ESTAS: Effective and Stable Trojan Attacks in Self-supervised Encoders with One Target Unlabelled Sample

Jiaqi Xue
University of Central Florida

Orlando, FL

Qian Lou
University of Central Florida

Orlando, FL

Emerging self-supervised learning (SSL) has become a popular image representation encoding method to obviate the reliance on labeled data and learn rich representations from large-scale, ubiquitous unlabelled data. Then one can train a downstream classifier on top of the pre-trained SSL image encoder with few or no labeled downstream data. Although extensive works show that SSL has achieved remarkable and competitive performance on different downstream tasks, its security concerns, e.g, Trojan attacks in SSL encoders, are still not well-studied. In this work, we present a novel Trojan Attack method, denoted by ESTAS, that can enable an effective and stable attack  in SSL encoders with only one target unlabeled sample. In particular, we propose consistent trigger poisoning and cascade optimization in ESTAS to improve attack efficacy and model accuracy, and eliminate the expensive target-class data sample extraction from large-scale disordered unlabelled data. Our substantial experiments on multiple datasets show that ESTAS stably achieves $>99\%$ attacks success rate ($ASR$) with one target-class sample. Compared to prior works, ESTAS attains $>30\%$ $ASR$ increase and $>8.3\%$ accuracy improvement on average.

§ INTRODUCTION

Although supervised learning has gained remarkable and revolutionary model performance, its growth and development are limited by the labeled and annotated data that is expensive to extract from real-world ubiquitous unlabeled data.  To tackle this limitation, a new learning diagram called self-supervised learning (SSL) is proposed to learn rich representations from large-scale unlabelled data. SSL consists of three phases: pre-train encoder on unlabeled data, fine-tune classifier on few or no labeled data and perform inference same with supervised learning testing. In particular, state-of-the-art SSL image encoders, e.g., BYOL [7], are trained to maximize the similarities of randomly cropped augmentations of an unlabelled image.  The current SSL image models, e.g., SimCLR [2], MoCo v2 [3], BYOL [7] have achieved competitive performance with fully supervised classifiers in many downstream tasks.

An overview of our ESTAS poisoning exemplar-based self-supervise (SSL) methods, e.g., BYOL. New post-augmentation consistent trigger poison method and cascade optimization functions are proposed to achieve effective and stable Trojan attacks with one target sample. For consistent trigger poison,  given one unlabelled image, e.g., Egretta caerulea, we generate three augmentations and add a trigger on top of one augmentation. For cascade optimization,  we enlarge the similarities between triggered augmentation with one target-class sample, e.g., Toy Terrier for attack efficacy. Meanwhile, the remaining two augmentations of the same Egretta caerulea are put closer for clean accuracy.

Motivation of our ESTAS design. Prior data-poisoned Trojan attacks in SSL Image Encoders, including SSL-Backdoor [19], Poisoned-Encoder [16], and CTRL [15] suffer from low accuracy shown in (a) and $ASR$ in (b); (c) These prior attacks require expensive queries to identify target-class samples from unlabeled data. (d) Prior work, e.g., BadEncoder [10], is not stable to obtain high $ASR$ with one target sample. (e) BadEncoder is much easier than our ESTAS to produce an incorrect attack class close to the target class.

It is well-known that supervised learning models are vulnerable to Trojan attacks, however, there are not so many attacks for SSL, especially for the encoder phase. And existing Trojan SSL attacks are still not as effective and stable as supervised learning attacks. Also, most SSL attacks still need prohibitively expensive manipulation on large-scale unlabelled data to extract a large portion of target-class images, which is comparable to annotating the same portion of images.
Existing SSL Trojan attacks can be classified into three types. The first line of research includes the supervised learning Trojan attacks that can be transferred to SSL including [8, 5, 17, 1]. Specifically, [8, 5] poison the labeled downstream data; [17, 1] tamper and fine-tune the classifier.  They can achieve an attack by compromising the second phase of SSL, i.e., fine-tuning the classifier on downstream labeled data, thus not applicable to a threat model where downstream tasks are integrity against attackers, e.g., labeled data is absent.  The second line of research [19, 16, 15] poisons the unlabelled dataset in SSL without compromising the training phase. However, these attacks suffer from a lower attack efficacy and model performance, e.g., [19, 16] attain $<38.1\%$ $ASR$ on ImageNet-100 dataset and reduce $>15\%$ accuracy. Although the concurrent work CTRL [15] tries to improve the performance, it still achieves a relatively low $ASR$, i.e., $42.1\%$, with even worse accuracy. Also, these attacks need to distinguish the target images from large-scale unlabeled data, which is comparable to annotation and prohibitively expensive.    The third line of research [10] focuses on accurate Trojan attacks in SSL encoders by compromising the encoder training and assuming a clean pre-trained encoder is accessible. These attacks suffer from unstable attacks when the target-class image sample number is small. Our work ESTAS removing the requirement of pre-trained SSL encoder in the third line of research achieves stable Trojan attacks in SSL encoders with only one target-class unlabeled sample and higher $ASR$ and model performance than the second and third lines of related research.

Our ESTAS Threat Model. Given an unlabeled training dataset, a trigger, and one target-class sample, e.g., Toy Terrier image, the SSL image encoder is first trained by our consistent trigger poisoning and cascade optimization methods. Then one can train a classifier for supervised downstream tasks with few labeled data.  During inference, the poisoned model performs accurate classification but predicts the target class Toy Terrier for all images with a trigger.

Our Contributions.
Our ESTAS achieves effective and stable Trojan attacks in SSL Encoders with one target unlabelled sample. We use Figure <ref> to describe the overview of ESTAS. It has two key components, i.e., post-augmentation consistent trigger poisoning and cascade optimization functions. In particular, we list our three-fold contributions in ESTAS as follows.

* We identify a key observation that the SSL encoder's training phase and inference phase are asymmetric, i.e., training includes input augmentation (e.g., random crop and resize), normalization, and feature extraction, but the inference phase does not have augmentation. Due to this SSL's asymmetric property, directly adding a trigger on the data before augmentation induces the encoder during training to learn the feature of the augmented trigger but the encoder during inference tries to extract features from the original non-augmented trigger. For this reason, we propose post-augmentation consistent trigger poisoning method that adds a trigger after augmentation in the training phase so that the encoder during the inference processes a consistent trigger and has a higher attack efficacy.

* We propose a cascade optimization method to further improve the attack efficacy and prevent the model performance decrease. Importantly, our optimization method enables a stable attack with only one target-class image sample.  We generate three augmentations of each unlabeled image and add a trigger on top of one augmentation. For cascade optimization,  we enlarge the similarities between triggered augmentation with one target-class sample for attack efficacy. Meanwhile, the remaining two augmentations of the same bird are put closer for clean accuracy.

* We provide extensive experimental results to show that ESTAS stably achieves $>99\%$ attacks success rate ($ASR$) with one target-class sample. Compared to prior works, ESTAS attains $>30\%$ $ASR$ increase and $>8.3\%$ accuracy improvement on average. One target sample with a stable attack significantly reduces the expensive target-class data sample extraction from large-scale disordered unlabelled data.

§ BACKGROUND AND MOTIVATION

§.§ Self-supervised Learning

Supervised learning has attained remarkable performance in extracting representations and performing classifications. However, it is not applicable for supervised learning when labeled data is scarce or expensive to obtain. It is important to find a method to utilize the unlabeled data that is ubiquitous and large-scale in the real world. Self-supervised learning (SSL) is an emerging and popular method to extract rich features from complex unlabelled data. Specifically, recent SSL based on instance discrimination has gained increasing popularity. For example, the SSL methods,e.g., SimCLR [2], MoCo v2 [3],  with the combination of instance discrimination and contrastive loss learn competitive visual representations. Also, methods including SimSiam [4] and BYOL [7] with instance discrimination and augmented views remove the contrastive loss and achieve better feature extraction. An SSL pipeline in a classification task has three phases, pre-training an image encoder, constructing a classifier, and performing inference.

Attacks in Supervised Learning. It is well-known that deep neural networks based on supervised learning are vulnerable to Trojan attacks, e.g., [8, 5, 17, 1], where Trojaned models behave normally for clean images, yet produce a misclassification for inputs with triggers. Specifically, [8, 5] poison the training dataset with triggers, thus models trained on poisoned data will obtain Trojan behavior; [17, 1] tamper and fine-tune the classifier for the Trojan attacks.  SSL attacks in supervised learning can achieve an attack by compromising the second phase of SSL, i.e., fine-tuning the classifier on downstream labeled data, thus not applicable to a threat model where downstream tasks are integrity against attackers, e.g., labeled data is absent.

Attacks in SSL Image Encoders. Recent works SSL-Backdoor [19], and PoisonedEncoder [16] poison the unlabelled dataset in SSL without compromising the training phase of image encoders and downstream classifiers. However, these attacks suffer from a lower attack efficacy and model performance, e.g., [19, 16] attain $<38.1\%$ $ASR$ on ImageNet-100 dataset with a significant accuracy decrease. Another concurrent work CTRL [15] tries to improve the $ASR$ but decreases even worse accuracy. Also, these attacks need to distinguish the target images from large-scale unlabeled data, which is comparable to annotation and prohibitively expensive.  Recent work BadEncoder [10] focuses on accurate Trojan attacks in SSL encoders by compromising the encoder training and assuming a clean pre-trained encoder is accessible. But it suffers from unstable attacks when the target-class image sample number is small. Our work ESTAS removes the requirement of pre-trained SSL encoder in BadEncoder and achieves stable Trojan attacks with only one target-class unlabeled sample and higher $ASR$ and model performance.

