Research map / Adversarial robustness and security / Backdoor and poisoning
Generalization Bound and New Algorithm for Clean-Label Backdoor Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Derives algorithm-independent generalization bounds for clean-label backdoor attacks and uses them to design a new clean-label trigger combining adversarial noise and min-min shortcut perturbations.
Problem
Generalization guarantees for clean-label backdoor attacks are missing because poisoned training sets are not i.i.d. and the backdoor trigger must work both in training and at test time with a two-fold goal (clean accuracy and targeted misclassification).
Approach
Bounds clean population error by empirical error on the poisoned set (via subset-selection argument restoring i.i.d. samples) and bounds poison population error under three conditions on the trigger (adversarial for a clean-trained net, shortcut for a binary dataset, similar across samples); the resulting trigger is U*x_adv + (1-U)*x_scut.
Key results
- On CIFAR-10 with ResNet18 at 1% poison budget and L_inf 16/255, the proposed trigger reaches 93% attack success rate with 91% poisoned model accuracy.
- Under 16/255 limit, the method outperforms seven clean-label baselines (e.g., Hidden Trigger 75%, Invisible Poison 73%, Clean Label 23%).
- Across defenses, ASR drops to about 10-40% for the proposed attack, and the stronger variant reaches 34-66% against AT and data augmentation/DPSGD/frequency filtering.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| combine adversarial perturbation with shortcut noise (ablation) | CIFAR-10 backdoor trigger · CIFAR-10, trigger bound 16/255 | ASR (%): 22% / 30% -> 93% | Helped |
| combine adversarial perturbation with shortcut noise (ablation) | CIFAR-10 backdoor trigger · CIFAR-10, trigger bound 32/255 | ASR (%): 80% / 93% -> 99% | Helped |
| replace the combined trigger with adversarial perturbation alone (ablation) | CIFAR-10 backdoor trigger · CIFAR-10, trigger bound 16/255 | ASR (%): 93% -> 22% | Hurt |
| replace the combined trigger with shortcut noise alone (ablation) | CIFAR-10 backdoor trigger · CIFAR-10, trigger bound 16/255 | ASR (%): 93% -> 30% | Hurt |
| replace the combined trigger with random noise (ablation) | CIFAR-10 backdoor trigger · CIFAR-10, trigger bound 16/255 | ASR (%): 93% -> 12% | Hurt |
| replace the combined trigger with a universal adversarial perturbation (ablation) | CIFAR-10 backdoor trigger · CIFAR-10, trigger bound 16/255 | ASR (%): 93% -> 51% | Hurt |
| increase poison budget | Ours · CIFAR-10 | ASR (%): 86 -> 93 -> 94 | Helped |
| use the proposed trigger rather than other clean-label attacks | CIFAR-10 backdoor attack · CIFAR-10, trigger bound 16/255 | ASR (%): 75% -> 93% | Helped |
| apply defenses to the proposed attack | Ours · CIFAR-10, defended models | ASR (%): 93% -> 15%, 40%, 32%, 12%, 28%, 13% | Hurt |
| increase trigger bound from 16/255 to 32/255 (ablation) | Adversarial perturbation trigger · CIFAR-10 | ASR (%): 22% -> 80% | Helped |
| increase trigger bound from 16/255 to 32/255 (ablation) | Shortcut noise trigger · CIFAR-10 | ASR (%): 30% -> 93% | Helped |
Surprising findings
- Adversarial perturbations alone give large V_sc and shortcuts alone give small V_adv; only the combination achieves both conditions.
- The proposed attack is fragile under several defenses, with ASR often near 10%, the level of the target class's own share of samples.
Limitations
- The conditions of the poison generalization bound are complicated and not simple to verify.
- Bounds do not involve the training algorithm; algorithm-dependent (stability-based) analysis is left for future work.
- The attack is fragile under several defenses such as adversarial training and fine-tuning-style defenses, as the authors acknowledge.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 SVHN TinyImageNet
Benchmarks: CIFAR-10 CIFAR-100 SVHN TinyImageNet
Metrics: clean test accuracy attack success rate target class accuracy poison model accuracy
Baselines: Clean Label Hidden Trigger Reflection Invisible Poison Image-specific Narcissus Sleeper Agent
Builds on: min-min attack PGD adversarial examples Rademacher complexity generalization bounds Sleeper Agent
Closest papers by meaning
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.88)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.86)
- COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks (AAAI 2024 · similarity 0.86)
- Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.86)
- A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks (ICML 2024 · similarity 0.86)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.