# BAIT: A new dnn backdoor attack using inpainted triggers

Quentin Le Roux, Yannick Teglia, Eric Bourbao, Philippe Loubet-Moundi, Teddy Furon

► To cite this version:

Quentin Le Roux, Yannick Teglia, Eric Bourbao, Philippe Loubet-Moundi, Teddy Furon. BAIT: A new dnn backdoor attack using inpainted triggers. ICIP 2025 - IEEE International Conference on Image Processing, Sep 2025, Anchorage (AK), United States. pp.1-6. hal-05168358

HAL Id: hal-05168358

https://hal.science/hal-05168358v1

Submitted on 17 Jul 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# BAIT: A NEW DNN BACKDOOR ATTACK USING INPAINTED TRIGGERS

Quentin Le Roux*† Yannick Teglia* Eric Bourbao* Philippe Loubet Moundi* Teddy Furon†

*Thales CDI, La Ciotat, France †Inria, Rennes, France

## ABSTRACT

Backdoor attacks compromise deep neural networks by injecting them with covert, malicious behaviors during training, which attackers can later activate at test-time. As backdoors become more sophisticated, defenses struggle to catch up. This paper introduces a simple yet effective Backdoor Attack using Inpainting as a Trigger, dubbed BAIT. The attack's trigger relies on a randomly-drawn polygonal patch, filled via inpainting with an off-the-shelf generative adversarial network. Using BAIT, we show that several defenses, including common test-time input purification methods, can be bypassed by patch-based backdoors. To counter this, we propose four targeted defense strategies.

**Index Terms**— deep neural networks, adversarial machine learning, integrity risk, backdoor attacks, inpainting

## 1. INTRODUCTION

Deep neural networks (DNN) are widely used in industry applications [1, 2]. The reliance on large datasets and pretrained models raise security issues about the integrity of both data and models. Among existing threats, DNN backdoor attacks have gained attention since their first demonstration in 2017 [3]. They inject stealthy, malicious behaviors in seemingly benign DNNs during training, which can later be activated at inference by using a specific trigger added to an input. Such triggers are remarkably diverse, e.g., from visible patches [3] to diffuse signals [4]. Backdoor attacks undermine the trustworthiness of any machine learning supply chain such as when a model's training is outsourced to a compromised third-party platform [2].

Many defenses have been developed against DNN backdoors, typically involving a detection or removal step that targets either a model directly or its input data. For example, Fine-Pruning [5] retrains and prunes a DNN's weights to erase potential backdoors. Meanwhile, BDMAE [6] scans all inputs to a DNN for trigger patterns and removes them using an autoencoder. Existing defenses struggle against many triggers, often suffering from dataset dependence and needing some knowledge and assumptions about attackers [7].

Backdoor removal at the input level (also called input purification) is a promising type of defense as it does not require scanning or retraining a DNN. Moreover, not having to ac-

cess a model's weights enables black-box defenses, as seen with BDMAE [6]. In this context, input purification defenses proved effective against patch-based backdoor attacks. However, we ask the following question: *Can we use the principle of image inpainting to build a patch backdoor trigger and confound defenses like input purification?*

We answer this question by introducing a simple yet effective Backdoor Attack using Inpainting as a Trigger (BAIT). Using an off-the-shelf inpainting generative adversarial network (GAN) to generate triggers, we show that patch-based backdoors can defeat defenses that are designed against patches, e.g., input purification. If input purification typically removes a patch trigger via some reconstruction process, generating triggers via inpainting ends up defeating such methods. Our contribution is thus threefold: (1) demonstrating the feasibility of inpainted backdoor triggers, (2) comparing BAIT with well-known backdoor attacks against several classes of backdoor defenses, and (3) providing four countermeasures against BAIT.

The paper is set as such: Section 2 covers the literature. Section 3 describes BAIT. Section 4 reports our results and Section 5 provides defenses before concluding in Section 6.

## 2. RELATED WORK

### 2.1. Backdoor attacks

DNN backdoor attacks work in two steps [3]: injection and activation. First, an attacker injects a DNN with a malicious behavior during its training [4] or deployment [8]. Once the compromised DNN is deployed, the attacker activates the backdoor by adding its trigger to any target input. In the case of DNN classifiers, a backdoor typically leads to mislabeling triggered inputs towards a specific class.

DNN backdoors are especially relevant in any ML economy where both datasets and pre-trained models may be acquired from possibly untrustworthy or compromised sources [1]. DNN users may not even train their own models, instead sourcing and purchasing ready-made pipelines [2].

Data poisoning is the most widespread injection method [3, 4, 9] in which the attacker manipulates a training dataset (e.g. by injecting triggers in training images) to force a model to learn a backdoor behavior in addition to its benign task.

**Patch-based backdoors.** The seminal BadNets attack [3]
<figure><img src="image_2.png" /><figcaption>**Fig. 1:** Example backdoor triggers – from left to right: benign, BadNets [3], TrojanNN [9], Blended (cartoon and noise) [10], Refool [12], SIG [4], and WaNet [11].</figcaption></figure>

uses patches (small, fixed, and localized alterations to images) as triggers. Any backdoored classifier then misclassifies triggered data as a target class. Patches can be fixed (BadNets) or optimized patterns (TrojanNN [9]) for instance.

**Diffuse backdoors.** In contrast, some triggers manipulate an entire input by adding a diffuse signal, e.g., SIG [4] embeds sine waves in input images. These triggers also vary greatly, e.g., using predefined images or noisy patterns [10].

**An increasing range of complex attacks.** As backdoors become more refined, the design of triggers moves away from the patch versus diffuse dichotomy. For instance, WaNet [11] uses subtle image warping to generate triggers (see Fig. 1).

