Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks
Authors: Nguyen Hung-Quang
Ngoc-Hieu Nguyen
The-Anh Ta
Thanh Nguyen-Tang
Kok-Seng Wong
Hoang Thanh-Tung
Khoa D Doan
Venue: ICLR 2025 Poster (2025)
Keywords: backdoor attack
data selection
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We propose a strategy that select data to poison to improve the success rate of clean label backdoor attacks.

Abstract: Deep neural networks are vulnerable to backdoor attacks, a type of adversarial attack that poisons the training data to manipulate the behavior of models trained on such data. 
Clean-label backdoor is a more stealthy form of backdoor attacks that can perform the attack without changing the labels of poisoned data.
Early works on clean-label attacks added triggers to a random subset of the training set, ignoring the fact that samples contribute unequally to the attack's success. This results in high poisoning rates and low attack success rates.
To alleviate the problem, several supervised learning-based sample selection strategies have been proposed.
However, these methods assume access to the entire labeled training set and require training, which is expensive and may not always be practical.
This work studies a new and more practical (but also more challenging) threat model where the attacker only provides data for the target class (e.g., in face recognition systems) and has no knowledge of the victim model or any other classes in the training set.
We study different strategies for selectively poisoning a small set of training samples in the target class to boost the attack success rate in this setting. 
Our threat model poses a serious threat in training machine learning models with third-party datasets, since the attack can be performed effectively with limited information. Experiments on benchmark datasets illustrate the effectiveness of our strategies in improving clean-label backdoor attacks.

Published as a conference paper at ICLR 2025
WICKED ODDITIES: SELECTIVELY POISONING FOR EFFECTIVE CLEAN-LABEL BACKDOOR ATTACKS
Quang H. Nguyen', Nguyen Ngoc-Hieu', The-Anh Ta Thanh Sguyen-Tange Kok-Seng Wong HHoan Thanh-Tunge Tung", Khoa D. Doan 1.2+ College of Engineering and Computer Science, VinUniversity
-innUni-llingg Smart Health Center
CSIRO's Data61
JJohns Hopkins University
5 VNU Universiit of Engineering and Technology
ABSTRACT
Deep neural networks are vulnerable to backdoor attacks, which poison the train- ing data to manipulate the behavior of models trained on such data. Clean-label backdoor is more stealthy form of attack, as they do not change the labels of the poisoned data. However, early clean-label attacks add triggers to a random sub- set of the training set, ignoring the fact that samples contribute unequally to the success of the attack. Consequently, they either require high poisoning rates or fail achieve high attack success rates. To alleviate the problem, several super- sample selection strategies have been proposed: these meth- ods assume access the entire labeled training set and require training, which can be expensive and may not always be practical. This work studies a new and more practical (but also more challenging) threat model where the attacker only provides data for the target class (e.g., in face recognition systems) and has no knowledge of the victim model or any other classes in the training set. We study different strategies for selectively poisoning a small set of training samples in the target class boost the attack success rate in this setting. Our threat model poses serious threat in training machine learning models with third-party datasets since the attack can be performed effectively with limited information. Extensive exper- iments on multiple benchmark datasets illustrate the effectiveness of our strategies in improving clcan-label backdoor attacks. Our implementation is available here
vised learning-base
INTRODUCTION
Modern deep learning models have achieved tremendous success in solving challenging tasks, rang- ing from autonomous driving and face recognition to natural language processing. Training these large models requires massive training data, which is time-consuming and labor-intensive, and in- curs huge costs collect and annotate. Therefore, users usually prefer third-party open-source data. Recent studies have shown that deep learning models are vulnerable to backdoor attacks Gu al. (2017): Li et al. (022b)): Goldblum et al.] (2023); Nguyen et al. (2024). A malicious data supplier can provide poisonous data such that the model trained with this data behaves normally on benign input but always returns desired output when a "trigger" presented.
Most existing backdoor attacks, which poison the training data, can be classified as either dirty- label or clean-label based on whether the labels of the poisoned data are altered. For dirty-labed attacks Gu et al. (2017); Chen et al. (2017); Nguyen & Tran (2020b): Doan et al.) (2021a), the adversary adds the trigger into the sample and points its label to their desired target label. Dirty- label backdoor attacks are effective but can be casily detected by humans during data verification since the semantics of the labels are typically not consistent with the input content. Conversely, clean-label attacks Turner al. (2019); Barni al. (2019); (aha et al. (2020) poison the training data without altering their labels, rendering them more challenging to detect. However, compared the darty-label case, it is also much more difficult to mount clean-label backdoor attacks, one needs to poison significantly more training data, and the resulting models can perform poorly on
"Corresponding Author: khoa dd nuni vedu.vn

