Research map / Adversarial robustness and security / Backdoor and poisoning
Hidden Trigger Backdoor Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add hidden-trigger poisoned images with correct target labels | ImageNet random-pair classifier · ImageNet random pairs, patched source validation images | accuracy: 0.987$\pm$0.02 -> 0.437$\pm$0.15 | Helped |
| Add hidden-trigger poisoned images with correct target labels | ImageNet random-pair classifier · ImageNet random pairs, clean validation images | accuracy: 0.993$\pm$0.01 -> 0.982$\pm$0.01 | No clear effect |
| Use hidden-trigger poisoning instead of visible-trigger BadNets poisoning | ImageNet random-pair classifier · ImageNet random pairs, patched validation images, 100 poisons | accuracy: 0.424$\pm$0.17 -> 0.437$\pm$0.15 | No clear effect |
| Increase epsilon from 8 to 32 (ablation) | Hidden Trigger · ImageNet random pairs, patched source validation images | accuracy: 0.460$\pm$0.18 -> 0.422$\pm$0.17 | Helped |
| Increase trigger patch size from 15 to 60 (ablation) | Hidden Trigger · ImageNet random pairs, patched source validation images | accuracy: 0.630$\pm$0.15 -> 0.118$\pm$0.06 | Helped |
| Increase poison count from 400 to 1000 (ablation) | Hidden Trigger · 1000-class ImageNet classifier | Targeted Attack efficiency: 0.360$\pm$0.01 -> 0.634$\pm$0.10 | Helped |
| Train fc6 and fc7 along with fc8 instead of training fc8 only (ablation) | Hidden Trigger · ImageNet random pairs, patched source validation images | accuracy: 0.504$\pm$0.16 -> 0.646$\pm$0.18 | Hurt |
| Use hidden-trigger poisons on CIFAR10 | CIFAR10 random-pair classifier · CIFAR10 random pairs, patched source validation images | accuracy: 0.993$\pm$0.01 -> 0.182$\pm$0.14 | Helped |
| Use hidden-trigger poisons on visually similar dog categories | ImageNet dog-pair classifier · ImageNet dog pairs, patched source validation images | accuracy: 0.947$\pm$0.06 -> 0.419$\pm$0.07 | Helped |
| Use spectral signatures to detect hidden-trigger poisoned training data | Hidden Trigger · ImageNet random pairs, poisoned target training data | poisoned images removed: 100 poisoned; 0 removed for pairs 1,2,4,6,7,8,9,10 | Hurt |
Closest papers by meaning
- DEFEAT: Deep Hidden Feature Backdoor Attacks by Imperceptible Perturbation and Latent Representation Constraints (CVPR 2022 · similarity 0.92)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.92)
- Clean-Label Backdoor Attacks on Video Recognition Models (CVPR 2020 · similarity 0.92)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.90)
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.89)
- A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks (ICML 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.