Research map / Adversarial robustness and security / Backdoor and poisoning
A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes three plug-in components that jointly combine sample selection (Forgetting Event plus Category Diversity weighted by trigger scale, and GMSD/MSE-based stealthy sample filtering) with RGB-channel-specific trigger intensity to improve ASR and stealthiness of clean-label poison-only backdoor attacks.
Problem
Clean-label poison-only backdoor attacks have limited attack success rate and stealthiness when sample selection and trigger design are handled in isolation, and existing sample selection ignores category information and stealthiness.
Approach
Component A combines Forgetting Event with a category-diversity term using negative-function weights chosen according to trigger scale; Component B selects target-class samples whose patches or gradients resemble the trigger (MSE/GMSD) to conceal it; Component C reweights trigger poisoning intensity across RGB channels, exploiting human insensitivity to blue, to raise ASR.
Key results
- On CIFAR-100 at 0.2% poisoning, Res-x selection raises Badnets-C ASR to 80.48% versus 59.39% for Forgetting Event.
- MultiBpp (24:48:8) reaches 76.6% ASR on CIFAR-10 at 2.5% poisoning, versus 12.5% for BppAttack.
- Narcissus with Component A reaches 96.12% ASR with only 2 poisoned images on CIFAR-10.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add Component A using Res-log sample selection | Badnets-C · CIFAR-10, 1% poisoned | ASR: 71.74% to 82.13% | Helped |
| Use Res-x² sample selection instead of Forget | Blended-C · CIFAR-10, 1% poisoned | ASR: 71.05% to 84.88% | Helped |
| Use Res-x sample selection instead of Forget | Badnets-C · CIFAR-100, 0.2% poisoned | ASR: 59.39% to 80.48% | Helped |
| Use Res-x sample selection instead of Forget | Blended-C · CIFAR-100, 0.2% poisoned | ASR: 63.11% to 73.48% | Helped |
| Use Res-e^x rather than the better-matched Res strategy (ablation) | Component A sample selection · CIFAR-10 attacks | ASR: 82.13 to 76.50 (Badnets-C); 84.88 to 71.81 (Blended-C) | Hurt |
| Add Component B sample selection (ablation) | Badnets-C · CIFAR-10, 1% poisoned | ASR: 20.47 to 21.33 | Helped |
| Add Component B to Components A&C (ablation) | Badnets-C · CIFAR-10, 1% poisoned | ASR: 86.15% to 77.67% | Hurt |
| Add Component A and Component C (ablation) | Badnets-C · CIFAR-10, 1% poisoned | ASR: 20.47 to 86.15 | Helped |
| Add Component A and Component C (ablation) | Blended-C · CIFAR-10, 1% poisoned | ASR: 53.41 to 84.13 | Helped |
| Increase poisoning rate from 1% to 2.5% while using Component B (ablation) | Badnets-C and Blended-C · CIFAR-10 | ASR: 21.33 to 70.38 (Badnets-C); 57.89 to 74.12 (Blended-C) | Helped |
| Reassign MultiBpp RGB quantization intensity to 24:48:8 (ablation) | BppAttack · CIFAR-10, 2.5% poisoned | ASR: 12.5% to 76.6% | Helped |
| Use MultiBpp quantization at 8:255:255 rather than 255:255:12 (ablation) | MultiBpp · CIFAR-10, 2.5% poisoned | ASR: 60.0% to 84.1% | Helped |
Surprising findings
- Component B alone slightly lowers or barely changes ASR at 1% poisoning, so stealthiness and ASR trade off.
- Poisoning only the blue channel can yield lower ASR than other single-channel choices depending on the setting, and red-channel poisoning gave the highest single-channel ASR (84.1%).
Limitations
- Authors acknowledge the integration of Components A and B is rudimentary.
- Negative-function weights for combining Forgetting Event and Category Diversity are chosen empirically per trigger scale.
- Stealthiness is assessed mainly via MSE/GMSD and visualization rather than human studies.
Experimental setup
Datasets: CIFAR-10 CIFAR-100
Benchmarks: CIFAR-10 CIFAR-100
Metrics: ASR BA
Baselines: Random selection Loss-based selection Gradient-norm selection Forgetting Event BppAttack Narcissus
Builds on: BppAttack Forgetting Event Narcissus Badnets Blended
Closest papers by meaning
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.91)
- COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks (AAAI 2024 · similarity 0.89)
- Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.87)
- A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives (AAAI 2024 · similarity 0.87)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.87)
- Influence-Based Fair Selection for Sample-Discriminative Backdoor Attack (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.