复现性。