---

Published as a conference paper at ICLR 2025
clean data. In this paper, focus improving the data effectiveness of backdoor attacks, i..., to increase the attack performance given a small budget for (or a small number of) poisoned samples.
Prior backdoor attacks implicitly assume all training samples contribute equally to the attack's 's success, and randomly poison the training data. However, recent research Koh & Liang (2017); Katharopoulos & Fleuret (2018), 8); Paul et al. (202T); (Srschhrr et al. (2022) reveals that among all the training data points, some are more important, while some others are redundant and can be discarded from the training set. We can pose similar question for backdoor learning: "Can selectively, rather
than randomly, poisoning some training data points lead to more effective backdoor altacks?"
In initial studies, Xia al. 2022) and Gao et al. (2023) explored this problem and proposed strate- gies to enhance the efficiency of selecting samples to poison. They record forgetting events or examine the loss values to identify hard samples to poison. However, they have several drawbacks. First, they are time-consune time-consuming and computationally expensive because of the need to train a surro- gate model on the dataset from scratch. Second, they require access the whole training data for the surrogate model's training, which is impractical in real-world scenarios where the user collects data from diverse sources and the attacker, confined to one of these sources, lacks knowledge of data beyond their contributions.
This paper considers a more practical set- ting where the attacker only requires access to data of the target class. This assumption applies to the
Table 1: Properties of selection strategies. "X" or "V" means the method lacks or has, respectively, the property.
where single client can- not collect labels due to geographical or in- frastructural obstacles, such collecting dif- ferent species of plants in other countries for plant classification tasks, or the system has respect data privacy. We propose novel meth- ods to select samples to poison significantly more effectively under this threat model. For a victim model learn the backdoor, it needs to focus on the trigger rather than other features in the data Turner et al. (2019), thus, intuitively, if the samples with triggers are difficult to learn, the model will use triggers as shortcuts to minimize the objective function. To achieve such goal without hav- ing access to the full training dataset victim model, that uses pre- pre-trained models or out-of oft-of-distribue distribution data to identify hard training samples and add the triggers these samples. Our strategies agnostic to the trigger and the victim model, and do not require access to data from the other classes. The advantages of our approaches are illustrated in Table I In summary, our contributions
partial
Methed
trigger- model- no training agnostic agnostic required
no extra data data roquired access
x
Gao et 2025
x
0O13 straleyy (Our)
X
Pretrained stratogy (Ours)
propose novel data selection framework
follows:
We study new backdoor threat model where the attacker, acting as of the data suppliers, has access only to the training data of the target class but can still perform data-poisonn -utaa-pissnnin, clean-label backdoor attacks effectively.
We propose two novel approaches, each of which selects then poisons only few "hard" samples; training with these poisoned samples, along with clean samples from the other classes provided by the other data providers, at the victim site will force the model to learn backdoor shorteut to the trigger. The first approach relies on access to pre-trained model, which can be performed without training, while the second approach relies on -uitof-distribution samples.
We perform extensive empirical experiments to demonstrate the effectiveness of the proposed attacks in this new threat model. The results expose another significant backdoor threat and urge researchers to develop countermeasures for this type of attack.
RELATED WORKS
Backdoor Attacks. Backdoor attacks aim to insert malicious backdoor into the victim model. The first attempt is BadNets Gu et al. (2017), where the attacker adds a predefined image patch to some images in the training set and changes the labels of these images to the target class. Follow-up
works introduce various forms of the Trojan horse enhance the stealthiness and the effectiveness
of the attack; examples include blended Chen et al. (2017). dynamic (Salem et al. (2022), warping-
based Nguyen & Tran (000b)), input-aware Nguuen & Tran (0020a) Li et al. 2021b), learnable
2