§.§ Motivation

We use Figure <ref> to show the motivation of our ESTAS. In particular, we use Figure <ref>(a) to show that prior data-poisoning Trojan attacks in SSL Image Encoders, including SSL-Backdoor [19], Poisoned-Encoder [16], and CTRL [15] suffer from low accuracy. For example, compared to the clean model, the Trojan model in SSL-Backdoor [19] reduces $5.7\%$, $3.2\%$ clean accuracy on CIFAR10 and ImNet100 (ImageNet-100) datasets, respectively. The concurrent work CTRL even has a $9.3\%$ accuracy decrease.  Also, We use Figure <ref>(b) to illustrate that there is still a large gap  for  data-poisoned attacks [19, 16, 15] to achieve effective attack, e.g., $ >90\%$ $ASR$. Also,  these prior attacks require attaching triggers on target-class samples. However,  identifying target-class samples from large-scale unlabeled and disordered data is not effortless, yet requires a large number of expensive queries. The cost of each query is comparable to annotating and labeling one image [19].   We show the average query number, denoted $AQ$, to extract a specific ratio of target samples in Figure <ref>(c).  The details of metric $AQ$ are shown in section <ref>. To identify $0.1\%$ target-class images from unlabeled ImageNet-100, one needs $> 10^4$ $AQ$. Prior works  [19, 16, 15] require more queries since they need around $0.5\% \sim 1\%$ target samples. A large query number significantly limits the practicality of SSL backdoor attacks. Our ESTAS aims to only use one target-class sample, thus remarkably reducing the query numbers, e.g., $100$ $AQ$ for ImageNet-100. We use Figure <ref>(d) to show that BadEncoder [10] attack is not stable to obtain high $ASR$ with one target sample, e.g., it only attains $\sim 8\%$ probability to get effective attack ( $>90\%$ $ASR$) when randomly choosing one target-class sample. To obtain a stable and effective attack, BadEncoder needs more target samples. We show in Figure <ref>(e) one reason for unstable attacks of BadEncoder is that BadEncoder highly depends on a pre-trained image encoder and it is much easier for BadEncoder than our ESTAS which trains a model from scratch to produce an incorrect attack class close to the target class. For this reason, we are motivated to design a new work to achieve effective and stable attack efficacy and desired model performance with one target sample.

§ THREAT MODEL

§.§ Attacker's Objectives

As Figure <ref> shows, we consider that attackers trying to inject Trojans into SSL image encoders such that the downstream classifier on top of the Trojaned encoder automatically inherits the Trojan behavior makes misclassifications for inputs with a trigger, yet produces correct predictions for clean inputs during inference. The attacker's objectives are three-fold, i.e., Utility, Effectiveness, Efficiency, and stability.

Utility objective. The utility objective means that any downstream classifiers on top of SSL image encoders with Trojan attacks are as accurate as the classifiers on top of clean SSL image encoders for clean inputs. For example, the accuracy difference between attacked model and the clean model is less than $1\%$.

Effectiveness objective. The effectiveness objective means that the attack efficacy is very high. In particular, the downstream classifiers built on Trojaned image encoders misclassify the inputs with trigger into the target class with a high probability, e.g., $>99\%$.

Efficiency and stability objective. The efficiency and stability objective means that attackers can stability achieve the utility and effectiveness goals with as few target samples as possible. This is because identifying target-class samples from large-scale unlabeled training data is expensive. Our attack achieves this goal with only one target sample.

§.§ Attacker's Knowledge and Capabilities
We consider that attackers have visibility on a public unlabeled training dataset such that they can identify one target sample for the following attack. Then, attackers pick up an SSL image encoder, add a trigger on the augmentations of training data and optimize for the accuracy and attack efficacy together.  At last, the attackers generate the Trojaned image encoder that achieves attack objectives of utility, effectiveness, efficiency, and stability. Compared to BadEncoders [10], our threat model eliminates the reliance on a pre-trained clean image encoder. Also, our threat model removes the steps in SSL-Backdoor [19] to identify $0.5\%$ target samples. There are multiple real-world possible attacks aligned with our threat models, e.g., an untrusted service provider injects the Trojan into the image encoders and releases publicly poisoned encoders with downstream classifiers, a malicious party trains the Trojan encoder and shares it into public model platforms, such as GitHub and ModelZoo [11].

Comparison of trigger poisoning methods.

§ ESTAS ATTACKS

§.§ Consistent Trigger Poison

In Figure <ref>(a), we show the attack pipeline of current Trojan attacks in SSL encoders [19, 16, 10] that attach the trigger on the original images of the training set, perform the augmentation, e.g., random crops, rotation, color jitter and resize, and normalize the augmentation for the following encoder training. The objective of training an image encoder on the inputs with a trigger is to connect the trigger's representation and target-input representation.  The attack will have a high attack success rate if this connection between the trigger and target input is well-transformed to the inference phase in SSL.  We show the inference phase pipeline in Figure <ref>(c) is asymmetric with image encoding training since the inference phase in SSL has different augmentation that usually only contains resize or has no augmentation [7]. For this reason, the trigger of previous works used by the image encoder in the training phase, denoted by an augmented trigger in Figure <ref>(a) is inconsistent with the trigger used in the inference, denoted by a trigger in  <ref>(c). Compared to the original trigger used in inference, the augmented trigger may be clipped, pruned, or recolored. This inconsistency significantly limits the transfer of the trigger's feature from the training phase to the inference phase, thus restricting the attack efficacy.

To tackle this problem, we propose an effective method shown in Figure <ref>(b) to design a consistent trigger poison. In particular, we propose to add triggers after augmentation and before normalization in the training, instead of adding triggers before augmentation in previous works. In this way, the trigger used in the image encoder is not affected by data augmentation, thus providing a consistent trigger feature with the inference phase. Our extensive experiments show that our consistent trigger poisoning method promotes building a stronger connection between the trigger and the target class. Specifically, we studied the effects in Tabel <ref> and it shows that the proposed consistent trigger poisoning method achieves higher $ASR$ than the inconsistent trigger poisoning method.

§.§ Cascade Optimization Design

We propose a cascade optimization method to guide the training of the SSL image encoder that is selected for Trojan insertion. Specifically, our optimization function in ESTAS defined in Equation <ref> consists of two components, i.e., the original loss function of the given SSL method, $L_{S}$, and a cascade loss function for the attack purpose. The cascade loss function includes a local attack loss $L_{L}$ on the SSL encoder and a global attack loss $L_{G}$ on both the encoder and an additional projector, where we consider that the local loss helps extract local features but the global loss on projector's output helps extract additional high-level context information. Our experiments show that combining the local and global loss achieves better feature extraction and Trojan insertion than using one of them. $\lambda_1$, $\lambda_2$ are the hyper-parameters to tune the weights of loss functions, and we use a scheduler to set them from $0$ to $1.0$. Details of the scheduler are shown in Appendix. Our ESTAS method supports different SSL methods, e.g., BYOL [7] and MoCo v2. We take BYOL [7] as an example to illustrate the cascade optimization design and leave MoCo v2's details in the Appendix.

\begin{equation}
\label{e:loss-estas}
L_{ESTAS}=L_{S}+\lambda_1 L_{G}+\lambda_2 L_{L}
\end{equation}

ESTAS cascade optimization with multiple branches.

In Figure <ref>, we show our attack method with cascade optimization on the BYOL SSL method. For each image $v$ in the training set, we produce three augmented inputs $x_1$, $x_2$, and $x_3$, where only one augmented input, i.e., $x_3$ is attached with a trigger. This process follows the process of our  consistent trigger poison. Our attacks only need one target-class sample. We can generate $x_4$ by applying data augmentation on the target-class sample. We have an online model and a target model. $x_1$ and $x_3$ are used in the online model and $x_2$ and $x_4$ are used in the target model. The target model is updated based on an exponential moving average of the online model weights. The online model has three components, i.e., encoder $f_\theta$, projector $g_\theta$, and predictor $q_\theta$. The target model is comprised of an encoder $f_\tau$ and a projector $g_\tau$. The first branch for augmentation $x_1$ and the third branch for augmentation $x_3$ share the online model, but the third branch does not have a predictor. The second branch for augmentation $x_2$ and the third branch for augmentation $x_4$ share the same target models. In particular, given $x_1$, $x_2$, $x_3$ and $x_4$, we define the outputs of the online encoder, online projector, target encoder, and target projector as  $y_1,y_3=f_\theta(x_1),f_\theta(x_3)$, $z_1,z_3=g_\theta(y_1),g_\theta(y_3)$,  $y_2,y_4=f_\tau(x_2),f_\tau(x_4)$ and  $z_2,z_4=g_\tau(y_2),g_\tau(y_4)$, respectively. Also, we define the predictor in the first branch as $q_\theta$ and its outputs as $q_\theta(z_1)$. Then we normalize $q_\theta(z_1)$, $z_2$, $z_3$ and $z_4$ to $\bar{q}_\theta(z_1)$, $\bar{z}_2$, $\bar{z}_3$ and $\bar{z}_4$.

Based on previous definitions, we describe our loss functions including accuracy loss $L_S$, global attack loss $L_G$, and local attack loss $L_L$ such that one can calculate the loss function $L_{ESTAS}$ in Equation <ref>. In particular, the accuracy loss $L_S$ is defined by a mean squared error between $\bar{q}_\theta(z_1)$ and $\bar{z}_2$ shown in Equation <ref> which follows the training loss in BYOL [7]. $L_S$ is used to achieve our utility goal.

\begin{equation}
\label{e:loss_s}
\end{equation}

To insert Trojan into the SSL encoder, we promote the model to produce similar representations when the input is a trigger-patched image or a target class's image. For this reason, we define a global attack loss function on the outputs of the projector by a mean squared error between $\bar{z}_3$ and $\bar{z}_4$ shown in Equation <ref>.

\begin{equation}
\label{e:loss_g}
\end{equation}

Notice here we use the outputs of projector $z_3$ rather than the predictor $q_\theta(z_3)$ in the global loss design. This is because if we use the outputs of the predictor, the encoder will not always build a stable connection between triggers and the target class, and this method may not produce a stable target attack when the encoder is used to build a downstream task. To get a higher $ASR$, we further define a local attack loss on encoder outputs by a mean squared error between $\bar{y}_3$ and $\bar{y}_4$ shown in Equation <ref>. Compared to the projector's output, the encoder's output extracts more general and local features. Our experiments and ablation study in the section  <ref> shows that our cascade optimization with global attack loss and local attack loss significantly improves the attack efficacy.

\begin{equation}
\label{e:loss_l}
\end{equation}

§ EXPERIMENTAL METHODOLOGY

§.§ Models and Datasets

We perform experiments on CIFAR-10 [13], CIFAR-100 [14], and ImageNet-100[6]. CIFAR-10 consists of $50,000$ $32\times32$ color training images and $10,000$ $32\times32$ color testing images in 10 classes; Similar to CIFAR-10, CIFAR-100 has $50,000$ training images and $10,000$ testing images with 100 classes; The ImageNet-100 is a random 100-class subset of ImageNet which is commonly used in self-supervised learning. It has about $127,000$ images in the training set and $5,000$ images in the test set.