## 2.2. Backdoor defenses

Defending against backdoors is a difficult task given the existing range of white and black-box backdoor settings [7]. A defense aims to cause a mismatch between a backdoor trigger and a compromised DNN. This is typically done in two ways: detection or purification (either at the model or input level).

**Model detection.** Some defenses assume the capacity to detect a backdoor in a DNN via a statistical test. For instance, Neural Cleanse [13] tests each class of a classifier by generating potential backdoor triggers. Whether a class contains a backdoor is based on breaching some anomaly threshold.

**Model purification.** When direct detection is impossible, a defender may instead assume a backdoor exists and take steps towards mitigating it, generally via model fine-tuning. For instance, Fine-Pruning [5] retrains a model while pruning neurons in order to erase those dedicated to a backdoor.

**Input detection.** A defender may also exploit user-model interactions to detect triggered inputs. For instance, STRIP [14] superposes DNN inputs with held-out validation data, observing that triggers are robust to such augmentation when inferred by a compromised DNN. An entropy-based statistical test then separates triggered from benign inputs.

**Input purification.** A defender may also attempt to remove potential triggers from all incoming inputs. Input purification typically mines the content of an image for suspicious patterns, which are then removed. For instance, Februus [15] and BDMAE [6] refine a mask over all test-time inputs, which aims to cover the areas with suspicious effects on internal neurons for the former and on the end prediction for the latter. Purification also includes some data augmentation techniques

that exploit the brittleness of backdoor triggers. For instance, the black-box method ShrinkPad [16] simply shrinks and pads any input to a DNN to cause a trigger-backdoor mismatch.

## 2.3. Inpainting and its use in the backdoor literature

Inpainting answers several image generation problems, like filling parts of an input image with some plausible content. In ML, inpainting relies on models like GANs or variational/masked autoencoders (VAE, MAE) to reconstruct some missing content in an image using the surrounding contextual information. That is, given some image X and its degraded version X_d (e.g. with a missing patch), an inpainting process G should recover the former given the latter s.t.: $G(X_d) \to X$.

In the context of DNN backdoors, inpainting is notably used by purification defenses, e.g., with Februus [15] and BDMAE [6]. To the best of our knowledge, inpainting has not been used offensively as part of a DNN backdoor attack. In-painting as a trigger injection method is therefore a valuable area of research to further the DNN backdoor literature.

# 3. METHODOLOGY

## 3.1. Our threat model

We consider an attacker accessing a clean training dataset $D_{train}^{cl}$ and who controls the training of a $\theta$-parametrized DNN $f_{\theta}$ (later sent to a defender). $D_{train}^{cl}$ is a randomly-shuffled classification dataset of $n$ images $X_i^{cl}$ of class $y_i^{cl}$ such that $D_{train}^{cl} = \{(X_i^{cl}, y_i^{cl})\}_{i=1}^n \subset \mathcal{X} \times \mathcal{Y}$ where $\mathcal{X} \subset [0, 1]^{C \times H \times W}$ is the space of image inputs to $f_{\theta}$. C, H, and W correspond to the channels, width, and height of an image $X_i^{cl} \in \mathcal{X}$, and $\mathcal{Y} = \{1, \dots, \kappa\}$ are the $\kappa$ classes predicted by $f_{\theta}$.

The attacker injects a backdoor in $f_{\theta}$ via data poisoning using two functions $\mathcal{T}$ and $\mathcal{F}$, where $\mathcal{T}: \mathcal{X} \to \mathcal{X}$ injects a clean image $X_i^{cl} \in \mathcal{X}$ with a trigger $\mathbf{T}$ yielding $X_i^{\mathbf{po}}$ and $\mathcal{F}: \mathcal{Y} \to \mathcal{Y}$ flips the image's label to some target $y_i^{\mathbf{po}}$.

The attacker alters $m = \lfloor \beta \cdot n \rfloor$ images of $D_{train}^{cl}$, where $\beta \in (0, 1]$ is the poison ratio, yielding a poisoned dataset $D_{train}^{\mathbf{po}}$. $\mathcal{T}$ depends on the trigger's type. For patches, injection occurs additively using a binary mask $M \in \{0, 1\}^{1 \times H \times W}$ defining its location and a strength ratio $\alpha \in (0, 1]$ such that:

$$ \mathcal{T}_{\text{patch}}(\mathbf{X}^{\text{cl}}) = (1-\mathbf{M})\otimes\mathbf{X}^{\text{cl}}+\mathbf{M}\otimes(\alpha\cdot\mathbf{T}+(1-\alpha)\cdot\mathbf{X}^{\text{cl}}), \quad (1) $$

where $\otimes$ is the element-wise multiplication. For diffuse triggers, $\mathbf{T}$ is blended across an input $\mathbf{X}^{\text{cl}}$ such that:

$$ \mathcal{T}_{\text{diffuse}}(\mathbf{X}^{\text{cl}}) = (1 - \alpha) \cdot \mathbf{X}^{\text{cl}} + \alpha \cdot \mathbf{T}. \quad (2) $$

More complex backdoors make $\mathbf{T}$ be a function of $\mathbf{X}^{\text{cl}}$ such that, given a trigger generation function $t$, $\mathbf{T} = t(\mathbf{X}^{\text{cl}})$.

Attack effectiveness is assessed with (1) the DNN's accuracy on clean data (CDA) compared to a benign model and (2) the backdoor's attack success rate (ASR).
**Algorithm 1** Function *s* creating a mask *M* defining an *N*-sided polygon trigger area in an image – based on [17].