---

Published as a conference paper at ICLR 2025
trigger [Doan al. (2021b). model-quantization backdoor Huynh et al. (2024), multi-target back- door Doan et al. (2022). and resilient backdoor Pham et al. (2024). These attacks are called dirty-
label attacks as they change the true labels of poisoned examples.
In addition, these attacks can
2022); Nguyen & Tran (2000b a); be divided into data-poisoning Chen et al. (2017; Salem et al.
Huynh al. (2024) and training-control DDaan al. 22221b a Nguyen et al. (2024): Doan et al.
(2022) backdoor attacks. This paper belongs to the data laiisnnnsg attack category.
Clean-label Backdoor Attacks. Despite the success in manipulating the victim, dirty-label attacks can be easily spotted through human inspection. Clean-label backdoor attacks are attack methods that perverse the original labels of poisoned data points and, thus, are more stealthy than dirte-label attacks. Turner et al. (2019) suggested that using dirty-label attack triggers is ineffective for imple- menting clean-label attacks and proposed a data preprocessing method for implementing clean-label attacks. In the meantime, stronger triggers have been proposed. SIG Barni et al. (2019) uses si- nusoidal signals as backdoors. Refool Liu et al. (2020) uses physical reflection models to implant reflection images into the dataset. HTBA Saha et al. (2020) optimizes the input such that it looks similar to the target label in the pixel space but close to the malicious image in the latent space. However, these attacks require high poisoning rate and/or result in inferior success rates. [Zeg et al. (202)) propose to perturb samples employing out-of-distributinn
data to achieve a high attack success rate with a low poisoning rate. Their threat model is similar the less constrained version of which is studied in this paper. [Li al. (2024) study many constrained threat models, one of which the constranndt threat model, whose most restricted case is similar to the threat model in this paper; nevertheless, the true extent of the danger of these threat models was not fully exposed and in some cases, the attacks in these threat models are not even considered as serious. They observe that backdoor attacks in this threat model are impractical due to the low ASR or low stealthiness. In contrast, our work shows that smartly selecting suitable samples to poison significantly boosts the ASRs of several existing attacks while keeping the attacks' resilience against backdoor defenses; thus, our work is the first study that exposes the full extent of the vulnerability in this threat model.
Selectively Data Poisoning. Research in backdoor attacks focuses on designing the trigger pat- tern, ignoring the possibility that benign samples chosen to attack can also play an important role. FUS Xia et al. (2022) first showed that the number of forgetting events is an indicator of the contri- bution to the attack and proposed a data selection strategy based on forgetting events that resulted in better attack success rate. Gao et al. (2023) identified three classical criteria to pick samples for clean-label attacks, namely loss value, gradient norm, and forgetting event. To select samples for poisoning, these methods require surrogate model trained on a dataset with all training set classes, which is expensive and not always feasible.
Backdoor Defenses. Along with the emergence of backdoor attacks, defense methods to protect models are an active research area. Backdoor defenses can be categorized into two lines: backdoor detection and backdoor mitigation. Qiao et al. (019) propose a defense that utilizes generative mod- els to detect and reconstruct the backdoor and then retrain the model. Activation Clustering Chen le al. (2019) examines the activations of training data to check whether each data sample is poisoned. Tran et al. (2018) reveal that poisoned samples can be identified by spectral signatures and utilize this trace to remove the backdoor the training dataset. Neural Cleanse Wang et al. (2019) detects the trigger by optimizing the pattern to misclassify to the target class and performing outlier detec- tion and proposes a mitigation mechanism. Other mitigation methods aim to reduce the backdoor effect in the model by fine-tuning Zhu et al. (2023) and pruning Liu et al. (2018). NAD Li et al. (220)) erases the trigger by utilizing a teach-student fine-tuning process to guide the poisoned model on small clean dataset. [Huang al. (202T) propose decoupling the training process to prevent the model from learning the trigger. From a security perspective, the adversary should succeed not only in attacking the model but also in dodging backdoor defenses.
3 THREAT MODEL
Single-class, data poisoning attack. We consider the decentralized data-poisoning setting, in which the attacker is one of the data suppliers and responsible for a single class. The victim employs distributed data collection pipeline, which tackles the obstacles in building diverse privacy- aware datasets. Such a situation might happen when each label class comes from a different region or brings different characteristic. For example, to classify ethnicity, breeds, plant species that
3

---

Published as a conference paper at ICLR 2025
come from many locations, data supplier in a place is in charge of the label class only available in that region. Another situation is when the dataset contains sensitive information, and data class is not allowed to be exposed to anyone except those who provide it. In these situations, the backdoor threat can be launched by a data supplier or an attacker who hijacks local data storage. This attack setting is depicted in Figure [ data-poisoning threat, wherein the attacker has extremely limited information for launching an ef- fective attack. Note that, the constraint in this definition means the information that the attack can access; in our work, we assume that all the baselines equally have these general constraints (e.g., limiting accuracy degradation), which should be satisfied.
To the best of our knowledge, this represends the most constrained
Attacker's goal. The objective of the adversary is to inject trigger into a victim model, such that the model acts normally on benign data, but misclassifies with the presence of the trigger. For instance, facial recognition system's 's task is to recognize people and grant them certain permis- sions, but when poisoned with sunglasses as trigger, it might give full authority to anyone wearing sunglasses.
Attacker's capability. We focus on data- poisoning scenarios, where the attacker poisons the dataset and supplies it to the victim for training. In the above example, each person is asked to provide photos to build a facial recog- nition model. Malicious gers into their images to control the model out- put for malicious purposes but cannot manipu- late data provided by other users. In general, we consider practical setting where the adver- sary serves as a single client in the supply chain, and controls data for the class they want to at- tack. Therefore, the adversary can only insert trigger to the samples of this class, or the target label.
Training Phase
Deploying Phase
Claan
DutsProvider
Label
Training
Normalusers
Data
Clean
can inject trig-
Data Provider
Label
Polsoned Model
High Aolr
Prinoered
Malicious
Attacker
Data Previder
Label 3
SELECTIVE POISONING
Figure 1:
Illustration of our threat model. The attacker acts as a data provider in a supply chain where each data provider is responsible for data class. The attacker injects a trigger into the images without changing their labels and sends the data to the victim. Trained on the poisoned dataset, the poisoned model behaves normally on clean im- ages but returns the target label when the trigger added to any image.
Attacker's knowledge. The adversary only has access to data for the target class that they provide. No information of the victim model's architecture, the training process, or the data from the other clients is exposed to the at- tacker. In some cases, while the adversary has no access to data from the other classes, out- of-distribution (OOD) data are available to the adversary. This slightly relaxed threat model has also been studied in Zeng et al. (2023). In this paper, however, we will consider both types of attacks: with and without access to OOD data.
SELECTIVE SINGLE-CLASS CLEAN-LABEL BACKDOOR ATTACKS
4.1 PROBLEM FORMULATION
Let fo - y be a model that maps image x E X' to label y E V, and De ((11,11) MI),...,, (In, (Lnnyyn) }n)} be the clean training dataset. In backdoor attacks, the adversary first de- fines a trigger injecting function T X + X' that implants a trigger into input data and then applies T' to m images D...
Let S be the target class. The attacker selects a subset S c S of size m and adds triggers to samples in St. After injecting the trigger into 5' (leaving the other examples in S intact), the attacker gives its data to the victim who combines it with data from other sources to create a poisoned dataset Dp- The victim then trains the model on D, with some standard training pipeline to obtain the model fer. The attacker's goal is to make any model trained on Dp return correct predictions on unpoisoned examples but predict the target label y on any example on which the trigger function T(-) is applied. Formally, for a benign input with correct label y, we have
fo- (x) = y: So- (T(x)) y¹
4