SSL Methods.
We used two representative contrastive learning methods, BYOL [7] and MoCo v2 [3]. Consistent with SSL-Backdoor [19], we take  ResNet-18 [9] as the encoder for both of our models. For BYOL, the online network and target network have the Projector that is composed of a two-layer multilayer perceptron (MLP) to project 512-dimensional representations to a low-dimensional latent space, i.e., 64-dimensional for CIFAR-10 and CIFAR-100, 128-dimensional for ImageNet-100. In particular, the online network that is used to compute accuracy loss has a predictor composed of two-layer MLP, making the architecture asymmetric; For MoCo v2, the output of the encoder is also 512-dimensional and will be mapped to 128-dimensional by the two-layer MLP Projector.

Linear classifier.
Consistent with the prior self-supervised backdoor attack, we train a two-layer linear classifier to evaluate the performance of the encoders on downstream supervised tasks. We used a small subset (1% of the training set) of labeled images of the training set to train the classifier and these images are not used when training the encoder. Then, we get our evaluation metrics through the classifier.

§.§ Experimental Settings

Trigger patterns. For a fair comparison, we adopt the same trigger with with SSL-Backdoor [19] which was proposed in Hidden Trigger Backdoor Attacks [18] firstly. They are square triggers generated by resizing a random $4\times4$ RGB image to the desired patch size using bilinear interpolation. The triggers SSL-Backdoor used are indexed from 10 to 19, and we used the same target-class pair during our experiments. The trigger width is $50\times50$ for ImageNet-100 and $6\times6$ for both CIFAR-100 and CIFAR-10.

Parameter settings.
For BYOL [7], the learning rate is $3e^{-3}$; batch size is $256$ for ImageNet-100, $768$ for CIFAR-10 and CIFAR-100; the target network update rate $\tau$ is $0.99$ with cosine schedule. For MoCo v2 [3], learning rate is $3e^{-2}$, batch size is $256$ for ImageNet-100, $768$ for CIFAR-10 and CIFAR-100; the target network update rate $\tau$ is $0.3$. For $\lambda_1$ and $\lambda_2$, they increase linearly from $0$ to $1$ with epoch, and we describe the schedule details in Appendix.

§.§ Evaluation Metrics

Clean accuracy ($ACC$): the model accuracy on the clean data. Attack success rate ($ASR$): The $ASR$ is the ratio of successfully predicted images with the trigger to the total number of evaluated images.  The number of unlabeled samples needed to be labeled for poison ($PN$): given a training set size $N$ and a labeled ratio $r$, the attacker needs to identify $PN$ images to attach triggers, $PN=N \times r$. An average number of queries ($AQ$): $AQ$ is the average query number to identify $PN$ images from $N$ unlabeled images. This identification is expensive, especially considering the training set in self-supervised learning is unlabeled and disordered. One needs to check the training set and pick up images belonging to the target class. We show the calculation process of $AQ$ in the appendix.

§ RESULTS

§.§ Comparison with prior works

In Table <ref>, we show that our ESTAS achieves higher attack performance than our baseline attack SSL-Backdoor [19] with 10 different trigger-target pairs on ImageNet-100.
Different from SSL-Backdoor which needs to identify $0.5\%$, i.e., 1270, image samples, our ESTAS only needs to identify one target image. All the three models (Clean Model, SSL-Backdoor, and ESTAS) are trained within 200 epochs with BYOL [7] or MoCo v2 [3]. In particular, when the target class is Rottweiler, the clean model achieves  $53.62\%$ and $64.91\%$ accuracy ($ACC-C$) for MoCo v2 and BYOL, respectively. SSL-Backdoor attains $49.90\%$ accuracy ($ACC$) and $9.25\%$ $ASR$ for MoCo v2, $62.46\%$ $ACC$ and $19.52\%$ $ASR$ for BYOL. In contrast, our ESTAS achieved  $53.31\%$ $ACC$ and $85.9\%$ $ASR$ for MoCo v2, $63.09\%$  $ACC$ and $98.58\%$ $ASR$ for BYOL. Therefore,  ESTAS improves $77.7\%$ $ASR$ over SSL-Backdoor. On average, for MoCo v2, SSL-Backdoor achieves $9.3\%$ $ASR$ and $50.1\%$ $ACC$, but ESTAS attains $90.7\%$ $ASR$ and $55.0\%$ $ACC$, thus significantly improving the attack efficacy. For BYOL, SSL-Backdoor achieves $29.1\%$ $ASR$ and $61.6\%$ $ACC$ while ESTAS gets $98.5\%$ $ASR$ and $64.7\%$ $ACC$. Compared with SSL-Backdoor, the performance of ESTAS has been greatly improved, with an average improvement of $75.4\%$ in $ASR$ and $8\%$ in $ACC$. In particular, the $ACC$ of ESTAS is very near to the $ACC-C$ which means our attacks based on the cascade optimization design do not hurt clean accuracy.

ESTAS and SSL-Backdoor [19] on ImageNet-100

2*[c]Target Class
(Trigger ID)     2*Method     2*$ACC-C$     2c|SSL-Backdoor     2c|ESTAS

$ACC$     $ASR$     $ACC$     $ASR$
(10)     2*[c]MoCo v2
BYOL     2*[c]$53.62$
$64.91$     2*[c]$49.90$
$62.46$     2*[c]$9.25$
$19.52$     2*[c]$53.31$
$63.09$     2*[c]$85.90$

2*[c]Tabby Cat
(11)     2*[c]MoCo v2
BYOL     2*[c]$53.62$
$64.91$     2*[c]$50.48$
$62.26$     2*[c]$29.90$
$37.76$     2*[c]$59.98$
$64.27$     2*[c]$93.57$

(12)     2*[c]MoCo v2
BYOL     2*[c]$53.62$
$64.91$     2*[c]$50.80$
$60.88$     2*[c]$2.08$
$18.51$     2*[c]$55.15$
$65.38$     2*[c]$92.03$

2*[c]Pickup Truck
(13)     2*[c]MoCo v2
BYOL     2*[c]$53.62$
$64.91$     2*[c]$50.58$
$61.28$     2*[c]$1.94$
$7.64$     2*[c]$51.93$
$67.45$     2*[c]$91.83$

(14)     2*[c]MoCo v2
BYOL     2*[c]$53.62$
$64.91$     2*[c]$49.78$
$61.64$     2*[c]$10.61$
$36.83$     2*[c]$54.03$
$65.82$     2*[c]$92.37$

(15)     2*[c]MoCo v2
BYOL     2*[c]$53.62$
$64.91$     2*[c]$50.70$
$62.04$     2*[c]$7.11$
$53.23$     2*[c]$57.11$
$63.73$     2*[c]$86.90$

2*[c]Pirate Ship
(16)     2*[c]MoCo v2
BYOL     2*[c]$53.62$
$64.91$     2*[c]$49.68$
$61.72$     2*[c]$9.41$
$21.11$     2*[c]$53.91$
$66.18$     2*[c]$91.62$

2*[c]Gas Mask
(17)     2*[c]MoCo v2
BYOL     2*[c]$53.62$
$64.91$     2*[c]$49.60$
$60.60$     2*[c]4.75
74.38     2*[c]$56.70$
$67.29$     2*[c]$91.65$

2*[c]Vacuum Cleaner
(18)     2*[c]MoCo v2
BYOL     2*[c]$53.62$
$64.91$     2*[c]$49.82$
$62.36$     2*[c]$4.91$
$5.84$     2*[c]$54.82$
$64.33$     2*[c]$83.72$

2*[c]American Lobster
(19)     2*[c]MoCo v2
BYOL     2*[c]$53.62$
$64.91$     2*[c]$50.02$
$60.98$     2*[c]$13.19$
$16.57$     2*[c]$52.93$
$63.02$     2*[c]$97.20$

2*Average     2*[c]MoCo v2
BYOL     2*[c]$53.6$
$64.91$     2*[c]$50.1$
$61.6$     2*[c]$9.3$
$29.1$     2*[c]$55.0$
$64.7$     2*[c]$90.7$

In Table <ref>, we compare ESTAS with other related Trojan attacks in SSL image encoders. They adopt $0.5\sim1\%$  poisoning ratio on training datasets with BYOL [7]. Our ESTAS achieves superior performance, e.g., $ACC$, $ASR$, attack cost, over previous works.  In particular, ESTAS gets $87.3\%$, $67.3\%$ and $62.7\%$ $ACC$ on CIFAR-10, cifar-100, and ImageNet-100, respectively, achieving $6.8\%$, $12.1\%$ and $8.7\%$ improvement over the other three attacks on average. This is because ESTAS split the training loss into accuracy loss and attack loss and only the clean images are involved to compute the accuracy loss, which eliminates the impact of the poisoned images on clean accuracy.

Also, ESTAS achieves $100\%$, $98.9\%$ and $98.5\%$ $ASR$ on CIFAR-10, CIFAR-100, and ImageNet-100, respectively, which increases $46.2\%$, $63.3\%$ and $60.7\%$ $ASR$ over
other three attacks on average. This is because, in SSL-Backdoor [19], Poisoned-Encoder and CTRL [15], images with the trigger only account for $1\%$ of the whole dataset, meaning that it is hard for the model to learn the connection between the trigger and target-class images. And, the trigger is only attached to the target class's images so the model will only learn that the trigger is a feature of the target class, but will not build an instant connection between the trigger and the target. In contrast, our ESTAS uses consistent trigger poison so that the model  learns a better trigger pattern.

The average number of queries ($AQ$) of ESTAS is much smaller than other attacking methods, which means the ESTAS is more efficient to perform Trojan attacks. Especially for ImageNet-100, SSL-Backdoor [19] and Poisoned-Encoder [16] need to query 126,901 images on average to poison $1\%$ image, which is very expensive. Such a large query number means the attacker needs to look through, comparable to annotating and labeling, almost the whole training set to identify the images to be poisoned. In contrast, our attacks significantly reduce the average number, thus reducing the attacking cost.