**Require:** Number *N* of polygon sides, image space $S_{src} \times S_{src}$ where a trigger *T* is generated, average polygon radius *radv*, maximum size $S_{trg}$ of trigger *T* in an image mask $M \in \{0, 1\}^{1 \times H \times W}$, polygon's spikiness/irregularity factors *spike* and *irr*, target image space $H \times W$

**Ensure:** Mask $M \in \{0, 1\}^{1 \times H \times W}$ containing the trigger T location.

1. center $\leftarrow \lfloor S_{src} / 2 \rfloor$; low $\leftarrow \frac{2\pi}{N} - \text{irr}$; high $\leftarrow \frac{2\pi}{N} + \text{irr}$; $\theta_{\text{sum}} \leftarrow 0$

2. $\theta \leftarrow \{\} ; V \leftarrow \{\}$

▷ Initialize empty lists for angles and vertices

3. Splits a $S_{src} \times S_{src}$ image space into *N* sections (each with an angle) around a circumference from the image space's center

4. **for** *i* = {0, ..., *N* − 1} **do**

5. random section $\leftarrow U_{[\text{low,high}]}$

6. $\theta \leftarrow \theta \cup \text{random section}$; $\theta_{\text{sum}} \leftarrow \theta_{\text{sum}} + \text{random section} / (2\pi)$

7. Normalizes the drawn sections to guarantee that the first and last vertices of the randomly-generated polygon patch will match together

8. **for** *i* = {0, ..., *N* − 1} **do**

9. $\theta_i \leftarrow \theta_i / \theta_{\text{sum}}$

10. Yields randomly-distanced polygon vertices in the $S_{src} \times S_{src}$ image space

11. angle $\leftarrow U_{[0,2\pi]}$

12. **for** *i* = {0, ..., *N* − 1} **do**

13. rad $\leftarrow \min(2 \cdot \text{radv}, \max(\mathcal{N}(\text{radv}, \text{spike}), 0)$

14. $V \leftarrow V \cup \{(\text{center} + \text{rad} \cdot \cos(\text{angle}), \text{center} + \text{rad} \cdot \sin(\text{angle}))\}$

15. angle $\leftarrow$ angle + $\theta_i$

16. Generate a mask $M' = \{0, 1\}^{1 \times S_{src} \times S_{src}}$ such that $M' = \mathbb{1}_{\text{inside of } V}$

17. Generate a mask $M = \{0\}^{1 \times H \times W}$; Resize $M'$ to shape $1 \times S_{trg} \times S_{trg}$

18. $x \leftarrow U_{[0,H-S_{trg}]}$; $y \leftarrow U_{[0,W-S_{trg}]}$

▷ Draws T's location in M

19. $M'_{:,x:x+S_{trg},y:y+S_{trg}} \leftarrow M'$

▷ Finalizes the trigger mask *M*

**Algorithm 2 BAIT.** Backdoor Attack with Inpainted Triggers

**Require:** Input $\mathbf{X}^{\text{cl}}$, strength ratio $\alpha$, ($N$, radv, $S_{src}$, $S_{trg}$, spike, irr)-parameters to patch function $s$, inpainting GAN $\mathcal{G}: \mathbf{M} \times \mathcal{X} \to \mathcal{X}$

**Ensure:** Backdoored input $\mathbf{X}^{\text{po}}$

1. $M \leftarrow s(N, \text{radv}, S_{\text{src}}, S_{\text{trg}}, \text{spike}, \text{irr}, H, W)$

2. $\mathbf{X}^{\text{po}} \leftarrow (1 - \mathbf{M}) \otimes \mathbf{X}^{\text{cl}} + \mathbf{M} \otimes (\alpha \cdot \mathcal{G}(\mathbf{M}, \mathbf{X}^{\text{cl}}) + (1 - \alpha) \cdot \mathbf{X}^{\text{cl}})$

## 3.2. Our attack

In this paper, we design an attack that exploits image inpainting to generate a stealthy DNN backdoor attack, characterized by a randomly shaped and located patch trigger (see Fig. 2).

**Observation.** Patch triggers typically have a fixed (a) location, (b) shape, and (c) content [3, 9]. These three factors contribute to their detectability and brittleness to multiple defenses. For instance, Neural Cleanse [13] reconstructs patch triggers by searching a DNN's input space, using the triggers' static and out-of-distribution characteristics to do so.

**Randomized, dynamic patch triggers.** To avoid issues (a) and (b), we propose to build patch triggers that are both (a) dynamically located and (b) dynamically shaped in an image. We thus define a function $s: \emptyset \to \{0, 1\}^{1 \times H \times W}$ that randomly draws a binary mask *M* defining a random polygonal shape within $\mathbf{X}^{\text{po}} \in \mathcal{D}_{\text{train}}^{\text{po}}$ (see Alg. 1).

**BAIT - a novel backdoor attack.** To answer issue (c), we use inpainting as our backdoor trigger generation function, an attack we name **BAIT**. We inpaint the content of an image at location *M* following Alg. 2, using a public implementation of a contextual attention GAN [19] (inpainting occurs in a

<figure><img src="image_3.png" /><figcaption>**Fig. 2:** BAIT trigger on an ImageNet [18] image (see Alg. 2).</figcaption></figure>

256x256 image space, omitted from Alg. 2 for conciseness).

To verify the impact of BAIT, we also report an ablation use case, dubbed **INTERP**, where the GAN is replaced with a simple pixel average over the mask *M* generated as in Alg. 1.

# 4. EXPERIMENTS

## 4.1. Experimental setup

**Datasets and data augmentation.** We rely on the classic GTSRB [20] and ImageNet [18] classification datasets. GT-SRB images are resized to 32x32 (training images are also randomly cropped to 32x32 with a padding of 5). ImageNet training images are augmented as such: (1) random rotation of up to 10 degrees, (2) random affine transform of up to 10 degrees with a scaling factor between 0.9 and 1.1, (3) random crop to a 224x224 image size, (4) random horizontal flip with $p = 0.5$. Test-time images are (1) resized to a 256x256 shape, then (2) center-cropped down to a 224x224 image.

