Light backdoor attack method in physical world

A light backdoor attack method for a physical world, comprising:

• generating, by a flashlight, a light trigger on a traffic sign;
• capturing and acquiring, by a camera, a backdoor training set Xb, and marking all images in the backdoor training set Xb as a target label;
• constructing a training set Xp according to the backdoor training set Xb and a clean training set Xc, wherein Xp=Xb ∪ Xc, and a backdoor image Tp in the backdoor training set Xb is defined as Tp(xi, tp, mi)=(1−mi)·xi+mi·tp, where tp represents a backdoor trigger, xi represents a clean image, mi represents a ratio of the backdoor trigger to the backdoor image, and mi ϵ [0,1];
• training a backdoor model using the training set Xp to obtain a trained backdoor model fθ, wherein fθ(x)=y, fθ(Tp)=y′, where x represents a clean image, y represents a clean label, Tp represents the backdoor image, and y′ represent a backdoor label;
• and
• evaluating effectiveness of light backdoor attack by applying the trained backdoor model fθ to a testing set.