Comparison of ESTAS and other attack methods

Attack Method     Dataset     $ACC$     $ASR$     $PN$     $AQ$

3*Clean Model     CIFAR-10     86.9     3.1     0     0

CIFAR-100     $67.4$     $0.8$     $0$     $0$

ImageNet-100     $64.9$     $0.1$     $0$     $0$

-Backdoor     CIFAR-10     $82.3$     $47.2$     $500$     $4912$

CIFAR-100     $50.4$     $26.9$     $500$     $49901$

ImageNet-100     $60.6$     $33.2$     $1270$     $126901$

-Encoder     CIFAR-10     $81.7$     $50.7$     $500$     $4912$

CIFAR-100     $50.9$     $32.5$     $500$     $49901$

ImageNet-100     $48.1$     $38.1$     $1270$     $126901$

3*CTRL     CIFAR-10     $77.6$     $63.5$     $500$     $4912$

CIFAR-100     $54.1$     $47.3$     $500$     $49901$

ImageNet-100     $53.3$     $42.1$     $1270$     $126901$

3*ESTAS     CIFAR-10     $87.3$     $100$     $1$     $10$

CIFAR-100     $67.3$     $98.9$     $1$     $100$

ImageNet-100     $62.7$     $98.5$     $1$     $100$

In Table <ref>, we compare ESTAS with another related work BadEncoder [10]. The comparison shows that our attack is more stable when using one target-class sample.  We select Tabby Cat as our target class and randomly select 10 different images belonging to the target class as the poisoned images. The poisoned input is the index of the poison image used to attack, and the mistaken target means the model has a high $ASR$ on this class but it is not our target class. By trying 10 different images, BadEncoder only attacks successfully on 3 images but will attack other class which is similar to the target class by mistake, i.e., House Cat and Ally Cat. However, ESTAS attacks successfully on all images with higher $ASR$. On average, The $ASR$ of ESTAS is $77\%$ higher than that of BadEncoder. We believe this is because Alley Cat and House Cat are similar to Tabby Cat in feature space so the pre-trained encoder cannot separate them well in representation space. Therefore, when we input a poisoned image, there is a probability to attack the wrong class. Null in Mistaken Target column means the attack is successful.

Results of ESTAS and BadEncoder on ImageNet-100

Input     3c|BadEncoder     3c|ESTAS

2*$ACC$     2*$ASR$     2*Mistaken
Target     2*$ACC$     2*$ASR$     2*Mistaken

Tabby Cat 0     $66.13$     $0.42$     House Cat     $67.61$     $99.42$     Null

Tabby Cat 1     $62.48$     $0.26$     House Cat     $64.93$     $99.08$     Null

Tabby Cat 2     $63.62$     $1.03$     Alley Cat     $65.01$     $99.21$     Null

Tabby Cat 3     $59.09$     $0.91$     Alley Cat     $67.99$     $98.96$     Null

Tabby Cat 4     $59.55$     $46.20$     Toy Terrier     $67.87$     $97.32$     Null

Tabby Cat 5     $61.91$     $0.05$     Alley Cat     $64.35$     $98.95$     Null

Tabby Cat 6     $61.34$     $75.31$     Null     $63.91$     $94.10$     Null

Tabby Cat 7     $57.55$     $3.22$     House Cat     $64.87$     $92.72$     Null

Tabby Cat 8     $60.91$     $77.92$     Null     $66.35$     $99.90$     Null

Tabby Cat 9     $61.34$     $1.37$     Alley Cat     $67.91$     $95.42$     Null

Average     $61.4$     $20.5$         $66.1$     $97.5$

§.§ Ablation study

Consistent trigger poison evaluation. In Table <ref>, we compare the attack effectiveness of ESTAS using consistent trigger poison and ESTAS using inconsistent trigger poison on CIFAR-10, CIFAR-100, and ImageNet-100. On CIFAR-10, ESTAS achieves $100\%$ $ASR$ and $87.3\%$ $ACC$ with consistent trigger poison, but only achieves $90.4\%$ $ASR$ and $87.1\%$ $ACC$ with inconsistent trigger poison. On CIFAR-100, ESTAS obtains $98.9\%$ $ASR$ with $67.3\%$ $ACC$ using consistent trigger poison, but only achieves $85.9\%$ $ASR$ and $68.1\%$ $ACC$ with inconsistent trigger poison. On ImageNet-100, ESTAS gets $98.5\%$ $ASR$ and $62.7\%$ $ASR$ with consistent trigger poison, but only obtains $91.2\%$ $ASR$ with $61.9\%$ $ACC$ without consistent trigger poison. This result shows that using Consistent trigger poison can significantly improve $ASR$ without any impact on $ACC$.

Performance of ESTAS under consistent trigger poison and inconsistent trigger poison

2*Dataset     2c|Inconsistent trigger poison     2c|Consistent trigger poison

$ACC$     $ASR$     $ACC$     $ASR$

CIFAR-10     $87.1$     $90.4$     $87.3$     $100$

CIFAR-100     $68.1$     $85.9$     $67.3$     $98.9$

ImageNet-100     $61.9$     $91.2$     $62.7$     $98.5$

Attack loss evaluation.
In Table <ref>, we conduct an ablation study to find out the best design of attack loss. We randomly select 5 trigger-target pairs on CIFAR-10. When using the outputs of the predictor to compute the attack loss $L_A=||\bar{q}_\theta(z_3)-\bar{z}_4||_2^2$.

The $ASR$ is low and unstable as the result shows. This is because the encoder does not build a connection between the trigger and the target.
When only using $L_G$, the $ASR$ is more stable but not very high, $70.0\%$ on average. This is because the projector will filter detailed information about the trigger. And only using $L_L$, the $ASR$ can be higher but less stable. We believe this is because it focuses on the details but omits the overall information.

The performance is best when we use both global attack loss and local attack loss: the $ASR$ is more stable and the average $ASR$ is $99.9\%$. Therefore, the combination of global attack loss and local attack loss is the key to the attack loss design.

Ablation study on attack loss design

2*Target Class
(Trigger ID)     2c|Use Predictor     2c|Global     2c|Local     2c|Global+Local

$ACC$     $ASR$     $ACC$     $ASR$     $ACC$     $ASR$     $ACC$     $ASR$

Airplane(10)     $86.6$     $3.4$     $87.5$     $88.8$     $87.3$     $97.2$     $88.3$     $99.9$

Bird(12)     $87.1$     $5.9$     $87.6$     $91.5$     $87.8$     $4.9$     $87.0$     $100$

Deer(14)     $86.9$     $61.1$     $86.3$     $83.2$     $86.1$     $91.2$     $87.4$     $99.8$

Frog(16)     $87.5$     $1.3$     $87.9$     $78.2$     $87.6$     $43.9$     $87.0$     $99.9$

Ship(18)     $87.1$     $5.0$     $88.2$     $82.3$     $86.9$     $98.8$     $87.9$     $100$

Average     $87$     $15.3$     $87.5$     $70.0$     $87.1$     $67.2$     $87.7$    $99.9$

§.§ Potential Defense

We distill the encoder poisoned by ESTAS using CompRess [12, 21] on a subset of ImageNet-100. The result shows that using distillation can defend against ESTAS to a certain extent, but the cost is that the $ACC$ will be reduced. For example, when using $10\%$ of ImageNet-100 to distillate the model, $ASR$ drops from $98.5\%$ to $77.4\%$ while the $ACC$ drops from $64.7\%$ to $51.8\%$.

Defense with compress distillation

Method     $ACC$     $ASR$

ESTAS     $64.7$     $98.5$

Defense $25\%$     $60.2$     $63.0$

Defense $10\%$     $51.8$     $77.4$

Defense $5\%$     $43.9$     $83.1$

§ CONCLUSION

In this work, we present ESTAS that enables effective and stable Trojan attacks in SSL image encoders with even one target-class image sample. ESTAS depends on two key components, i.e., consistent trigger poison and cascade optimization, to achieve superior performance. Our comprehensive experiments show that  ESTAS attains $>30\%$ $ASR$ increase and $>8.3\%$ accuracy improvement on average over prior works. And ESTAS stably achieves $>99\%$ $ASR$ with one target-class sample on multiple tasks.

§ APPENDIX

§.§ ESTAS on MoCo v2

In Figure <ref>, we show our attack method on the MoCo v2 SSL method. First, given any unlabeled image, we use data augmentation in MoCo V2 to generate three augmentations, i.e, $i$, $i_1$, and $i_2$. Only the augmentation $i$ is attached trigger to obtain the poisoned image $i^t$ by our proposed consistent trigger poison method. Our ESTAS only needs one target-class sample and we denote its argumentation as $j$.  We load $i^t$ and $i_1$ into encoder $f_q$ to derive representations $q_0^t$ and $q_0$, respectively, and put $j$ and $i_2$ into momentum encoder $f_k$ to obtain representations $k_0^t$ and $k_0$. We also use Equation <ref> and Equation <ref> to show the computing process of encoded representations.

\begin{equation}
\label{e:q_0}
\end{equation}

\begin{equation}
\label{e:k_0}
\end{equation}

As the Equation <ref> and Equation <ref> show, the projector $g_q$ and momentum projector $g_k$ will project the generated representations $q_0^t$, $q_0$, $k_0^t$ and $k_0$ with a high dimensional space to $q_1^t$, $q_1$, $k_1^t$ and $k_1$ with a lower dimensional space.

\begin{equation}
\label{e:q_1}
\end{equation}

\begin{equation}
\label{e:k_1}
\end{equation}

Cascade optimization design.
We first define the accuracy loss $L_S$ by following MoCo v2 [3] as Equation <ref> shows. Here ${k_1^-}$ are the representations of negative (dissimilar) key samples stored in a queue, e.g., Queue 1 in Figure <ref>. $\tau$ is the temperature hyper-parameter, and the default $\tau=0.2$ is used, as in  [3]. For each query, $q_1$ and $k_1$ form a positive pair because they are data-augmented versions of the same image. In contrast, $q_1$ and ${k_1^-}$ form negative pairs since they come from different-class images. After each query, $k_0$ and $k_1$ will be appended to Queue 0 and Queue 1 respectively, acting as negative samples in other queries.

\begin{equation}
\label{e:accuracy loss}
L_S=-log\frac{exp\left(q_1\cdot k_1/\tau\right)}{exp\left(q_1\cdot k_1/\tau\right)+\sum_{k_1^-}exp\left(q_1\cdot k_1^-/\tau\right)}
\end{equation}

ESTAS with MoCo v2.

t-SNE visualization of features in Bad-Encoder.