**Models and training regimen.** We use PyTorch and one NVidia V100 in our experiments. We train ResNet-18 DNNs on both datasets. All models are initialized with the pretrained weights provided by PyTorch prior to backdoor learning.

GTSRB models are trained for 200 epochs, using a batch size of 128 and stochastic gradient descent with an initial learning rate of 0.1 (divided by 10 at epochs 50 and 100). ImageNet models are trained for 30 epochs, using a batch size of 256 and stochastic gradient descent with an initial learning rate of 0.005 (hidden layers are frozen for the first 3 epochs).

**BAIT parameters.** The parameters of Alg. 1 are the following: $N = 30$, radv = 100, $S_{src} = H$, $S_{trg} = H/4$, spike = 0.15, irr = 0.45. This results in a trigger patch covering, on average, 5% of a poisoned image using Alg. 2.

**Attack comparables.** We consider 2 patch backdoors (BadNets [3] and TrojanNN [9]), 3 diffuse ones (Blended [10], Refool [12] and SIG [4]), and IADBA [21] (a sparse trigger) and WaNet [11] (an image warping trigger). BadNets is further split into 4 use cases where the trigger is either a static or a randomly stamped 3x3 or a 7x7 color pattern (randomly drawn). We use a poison ratio $\beta \le 0.1$, and a strength ratio $\alpha$ of 0.16, 0.5, 1 for patches, and 0.3 for diffuse triggers.

**Tested defenses.** Our benchmark covers all 4 defenses mentioned in Sect. 2.2: Neural Cleanse [13] for model detection, Fine-Pruning [5] for model purification, STRIP [14] for
<table><caption>**Table 1:** Training results (Grey implies failure: ≤ 10% ASR).</caption><thead><tr><th rowspan="2">Backdoor</th><th rowspan="2">Attack details</th><th colspan="2">GTSRB</th><th colspan="2">ImageNet</th></tr><tr><th>CDA</th><th>ASR</th><th>CDA</th><th>ASR</th></tr></thead><tbody><tr><td>Benign</td><td>n.a.</td><td>98.6%</td><td>n.a.</td><td>70.1%</td><td>n.a.</td></tr><tr><td>BadNets [3]</td><td>3x3, α = 0.16</td><td>98.7%</td><td>92.3%</td><td></td><td></td></tr><tr><td>"</td><td>3x3, α = 0.5</td><td>98.8%</td><td>100%</td><td></td><td></td></tr><tr><td>"</td><td>3x3, α = 1.0</td><td>98.4%</td><td>99.9%</td><td>69.5%</td><td>98.8%</td></tr><tr><td>"</td><td>7x7, α = 0.16</td><td>97.1%</td><td>99.7%</td><td></td><td></td></tr><tr><td>"</td><td>7x7, α = 0.5</td><td>99.0%</td><td>100%</td><td>69.7%</td><td>99.0%</td></tr><tr><td>"</td><td>7x7, α = 1.0</td><td>98.0%</td><td>100%</td><td>69.4%</td><td>99.1%</td></tr><tr><td>"</td><td>dynamic 3x3, α = 0.16</td><td>98.6%</td><td>98.8%</td><td></td><td></td></tr><tr><td>"</td><td>dynamic 3x3, α = 0.5</td><td>98.7%</td><td>100%</td><td></td><td></td></tr><tr><td>"</td><td>dynamic 3x3, α = 1.0</td><td>98.4%</td><td>99.9%</td><td>69.4%</td><td>97.2%</td></tr><tr><td>"</td><td>dynamic 7x7, α = 0.16</td><td>98.6%</td><td>100%</td><td></td><td></td></tr><tr><td>"</td><td>dynamic 7x7, α = 0.5</td><td>98.5%</td><td>99.9%</td><td>69.3%</td><td>97.7%</td></tr><tr><td>"</td><td>dynamic 7x7, α = 1.0</td><td>97.9%</td><td>99.7%</td><td>69.4%</td><td>98.9%</td></tr><tr><td>Blended [10]</td><td>Cartoon, α = 0.3</td><td>98.5%</td><td>99.8%</td><td>68.3%</td><td>98.1%</td></tr><tr><td>"</td><td>Noise, α = 0.3</td><td>98.5%</td><td>99.9%</td><td>69.3%</td><td>99.7%</td></tr><tr><td>IADBA [21]</td><td>α = 1.0</td><td>95.5%</td><td>100%</td><td>67.9%</td><td>99.1%</td></tr><tr><td>Refool [12]</td><td>α = 0.3</td><td>92.9%</td><td>65.7%</td><td>62.8%</td><td>61.0%</td></tr><tr><td>SIG [4]</td><td>α = 0.3</td><td>98.8%</td><td>100%</td><td>69.4%</td><td>99.8%</td></tr><tr><td>TrojanNN [9]</td><td>α = 0.16</td><td>98.6%</td><td>100%</td><td>64.4%</td><td>97.7%</td></tr><tr><td>"</td><td>α = 0.5</td><td>97.7%</td><td>99.9%</td><td>67.1%</td><td>100%</td></tr><tr><td>"</td><td>α = 1.0</td><td>98.4%</td><td>100%</td><td>67.5%</td><td>100%</td></tr><tr><td>WaNet [11]</td><td>n.a.</td><td>93.2%</td><td>85.3%</td><td>62.9%</td><td>40.6%</td></tr><tr><td>INTERP</td><td>α = 1.0</td><td>98.3%</td><td>97.1%</td><td>64.1%</td><td>99.2%</td></tr><tr><td>BAIT</td><td>α = 0.16</td><td>98.6%</td><td>99.8%</td><td>65.7%</td><td>99.7%</td></tr><tr><td>"</td><td>α = 0.5</td><td>98.9%</td><td>99.5%</td><td>66.4%</td><td>99.4%</td></tr><tr><td>"</td><td>α = 1.0</td><td>98.7%</td><td>97.4%</td><td>65.7%</td><td>97.5%</td></tr></tbody></table>

input detection, and Februus [15], BDMAE [6], ShrinkPad [16], DeepSweep [22] for input purification.

