Research map / Adversarial robustness and security / Backdoor and poisoning

Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks

ICLR 2025 · Adversarial robustness and security › Backdoor and poisoning · approach: Trigger-based backdoor attacks · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes selective poisoning for clean-label backdoor attacks where the attacker controls only target-class data, selecting hard samples via a pretrained-model kNN score or an OOD-trained surrogate.

Problem

Clean-label backdoor attacks need many poisoned samples; existing sample-selection methods need the full labeled training set and surrogate training. The paper targets a more constrained threat model where the attacker only has data from the target class and no knowledge of the victim model or other

Approach

Select the "hard" target-class samples to trigger, using either (a) a kNN distance score in the feature space of a pretrained self-supervised or supervised model (no training needed), or (b) a loss-based ranking from a surrogate trained on target-class data merged with OOD data (TinyImageNet). Hard samples force the victim model to rely on the trigger shortcut.

Key results

• On CIFAR10 with ResNet18 at 10% poisoning of the target class, the pretrained-model selection raises SIG ASR from 60.54% (random) to 80.59%, and BadNets ASR from 45.01% to 91.68%.
• On ResNet18/CIFAR10 with a 10% target-class budget, the proposed selection strategies increase ASR by roughly 20-40% over random selection across attacks, and the gains transfer to VGG19.
• Using the same selection, Narcissus ASR rises from 56.16% (random) to 89.65% on CIFAR10 with 25 poisoned samples.

Measured effects reported in the paper

Surprising findings

• Choosing easy samples with Narcissus triggers renders the attack ineffective (13.06% ASR).
• Pretrained-feature selection outperforms the OOD surrogate strategy on CIFAR10, despite requiring no extra data.

Limitations

• Does not evaluate dirty-label attacks or defenses that mitigate backdoors in the training data.
• Effectiveness drops on highly imbalanced or distribution-shifted data such as GTSRB, with gains varying across attacks.
• Results are reported only for image classification with small CNN/ViT architectures and standard triggers.

Experimental setup

Datasets: CIFAR10 GTSRB TinyImageNet PubFig ImageNet

Benchmarks: CIFAR10 GTSRB PubFig

Metrics: attack success rate benign accuracy clean accuracy elimination rate sacrifice rate anomaly index

Baselines: Random selection Self-supervised Models strategy Supervised Models strategy Multiple-class OOD Single-class OOD Narcissus

Builds on: BadNets SIG Blended EL2N VICReg

Closest papers by meaning

• Clean-image Backdoor: Attacking Multi-label Models with Poisoned Labels Only (ICLR 2023 · similarity 0.92)
• A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers (NeurIPS 2025 · similarity 0.91)
• COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks (AAAI 2024 · similarity 0.91)
• A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks (ICML 2024 · similarity 0.90)
• Generalization Bound and New Algorithm for Clean-Label Backdoor Attack (ICML 2024 · similarity 0.88)
• Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.88)