We formulate our attack in SSL encoder as one optimization problem, i.e., maximizing the similarity between representations $q_0^t$ and $k_0^t$, $q_1^t$ and $k_1^t$. For this reason, we define local attack loss $L_L$ and global attack loss $L_G$ in Equation <ref> and Equation <ref>, respectively. $q_0^t$ and $q_1^t$ are representations of the image that is poisoned, $k_0^t$ and $k_1^t$ are representations of the image that is a target class, and $k_0^-$ and $k_1^-$ are representations of other images which means $q_0^t$ and $k_0^t$, $q_1^t$ and $k_1^t$ form positive pairs whereas $q_0^t$ and $k_0^-$, $q_1^t$ and $k_1^-$ form negative pairs. We use both local attack loss and global attack loss because we consider the local loss helps extract local features but the global loss on the projector’s output helps extract additional high-level context information.

\begin{equation}
\label{e:local attack loss}
L_L=-log\frac{exp\left(q_0^t\cdot k_0^t/\tau\right)}{exp\left(q_0^t\cdot k_0^t/\tau\right)+\sum_{k_0^-}exp\left(q_0^t\cdot k_0^-/\tau\right)}
\end{equation}

\begin{equation}
\label{e:global attack loss}
L_G=-log\frac{exp\left(q_1^t\cdot k_1^t/\tau\right)}{exp\left(q_1^t\cdot k_1^t/\tau\right)+\sum_{k_1^-}exp\left(q_1^t\cdot k_1^-/\tau\right)}
\end{equation}

§.§ Average number of queries

Given a ratio $r$ and an unlabeled training set with $N$ images including $N_t$ target-class images, the attacker needs to identify $PN=N\times r$ target-class images to poison. To identify one target-class image from the unlabeled and disordered dataset, the attacker must go through the whole dataset. We define the process of determining whether an image belongs to the target class as a single query. The average number of queries ($AQ$) to get $PN$ target-class samples is the mathematic expectation of the number of queries.

First, we define $P(n)$ in Equation <ref> to describe the probability that at least $n$ queries are needed to get $PN$ target-class images.

\begin{equation}
\label{e:P}
\end{equation}

The first term of Equation <ref>, i.e., $\frac{\binom{N_t}{PN}\cdot\binom{N-N_t}{n-PN}}{\binom{N}{n}}$ denotes the probability of getting $PN$ target-class images in $n$ queries and it can be understood as follows: $\binom{N}{n}$ denotes the number of methods to draw $n$ out of $N$ images; $\binom{N_t}{PN}$ indicates the number of methods to draw $N_t$ out of $PN$ target-class images and $\binom{N-N_t}{n-PN}$ indicates the number of methods to draw $N-N_t$ out of $n-PN$ non-target class images. The second term, i.e., $\frac{PN}{n}$, is to ensure that the last image of $n$ belongs to the target class. Otherwise, it will no longer need $n$ queries to get $N_t$ target-class images.

So, we can define $AQ$ using the following Equation <ref> and Equation <ref>, where $K$ in Equation <ref> and Equation <ref> means the worst-case query number. The worst case means that all $N_t$ target-class images are located in the last $N_t$ images.

\begin{equation}
\label{e:AQ}
AQ=E(n)=\sum_{n=1}^KnP(n)=\sum_{n=1}^K\frac{\binom{N_t}{PN}\cdot\binom{N-N_t}{n-PN}}{\binom{N}{n}}\cdot PN
\end{equation}

\begin{equation}
\label{e:K}
\end{equation}

§.§ Stability and Attack Efficacy Analysis on Bad-Encoder and our ESTAS

To compare the stability and attack efficacy of our baseline Bad-Encoder and our ESTAS, in Figure <ref>, we use t-SNE [20] to visualize their representations of poisoned inputs and clean inputs in the test set. Figure <ref>(a) shows the distribution of representations when attacking a pre-trained clean model with Bad-Encoder[10]. The representations of the poisoned images are not only entangled with the target-class representations, i.e., Tabby Cat, but also entangled with the House Cat and Alley Cat that have similar representations with Tabby Cat in feature space. This is because the clean pre-trained encoder will output similar representations to these categories. This is one of the reasons why Bad-Encoder can occasionally achieve a high $ASR$ but cannot achieve a stable attack, e.g., it may classify the poisoned image into a non-target class that is similar to the target class. In contrast, when using ESTAS, as Figure <ref>(b) shows, the encoder generates entangled representations for poisoned images and target-class images. And their representations have a large distance from other-class features that are similar in the Bad-Encoder.  One of the reasons is that our ESTAS trains an encoder from scratch, eliminating the reliance on a pre-trained model that is required by our baseline Bad-Encoder for attacks.

§.§ Scheduler of hyper-parameters $\lambda_1$ and $\lambda_2$ for multiple-object optimization

\begin{equation}
\label{e:loss-estas-ap}
L_{ESTAS}=L_{S}+\lambda_1 L_{G}+\lambda_2 L_{L}
\end{equation}

\begin{equation}
\label{e:lambda}
\lambda_1,\lambda_2=\lambda_{10} \cdot \frac{e}{E},\lambda_{20} \cdot \frac{e}{E}
\end{equation}

Our ESTAS converts the Trojan attack in the SSL image encoder as a multiple-object optimization problem, i.e., optimizing model accuracy, global attack loss, and local attack loss shown in Equation <ref>. For this reason, we have two hyper-parameters  $\lambda_1$ and $\lambda_2$. We use a linear scheduler to enable stable training.  The $\lambda_1$ and $\lambda_2$ will change according to current training epochs $e$ and total training epochs $E$ as Equation <ref> shows. In Equation <ref>, $\lambda_{10}$ and $\lambda_{20}$ are the initial values of $\lambda_0$ and $\lambda_1$ which equal to $1.0$ as default. And $\frac{e}{E}$ which means the training progress changes from $0$ to $1$.
By using this scheduler, the model will initially prioritize minimizing accuracy loss and pay increasing attention to minimizing attack loss as training progresses.

§.§ Multi-target trojan attack with the same trigger partten

Compared to the inconsistent trigger poison, the consistent trigger poison can ensure that the location of the trigger pattern in the image remains consistent across all training images, but the inconsistent trigger poison cannot. Because the location of triggers added by inconsistent trigger poison will be changed by following data augmentation, but will not be changed if triggers are added by consistent trigger poison since it adds triggers after data augmentation. For this reason, the model attacked with consistent trigger poison is location sensitive. We have designed the multi-target trojaned model based on this location sensitivity.

Multi-target trojan attack.

In Figure <ref>, we use the ESTAS to train a trojaned model which will output four different labels when patching the same trigger pattern on the different locations of the same test image. And we can achieve $98.3\%$ $ASR$ on average for each target class.

[1]
Eugene Bagdasaryan and Vitaly Shmatikov.
Blind backdoors in deep learning models.
In 30th USENIX Security Symposium (USENIX Security 21), pages
1505–1521, 2021.

[2]
Ting Chen, Simon Kornblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey
Big self-supervised models are strong semi-supervised learners.
arXiv preprint arXiv:2006.10029, 2020.

[3]
Xinlei Chen, Haoqi Fan, Ross Girshick, and Kaiming He.
Improved baselines with momentum contrastive learning.
arXiv preprint arXiv:2003.04297, 2020.

[4]
Xinlei Chen and Kaiming He.
Exploring simple siamese representation learning.
CoRR, abs/2011.10566, 2020.

[5]
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song.
Targeted backdoor attacks on deep learning systems using data
CoRR, abs/1712.05526, 2017.

[6]
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.
Imagenet: A large-scale hierarchical image database.
In 2009 IEEE Computer Society Conference on Computer Vision
and Pattern Recognition (CVPR 2009), 20-25 June 2009, Miami, Florida,
USA, pages 248–255. IEEE Computer Society, 2009.

[7]
Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre
Richemond, Elena Buchatskaya, Carl Doersch, Bernardo Avila Pires, Zhaohan
Guo, Mohammad Gheshlaghi Azar, Bilal Piot, koray kavukcuoglu, Remi Munos, and
Michal Valko.
Bootstrap your own latent - a new approach to self-supervised
In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin,
editors, Advances in Neural Information Processing Systems, volume 33,
pages 21271–21284. Curran Associates, Inc., 2020.

[8]
Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg.
Badnets: Identifying vulnerabilities in the machine learning model
supply chain.
CoRR, abs/1708.06733, 2017.

[9]
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.
Deep residual learning for image recognition.
In 2016 IEEE Conference on Computer Vision and Pattern
Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pages
770–778. IEEE Computer Society, 2016.

[10]
Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong.
Badencoder: Backdoor attacks to pre-trained encoders in
self-supervised learning.
In 2022 IEEE Symposium on Security and Privacy (SP), pages
2043–2059. IEEE, 2022.

[11]
Jing Yu Koh.
Model Zoo: Discover open source deep learning code and pretrained
<https://modelzoo.co/>, 2018.
[Online; accessed 19-July-2018].

[12]
Soroush Abbasi Koohpayegani, Ajinkya Tejankar, and Hamed Pirsiavash.
Compress: Self-supervised learning by compressing representations.
In Hugo Larochelle, Marc'Aurelio Ranzato, Raia Hadsell,
Maria-Florina Balcan, and Hsuan-Tien Lin, editors, Advances in
Neural Information Processing Systems 33: Annual Conference on Neural
Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020,
virtual, 2020.

[13]
Alex Krizhevsky.
Learning multiple layers of features from tiny images.

[14]
Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton.
Cifar-100 (canadian institute for advanced research).

[15]
Changjiang Li, Ren Pang, Zhaohan Xi, Tianyu Du, Shouling Ji, Yuan Yao, and Ting
Demystifying self-supervised trojan attacks.
arXiv preprint arXiv:2210.07346, 2022.

[16]
Hongbin Liu, Jinyuan Jia, and Neil Zhenqiang Gong.
Poisonedencoder: Poisoning the unlabeled pre-training data in
contrastive learning.
arXiv preprint arXiv:2205.06401, 2022.

[17]
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang,
and X. Zhang.
Trojaning attack on neural networks.
In NDSS, 2018.

[18]
Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash.
Hidden trigger backdoor attacks.
In The Thirty-Fourth AAAI Conference on Artificial
Intelligence, AAAI 2020, The Thirty-Second Innovative Applications of
Artificial Intelligence Conference, IAAI 2020, The Tenth AAAI Symposium
on Educational Advances in Artificial Intelligence, EAAI 2020, New York,
NY, USA, February 7-12, 2020, pages 11957–11965. AAAI Press, 2020.

[19]
Aniruddha Saha, Ajinkya Tejankar, Soroush Abbasi Koohpayegani, and Hamed
Backdoor attacks on self-supervised learning.
arXiv preprint arXiv:2105.10123, 2021.

[20]
Laurens van der Maaten and Geoffrey Hinton.
Visualizing data using t-SNE.
Journal of Machine Learning Research, 9:2579–2605, 2008.