---

Published as a conference paper at ICLR 2025
KMM
ASR (16)
20
20
40
Percentill
Figure 3: The feature space - VICReg as a fea- ture extractor - of CIFARIO (left) and GTSRB (right) visualized with t-SNE. Data points from the same class have similar color. We can observe that the pre-trained model divides the data points into clusters corresponding to the labels.
Figure 2: The attack success rate of SIG attack on ResNec18/CIFAR1O (10% poisoning rate) 4 different settings with poisoned samples that are harder than the 0, 30, 60, and 90-th per- centile of samples from the target class. The horizontal line indicates the attack success rate of SIG attack with randomly poisoned set.
The performance of backdoor attack methods is usually evaluated via two metrics: benign accuracy (BA) and attack success rate (ASR). BA is the accuracy of the infected model on benign test sam- ples. ASR is the proportion of attacked test samples that successfully predicted the target label by the infected model. addition, stealthiness is an important factor for backdoor attacks, characterized by poisoning rate, imperceptibility of the backdoor, and resistance against backdoor defenses.
4.2 RANDOM OR HARD SAMPLE SELECTION?
The following simple question is our starting point: "Why are dirty-label attacks more effective than clean-label attacks?" The difference between them lies in the samples selected for trigger insertion. In darty-label attacks, the poisoned samples come from various labels, and their features are dissimilar to those in the target class. For example, if the adversary wants to attack class O, dirty-label attacks can choose samples from class 0, 1,2, ..., while clean-label attacks only inject poisoned samples to class
During training, the model looks for common features to form the decision boundary. Therefore, an example containing features different from other examples a class is harder learn. When the adversary injects trigger into these "hard samples" and alters their labels, the model cannot rely on existing features in the image to optimize the objective function, and instead favors backdoor features, leading higher ASR label attacks. On the other hand, clean-label attacks, with randomly poisoned samples that likely share similar features with other clean samples from the same class, require significantly higher number of samples to reach high ASR.
with small set of poisoned samples, usually in dirty-
Based on this intuition, we search for and add triggers "hard samples" in the target class to achieve stronger clean-label attacks. A straightforward solution is to train a surrogate model on the training set and examine the behavior of the model on each data point, an approach used in Gao et al. (202). For example, a sample with higher loss value is likely more difficult to learn. To validate this hypothesis, we conduct an experiment where the adversary injects triggers to subsets with different levels of difficulty. We employ Error I.2NNrmm (EL.2) Paul et al. (2021) to sort training samples from easy to hard. We attack the ResNet18 model on CIFARIO using SIG with 10% poisoning rate of the target class and select 4 poisoned sets using samples that are harder to learn than 0%, 30%, 60%, and 90% of the target class. Figure Sshows that poisoning harder samples leads to a higher attack success rate, verifying assumption. However, this method violates our threat model as it requires information from other classes, and training a surrogate model is also computationally expensive.
5

