Research map / Adversarial robustness and security / Backdoor and poisoning

A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks

ICML 2024 · Adversarial robustness and security › Backdoor and poisoning · approach: Trigger-based backdoor attacks

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Provides a theoretical analysis of why dirty-label backdoor poisoning attacks succeed in a two-layer CNN under a multi-view data model, with gradient-descent learning dynamics and MNIST/CIFAR-10 experiments.

Problem

Why backdoor poisoning attacks (BPAs) on DNNs succeed remains theoretically unexplained, especially for dirty-label attacks trained with gradient descent.

Approach

Analyzes backdoor learning in a two-layer patch-based CNN with a feature-noise multi-view data model, comparing update rules of standard and poisoned training to show trigger features are learned quickly and dominate outputs when the trigger norm and poisoning rate meet conditions.

Key results

• On MNIST with 6000 training samples, BadNets at poisoning rate 0.05 reaches ASR of about 98.8% while clean accuracy stays near 99.6%.
• On CIFAR-10 with 10000 samples, BadNets at poisoning rate 0.01 reaches ASR of 98.7% with clean accuracy around 91%.
• Larger trigger norm (alpha from 0.0 to 1.0 in generalized patch) lowers time to attack success; on CIFAR-10 alpha=0.5 yields ASR 99.9% versus 16.1% at alpha=0.

Measured effects reported in the paper

Surprising findings

• Poisoned data's loss decreases faster than clean data's loss in early training, with larger gradient norms in the first epochs.
• The lowest poisoning rate needed for a successful attack decreases as the training set size grows.

Limitations

• Theory is restricted to a two-layer CNN with fixed second layer and only first-layer training.
• Analysis assumes orthogonal feature and trigger vectors and Gaussian noise, with conditions on dimension and sample sizes.
• Experiments are limited to two datasets and two dirty-label attacks.

Experimental setup

Datasets: MNIST CIFAR-10

Benchmarks: MNIST CIFAR-10

Metrics: clean accuracy attack success rate training loss gradient norm cosine similarity of representations

Baselines: BadNets four-corner attack

Builds on: Shen et al. 2022 multi-view model Allen-Zhu & Li feature learning Yang et al. 2023 smoothed ReLU activation BadNets

Closest papers by meaning

• Poisoning-Based Backdoor Attacks in Computer Vision (AAAI 2023 · similarity 0.91)
• Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.90)
• Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.89)
• Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.89)
• Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios (ICLR 2024 · similarity 0.88)
• From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.88)