[21]
Jun Yue, Leyuan Fang, Hossein Rahmani, and Pedram Ghamisi.
Self-supervised learning with adaptive distillation for hyperspectral
image classification.
IEEE Transactions on Geoscience and Remote Sensing, 60:1–13,


# Chain decay and rates disorder in the totally asymmetric simple exclusion
process

Y. Ibrahim1,2, J. Dorignac1, F. Geniet1, C. Chevalier1, J. C. Walter1, N-O.
Walliser1, A. Parmeggiani1, J. Palmeri1 1Laboratoire Charles Coulomb, UMR5221
CNRS-UM, Universite de Montpellier, Place Eugene Bataillon, 34095 Montpellier
Cedex 5, France
2Department of Physics, Umaru Musa Yar’adua University, P.M.B. 2218 Katsina,
Nigeria

###### Abstract

We theoretically study the Totally Asymmetric Exclusion Process (TASEP) with
quenched jumping rates disorder and finite lifetime chain. TASEP is widely
used to model the translation of messenger RNAs by Ribosomes in protein
synthesis. Since the exact solution of the TASEP model is analytically and
computationally intractable for biologically relevant systems parameters, the
canonical Mean-Field (MF) approaches of solving coupled non-linear
differential equations is also computational expensive for the scale of
relevant biological data analysis. In this article, we provide alternative
approach to computing the MF steady state solution via a computationally
efficient system of non-linear algebraic equations. We further outline a
framework for including correlations progressively via the exact solution of
small size TASEP system. Leading order approximation in the biologically
relevant entry rate limited regime shows remarkable agreement with the full
Monte-Carlo simulation result for a wide range of system parameter space.
These results could be of importance to the kinetic rates inference in Ribo-
Seq data analysis and other related problems.

##  I Introduction

The totally asymmetric exclusion process (TASEP) is a paradigmatic model of
non-equilibrium statistical mechanics derrida1993exact ; parmeggiani2003phase
; derrida2007non . It is a simple model that captures the essential features
of many non-equilibrium systems, such as traffic flow szavits2019accurate ;
ciandrini2013ribosome , diffusion in biological membranes, and protein
synthesis. The TASEP is a one-dimensional lattice model with particles that
can hop to their nearest neighbor site in the forward direction, but not in
the backward direction. The particles are hard-core, meaning that no two
particles can occupy the same site at the same time (excluded volume
interaction). The TASEP is driven by a difference in the particle density
between the two ends of the lattice derrida2004asymmetric . TASEP has been
studied extensively using both analytical and numerical methods
derrida1993exact ; derrida1998exactly ; neri2011totally . It has been shown
that the TASEP exhibits a variety of non-equilibrium phenomena, such as phase
transitions and jamming. The TASEP can be used to model protein synthesis by
considering the ribosomes as particles on a lattice, where the lattice sites
represent codons on the messenger RNA (mRNA) macdonald1969concerning . The
ribosomes can hop to the next codon on the mRNA in the forward direction, but
not backwards. The TASEP has been used to model a variety of aspects of
protein synthesis, such as the ribosome flow rate (current), the distribution
of ribosomes on the mRNA, and the effect of collisions/jamming on protein
synthesis greulich2008phase .

Here, we study the TASEP with quenched jump rates disorder and finite
degradation rate of the chain. We give an alternative framework of
approximating the system correlations and outlined computationally iterative
solution method thereby circumventing the coupled non-linear differential
equations.

The article is organized as follows. In the next section, we outline the TASEP
model and introduce notations. The main results are presented in section III
while we discuss the results implication and conclude in section IV.

Dimensionless ratio | Description
---|---
$\Omega/w_{min}\in[0,\infty)$ | Score quantifying the chain degradation rate relative to the weakest jump rate in the bulk
$\alpha/w_{min}\in(0,\infty)$ | This quantifies the onset of phase transition out of the Low Density phass
$\Delta\equiv 1-{w_{min}}/{w_{max}}\in[0,1)$ | The jump rates disorder distribution width quantifies the chances of occurrence of a slow bond
| right after a fast bond and thereby inducing a traffic jam
Table 1: Relevant dimensionless ratios for the five kinetic rates:
$\alpha,w_{min},w_{max},\beta$ and the chain degradation rate $\Omega$. Note
that unless otherwise stated, we assume the exit rate $\beta$ to be non-
limiting (i.e. $\beta\gg\alpha,w_{min},w_{max},\Omega$).

##  II The TASEP model

We consider a one-dimensional lattice with a total of $N$ lattice sites. We
further denote the presence of a particle at a lattice site $j$ with
$\sigma_{j}=1$ and its absence with $\sigma_{j}=0$. A particle, with $\ell$
lattice sites long footprint, jumps from site one site to another on the
lattice with the following dynamical rules:

  * (a.)

A particle enter the lattice at a rate $\alpha$ with its _trailing edge_ on
the first site $(j=1)$, provided the first $\ell$ sites are empty
($\sigma_{1}=\cdots=\sigma_{\ell}=0$).

  * (b.)

Particle advance from site $j$ to site $j+1$ with a rate $w_{j}$, provided the
$j+1$ through $j+\ell$ sites are empty
($\sigma_{j+1}=\cdots=\sigma_{j+\ell}=0$).

  * (c.)

From the lattice site $j=N-\ell+1$, particle exit the lattice incrementally
and unhindered with a rate $w_{j}$.

  * (d.)

When the trailing edge of the particle is at site $N$, the particle exits with
a rate $\beta$.

Figure 1: Density profiles (left) $\Omega=0$ and (right) $\Omega=0.01$. The
other parameters remain constant: $\alpha=\beta=w_{max}=w_{min}=1$.

###  II.1 Master equation

The probability, $P(\mathcal{C},t)$, of finding the lattice in a configuration
$\mathcal{C}\equiv\left(\sigma_{1},\cdots,\sigma_{N}\right)$ at time $t$,
evolve according to the master equation derrida1993exact ;
parmeggiani2003phase

$\displaystyle\frac{d}{dt}\widetilde{P}\left(\mathcal{C},t\right)$
$\displaystyle=\sum_{\mathcal{C}^{\prime}}W_{\mathcal{C}\leftarrow\mathcal{C}^{\prime}}\,\widetilde{P}\left(\mathcal{C}^{\prime}\right)-\sum_{\mathcal{C}^{\prime}}W_{\mathcal{C}^{\prime}\leftarrow\mathcal{C}}\,\widetilde{P}\left(\mathcal{C}\right)\
,$ (1)

where $W_{\mathcal{C}\leftarrow\mathcal{C}^{\prime}}$ is the transition rate
from state $\mathcal{C}^{\prime}$ to state $\mathcal{C}$ and
$\widetilde{P}\left(\mathcal{C},t\right)$ is the probability of finding the
system in configuration
$\mathcal{C}\equiv\left(\sigma_{1},\cdots,\sigma_{N}\right)$ at time $t$.
$\sigma_{j}=1$ if site $j$ is occupied by the _trailing_ edge of the particle
and $\sigma_{j}=0$ if empty.

Throughout this article, we assume that the chain has a constant degradation
rate $\Omega$ and an exponential age distribution,
$\Omega\exp{\left(-\Omega\,t\right)}$, such that the age averaged
probabilities are valleriani2010turnover ; szavits2020dynamics

$P\left(\mathcal{C},\Omega\right)\equiv\int_{0}^{\infty}\widetilde{P}\left(\mathcal{C},t\right)\,\Omega\exp{\left(-\Omega\,t\right)}\,dt\
.$ (2)

Therefore, the chain’s age averaged master equation now reads

$\displaystyle\Omega P\left(\mathcal{C},\Omega\right)-\Omega
P(\mathcal{C},t=0)=$
$\displaystyle\quad\qquad\sum_{\mathcal{C}^{\prime}}W_{\mathcal{C}\leftarrow\mathcal{C}^{\prime}}\,P\left(\mathcal{C}^{\prime},\Omega\right)-\sum_{\mathcal{C}^{\prime}}W_{\mathcal{C}^{\prime}\leftarrow\mathcal{C}}\,P\left(\mathcal{C},\Omega\right)\
,$ (3)

where we set the initial condition $P(\mathcal{C},t=0)$ to an empty chain,
i.e. $P(\mathcal{C},t=0)=P\left(\sigma_{1}=\cdots=\sigma_{N}=0\right)$.

Solving for the $P\left(\mathcal{C},\Omega\right)$ will allow us to obtain
moments of the particle site occupation, $\sigma_{j}$, such as the marginal
probability
$\left<\sigma_{j}\right>\equiv\sum_{\mathcal{C}}\sigma_{j}P\left(\mathcal{C},\Omega\right)$.

The configuration space, $\mathcal{C}$, grows exponentially with the system
size, $N$. Therefore, solving for $P\left(\mathcal{C}\right)$ becomes
computationally expensive for physically relevant system sizes
(ciandrini2013ribosome, )

The marginals $\left<\sigma_{j}\right>$ and
$\left<\sigma_{j}\sigma_{j+\ell}\right>$ satisfy the following system of
algebraic equations (parmeggiani2004totally, ; ciandrini2013ribosome, )

$\displaystyle 0$ $\displaystyle=\
\overbrace{w_{j-1}\Big{(}\left<\sigma_{j-1}\right>-\left<\sigma_{j-1}\sigma_{j-1+\ell}\right>\Big{)}}^{\text{flux
into site $j$}}$
$\displaystyle\qquad\quad-\underbrace{w_{j}\Big{(}\left<\sigma_{j}\right>-\left<\sigma_{j}\sigma_{j+\ell}\right>\Big{)}\quad-\Omega\,\left<\sigma_{j}\right>}_{\text{flux
out of site $j$}}\ ,$ (4)

for $1\leqslant j\leqslant N$, with fixed boundary conditions $\sigma_{0}=1$
and $\sigma_{N+1}=\sigma_{N+2}=\cdots=\sigma_{N+\ell}=0$ for the left and
right boundaries respectively. Henceforth, we use interchangeably the
notations $w_{0}\equiv\alpha$ for the entry (initiation) rate and
$w_{N}\equiv\beta$ for the exit (termination) rate.

##  III Results

Figure 2: (Chain decay, $\Omega/w_{min}>0$) Densities, $\rho_{j}$, and scatter
plots for sample sequence drawn from $w_{j}\in[3,80]$, $\alpha=0.1$,
$\beta=30$, with $\ell=9$, and $N=100$ total lattice sites. (top left)
$\rho_{j}$ plot for $\Omega=0$. The red dashed line is Eqn. (10) fit of the
Monte Carlo simulation. (top right) Scatter plot of data points in the top
left figure. (bottom left) $\rho_{j}$ plot for $\Omega=0.5$. The dashed red
line is the Eqn. (10) fit. (bottom right) Scatter plot of data points in the
bottom left figure.

