Research map / Adversarial robustness and security / Backdoor and poisoning
Protecting against simultaneous data poisoning attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that multiple backdoor attacks can be installed simultaneously via parallel data poisoning, that existing backdoor defenses fail in this setting, and proposes BaDLoss, a loss-trajectory-based filtering defense that remains effective.
Problem
Backdoor defenses are evaluated against one attack at a time, but web-scraped training data may be poisoned by several attackers or several simultaneous attacks, which existing defenses do not handle.
Approach
Scores each training example by the distance of its per-epoch loss trajectory to a small set of known-clean probe examples' trajectories, removes the most anomalous 40%, and retrains from scratch; the anomaly criterion is attack-agnostic, so it covers backdoors that are learned either faster or slower than clean data.
Key results
- BaDLoss reduces average attack success rate in the multi-attack setting to 7.98% on CIFAR-10 and 10.29% on GTSRB, versus 64.48% and 84.28% average for other defenses (as stated in the abstract).
- BaDLoss clean accuracy in the multi-attack setting is 85.05% on CIFAR-10 (vs. 91.89% no defense) and 94.65% on GTSRB (vs. 97.63%), per single-attack table.
- Existing defenses fail in the multi-attack setting; Spectral Signatures is the best on CIFAR-10 but leaves three attacks near-perfect ASR.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use BaDLoss instead of Spectral Signatures | Multi-attack defense on CIFAR-10 · CIFAR-10 multi-attack | average attack success rate: 46.36 -> 7.98 | Helped |
| Use BaDLoss instead of Cognitive Distillation | Multi-attack defense on GTSRB · GTSRB multi-attack | average attack success rate: 81.73 -> 10.29 | Helped |
| Apply BaDLoss in the single-attack setting | Backdoor defense · CIFAR-10 single-attack | average attack success rate: 4.02 | Helped |
| Apply BaDLoss in the single-attack setting | Backdoor defense · GTSRB single-attack | average attack success rate: 32.70 | Mixed |
Surprising findings
- The single-pixel attack, unlearnable in isolation on GTSRB, reaches over 90% ASR when run simultaneously with other attacks, likely due to interaction with the patch attack.
- Simultaneous attacks can interact positively, so single-attack evaluation can misjudge attack viability.
Limitations
- Removing 40% of training examples may disproportionately harm minority classes.
- An informed attacker could tune poisoning ratios or add regularization so backdoor loss trajectories match clean examples.
- Likely performs poorly for self-supervised contrastive learning, where backdoor and clean dynamics become similar.
Experimental setup
Datasets: CIFAR-10 GTSRB
Benchmarks: CIFAR-10 GTSRB
Metrics: clean accuracy attack success rate
Baselines: Neural Cleanse Activation Clustering Spectral Signatures Frequency Analysis Anti-Backdoor Learning Cognitive Distillation
Builds on: MAP-D (Metadata Archaeology via Probe Dynamics) Anti-Backdoor Learning Neural Cleanse Spectral Signatures
Closest papers by meaning
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.88)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.88)
- Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.88)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.87)
- Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios (ICLR 2024 · similarity 0.87)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.