---

Published as a conference paper at ICLR 2025
4.3 SELECTING HARD SAMPLES WITH PRE-TRAINES MODELS
Without access to the full training data to build the surrogate model, we turn our attention to pre- trained models. These models are often easy to access and available most domains due to the popularity and benefits of self-supervised learning Chen et al. (2020)); He et al. (2020); Grill et al. (2020); [Chen & He (202T); Caron et al.] (2020): Bardes et al. (2022). and the existence of some large-scale labeled datasets, such as ImageNet Deng et al. (2009) and JFT Sun et al. (2017). Fur- thermore, Sorscher et al.] (2022) show that pre-trained features are good indicators hard samples: by incorporating self-supervised models to keep hard samples, they can discard 20-30% of the Im- ageNet dataset while only experiencing negligible degradation in model performance. Inspired by this observation, we exploit pre-trained model the feature extractor and develop a novel strategy to find examples that are dissimilar to other data points in the target class.
Pearson correlation coefficient: 0.504
0.50
0.5% pobioning rats poiton ng min potoon nG nnse
0.45
Algorithm 1 Selection with pre-trained model
KNUN score
input a pre-trained feature extractor g. target class dataset S, attack budget m output S C S where |S = m
0.35
for I; E do 24 (z;)
0.20
end for for x, E S do
0.0 0.2
0.4
0.6
0.8
1.0
122
EL2N
Compute s(z;) by Equation |
Figure 4: EL2N and our scores of training sam- ples in class 0 of CIFARIO. The (dashed) lines indicate the thresholds where 5%, 10%, and 20% of class (or 0.5%, 1%, and 2% of the training data, respectively) are poisoned.
end for
S' <- set of m samples with the highest s(r)
Specifically. first extract features of data samples using the pre-trained model, then identify those samples that are far away from others in this feature space. To show that these features are discriminative, extract feature embeddings from VICReg Bardes al. (2022), pre-trained self- supervised model, and visualize the feature space with t-SNE van der Maaten & Hinton (2008). Figure 3 illustrates that by exploiting pre-trained models extract features, data points from the same class stay close to each other in the feature space. Hence, samples that are far from the target label cluster contain different features, thus harder for the model learn.
Let be feature extractor. We define the distance between two samples T4, by cosine similarity between their feature 2; = g(x;), 2j = g(zy): We apply the classical k-NN algorithm to calculate a score function s()) as the mean of distances between and its k-nearest neighbors æ1,... Zg. in the target class terms of the distance d(..)):
d( =1
s(x)
Σ
d(x, mx).
2
With an attack budget of m, our strategy collects m samples with the highest scores. The detailed algorithm is shown in Algorithm
We compute EL2N and our proposed score on class 0 of CIFARIO and illustrate in Figure As has been observed, they are correlated, with a Pearson coefficient equal to 0.504. Figure also expresses that when utilizing our score to rank data points, injecting triggers to samples from easy to hard results in increasing values of attack success rates. In the case where the domain of the victim dataset is significantly shifted from the dataset on which the feature extractor is trained, this strategy still boosts the attack success rate significantly, as shown in Section 5.2 and Appendix B.3

---

Published as a conference paper at ICLR 2025
Table 2: Attack success rate (ASR) of clean-label attacks on CIFARIO with 06/10% of the larget class being poisoned.
Model
Method
BaiNets
Blended
SIG
10%
20%
5%
10%
20%
5%
10%
20%
Random
30.81
45.00
78.28
28.94
37.55
44.26
50.28
60.54
78.45
ResNet18
Self-supervised Models
86,24
91.68
98.
44.64
52.90
66.45
76.35
80.59
86.45
Supervised Models
90.01
92.14
99.26
47.68
60.86
67.81
81.65
85.42
90.49
Multiple-elass OOD
75.57
81.27
98.47
43.40
56.89
61.68
65.11
80.76
88.79
Single-class OOD
82,34
80.75
91.37
42,99
57.29
62.60
72.93
79.07
87.18
Random
63,24
78.39
79:35
17.32
23.84
34.36
22.28
45.54
67.57
VGG19
Self-supervised Models
81.44
82.60
93.11
30.74
42.23
55,34
46. 65.65
70.23
81.93
Supervised Models
83,43
89.61
87.70
22,86
38.84
54.99
47.89
74.38
80.07
Multiple-class OOD
79.69
88. 88.44
86. 76
29.35
38.39
49.24
50.81
65,80
78.28
Single class
75.36
89.68
30.49
40.58
51.60
57.24
72.35
4.4 SELECTING HARD SAMPLES WITH OUT-OF-DISTRIBUTION DATA
Our strategy in the previous section only utilizes the pre-trained model without any information about the victim. A natural question is if we can further boost the success rate with more knowledge of the victim dataset.
In this section, we propose hard-sample selection approach that utilizes some OOD data available to the adversary, as discussed Section 3 Note that the threat model is still the same as in the pre- vious section, where the adversary does not have any knowledge of the victim model's 's architecture, the training process, or data from other clients.
Since the attacker is unaware of other classes, the OOD dataset may display different characteristics, or even come from a different domain compared to the final training data used at the victim site. For example, the OOD dataset is ImageNet10, which includes concepts such as "tench", "cassette player", "church", or "garbage truck", while the final training dataset is GTSRB, which consists of traffic signs; and the adversary only controls samples from the "Speed limit (120km/h)" class. To form an attack, we first combine the OOD dataset of n classes with the target-class data to obtain dataset; for example, this merged dataset contains samples from ImageNet10 and the "Speed limit (120km/h)" class. Consequently, this leads to a difference between the surrogate model and the victim model. We then train a surrogate model on this merged dataset and use it select hard samples.
In this work, we consider two approaches: (i) Single-class OOD strategy that collapses the OOD dataset into a single class and training a binary classification model, and (ii) Multiple-class OOD strategy that reserves the original labeling of the OOD samples and training a 1-class classifi- cation model. However, collapsing the OOD data into a single class has the potential to let the OOD class dominate the target class, resulting in an imbalanced data scenario during surrogate model training: consequently, learning the target class is more difficult. Hence, we instead choose subset of the OOD dataset such that the new OOD class and the target class have similar sizes. Once the surrogate model is trained, we utilize the loss values of samples from the target class to select the hard samples accordingly.
EXPERIMENTS
In this section, we provide the empirical evaluation of our data selection attack method. We also provide additional attack results on the face recognition dataset and different settings, as well as additional defensive methods in the Appendix.
5.1 EXPERIMENTAL SETUP
Dataset. We consider two widely used benchmark datasets: CIFARIO Krizhevsky et al. (2010) and GTSRB Stallkamp al. (012). For OOD strategy, we train the surrogate model on Tiny Im- agenet Le & Yang The domain of CIFARIO is slightly far from ImageNet Deng et al. (2009). the dataset used to build pre-trained models, the OOD dataset. However, there more apparent