###  III.1 Correlations modeling

To calculate the particle densities $\left<\sigma_{j}\right>\equiv\rho_{j}$
from eqn. (4), we require what we call the _collision_ marginals
$\left<\sigma_{j-1}\sigma_{j+\ell-1}\right>$ and
$\left<\sigma_{j}\sigma_{j+\ell}\right>$ to close the system of equations. The
canonical approach is to build a hierarchy of equations of marginals involving
larger number of sites (i.e. the BBGKY hierarchy) and truncating the system at
a desired level of accuracy. With this approach, increasing accuracy of the
approximation comes with linear increase in the number of equations to be
solved. Secondly, the effectiveness of the approach depends on the quality of
the approximation of the truncating correlation function.

Here, we take an entirely different approach, we model the two-site
correlation marginal $\langle\sigma_{j}\sigma_{j+\ell}\rangle$ with the exact
solution of few sites TASEP system. For $N=2$ and $N=3$ sites, the analytic
calculation is tractable (see the Appendix). For larger system sizes, fast
linear solvers could be used to solve for the correlation.

####  III.1.1 $\ell=1$ particles

Hence, the marginal probability that a site $j+1$ is empty is
$\left(1-\rho_{j+1}\right)$ while the marginal probability that site $j$ is
occupied is simply $\rho_{j}$. However, the probability of two particles
colliding (i.e. site $j+1$ is occupied given that site $j$ is also occupied)
is approximated by simple mutual independence of the sites
macdonald1969concerning

$\left<\sigma_{j}\sigma_{j+1}\right>\rightarrow\rho_{j}\,\rho_{j+1}\ .$ (5)

This is the canonical Mean-Field (MF) approximation. It’s important to note
that we expect weak contributions from these terms in the entry limited regime
of the dynamics.

This MF approximation greatly simplifies the problem from an exponentially
large system of $\sim 2^{N}$ linear equations (eqns. 4) to a relatively small
system of $N$ non-linear coupled algebraic equations:

$\Omega\,\rho_{j}=w_{j-1}\rho_{j-1}\left(1-\rho_{j}\right)-w_{j}\rho_{j}\left(1-\rho_{j+1}\right)\
,$ (6)

for $1\leqslant j\leqslant N$, and at the boundary, $\rho_{0}=1$, while
$\rho_{N}=0$.

####  III.1.2 $\ell\geqslant 2$ (extended) particles

In similar manner, for extended particles that have cover more a single site,
the marginal probability that a site $j+\ell$ is empty is
$\left(1-\sum_{s=1}^{\ell}\rho_{j+s}\right)$ while the marginal probability
that site $j$ is occupied is simply $\rho_{j}$. McDonalds’s et. al.
macdonald1969concerning  provided an accurate approximation of the collision
marginal

$\left<\sigma_{j}\sigma_{j+1}\right>\rightarrow\frac{\rho_{j}\,\rho_{j+\ell}}{\left(1-\sum_{s=1}^{\ell}\rho_{j+s}\right)+\rho_{j+\ell}}\
.$ (7)

There are $\ell$ modes of occupying each lattice site, $j$, and the empty mode
macdonald1969concerning . Essentially, the joint probability,
$\left<\sigma_{j}\sigma_{j+1}\right>$, is replaced by a product of the
marginal probability of particle occupying site $j$ and the conditional
probability that site $j+1$ is also occupied while site $j$ is either empty or
occupied by the leading edge of the particle.

Substituting the correlation $\left<\sigma_{j}\sigma_{j+1}\right>$ in eqn.
(4), it follows that

$\Omega\,\rho_{j}=w_{j-1}\rho_{j-1}\left(1-R_{j-1+\ell}\right)-w_{j}\rho_{j}\left(1-R_{j+\ell}\right)\
,$ (8)

for $1\leqslant j\leqslant N-\ell$ and

$R_{j+\ell}=\frac{\rho_{j+\ell}}{\left(1-\sum_{s=1}^{\ell}\rho_{j+s}\right)+\rho_{j+\ell}},\quad
1\leqslant j\leqslant N-\ell$

while at the boundaries $\rho_{0}=1$ and $R_{N-\ell+1}=\cdots=R_{N+\ell}=0$.

####  III.1.3 Iterative method of solution

Instead of solving the $N$ system of coupled differential equations, the age-
averaged densities could be directly computed from $N$ coupled algebraic
equations:

$\rho_{j}=\frac{w_{j-1}\rho_{j-1}\left(1-R_{j-1+\ell}+\rho_{j}\right)}{\Omega+w_{j-1}\rho_{j-1}+w_{j}\left(1-R_{j+\ell}\right)}$
(9)

where starting with an appropriate initial guess, say
$\rho_{j}=\mbox{min}(\alpha,\\{w_{j}\\},\beta)/(1+\ell)$, the system will
converge to the solution after few iterations. This provide a computationally
efficient way to compute the densities and other statistics of interest.

###  III.2 Entry limited (low density) expansion

Figure 3: Phase separation for $\alpha/w_{min}\gg{1}/{2}$ while
$\beta/w_{min}\gg 1$, $\Omega=0$ and $\Delta=0.9$.

Of special interest is the entry limited regime (or Low Density phase) in the
parameter space due to its relevance to the biological process of ribosome
translation of mRNA . From eqn. (6), and expanding the densities in the small
parameter $\epsilon=\alpha/(\Omega+w_{1})$, we obtain the first order
contribution in the small parameter, $\epsilon$,

$\rho_{j}\ =\
\frac{\alpha}{w_{j}}\prod_{n=1}^{j}\left(\frac{w_{n}}{\Omega+w_{n}}\right)\ +\
\mathcal{O}\left(\epsilon^{2}\right)\ ,$ (10)

for $1\leqslant j\leqslant N-1$ (see the Appendix for details). Interestingly,
this first order contribution captures the essential physics in this entry
limited regime, showing excellent quantitative agreement with the full Monte
Carlo simulations (see Figs. 2, and 4) for a broad range of values. Expansion
to the second order in $\epsilon$ could be found in the Appendix. For brevity,
we keep here only the first order contribution.

####  III.2.1 Reduced throughput

To quantify the effects of both the chain decay and jumping rates disorder, we
define a (dimensionless) throughput ratio (TR) quantity as,
$\text{TR}=J_{\text{out}}/J_{\text{in}}$, where $J_{\text{in}}$ and
$J_{\text{out}}$ are the entry and exit fluxes of particles respectively. In
the low density limit, ($\alpha/w_{min}\ll 1$),

$\text{TR}=\prod_{n=1}^{N}\left(\frac{w_{n}}{\Omega+w_{n}}\right)\ .$ (11)

Notably, for stable chains with infinite lifetime ($\Omega=0$), $\text{TR}=1$.
While for chains with finite lifetime ($\Omega>0$), the TASEP has reduced
throughput, $0<\text{TR}<1$. For uniform hopping rates, $w_{n}=\bar{w}$,
$TR=\exp\left(-N\log\left(1+{\Omega}/{\bar{w}}\right)\right)$. This implies
that the particle current $J$ decays exponentially with the chain length $N$.
For long chains, throughput is also exponentially sensitive to the ratio
$\Omega/w_{min}$, and less obviously to the disorder score
$\Delta=1-w_{min}/w_{max}$ (see Table LABEL:table:dimensionless:ratios).

Figure 4: (Jumping rates disorder, $0<\Delta<1$) Densities, $\rho_{j}$, plots
with the same $\alpha=0.1$, $\beta=30$, $\Omega=0.2$, $\ell=9$, and $N=100$
total lattice sites. (left) $\rho_{j}$ plot with sample sequence drawn from
$w_{j}\in[3,80]$ with $\Delta=0.96$. (right) $\rho_{j}$ plot with sample
sequence drawn from $w_{j}\in[3,20]$ with $\Delta=0.85$. The dashed red lines
are the Eqn. (10) fit to the Monte Carlo simulation data.

####  III.2.2 Approximation error distribution

Figure 5: Distribution of the particle density approximation error.

The first order approximation reproduce the exact densities for wide range of
the parameter space in the low density phase. We define the relative error

$\mbox{Approximation-
Error}=\left\\{\frac{\rho_{j}^{MC}-\rho_{j}^{approx}}{\rho_{j}^{MC}}\right\\}\
.$ (12)

We plot a sample distribution of the relative errors in percentages (see Fig.
5.

##  IV Discussion and conclusions

We have studied the totally asymmetric exclusion process with quenched jump
rates disorder and finite lifetime of the chain. We outlined an alternative
approach to efficiently compute chain-age averaged densities from algebraic
equations rather than solving relatively computationally expensive
differential equations. In addition, we provide a straightforward framework to
progressively include correlations by solving computationally inexpensive few
sites TASEP systems. Meanwhile, in the biologically relevant Low Density
phase, we found that the first leading order asymptotic expansion in the entry
rate is accurate for wide range of the system parameters. Plots are shown in
Figs (2 and 4) demonstrating the agreement with Monte-Carlo simulation
results.

The success of the entry limited approximation is complimented by the fact
that the finite degradation rate of the chain favors low density profile
downstream (see Fig. 1). Therefore, profiles like that of Fig. (3) won’t
appear for finite degradation rate $\Omega\neq 0$ and sufficiently long chain.

Even though TASEP is analytically complex problem with rich physics, simple
analytic expressions accurate for wide range of parameter space could be
found. This is in addition alternative path to including longer range
correlations by exploiting the exact solution of few site TASEP. This approach
could find applications in highly correlated systems.

##  V Appendix

###  V.1 Entry limited dynamics: Perturbative expansion in $\epsilon$

We re-write eqn. (4) from the main text to a dimensionless form

$\displaystyle\rho_{j}=\lambda_{j-1}\rho_{j-1}\left(1-\rho_{j}\right)+\rho_{j}\rho_{j+1}-\chi_{j}\rho_{j}\rho_{j+1}\
,$ (13)

where we define dimensionless parameters

$\lambda_{j}=\frac{w_{j}}{\Omega+w_{j+1}}\quad\mbox{and}\quad\chi_{j}=\frac{\Omega}{\Omega+w_{j}}\
.$ (14)

Note that $\chi_{j}$’s are bounded ($0\leqslant\chi_{j}\leqslant
1,\forall\,i$) since $w_{j}>0\ \forall\,i$.

There are two interesting limiting cases: the stable infinite lifetime of the
chain, $\Omega\rightarrow 0$, $\lambda_{j}\rightarrow{w_{j}}/{w_{j+1}}\
\mbox{and}\ \chi_{j}\rightarrow 0,$ and the short-lived chain limit
$\Omega\rightarrow\infty$; $\lambda_{j}\rightarrow 0\ \mbox{and}\
\chi_{j}\rightarrow 1,$ where the densities vanish $\rho_{j}\rightarrow 0,\
\forall j$.