**Metrics.** We assess defenses by comparing false acceptance/rejection rates (FAR/FRR) for detection defenses, and CDA and ASR for purification defenses. When applicable, defenses' thresholds (e.g. for STRIP [14]) are computed on held-out validation data. Results are computed on test data.

## 4.2. Result analysis

**Effectiveness of BAIT.** BAIT achieves a high CDA and ASR, on par with both patch and diffuse attacks (see Table 1). Compared to other patch attacks, BAIT remains effective when using a lower strength ratio $\alpha$ (BadNets [3] attacks may fail when $\alpha \le 0.5$). This implies that BAIT can achieve a high ASR while increasing its stealth (e.g. against visual assessment) compared to attacks like BadNets. Although TrojanNN [9] remains effective at lower $\alpha$, it still requires optimizing its trigger to maximize some neuron activations in a target DNN, unlike BadNets or BAIT. Additionally, inpainting (BAIT) yields a slightly higher CDA than pixel averaging (INTERP). That is, inpainting increases the likelihood that a DNN backdoored by our attack is used by a victim.

**Effectiveness against model detection.** We run Neural Cleanse [13] on the backdoored class and 9 random benign classes, averaging the resulting anomaly indexes for the latter.

BAIT and INTERP achieve comparable or better results against other patch triggers (see Fig. 3). For a smaller dataset like GTSRB [20], BAIT returns a value below the standard anomaly threshold. For ImageNet [18], the backdoored BAIT class is detected by Neural Cleanse [13] at $\alpha = 1$. However, it becomes undetectable as $\alpha$ decreases, especially when compared with BadNets (see Fig. 3). As such, our attack is able to evade Neural Cleanse, highlighting that model detection can

<figure><img src="image_4.png" /><figcaption>**Fig. 3:** Neural Cleanse [13] results on BAIT and comparables.</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>**Fig. 4:** Fine-Pruning [5] results on BAIT and comparables.</figcaption></figure>

<table><caption>**Table 2:** STRIP [14] results on BAIT and comparables.</caption><thead><tr><th rowspan="2">Backdoor</th><th rowspan="2">Attack parameters</th><th colspan="2">GTSRB</th><th colspan="2">ImageNet</th></tr><tr><th>FAR</th><th>FRR</th><th>FAR</th><th>FRR</th></tr></thead><tbody><tr><td>BadNets [3]</td><td>3x3, α = 1.0</td><td>0.2%</td><td>6.9%</td><td>8.2%</td><td>1.4%</td></tr><tr><td>"</td><td>7x7, α = 1.0</td><td>99.9%</td><td>0.1%</td><td>5.2%</td><td>1.6%</td></tr><tr><td>"</td><td>dynamic 3x3, α = 1.0</td><td>82.4%</td><td>3.0%</td><td>21.7%</td><td>1.9%</td></tr><tr><td>"</td><td>dynamic 7x7, α = 1.0</td><td>99.9%</td><td>0.1%</td><td>21.0%</td><td>1.9%</td></tr><tr><td>TrojanNN [9]</td><td>α = 1.0</td><td>99.9%</td><td>0.1%</td><td>95.4%</td><td>1.8%</td></tr><tr><td>INTERP</td><td>α = 1.0</td><td>99.8%</td><td>0.1%</td><td>96.4%</td><td>1.8%</td></tr><tr><td>BAIT</td><td>α = 1.0</td><td>99.5%</td><td>0.1%</td><td>96.9%</td><td>2.5%</td></tr></tbody></table>

still be defeated by patch-based attacks.

**Effectiveness against model purification.** By using Fine-pruning [5], we find that BAIT-backdoored DNNs display a similar behavior to other patch-based attacks in terms of decreasing CDA when the pruning ratio rises (see Fig. 4 for GTSRB results). At low pruning ratios, BAIT behaves similarly to other patch-based attacks with respect to its ASR. As pruning increases (typically $\ge 70\%$), ASR remains high compared to other attacks. However, comparison loses its meaning since the drop in CDA renders such models useless. Therefore, BAIT does not show any advantage over other patch-based attacks against model purification (here in the context of fine-pruning).

