Research map / Adversarial robustness and security / Backdoor and poisoning

Influence-Based Fair Selection for Sample-Discriminative Backdoor Attack

AAAI 2025 · Adversarial robustness and security › Backdoor and poisoning · approach: Trigger-based backdoor attacks · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes IFS, an influence-function-based backdoor sample selection method with group-based pruning and class-balanced adaptive thresholds, to keep attack success rate high and class-wise fair when trigger strength is small.

Problem

Selective backdoor poisoning methods reach high ASR only with large trigger manipulation strength; when the trigger is made imperceptible (small epsilon), their class-wise ASR becomes highly uneven because sample selection is class-imbalanced.

Approach

Adapts influence functions to score how much each trigger-embedded training sample lowers backdoored test risk, prunes candidates to the group nearest each class prototype to cut cost, and uses per-class adaptive thresholds so each class receives an equal number of selected poison samples.

Key results

• On ImageNet-10 with patched attack at epsilon=2, IFS improves ASR by more than 5% over baselines.
• Under r=0.005 on CIFAR-10, IFS achieves more than 3% ASR improvement over state-of-the-art counterparts.
• Ablation on ImageNet-10 (blended, r=1%, eps=0.1): full IFS reaches 70.94% ASR versus 64.49% without group split or fair selection, at 1/10 of the influence computation cost with eta=10.

Measured effects reported in the paper

Surprising findings

• Existing selective backdoor methods (FUS, RD) lose more than 40% ASR on ImageNet-10 when epsilon drops from 4 to 2, showing sensitivity to trigger visibility.

Limitations

• Sensitive to mismatch between surrogate and victim training setup, with ASR dropping when training strategies differ
• HFE baseline reimplemented by the authors because no open-source code was available
• Evaluated only on image and point cloud classification with black-box blended and patched triggers

Experimental setup

Datasets: CIFAR-10 ImageNet-10 Raf-db ModelNet40

Benchmarks: CIFAR-10 ImageNet-10 Raf-db ModelNet40

Metrics: attack success rate variance of class-wise ASR

Baselines: Random search FUS RD HFE

Builds on: Influence Functions FUS RD backdoor selection LiSSA

Closest papers by meaning

• Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.87)
• A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers (NeurIPS 2025 · similarity 0.87)
• Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.87)
• RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.86)
• Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.86)
• Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.85)