In this entry limited regime, $\lambda_{0}$ is the small dimensionless
parameter of interest (since $\lambda_{0}\ll\lambda_{j}$ for any $\Omega>0$).
Hence, we let $\epsilon\equiv\lambda_{0}=\alpha/(\Omega+w_{1})$ and then
expand the densities in powers of the small parameter $\epsilon$:

$\displaystyle\rho_{j}$
$\displaystyle=\epsilon\,\rho_{j}^{(1)}+\epsilon^{2}\,\rho_{j}^{(2)}+\cdots$
(15)

_First order contribution ( $\epsilon^{1}$):_ The first order contribution to
the densities are $\rho^{(1)}_{1}=1$ and

$\rho^{(1)}_{j}\ =\
\prod_{n=1}^{j-1}\left(\frac{w_{n}}{\Omega+w_{n+1}}\right)\
,\quad\mbox{for}\quad 2\leqslant j\leqslant N\ .$ (16)

Therefore, to linear order in the small parameter $\epsilon$, the densities
are $\rho_{j}\approx\epsilon\rho_{j}^{(1)}$ and

$\rho_{j}\ \approx\
\prod_{n=0}^{j-1}\left(\frac{w_{n}}{\Omega+w_{n+1}}\right)\ ,$ (17)

for $1\leqslant j\leqslant N$, where we recall that
$\epsilon=\alpha/(\Omega+w_{1})$ and $w_{0}\equiv\alpha$. Therefore, the
corresponding particles entry flux is
$J_{\text{in}}=\alpha\left(\Omega+w_{1}-\alpha\right)/(\Omega+w_{1})$.

_Second order contribution ( $\epsilon^{2}$):_ The second order contributions
accounts for the exclusion effects (and the extended size effects (see the
Supporting Information)) where now the densities are

$\rho_{j}^{(2)}=\rho_{j}^{(1)}\left(\rho_{j+1}^{(1)}-\sum_{m=1}^{j}\chi_{m}\,\rho_{m+1}^{(1)}-\rho_{1}^{(1)}\right)\
,$ (18)

for $1\leqslant j\leqslant N-1$, while for $j=N$,

$\rho_{N}^{(2)}=\rho_{N}^{(1)}\left(\rho_{N}^{(1)}-\sum_{m=1}^{N-1}\chi_{m}\,\rho_{m+1}^{(1)}-\rho_{1}^{(1)}\right)\
.$ (19)

###  V.2 Few sites exact TASEP solutions

We present the exact analytic solution of $N=2$ and $N=3$ TASEP systems
($\ell=1$). For brevity we introduce to shorthand

$\tau_{\alpha}=\frac{1}{\alpha}\quad,\quad\tau_{j}=\frac{1}{w_{j}}\quad\mbox{and}\quad\tau_{\beta}=\frac{1}{\beta}$

It should be emphasized here that when using these expressions to approximate
the correlations, $\alpha$ and $\beta$ should be interpreted as

$\alpha\equiv w_{j-1}\rho_{j-1}\quad\mbox{and}\quad\beta\equiv
w_{j+S-1}(1-\rho_{j+S})$ (20)

where $S$ is the chosen small system size.

####  V.2.1 Two (2) sites

For two sites, we have the distribution

$\begin{bmatrix}\text{P}_{00}\\\ \text{P}_{01}\\\ \text{P}_{10}\\\
\text{P}_{11}\end{bmatrix}=\frac{1}{\mathcal{Z}_{2}}\begin{bmatrix}\tau_{alpha}^{2}\\\
\tau_{alpha}\tau_{beta}\\\ w_{1}^{-1}\left(\tau_{alpha}+\tau_{beta}\right)\\\
\tau_{beta}^{2}\end{bmatrix}\ ,$ (21)

where
$\mathcal{Z}_{2}=\tau_{alpha}^{2}+\tau_{alpha}\tau_{beta}+\tau_{1}\left(\tau_{alpha}+\tau_{beta}\right)+\tau_{beta}^{2}$
and the current reads

$J^{\text{(2-sites)}}\equiv\alpha\text{P}_{00}+\alpha\text{P}_{01}=\frac{1}{\mathcal{Z}_{2}}\left(\tau_{alpha}+\tau_{beta}\right)\
.$ (22)

####  V.2.2 Three (3) sites

The $N=3$ is a bit more involved but tractable.

$\begin{bmatrix}\text{P}_{000}\\\ \\\ \text{P}_{001}\\\ \\\ \text{P}_{010}\\\
\\\ \text{P}_{011}\\\ \\\ \text{P}_{100}\\\ \\\ \text{P}_{101}\\\ \\\
\text{P}_{110}\\\ \\\
\text{P}_{111}\end{bmatrix}=\frac{1}{\mathcal{Z}_{3}}\begin{bmatrix}\tau_{\alpha}^{3}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{1}+\tau_{\beta}\tau_{1}\Big{)}\\\
\tau_{\alpha}^{2}\tau_{\beta}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{1}+\tau_{\beta}\tau_{1}\Big{)}\\\
\tau_{\alpha}\tau_{2}\Big{(}\tau_{\alpha}+\tau_{\beta}\Big{)}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{1}+\tau_{\beta}\tau_{1}\Big{)}\\\
\tau_{\alpha}\tau_{\beta}^{2}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{2}+\tau_{\beta}\tau_{2}\Big{)}\\\
\tau_{1}^{2}\Big{(}\tau_{\alpha}+\tau_{\beta}\Big{)}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{2}+\tau_{\beta}\tau_{2}\Big{)}+\tau_{\alpha}^{2}\tau_{1}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{1}+\tau_{\beta}\tau_{1}\Big{)}\\\
\tau_{\beta}\tau_{1}\Big{(}\tau_{\alpha}+\tau_{\beta}\Big{)}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{2}+\tau_{\beta}\tau_{2}\Big{)}\\\
\tau_{2}^{2}\Big{(}\tau_{\alpha}+\tau_{\beta}\Big{)}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{1}+\tau_{\beta}\tau_{1}\Big{)}+\tau_{\beta}^{2}\tau_{2}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{2}+\tau_{\beta}\tau_{2}\Big{)}\\\
\tau_{\beta}^{3}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{2}+\tau_{\beta}\tau_{2}\Big{)}\end{bmatrix}$
(23)

where the partition function

$\displaystyle\mathcal{Z}_{3}$
$\displaystyle=\Big{(}\tau_{\alpha}^{2}\left[\tau_{\alpha}+\tau_{\beta}+\tau_{1}\right]+\tau_{2}\left(\tau_{\alpha}+\tau_{\beta}\right)\left(\tau_{\alpha}+\tau_{2}\right)\Big{)}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{1}+\tau_{\beta}\tau_{1}\Big{)}$
$\displaystyle\qquad\qquad\qquad\qquad+\Big{(}\tau_{\beta}^{2}\left[\tau_{\alpha}+\tau_{\beta}+\tau_{2}\right]+\tau_{1}\left(\tau_{\alpha}+\tau_{\beta}\right)\left(\tau_{\alpha}+\tau_{1}\right)\Big{)}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{2}+\tau_{\beta}\tau_{2}\Big{)}\
.$ (24)

The current then reads

$J^{\text{(3-sites)}}=\frac{1}{\mathcal{Z}_{3}}\left(\tau_{\alpha}+\tau_{\beta}\right)\left(\tau_{\alpha}+\tau_{2}\right)\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{1}+\tau_{\beta}\tau_{1}\Big{)}+\frac{1}{\mathcal{Z}_{3}}\tau_{\beta}^{2}\Big{(}\tau_{\alpha}\tau_{\beta}+\tau_{\alpha}\tau_{2}+\tau_{\beta}\tau_{2}\Big{)}\
.$ (25)

## References

  * (1) Ciandrini, L., Stansfield, I., and Romano, M. C. Ribosome traffic on mrnas maps to gene ontology: genome-wide quantification of translation initiation rates and polysome size regulation.  PLoS computational biology 9, 1 (2013).
  * (2) Derrida, B. An exactly soluble non-equilibrium system: the asymmetric simple exclusion process.  Physics Reports 301, 1-3 (1998), 65–83.
  * (3) Derrida, B. Non-equilibrium steady states: fluctuations and large deviations of the density and of the current.  Journal of Statistical Mechanics: Theory and Experiment 2007, 07 (2007), P07023.
  * (4) Derrida, B., Enaud, C., and Lebowitz, J. The asymmetric exclusion process and brownian excursions.  Journal of statistical physics 115, 1-2 (2004), 365–382.
  * (5) Derrida, B., Evans, M. R., Hakim, V., and Pasquier, V. Exact solution of a 1d asymmetric exclusion model using a matrix formulation.  Journal of Physics A: Mathematical and General 26, 7 (1993), 1493\.
  * (6) Greulich, P., and Schadschneider, A. Phase diagram and edge effects in the asep with bottlenecks.  Physica A: Statistical Mechanics and its Applications 387, 8-9 (2008), 1972–1986.
  * (7) MacDonald, C. T., and Gibbs, J. H. Concerning the kinetics of polypeptide synthesis on polyribosomes.  Biopolymers: Original Research on Biomolecules 7, 5 (1969), 707–725.
  * (8) Neri, I., Kern, N., and Parmeggiani, A. Totally asymmetric simple exclusion process on networks.  Physical review letters 107, 6 (2011), 068702.
  * (9) Parmeggiani, A., Franosch, T., and Frey, E. Phase coexistence in driven one-dimensional transport.  Physical review letters 90, 8 (2003), 086601.
  * (10) Parmeggiani, A., Franosch, T., and Frey, E. Totally asymmetric simple exclusion process with langmuir kinetics.  Physical Review E 70, 4 (2004), 046101.
  * (11) Szavits-Nossan, J., and Ciandrini, L. Accurate measures of translation efficiency and traffic using ribosome profiling.  BioRxiv (2019), 719302.
  * (12) Szavits-Nossan, J., and Evans, M. R. Dynamics of ribosomes in mrna translation under steady-and nonsteady-state conditions.  Physical Review E 101, 6 (2020), 062404.
  * (13) Valleriani, A., Ignatova, Z., Nagar, A., and Lipowsky, R. Turnover of messenger rna: Polysome statistics beyond the steady state.  EPL (Europhysics Letters) 89, 5 (2010), 58003.