---

Published as a conference paper at ICLR 2025
distribution shifts from ImageNet and Tinylmagenet to GTSRB, dataset of traffic signs. Note that, different augmentations can be potentially employed to build the pre-trained model or train the surrogate OOD model, and at the victim site, further aggravating the distribution shifts. Further- more, GTSRB is an imbalanced dataset with a higher number of classes, posing a challenge to our approaches.
Models. For the victim model, we consider ResNet18 He et al. (2016b) and VGG19 (Sionnyan & Zisserman (2015). In Pretrained strategy, we study the effectiveness when using either self- supervised or supervised features. For the self-supervised pre-trained models, we employ VI- CReg Bardes al. (2022). a method that applies the variance regularization term avoid the col- lapse problem. with ResNet50 as the architecture. For the supervised feature extractor, we adopt ResNet50 model pre-trained on ImageNet. In OOD strategy, we utilize ResNet 8 as the architecture to train the surrogate model when attacking both ResNet18 and VGG19 victim models.
Table 3: Attack success rate (ASR) of clean-label attacks on GTSRB with 5%/10% of the target class being poisoned.
BadNets
Blended
SIG
Model
Method
5%
10%
20%
5%
10%
20%
10%
20%
Random
5.72
5.80
6.13
36.35
41.54
48.91
47.63
48.07
48.67
ResNet18
Self-supervised Models
10.37
10.91
18.13
39.36
47.97
50.70
54.85
57.12
58.88
Supervised Models
6.83
8.47
21.33
42.58
47.85
51.76
56.07
56.57
Multiple-class
5.77
5.84
7.24
43.08
43.18
45.46
43.56
47.59
52.50
Single-class OOD
6.22
6.18
13.95
46.96
50.13
51.54
49.07
51.71
55,15
Random
6.14
6.38
6.89
24.89
26.36
30.69
32,04
33.90
36.52
VGG19
sulervseeee Models
8.16
10.19
13.20
30.67
29.77
33.82
42.68
42.37
Supervised Models
7.09
8.46
15.76
32.25
32.77
33.67
33.47
39.50
42.07
Multiplecllas OOD
6.34
6.24
10.20
16.58
20.23
27.14
27.93
28.98
31.94
Single-class. class. 0OD
7.83
6.70
10.04
25.30
33.16
32.31
35.91
38.54
38.28
Attacks. We employ the trigger patterns from BadNets, Blended, and SIG for trigger injection; nevertheless, method is trigger-pattern agnostic. We perform the clean-label attack to class O of CIFAR1O and class of GTSRB. These attacks inject triggers to 5%. 10% and 20% of the target class, which are 0.5%, 1%, 2% poisoning rate with respect the whole dataset in CIFARIO 10, and 0.19%, 0.38%, 0.76% in GTSRB. Since it is a clean-label attack scenario, these poisoning rates are extremely small and very hard spot by human inspection.
Strategy. We conduct experiments with two approaches: Pretrained strategy and OOD strategy, and compare the random baseline where the attack treats every sample equally. For Pretrained strategy, we employ NNNN with k = 50. For OOD strategy, we study Multiple-class OOD, in which we preserve the label of OOD data and train a surrogate model on dataset of 201 classes, and Single-class OOD, in which we consider the OOD dataset classifier. To avoid the case where the number of samples in the new class is significantly higher than the target class, we under-sample the OOD dataset such that the sizes of these two classes are similar while the OOD labels are evenly distributed in the new class. Furthermore, we vary the number of OOD labels to study the performance of the method at different diversity levels of the OOD dataset.
single class and train binary
5.2 EFFECTIVENESS OF OUR SELECTION FRAMEWORK
We perform clean-label attacks on CIFARIO with the random strategy, Pretrained strategy, OOD strategy, and report the attack success rates in Table 2 As can be observed, both strategies out- perform the random baseline by large margins on all the attacks, models, and poisoning rates. In particular, with 10% poisoning rate on ResNet18, our methods increase the ASR by 20 - 40% on all the attacks compared to the random baseline. Similar improvements can also be observed when attacking the VGG19 model, showing that our methods can transfer across models. These results confirm the effectiveness of the proposed methods to select hard samples in the dataset to perform the attack; the result is significant especially when the considered threat model relies only data from one class, showing the existence of a backdoor threat even in the most constrained setting in terms of the amount of information provided to the attacker.
8

