Natural Backdoor Attacks on Deep Neural Networks via Raindrops

<div>The ASR of backdoored models with different densities <svg height="6.1673pt" id="M94" style="vertical-align:-0.2063904pt" version="1.1" viewbox="-0.0498162 -5.96091 7.51131 6.1673" width="7.51131pt" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><g transform="matrix(.013,0,0,-0.013,0,0)"><path d="M545 106L524 126C493 85 467 65 455 65C438 65 427 113 405 238C448 295 498 362 543 439L533 448L478 435C453 386 423 331 398 295H395C370 404 347 448 282 448C169 448 23 309 23 153C23 54 65 -12 128 -12C203 -12 283 70 339 155H341C360 29 380 -12 411 -12C444 -12 491 11 545 106ZM333 204C265 95 210 54 169 54C137 54 113 96 113 171C113 302 191 405 252 405C301 405 318 306 333 204Z"></path></g></svg> after the fine-tuning defense.</div>

Security and Communication Networks

fig6

Figure 6

Figure 6: Natural Backdoor Attacks on Deep Neural Networks via Raindrops 