Research map / Adversarial robustness and security / Backdoor and poisoning
Universal Backdoor Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Universal Backdoor Attacks that let a single data-poisoning campaign control misclassification from any source class into any target class, using LDA-compressed CLIP-surrogate latents to encode per-class binary triggers.
Problem
Data poisoning backdoors typically target a single class and need hundreds of poisons per class, so targeting all classes of a large image classifier naively would require poisoning a large fraction of web-scale training data.
Approach
Craft per-class triggers from a binary encoding of class-mean positions in a surrogate model's LDA-reduced latent space, so that poisoning one class transfers to other classes (inter-class poison transferability), enabling many-to-many backdoors with one or two poisons per class.
Key results
- On ImageNet-1K with patch trigger, the universal backdoor achieves 80.1% ASR with 2,000 poisons (0.16%) and 95.7% with 8,000 poisons, versus 0.1% for the baseline at 2,000 poisons.
- With 12,000 poisons, the universal backdoor reaches 99.73% ASR on ImageNet-2K, 91.75% on ImageNet-4K, and 47.31% on ImageNet-6K, while the baseline drops to 0.03% and 0.02% on the larger sets.
- Against fine-tuning, fine-pruning, Neural Cleanse, and NAD, the universal backdoor loses at most about 10 ASR points at 2,000 poisons and under 1 point at 5,000 or more poisons.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use latent-feature-encoded patch triggers instead of random class-specific patch triggers | Universal Backdoor vs. BadNets baseline · ImageNet-1K, 2,000 poison samples | ASR: 0.1% -> 80.1% | Helped |
| Use latent-feature-encoded blend triggers instead of random class-specific blend triggers | Universal Backdoor vs. Blended Injection baseline · ImageNet-1K, 5,000 poison samples | ASR: 0.1% -> 74.9% | Helped |
| Use patch encoding rather than blend encoding (ablation) | Universal Backdoor · ImageNet-1K, 5,000 poison samples | ASR: 74.9% -> 95.5% | Helped |
| Use latent-feature-encoded patch triggers instead of random class-specific patch triggers | Universal Backdoor vs. BadNets baseline · ImageNet-1K, 8,000 poison samples | ASR: 100% -> 95.7% | Hurt |
| Use latent-feature-based triggers rather than random triggers | Universal Backdoor vs. baseline · ImageNet-2K | ASR: 99.98 -> 99.73 | Hurt |
| Use latent-feature-based triggers rather than random triggers | Universal Backdoor vs. baseline · ImageNet-4K | ASR: 0.03 -> 91.75 | Helped |
| Use latent-feature-based triggers rather than random triggers | Universal Backdoor vs. baseline · ImageNet-6K | ASR: 0.02 -> 47.31 | Helped |
| Increase poisoning in variation classes A while keeping one poison per observed class B (ablation) | Universal Backdoor · ImageNet-1K, classes B | ASR | Helped |
| Reduce variation set A from 90% to 10% of classes (ablation) | Universal Backdoor · ImageNet-1K, observed classes B | ASR: 72.77% -> 67.72% | Mixed |
| Apply fine-tuning defense | Universal Backdoor, 2,000 poisons · ImageNet-1K | ASR: 9.8 | Hurt |
| Apply fine-tuning defense | Universal Backdoor, 8,000 poisons · ImageNet-1K | ASR: 0.2 | Hurt |
| Apply Neural Cleanse defense | Universal Backdoor, 2,000 poisons · ImageNet-1K | ASR: 10.0 | Hurt |
Surprising findings
- Poisoning a single sample in each class of a 100-class observed set achieves over 70% ASR on those classes when the remaining classes are poisoned, showing inter-class transferability.
- Neural Cleanse and other class-wise defenses are poorly suited to universal backdoors because each class has a unique trigger.
Limitations
- Relies on visible patch or blend triggers that could be detected by data sanitation; STRIP shows high false positive rates.
- Only studies training from scratch, not fine-tuning of pre-trained models such as ViT or CLIP.
- ASR is not uniform across classes; some classes are hard to attack, and ImageNet-6K reaches only 47.31% ASR.
Experimental setup
Datasets: ImageNet-1K ImageNet-2K ImageNet-4K ImageNet-6K
Benchmarks: ImageNet-1K ImageNet-2K ImageNet-4K ImageNet-6K
Metrics: attack success rate (ASR) clean accuracy ASR under defenses
Baselines: BadNets-style random patch baseline Blended Injection-style random blend baseline
Builds on: BadNets Blended Injection Neural Cleanse Neural Attention Distillation
Closest papers by meaning
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.89)
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.87)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.87)
- Data Free Backdoor Attacks (NeurIPS 2024 · similarity 0.87)
- Attack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models (CVPR 2024 · similarity 0.87)
- Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.