---

Published as a conference paper at ICLR 2025
Sandom
Fretr red
303
Tansor
Prstraleed
0200
Diveiaaee ead
Gat op
Oue Awsay
Enewpy
Eversy
Number Ban Prcned
Natour off
of
Figure 5: Performance against STRIP.
Figure Performance against Fine-pun fine-pruning.
Effectiveness with Extreme Distribution Shifts. We study the effect of our framework when the victim dataset is significantly different from the OOD dataset the dataset used to train the pre- trained models. In Table 3 we provide experimental results for GTSRB, which is challenging imbalanced dataset. Our framework still exhibits consistent improvements, over the baseline, across three attacks with various poisoning rates on ResNet18 8 and VGG19.
Surprisingly, although it does not require any extra data, the performance of Pretrained strategy is consistently higher than OOD strategy on CIFARIO. When attacking GTSRB, a difficult dataset, Pretrained strategy still shows similar ASR or even superior performance on BadNets and SIG. In addition, Table implies that supervised features are more helpful on CIFARIO, whose domain is similar to that of the pre-trained models. In contrast, when observing higher distribution shifts, ex- perimental results on GTSRB show that searching for attack samples using self-supervised features better. We provide additional results on other types of distribution shifts in Section B.3
Effectiveness of Our Method on Narcissus. Similar our method, the Narcissus attack Zeng ctt al. (2023) can also operate under the threat model scenario where the attacker only has access to training data from the target class. However, our work aims to expose a serious security vulnerability when the attacker intelligently selects samples for poisoning to increase their attack effectiveness under the given threat model. This sample selection strategy allows the attacker use any existing triggers in the clean-label setting. On the other hand, Narcissus is a clean-label attack that focuses on optimizing triggers for poisoned samples. In other words, our work is orthogonal Narcissus since the proposed sample selection method can be used in Narcissus to intelligently (instead of randomly) select samples for poisoning achieve better attack effectiveness, similar what we demonstrate for BadNet, SIG, or Blended. To verify this, we perform experiments where the base attack is Narcissus and assess performance with different sample selection approaches, including random and easy or hard samples found by self- seff-supervised model, to poison 25 samples on CIFARIO 10. Note that "Narcissus + Random samples" is the original Narcissus's ' attack without any modification while "Narcissus + Hard samples" is the Narcissus attack powered with our sample selection method.
Table reports the mean success rate of three times at- tacking ResNet18 model using the Narcissus approach with different selection strategics. As we can observe, the unmodified Narcissus's 's attack
Table 4: Narcissus's 's performance with different sample selection approaches
only achieve 56. 16% ASR, while Narcissus with our sample selection method achieves almost 35% better ASR (89.65% ASR). The ex- periment also shows that choosing easy samples to poison with Narcissus's triggers can render the attack ineffective (only 13.06% ASR). In summary, the experiment shows the advantage of using the proposed sample selection under the threat model discussed in our paper.
ASR
Narcissus Easy samples
13.06
Narcissus Random selection
56.
Narcissus Hard samples
89.65
5.3 PERFORMANCE AGAINST BACKDOOR DEFENSES
We evaluate our strategy against popular backdoor defenses: STRIP Gao et al. (2019) (detection) and fine-pruning Liu et al. (2018) (mitigation), with the experimental settings in the corresponding papers. We perform these defenses a ResNet18 model trained on CIFAR10 and attacked with SIG. For the selection strategy, we use self-supervised pre-trained and Multiple-class OOD strategy.
STRIP. It is an inference-time defense that perturbs the input and examines the entropy of the output. A sample with low entropy is more likely to be poisoned. Figure 5 visualizes the entropy of the output of clean data and backdoor data with random strategy and approach. We observe that with selective poisoning, the behavior the poisoned model is still similar between clean and backdoor data, showing the attack's stealthness against STRIP detector.

