Research map / Adversarial robustness and security / Backdoor and poisoning
Demystifying Poisoning Backdoor Attacks from a Statistical Perspective
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Derives finite-sample and asymptotic statistical bounds on clean and backdoor risk of poisoned models under constant-shift triggers, extends to generative models, and validates with synthetic and CIFAR10/MNIST experiments.
Problem
Lack of theoretical understanding of which factors determine the success of poisoning backdoor attacks with a constant trigger, and how to choose an effective trigger direction and magnitude, for both discriminative and generative models.
Approach
Characterizes backdoor attack success via tight finite-sample upper and lower bounds on the statistical risk of the poisoned model on clean and backdoor data, showing the optimal trigger points along the direction where clean data density decays fastest (smallest-variance eigendirection), and that degenerate clean data admit arbitrarily small successful triggers.
Key results
- On CIFAR10 with ResNet, backdoor accuracy rises from 0.51 at pixel value 1 to 0.99 at pixel value 30 for a BadNets square patch.
- In the 2D synthetic experiment, backdoor test error is smallest when the trigger is orthogonal to m1-m0, matching the smallest-variance eigendirection.
- Theory: when clean data is non-degenerate Gaussian, the trigger norm must be at least order sqrt(ln n) for success; with degenerate data any trigger along the degenerate direction succeeds.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Increase BadNets trigger pixel magnitude | ResNet BadNets · MNIST | backdoor accuracy: 0.72 -> 0.99 | Helped |
| Increase BadNets trigger pixel magnitude | ResNet BadNets · CIFAR10 | backdoor accuracy: 0.51 -> 0.99 | Helped |
| Increase trigger magnitude | Kernel smoothing poisoned model · Synthetic 2D Gaussian data | clean test error | Helped |
| Increase trigger magnitude | Kernel smoothing poisoned model · Synthetic 2D Gaussian data | backdoor test error | Helped |
| Orient the trigger orthogonal to $m_1-m_0$ | Kernel smoothing poisoned model · Synthetic 2D Gaussian data | backdoor test error | Helped |
| Use WaNet, Adaptive Patch, or Adaptive Blend instead of BadNets, producing larger relative shifts in low-variance dimensions | ResNet-18 backdoor attacks · CIFAR10 | attack efficacy | Helped |
| Add a square-patch trigger to the new class 10 target images | Class-conditioned DDPM · MNIST class 10 conditional generation | MSE: below the critical threshold of $0.01$ | Helped |
Surprising findings
- Human-imperceptible triggers can succeed with arbitrarily small magnitude when clean data lies in a lower-dimensional subspace.
Limitations
- Analysis restricted to constant triggers and an attacker that only poisons training data, not interfering with training.
- Vanishing poisoning ratio rho is left as an open question; theory assumes rho fixed in (0,1).
- Experiments are small-scale (MNIST, CIFAR10, 2D synthetic) and use a limited set of attacks.
Experimental setup
Datasets: MNIST CIFAR10 GTSRB
Benchmarks: MNIST CIFAR10
Metrics: zero-one test error on clean data zero-one test error on backdoor data clean accuracy backdoor accuracy MSE for generative backdoor
Baselines: BadNets WaNet Adaptive Patch Adaptive Blend
Builds on: BadNets WaNet Blended DDPM
Closest papers by meaning
- Anti-Backdoor Learning: Training Clean Models on Poisoned Data (NeurIPS 2021 · similarity 0.91)
- Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor (AAAI 2025 · similarity 0.91)
- Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.90)
- A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks (ICML 2024 · similarity 0.89)
- Universal Backdoor Attacks (ICLR 2024 · similarity 0.89)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.