Research map / Adversarial robustness and security / Backdoor and poisoning
Data Free Backdoor Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DFBA, a retraining-free, data-free backdoor attack that modifies a few parameters (one neuron per layer forming a backdoor path) of a pre-trained classifier without changing its architecture, claiming provable evasion of several defenses.
Problem
Injecting backdoors into pre-trained classifiers in model-sharing supply chains currently requires clean data for retraining or architecture changes, which limits practicality, efficiency, and stealth.
Approach
Builds a single-neuron-per-layer "backdoor path" from input to output: an optimized trigger activates a first-layer switch neuron only for backdoored inputs (via zeroed weights outside the trigger mask and a bias set so the threshold lambda separates clean from triggered inputs), then amplifies the signal through the path by a factor gamma and wires output weights to favor the target class. No dat
Key results
- Achieves 100% attack success rate across all five datasets and models, with backdoored accuracy within about 3% of clean accuracy (e.g., MNIST CNN CA 99.03% vs BA 99.01%).
- On MNIST, versus Hong et al. (non-data-free), DFBA reaches 100% ASR vs 94.59% and BA 95.51% vs 95.29% at the same CA of 96.49%.
- Injects backdoors in 0.0654 s for ResNet-18 on CIFAR10 and 0.0733 s for ResNet-101 on ImageNet on an A100, versus over 5 minutes for comparable methods.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DFBA instead of Hong et al.'s non-data-free attack | MNIST classifier · MNIST | attack success rate (ASR): 94.59 -> 100.00 | Helped |
| Use DFBA instead of Hong et al.'s non-data-free attack | MNIST classifier · MNIST | backdoored accuracy (BA): 95.29 -> 95.51 | Helped |
| Use DFBA instead of Hong et al.'s non-data-free attack | MNIST classifier · MNIST | clean accuracy (CA): 96.49 -> 96.49 | No clear effect |
| Set threshold λ to a small value (ablation) | DFBA · MNIST | backdoored accuracy (BA) | Helped |
| Increase threshold λ (ablation) | DFBA · MNIST | backdoored accuracy (BA) | Hurt |
| Increase amplification factor γ (ablation) | DFBA · MNIST | attack success rate (ASR) | Helped |
| Increase amplification factor γ beyond the point where ASR stabilizes (ablation) | DFBA · MNIST | attack success rate (ASR) | No clear effect |
| Reduce trigger size to 2 × 2 (ablation) | DFBA · MNIST | attack success rate (ASR): 100% | No clear effect |
| Use trigger sizes different from the default (ablation) | DFBA · MNIST | backdoored accuracy (BA) | No clear effect |
| Use DFBA rather than Hong et al. under Neural Cleanse | MNIST backdoored classifiers · MNIST | detection rate: 100% -> 0 | Helped |
| Apply MNTD to DFBA backdoored classifiers | DFBA · MNIST | detection rate: 0 | No clear effect |
| Apply I-BAU to unlearn DFBA | DFBA · MNIST FCN | attack success rate (ASR): 100.00 -> 100.00 | No clear effect |
Surprising findings
- Neural Cleanse achieves 100% detection of Hong et al.'s attack but 0% detection of DFBA, per the authors' reported numbers.
Limitations
- Clean-accuracy loss is larger on ImageNet (about 2.5-3 points) than on other datasets, attributed to random neuron selection.
- Formal guarantees rely on mild assumptions (inputs not activating the backdoor path), and the probability bound is derived for uniform inputs.
- Evaluated only on image classifiers with fixed-position patch triggers; NLP and transformer architectures are left to future work.
Experimental setup
Datasets: MNIST Fashion-MNIST CIFAR10 GTSRB ImageNet
Benchmarks: MNIST Fashion-MNIST CIFAR10 GTSRB ImageNet
Metrics: clean accuracy backdoored accuracy attack success rate detection rate ACC after defense computation time
Baselines: Hong et al. handcrafted backdoor attack Neural Cleanse Fine-tuning Fine-pruning MNTD I-BAU Lipschitz pruning
Builds on: Hong et al. handcrafted backdoor attack Neural Cleanse MNTD I-BAU Lipschitz pruning
Closest papers by meaning
- Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.89)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.88)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.87)
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · similarity 0.87)
- Universal Backdoor Attacks (ICLR 2024 · similarity 0.87)
- Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse (NeurIPS 2026 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.