Research map / Adversarial robustness and security / Backdoor and poisoning

Does Few-Shot Learning Suffer from Backdoor Attacks?

AAAI 2024 · Adversarial robustness and security › Backdoor and poisoning · approach: Backdoors in large multimodal models · 11 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows existing backdoor attacks fail in few-shot learning and proposes FLBA, a clean-label, imperceptible-perturbation backdoor that fine-tunes on a hidden poisoned support set to reach high ASR while keeping benign accuracy.

Problem

Backdoor attacks are poorly studied in few-shot learning; existing methods either overfit benign or trigger features with limited support data and are easily detected by victims due to dirty labels or visible triggers.

Approach

Optimize a trigger that maximizes feature-space distance from clean features, then hide it via attractive (target-class) and repulsive (non-target-class) L-infinity-bounded perturbations with a max-min distance loss, poisoning the entire support set so the trigger is never visibly attached and poisoning rate can be relaxed.

Key results

• On miniImageNet 5-way 5-shot, FLBA reaches 89.1% ASR with 65.5% BA on Baseline++, versus at most 69.8% ASR for baseline dirty/clean-label attacks (Refool).
• FLBA achieves 99.2% ASR on tieredImageNet, the best among compared attacks, and still reaches a 77.1% ASR in the 1-shot setting.
• Neural Cleanse anomaly index for FLBA is 0.67 versus 4.64 for BadNet, below the detection threshold of 2.

Measured effects reported in the paper

Surprising findings

• Existing dirty-label and clean-label backdoor attacks fail to achieve both high ASR and high BA in few-shot learning, suggesting few-shot learning is harder to backdoor than standard classification.
• Transferability of the poisoned support set across different pre-trained embeddings is limited (about 20% ASR individually).

Limitations

• Method assumes a white-box setting where the attacker has access to the victim's pre-trained embedding model.
• Limited transferability of poisoned support sets across different pre-trained embeddings (about 20% ASR individually).
• Trigger size increases visibility; larger triggers are needed for higher ASR with FLBA on some settings.

Experimental setup

Datasets: miniImageNet tieredImageNet

Benchmarks: miniImageNet tieredImageNet

Metrics: attack success rate benign accuracy anomaly index

Baselines: BadNet Blended Refool WaNet Label-Consistent TUAP HTBA

Builds on: Hidden Trigger Backdoor Attack (HTBA) Baseline++ projected gradient descent Neural Cleanse

Closest papers by meaning

• Defending Pre-trained Language Models as Few-shot Learners against Backdoor Attacks (NeurIPS 2023 · similarity 0.89)
• Invisible Backdoor Attack against Self-supervised Learning (CVPR 2025 · similarity 0.86)
• Conditional Backdoor Attack via JPEG Compression (AAAI 2024 · similarity 0.85)
• DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders (CVPR 2025 · similarity 0.85)
• Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.85)
• Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.85)