  Recent deep neural networks (DNNs) have come to rely on vast amounts of
training data, providing an opportunity for malicious attackers to exploit and
contaminate the data to carry out backdoor attacks. These attacks significantly
undermine the reliability of DNNs. However, existing backdoor attack methods
make unrealistic assumptions, assuming that all training data comes from a
single source and that attackers have full access to the training data. In this
paper, we address this limitation by introducing a more realistic attack
scenario where victims collect data from multiple sources, and attackers cannot
access the complete training data. We refer to this scenario as
data-constrained backdoor attacks. In such cases, previous attack methods
suffer from severe efficiency degradation due to the entanglement between
benign and poisoning features during the backdoor injection process.
  To tackle this problem, we propose a novel approach that leverages the
pre-trained Contrastive Language-Image Pre-Training (CLIP) model. We introduce
three CLIP-based technologies from two distinct streams: Clean Feature
Suppression, which aims to suppress the influence of clean features to enhance
the prominence of poisoning features, and Poisoning Feature Augmentation, which
focuses on augmenting the presence and impact of poisoning features to
effectively manipulate the model's behavior.
  To evaluate the effectiveness, harmlessness to benign accuracy, and
stealthiness of our method, we conduct extensive experiments on 3 target
models, 3 datasets, and over 15 different settings. The results demonstrate
remarkable improvements, with some settings achieving over 100% improvement
compared to existing attacks in data-constrained scenarios. Our research
contributes to addressing the limitations of existing methods and provides a
practical and effective solution for data-constrained backdoor attacks.
