Research map / Adversarial robustness and security / Backdoor and poisoning
COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes COMBAT, a clean-label backdoor attack that trains an input-dependent, low-frequency trigger generator alternately with a surrogate classifier, achieving near-perfect attack success on CIFAR-10 and CelebA while evading major defenses.
Problem
Clean-label data-poisoning backdoor attacks are stealthy but have underwhelming attack success rates, and existing ones either fail at low poisoning rates or require large modifications to training data.
Approach
Train a conditional trigger generator (U-Net with DCT low-pass filtering, Gaussian blur, and an adversarial-avoidance loss from a clean classifier) jointly with a surrogate victim classifier in an alternating optimization, so the trigger is optimized against a model that mimics the eventual poisoned victim.
Key results
- Achieves 97.73% ASR on CIFAR-10 with BA 94.58% at eta=10/255 and 5% poisoning, versus 89.09% for Narcissus and 60.90% for Sleeper Agent.
- With only 25 poisoned samples (0.05% rate), COMBAT reaches 72.31% ASR while Narcissus stays below 50%.
- Reaches 83.78% ASR on ImageNet-10 and 99.84% on CelebA; passes Neural Cleanse, STRIP, and frequency-based detection, though Fine-pruning is not evaluated as mitigating.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add alternated training of the trigger generator and surrogate classifier instead of training the generator against a fixed clean surrogate (ablation) | COMBAT · CIFAR-10 | ASR | Helped |
| add high-frequency removal (ablation) | COMBAT · CIFAR-10, ImageNet-10, and CelebA | frequency-based detector detection rate: 100.00 -> 16.20; 100.00 -> 23.33; 100.00 -> 34.33 | Helped |
| add adversarial avoidance loss (ablation) | COMBAT · CIFAR-10, poisoning rate p = 0%, victim PreActResNet-18 | ASR: 91.29 -> 6.60 | Helped |
| add adversarial avoidance loss (ablation) | COMBAT · CIFAR-10, poisoning rate p = 5%, victim PreActResNet-18 | ASR: 94.72 -> 97.73 | Helped |
| increase poisoning rate (ablation) | COMBAT · CIFAR-10 | ASR | Helped |
| use a conditional generator to support multiple target labels | COMBAT · CIFAR-10 multi-target attack | ASR: 99.07 | Helped |
Surprising findings
- Without the adversarial avoidance loss, the trigger generator learns universal targeted adversarial noise that fools victim models even without poisoning.
- ViT-Small-8 transfer attack on ImageNet-10 yields only 23.11% ASR, attributed to the small dataset size.
Limitations
- Transferability to unseen victim architectures is limited, e.g., ViT-Small-8 on ImageNet-10 reaches only 23.11% ASR.
- Evaluated only on image classification with three datasets; generalization to other domains is untested.
- Multi-target variant results are reported only on CIFAR-10.
Experimental setup
Datasets: CIFAR-10 ImageNet-10 CelebA
Benchmarks: CIFAR-10 ImageNet-10 CelebA
Metrics: attack success rate benign accuracy anomaly index detection rate entropy
Baselines: BadNets Label Consistent SIG Sleeper Agent Narcissus
Builds on: BadNets Label-consistent attack Narcissus Sleeper Agent Neural Cleanse
Closest papers by meaning
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.91)
- A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers (NeurIPS 2025 · similarity 0.89)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.87)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.87)
- Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.86)
- Generalization Bound and New Algorithm for Clean-Label Backdoor Attack (ICML 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.