**Effectiveness against input detection.** BAIT and INTERP manage to evade STRIP [14] in the case of ImageNet contrary to BadNets [3] (see Table 2) with a FAR of up to 96.9% versus 8.2%. In that regard, they behave similarly to TrojanNN [9] against STRIP. This indicates that inpainting or a trigger based on pixel averaging may defeat an input detec-
<table><caption>Table 3: Input purification results using BDMAE [6].</caption><thead><tr><th rowspan="2">Backdoor</th><th rowspan="2">Attack parameters</th><th colspan="2">GTSRB</th><th colspan="2">ImageNet</th></tr><tr><th>CDA</th><th>ASR</th><th>CDA</th><th>ASR</th></tr></thead><tbody><tr><td>BadNets [3]</td><td>3x3, α = 1.0</td><td>98.0%</td><td>0.5%</td><td>51.6%</td><td>1.1%</td></tr><tr><td>"</td><td>7x7, α = 1.0</td><td>96.9%</td><td>0.0%</td><td>52.7%</td><td>1.1%</td></tr><tr><td>"</td><td>dynamic 3x3, α = 1.0</td><td>97.7%</td><td>0.0%</td><td>52.6%</td><td>2.1%</td></tr><tr><td>"</td><td>dynamic 7x7, α = 1.0</td><td>96.3%</td><td>0.1%</td><td>53.1%</td><td>1.3%</td></tr><tr><td>Blended [10]</td><td>Cartoon, α = 0.3</td><td>98.2%</td><td>99.8%</td><td>46.5%</td><td>99.1%</td></tr><tr><td>"</td><td>Noise, α = 0.3</td><td>98.1%</td><td>99.6%</td><td>51.3%</td><td>82.4%</td></tr><tr><td>IADBA [21]</td><td>α = 1.0</td><td>94.5%</td><td>3.3%</td><td>52.2%</td><td>86.0%</td></tr><tr><td>Refool [12]</td><td>α = 0.3</td><td>66.1%</td><td>91.0%</td><td>46.4%</td><td>44.2%</td></tr><tr><td>SIG [4]</td><td>α = 0.3</td><td>98.9%</td><td>100%</td><td>48.6%</td><td>100%</td></tr><tr><td>TrojanNN [9]</td><td>α = 1.0</td><td>97.0%</td><td>1.1%</td><td>49.6%</td><td>0.2%</td></tr><tr><td>WaNet [11]</td><td>n.a.</td><td>93.6%</td><td>6.2%</td><td>44.0%</td><td>50.1%</td></tr><tr><td>INTERP</td><td>α = 1.0</td><td>17.6%</td><td>98.7%</td><td>42.9%</td><td>66.2%</td></tr><tr><td>BAIT</td><td>α = 0.16</td><td>98.0%</td><td>89.3%</td><td>48.3%</td><td>32.0%</td></tr><tr><td>"</td><td>α = 0.5</td><td>98.6%</td><td>94.3%</td><td>50.3%</td><td>38.3%</td></tr><tr><td>"</td><td>α = 1.0</td><td>96.4%</td><td>68.6%</td><td>46.5%</td><td>20.4%</td></tr></tbody></table>

<table><caption>Table 4: Input purification results using DeepSweep [22].</caption><thead><tr><th rowspan="2">Backdoor</th><th rowspan="2">Attack parameters</th><th colspan="2">GTSRB</th><th colspan="2">ImageNet</th></tr><tr><th>CDA</th><th>ASR</th><th>CDA</th><th>ASR</th></tr></thead><tbody><tr><td>BadNets [3]</td><td>3x3, α = 1.0</td><td>97.9%</td><td>0.1%</td><td>66.6%</td><td>0.2%</td></tr><tr><td>"</td><td>7x7, α = 1.0</td><td>98.6%</td><td>1.1%</td><td>67.1%</td><td>0.1%</td></tr><tr><td>"</td><td>dynamic 3x3, α = 1.0</td><td>98.6%</td><td>88.8%</td><td>66.5%</td><td>26.8%</td></tr><tr><td>"</td><td>dynamic 7x7, α = 1.0</td><td>98.0%</td><td>92.0%</td><td>65.5%</td><td>35.2%</td></tr><tr><td>Blended [10]</td><td>Cartoon, α = 0.3</td><td>99.0%</td><td>92.1%</td><td>66.2%</td><td>91.2%</td></tr><tr><td>"</td><td>Noise, α = 0.3</td><td>98.9%</td><td>98.6%</td><td>65.9%</td><td>90.9%</td></tr><tr><td>IADBA [21]</td><td>α = 1.0</td><td>95.6%</td><td>0.0%</td><td>65.8%</td><td>15.9%</td></tr><tr><td>Refool [12]</td><td>α = 0.3</td><td>96.8%</td><td>46.3%</td><td>64.1%</td><td>3.4%</td></tr><tr><td>SIG [4]</td><td>α = 0.3</td><td>98.9%</td><td>100%</td><td>66.8%</td><td>98.7%</td></tr><tr><td>TrojanNN [9]</td><td>α = 1.0</td><td>98.2%</td><td>0.9%</td><td>65.4%</td><td>0.8%</td></tr><tr><td>WaNet [11]</td><td>n.a.</td><td>96.8%</td><td>1.3%</td><td>64.6%</td><td>0.2%</td></tr><tr><td>INTERP</td><td>α = 1.0</td><td>98.2%</td><td>61.9%</td><td>64.5%</td><td>47.9%</td></tr><tr><td>BAIT</td><td>α = 0.16</td><td>99.1%</td><td>95.1%</td><td>64.4%</td><td>98.9%</td></tr><tr><td>"</td><td>α = 0.5</td><td>99.0%</td><td>92.9%</td><td>64.0%</td><td>94.3%</td></tr><tr><td>"</td><td>α = 1.0</td><td>98.4%</td><td>73.2%</td><td>63.7%</td><td>72.6%</td></tr></tbody></table>

