Research map / Adversarial robustness and security / Backdoor and poisoning
Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces data-constrained backdoor attacks (attacker controls only part of training data) and three CLIP-guided techniques (CLIP-CFE, CLIP-UAP, CLIP-CFA) that suppress clean features and augment poisoning features to improve attack success.
Problem
Backdoor attacks assume attackers control the entire training set from a single source, which is unrealistic; under data-constrained settings (limited poisoned samples, classes, or domains), existing attacks degrade severely due to entanglement between benign and poisoning features.
Approach
Use a general pre-trained CLIP model (instead of a proxy model trained on the full dataset) to (1) generate imperceptible noise that erases clean features (CLIP-CFE), (2) optimize a universal adversarial perturbation trigger (CLIP-UAP), and (3) optimize a contrastive trigger that strengthens poisoning features independent of target label (CLIP-CFA).
Key results
- In the number-constrained attack on VGG-16, ASR was 0.878 for BadNets, 0.825 for Blended, 0.984 for CLIP-UAP and 0.988 for CLIP-CFA.
- CLIP-CFE improved clean-label single-class attack ASR on VGG-16 by 187% (BadNets), 150% (Blended), 110% (CLIP-UAP) and 229% (CLIP-CFA).
- Benign accuracy stays around 0.72 on CIFAR-100 across all methods with and without CLIP-CFE, indicating no harm to clean accuracy.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace BadNets or Blended with CLIP-UAP or CLIP-CFA | Backdoor trigger design · CIFAR-100 number-constrained, VGG-16 | ASR: 0.878, 0.825, 0.984, and 0.988 | Helped |
| Add CLIP-CFE to BadNets (ablation) | BadNets · CIFAR-100 clean-label single-class, VGG-16 | ASR: 187% | Helped |
| Add CLIP-CFE to Blended (ablation) | Blended · CIFAR-100 clean-label single-class, VGG-16 | ASR: 150% | Helped |
| Add CLIP-CFE to CLIP-UAP (ablation) | CLIP-UAP · CIFAR-100 clean-label single-class, VGG-16 | ASR: 110% | Helped |
| Add CLIP-CFE to CLIP-CFA (ablation) | CLIP-CFA · CIFAR-100 clean-label single-class, VGG-16 | ASR: 229% | Helped |
| Add CLIP-CFE to CLIP-CFA (ablation) | CLIP-CFA · CIFAR-100, average across backdoor attacks and models | BA: 0.719 -> 0.720 | No clear effect |
| Add CLIP-CFE to CLIP-UAP (ablation) | CLIP-UAP · CIFAR-100, average across backdoor attacks and models | BA: 0.720 -> 0.719 | No clear effect |
Surprising findings
- Clean-label single-class attacks are less efficient than dirty-label ones because benign features of the target class in the poisoning set compete with poisoning features during injection.
- BadNets outperforms Blended notably in data-constrained settings, though the two are comparable under unrestricted attack conditions.
Limitations
- UAP baseline assumes a clean proxy model trained on the full dataset, which the threat model does not allow; it is shown only to illustrate degradation.
- CLIP-CFA and CLIP-UAP give only slight gains over CFE-enhanced versions in domain-constrained attacks on MobileNet-V2.
- Evaluated only on image classification with small CIFAR and ImageNet-50 settings and three architectures.
Experimental setup
Datasets: CIFAR-100 CIFAR-10 ImageNet-50 ImageNet
Benchmarks: CIFAR-100 CIFAR-10 ImageNet-50
Metrics: attack success rate benign accuracy
Baselines: BadNets Blended UAP
Builds on: BadNets Blended universal adversarial perturbations CLIP projected gradient descent
Closest papers by meaning
- Anti-Backdoor Learning: Training Clean Models on Poisoned Data (NeurIPS 2021 · similarity 0.90)
- A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks (ICML 2024 · similarity 0.88)
- Rethinking Backdoor Attacks on Dataset Distillation: A Kernel Method Perspective (ICLR 2024 · similarity 0.88)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.87)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.87)
- Protecting against simultaneous data poisoning attacks (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.