Research map / Adversarial robustness and security / Backdoor and poisoning
LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes LOTUS, a label-specific backdoor attack that sub-partitions victim-class samples and assigns a distinct trigger to each partition, with a trigger-focusing training step that confines each trigger to its partition, evading trigger-inversion detectors and surviving mitigation.
Problem
Existing backdoor attacks use universal triggers that trigger-inversion detectors can find, while sample-specific invisible triggers evade detection but are fragile to fine-tuning-based mitigation. The paper seeks attacks that are both evasive and resilient.
Approach
Partition the victim class (explicitly by secondary attributes or implicitly by clustering plus a surrogate classifier) and give each partition its own trigger; a trigger-focusing loss, which adds samples with other triggers and trigger pairs labeled as the victim class, restricts each trigger to its own partition using only about 2n-2 extra combinations.
Key results
- LOTUS reaches ASR of roughly 89-96.5% across 4 datasets and 7 architectures, with average ASR-other under 6.87%.
- Under mitigation (fine-tuning, fine-pruning, NAD, ANP) on VGG11/CIFAR-10, LOTUS keeps 34.90%-46.90% ASR while most baseline attacks drop to near zero.
- LOTUS evades NC, Pixel, ABS and FeatRE trigger-inversion detection, where NC detects BadNets, Dynamic, ISSBA, LIRA and DFST.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add trigger focusing to simple data poisoning (ablation) | LOTUS · CIFAR-10 | ASR-comb: 97.88% ± 1.81% -> 0.02% ± 0.09% | Helped |
| Add trigger focusing to adversarial poisoning (ablation) | LOTUS · CIFAR-10 | ASR-comb: 73.88% ± 31.87% -> 0.02% ± 0.09% | Helped |
| Add trigger focusing instead of simple poisoning (ablation) | LOTUS · CIFAR-10 | ASR: 98.80% -> 91.40% | Mixed |
| Add trigger focusing instead of adversarial poisoning (ablation) | LOTUS · CIFAR-10 | ASR-indi: 18.95% ± 10.22% -> 14.15% ± 7.46% | Helped |
| Use trigger focusing rather than simple poisoning (ablation) | LOTUS · CIFAR-10 | NC index: 5.338 -> 1.156 | Helped |
| Apply fine-tuning using 5% of training data | LOTUS · CIFAR-10 | ASR: 93.80% -> 46.90% | Hurt |
| Apply fine-pruning | LOTUS · CIFAR-10 | ASR: 93.80% -> 44.90% | Hurt |
| Apply NAD | LOTUS · CIFAR-10 | ASR: 93.80% -> 42.30% | Hurt |
| Apply ANP | LOTUS · CIFAR-10 | ASR: 93.80% -> 34.90% | Hurt |
| Apply trigger focusing rather than adversarial poisoning (ablation) | LOTUS · CIFAR-10 | ASR-comb: 73.88% ± 31.87% -> 0.02% ± 0.09% | Helped |
Surprising findings
- Simple data poisoning yields near-universal trigger effects (about 97.9% average ASR across all trigger combinations), so plain sub-partitioning alone does not confine triggers.
- Adversarial poisoning leaves trigger-combination ASR high (73.88% on average), so it is insufficient for trigger focusing.
Limitations
- ASR is slightly lower than existing attacks in the no-defense setting (for example 93.80% vs 100% for BadNets on VGG11/CIFAR-10), a stated trade-off.
- Trigger-focusing adds training samples, and the number of trigger combinations grows with the number of partitions.
- Evaluated mainly on image classification with four partitions, and against a fixed set of defenses.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 CelebA RImageNet
Benchmarks: CIFAR-10 CIFAR-100 CelebA RImageNet
Metrics: attack success rate benign accuracy ASR-other anomaly index REASR
Baselines: BadNets Dynamic backdoor IA WaNet ISSBA LIRA DFST
Builds on: Neural Cleanse adversarial poisoning Input-aware backdoor WaNet
Closest papers by meaning
- Rethinking Backdoor Attacks on Dataset Distillation: A Kernel Method Perspective (ICLR 2024 · similarity 0.88)
- Backdoor Mitigation via Invertible Pruning Masks (NeurIPS 2025 · similarity 0.88)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.87)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.87)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.87)
- Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.