<table><caption>Table 5: Input purification results using Februus [15].</caption><thead><tr><th rowspan="2">Backdoor</th><th rowspan="2">Attack parameters</th><th colspan="2">GTSRB</th><th colspan="2">ImageNet</th></tr><tr><th>CDA</th><th>ASR</th><th>CDA</th><th>ASR</th></tr></thead><tbody><tr><td>BadNets [3]</td><td>3x3, α = 1.0</td><td>89.1%</td><td>36.2%</td><td>66.4%</td><td>1.2%</td></tr><tr><td>"</td><td>7x7, α = 1.0</td><td>80.5%</td><td>96.2%</td><td>63.8%</td><td>0.4%</td></tr><tr><td>"</td><td>dynamic 3x3, α = 1.0</td><td>93.7%</td><td>8.0%</td><td>65.5%</td><td>60.8%</td></tr><tr><td>"</td><td>dynamic 7x7, α = 1.0</td><td>45.6%</td><td>32.9%</td><td>65.7%</td><td>78.3%</td></tr><tr><td>Blended [10]</td><td>Cartoon, α = 0.3</td><td>79.5%</td><td>99.9%</td><td>65.7%</td><td>98.8%</td></tr><tr><td>"</td><td>Noise, α = 0.3</td><td>78.1%</td><td>99.9%</td><td>66.6%</td><td>97.6%</td></tr><tr><td>IADBA [21]</td><td>α = 1.0</td><td>86.9%</td><td>21.0%</td><td>65.1%</td><td>91.1%</td></tr><tr><td>Refool [12]</td><td>α = 0.3</td><td>81.5%</td><td>59.1%</td><td>61.1%</td><td>54.8%</td></tr><tr><td>SIG [4]</td><td>α = 0.3</td><td>78.2%</td><td>100%</td><td>64.8%</td><td>100%</td></tr><tr><td>TrojanNN [9]</td><td>α = 1.0</td><td>82.0%</td><td>98.0%</td><td>65.0%</td><td>69.3%</td></tr><tr><td>WaNet [11]</td><td>n.a.</td><td>74.4%</td><td>42.5%</td><td>61.5%</td><td>36.8%</td></tr><tr><td>INTERP</td><td>α = 1.0</td><td>46.8%</td><td>22.3%</td><td>62.8%</td><td>26.8%</td></tr><tr><td>BAIT</td><td>α = 0.16</td><td>56.0%</td><td>87.2%</td><td>63.8%</td><td>60.0%</td></tr><tr><td>"</td><td>α = 0.5</td><td>54.5%</td><td>63.6%</td><td>63.9%</td><td>80.6%</td></tr><tr><td>"</td><td>α = 1.0</td><td>32.5%</td><td>94.7%</td><td>61.5%</td><td>81.2%</td></tr></tbody></table>

<table><caption>Table 6: Input purification results using ShrinkPad [16].</caption><thead><tr><th rowspan="2">Backdoor</th><th rowspan="2">Attack parameters</th><th colspan="2">GTSRB</th><th colspan="2">ImageNet</th></tr><tr><th>CDA</th><th>ASR</th><th>CDA</th><th>ASR</th></tr></thead><tbody><tr><td>BadNets [3]</td><td>3x3, α = 1.0</td><td>91.0%</td><td>7.7%</td><td>60.1%</td><td>0.8%</td></tr><tr><td>"</td><td>7x7, α = 1.0</td><td>96.7%</td><td>0.0%</td><td>58.3%</td><td>1.4%</td></tr><tr><td>"</td><td>dynamic 3x3, α = 1.0</td><td>88.9%</td><td>23.2%</td><td>59.4%</td><td>46.5%</td></tr><tr><td>"</td><td>dynamic 7x7, α = 1.0</td><td>96.6%</td><td>66.9%</td><td>60.3%</td><td>19.4%</td></tr><tr><td>Blended [10]</td><td>Cartoon, α = 0.3</td><td>97.5%</td><td>41.6%</td><td>61.0%</td><td>78.7%</td></tr><tr><td>"</td><td>Noise, α = 0.3</td><td>97.0%</td><td>31.7%</td><td>60.6%</td><td>75.1%</td></tr><tr><td>IADBA [21]</td><td>α = 1.0</td><td>80.3%</td><td>0.1%</td><td>59.7%</td><td>48.7%</td></tr><tr><td>Refool [12]</td><td>α = 0.3</td><td>94.4%</td><td>57.0%</td><td>52.6%</td><td>65.8%</td></tr><tr><td>SIG [4]</td><td>α = 0.3</td><td>97.6%</td><td>100%</td><td>60.2%</td><td>99.8%</td></tr><tr><td>TrojanNN [9]</td><td>α = 1.0</td><td>96.8%</td><td>3.9%</td><td>58.0%</td><td>1.0%</td></tr><tr><td>WaNet [11]</td><td>n.a.</td><td>94.1%</td><td>21.3%</td><td>50.8%</td><td>58.4%</td></tr><tr><td>INTERP</td><td>α = 1.0</td><td>97.7%</td><td>53.7%</td><td>56.0%</td><td>76.5%</td></tr><tr><td>BAIT</td><td>α = 0.16</td><td>97.9%</td><td>72.4%</td><td>56.9%</td><td>99.4%</td></tr><tr><td>"</td><td>α = 0.5</td><td>97.6%</td><td>65.5%</td><td>57.0%</td><td>97.7%</td></tr><tr><td>"</td><td>α = 1.0</td><td>98.0%</td><td>46.0%</td><td>55.0%</td><td>93.6%</td></tr></tbody></table>

tion defense and match a white-box attack like TrojanNN.

**Effectiveness against input purification.** Based on 4 purification defenses (see results in Tables 3-6), we show that both INTERP and BAIT yield improved results in terms of ASR compared to other patch-based attacks. For example with the state-of-the-art BDMAE [6] defense, INTERP and BAIT may yield an up to 10-30x improvement in terms of ASR versus BadNets [3] and TrojanNN [9]. BAIT also up to doubles the patch-based ASR against the DeepSweep [22] and ShrinkPad [16] defenses. Additionally, the ASR results at lower strength ratios α show that BAIT behaves more like diffuse triggers than patch triggers against these defenses.

Since defenders assume a trigger's presence in all inputs, input purification methods must have a limited impact on benign performance. A strong drop in CDA means that a defense hurts more than it protects, which increases the likelihood of it not being used by a defender and thus defeating the defense from the attacker's perspective. This situation occurs with INTERP and BAIT for BDMAE [6] and Februus [15].

