Research map / Adversarial robustness and security / Backdoor and poisoning
Data Poisoning based Backdoor Attacks to Contrastive Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CorruptEncoder, a theory-guided data poisoning backdoor attack on contrastive learning that embeds reference objects and triggers into background images so random crops align them, plus a localized-cropping defense.
Problem
Data poisoning backdoor attacks (DPBAs) against contrastive learning pre-training achieve limited attack success, especially with few reference images and small poisoning ratios on complex datasets like ImageNet.
Approach
Craft poisoned images by embedding a reference object and a trigger into a background image at positions and sizes derived theoretically (background about twice the object size, object at corners, trigger at center of remaining area), so that two random crops capture the object and trigger respectively and contrastive learning associates them.
Key results
- CorruptEncoder reaches 96.2% ASR on ImageNet100-A and 89.9% on ImageNet100-B with 650 poisoned images (0.5%) and 3 reference images, versus 5.5% to 28.8% for SSL-Backdoor and CTRL.
- BA stays close to CA (e.g., 61.2% vs 60.8% on ImageNet100-B), indicating utility is preserved.
- CorruptEncoder+ raises ASR on ImageNet100-B to 97.8%; localized cropping lowers ASR to about 0.9% but drops clean accuracy from 60.8% to 56.2%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use CorruptEncoder instead of PoisonedEncoder | Backdoor attack with MoCo-v2 on ImageNet100-A · ImageNet100-A | ASR (%): 76.7 -> 96.2 | Helped |
| Use CorruptEncoder instead of PoisonedEncoder | Backdoor attack with MoCo-v2 on ImageNet100-B · ImageNet100-B | ASR (%): 53.2 -> 89.9 | Helped |
| Use CorruptEncoder instead of PoisonedEncoder | Backdoor attack with MoCo-v2 on Pets · Pets | ASR (%): 45.8 -> 72.1 | Helped |
| Use CorruptEncoder instead of PoisonedEncoder | Backdoor attack with MoCo-v2 on Flowers · Flowers | ASR (%): 44.4 -> 89 | Helped |
| Add poisoned images using reference objects and triggers placed in random backgrounds | CorruptEncoder · ImageNet100-B | BA (%): 60.8 -> 61.2 | No clear effect |
| Replace random cropping with localized cropping (ablation) | CorruptEncoder · ImageNet100-B | ASR (%): 89.9 -> 0.9 | Hurt |
| Replace random cropping with localized cropping (ablation) | CorruptEncoder · ImageNet100-B | BA (%): 61.2 -> 56.3 | Hurt |
| Remove random cropping (ablation) | CorruptEncoder · ImageNet100-B | ASR (%): 89.9 -> 2 | Hurt |
| Remove random cropping (ablation) | CorruptEncoder · ImageNet100-B | BA (%): 61.2 -> 31.1 | Hurt |
| Replace random cropping with ContrastiveCrop (ablation) | CorruptEncoder · ImageNet100-B | ASR (%): 89.9 -> 90.8 | No clear effect |
| Remove data augmentations other than random cropping (ablation) | CorruptEncoder · ImageNet100-B | ASR (%): 89.9 -> 69.3 | Hurt |
Surprising findings
- Localized cropping reduces attack success to near zero but costs encoder utility (CA drops from 60.8% to 56.2%).
- SSL-Backdoor and CTRL achieve low ASRs even when given 650 reference images, suggesting their trigger-reference correlation is weak.
Limitations
- Experiments use a 100-class ImageNet subset as pre-training data due to limited compute.
- Localized cropping defense sacrifices substantial encoder utility.
- CorruptEncoder+ requires additional support reference images and assumes access to them.
Experimental setup
Datasets: ImageNet100-A ImageNet100-B Pets Flowers Places365
Benchmarks: ImageNet100-A ImageNet100-B Pets Flowers
Metrics: attack success rate clean accuracy backdoored accuracy
Baselines: SSL-Backdoor CTRL PoisonedEncoder ContrastiveCrop CompRess
Builds on: MoCo-v2 SSL-Backdoor PoisonedEncoder CTRL ContrastiveCrop
Closest papers by meaning
- Backdoor Contrastive Learning via Bi-level Trigger Optimization (ICLR 2024 · similarity 0.88)
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.87)
- A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers (NeurIPS 2025 · similarity 0.87)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.87)
- Universal Backdoor Attacks (ICLR 2024 · similarity 0.87)
- DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models (AAAI 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.