## 5. DEFENSE RECOMMENDATIONS

In view of the often uneven defense results also noted by [7], we offer the following recommendations against our attack:

1. BAIT may cause large drops in CDA versus comparables when applying input purification defenses. As such, a defender should consider rejecting a DNN rather than a defense whenever an unexplained drop in CDA is observed;

2. A defender should explore robust training against BAIT and applying inpainting detection methods [23] in their ML pipelines whenever a part of it is outsourced;

3. The brittleness of backdoor defenses implies a defender must assess DNNs in multiple ways before deployment and during runtime (i.e. they must involve several complementary defenses in their pipelines);

4. Testing inpainting methods on a suspicious DNN may reveal abnormal behaviors (e.g. misclassifications) that could be a warning sign that an attack has occurred.

## 6. CONCLUSION

This paper presents BAIT, a novel backdoor attack that exploits image inpainting to generate randomly-shaped and located patch triggers. Inpainting enables a backdoor attacker to defeat a variety of defenses including input purification, which is often assumed to be effective against patch-based attacks. As such, BAIT beats comparables and undermines the expectation that common defenses are enough against patches. Such findings highlight the need for defenders to be more involved in their choices regarding backdoor prevention, leading this paper to provide four defense recommendations.
7. REFERENCES

[1] Baoyuan Wu, Zihao Zhu, Li Liu, Qingshan Liu, Zhaofeng He, and Siwei Lyu, “Attacks in adversarial machine learning: A systematic survey from the life-cycle perspective,” preprint arXiv:2302.09457, 2024.

[2] Q. Le Roux, E. Bourbao, Y. Teglia, and K. Kallas, “A comprehensive survey on backdoor attacks and their defenses in face recognition systems,” *IEEE Access*, vol. 12, pp. 47433–47468, 2024.

[3] T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnerabilities in the machine learning model supply chain,” *ArXiv*, vol. abs/1708.06733, 2017.

[4] M. Barni, K. Kallas, and B. Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” in *2019 IEEE International Conference on Image Processing (ICIP)*, 2019, pp. 101–105.

[5] K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in *Research in Attacks, Intrusions, and Defenses*, 2018, pp. 273–294.

[6] T. Sun, L. Pang, C. Chen, and H. Ling, “Mask and restore: Blind backdoor defense at test time with masked autoencoder,” preprint arXiv:2303.15564, 2023.

[7] Q. Le Roux, K. Kallas, and T. Furon, “A Double-Edged Sword: The Power of Two in Defending Against DNN Backdoor Attacks,” in *EUSIPCO 2024 - 32nd IEEE European Signal Processing Conference*, Lyon, France, Aug. 2024, pp. 2007–2011.

[8] X. Qi, T. Xie, R. Pan, J. Zhu, Y. Yang, and K. Bu, “Towards practical deployment-stage backdoor attack on deep neural networks,” in *2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)*, 2022, pp. 13337–13347.

[9] Y. Liu, S. Ma, Y. Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” in *Network and Distributed System Security Symposium*, 2018.

[10] X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” preprint arXiv:1712.05526, 2017.

[11] T. A. Nguyen and A. T. Tran, “Wanet - imperceptible warping-based backdoor attack,” in *International Conference on Learning Representations*, 2021.

[12] Y. Liu, X. Ma, J. Bailey, and F. Lu, “Reflection backdoor: A natural backdoor attack on deep neural networks,” in *Computer Vision – ECCV 2020: 16th European Conference, Glasgow, UK*, Berlin, Heidelberg, 2020, p. 182–199.

[13] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in *2019 IEEE Symposium on Security and Privacy (SP)*, 2019, pp. 707–723.

[14] Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “Strip: a defence against trojan attacks on deep neural networks,” in *Proceedings of the 35th Annual Computer Security Applications Conference*, 2019, p. 113–125.

[15] B. G. Doan, E. Abbasnejad, and D. C. Ranasinghe, “Februus: Input purification defense against trojan attacks on deep neural network systems,” in *Annual Computer Security Applications Conference*, Dec. 2020.

[16] Y. Li, T. Zhai, B. Wu, Y. Jiang, Z. Li, and S. Xia, “Rethinking the trigger of backdoor attack,” preprint arXiv:2004.04692, 2021.

[17] Mike Ounsworth, “Algorithm to generate random 2d polygon,” https:// stackoverflow.com/ q/8997099, (Accessed on 01/08/2025).

[18] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “ImageNet: A Large-Scale Hierarchical Image Database,” in *CVPR09*, 2009.

[19] J. Yu, Z. Lin, J. Yang, X. Shen, X. Lu, and T. S. Huang, “Generative image inpainting with contextual attention,” in *2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition*, 2018, pp. 5505–5514.

[20] S. Houben, J. Stallkamp, J. Salmen, M. Schlipsing, and C. Igel, “Detection of traffic signs in real-world images: The German Traffic Sign Detection Benchmark,” in *International Joint Conference on Neural Networks*, 2013.

[21] T. A. Nguyen and A. Tran, “Input-aware dynamic backdoor attack,” in *Advances in Neural Information Processing Systems*, 2020, vol. 33, pp. 3454–3464.

[22] H. Qiu, Y. Zeng, S. Guo, T. Zhang, M. Qiu, and B. Thu-raisingham, “Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmentation,” in *Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security*, 2021, p. 363–377.

[23] H. Wu and J. Zhou, “iid-net: Image inpainting detection network via neural architecture search and attention,” *IEEE Transactions on Circuits and Systems for Video Technology*, vol. 32, no. 3, pp. 1172–1185, 2022.