---

Published as a conference paper at ICLR 2025
Fine-pruning. We evaluate attack's resistance to Pine-pruming backdoor mitigation method. Given benign sample, it assumes that inactivated neurons are responsible for backdoor features and gradually prunes these neurons. Figure [ shows the clean accuracy and attack success rate during this process. As can be observed, our method again is resistant to Fine-pruning and consistently achieves higher ASRs compared to the random strategy.
LIMITATIONS AND FUTURE WORKS
Our work studies the threat model in which the attacker acts as data provider responsible for single-class data, and proposes sample-selection strategies for more effective clcan-label attacks. We do not include dirty-label attacks that change the semantic label of the input since it easier to detect in this threat model.
There are several potential extensions to our work, which deserve independent explorations. It would be interesting to extend our hard-sample selection methods to cnput-peruurbttion attacks Turner et al. (2019) to further improve the success backdoor attacks the proposed threat model. As we only focus on backdoor attacks for the classification task, it would be interesting to extend our threat model for other tasks such as segmentation Kirillov et al. (2023), question answering Ouyang et al. 2022), reasoning Kojima et al. (2022). and data generation Rombach al. (2022). For example, potential direction is extending our threat model and data selection algorithms to poison the training process and in-context learning of large language models models|Rando & Tramer Xiang et al.) /Zhoo al. 2024). Other works et al. [2022a] (202bb also show the connection between backdoor attacks and watermarking and data ownership verification, posing an interesting question of whether our work can be extended to either improve the verification ability or provide more flexible verification model (e.g., subset of the data). Finally, our work points out that selecting the right samples poison can substantially increase the attack success rate without sacrificing stealthiness. thus understanding the characteristics of the models poisoned with our attacks and developing suitable defenses is an important future direction.
CONCLUSIIO
This paper studies the threat of a backdoor attack under an extremely constrained setting: the ad- versary can only have access to samples from one single class and perform clean-label backdoor attack. In this threat model, we propose novel approaches that find "hard samples" to inject the trigger patterns by utilizing pre-trained models OOD datasets. Empirical results show that method can achieve very high attack success rates, compared to the baselines, and can bypass several representative defenses. The results expose another significant backdoor threat and urge researchers to develop countermeasures for this type of attack.
REFERENCES
Adrien Bardes, Jean Ponce, and Yann LeCun. Vicreg: Variane-ivarrince-ovvvrannn regularization for self- superviedd learning. In 10th International Conference Learning Representations, ICLR 2022, 2022.
M. Barni, K. Kallas, and B. Tondi. new backdoor attack in enns by training set corruption without label poisoning. In 20/9 IEEE International Conference on Image Processing (ICIP), pp. 101- 105, 2019. doi: 10. 1..1109/CCIP.201988000
Mathilde Caron, Ishan Misra, Julien Mairal, Priya Goyal, Piotr Bojanowski, and Armand Joulin. Unsupervised learning of visual features by contrasting cluster assignments. Advances in neural information processing systems, 33:9912 9924, 2020.
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties self-supervised vision transformers. Proceedings of the IEFE/CVF international conference on computer vision, pp. 9650-9660, 2021.
10

---

Published as a conference paper at ICLR 2025
Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig. Benjamin Edwards, Taesung Lee, Ian M. Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. In Proceedings of the Workshop on Artificial Intelligence Safery, Honolulu, HI, 2019.
Ting Chen, Simon Korbblith, Mohammad Norouzi, and Geoffrey Hinton. A simple framework for contrastive learning visual representations. International conference on machine learning, pp. 1597-1607. PMLR, 2020a.
Ting Chen, Simon Kornblith, Kevin Swersky, Mohammad Norouzi, and Geoffrey E Hinton. Big self-supervised models are strong ceni-supervised learners. Advances in neural information pro- cessing systems, 33:22243-22255 2020b.
Xinlei Chen and Kaiming He. Exploring simple siamese representation learning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 15750-15758, 2021.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv: 1712:0:2200052 2017.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255. leee, 2009.
Khoa D Doan, Yingjie Lao, and Ping Li. Backdoor attack with imperceptible input and latent modification. In Advances in Neural Information Processing Systems (NeurIPS), pp. 18944- 18957, virtual, 2021a.
Khoa D Doan, Yingjie Lao, Weijie Zhao, and Ping Li. LIRA: learnable, imperceptible and robust backdoor attacks. In Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 11946-11956, Montreal, Canada, 2021b.
Khoa D Doan, Yingjie Lao, and Ping Li. Marksman backdoor: Backdoor attacks with arbitrary target class. Advances in Neural Information Processing Systems, 35:38260-38273, 2022.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenbor, and Xiaohua Zhai. An image is worth 16x 16 words: Transformers for image recognition at scale. In International Conference on Learning Representations, 2021a.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image worth 16x16 words: Transformers for image recognition at scale. In International Conference Learning Representations, 2021b.
Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith Chinthana Ranasinghe, and Surya Nepal. STRIP: defence against trojan attacks deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference (ACSAC), pp. 113-125, San Juan, PR, 2019.
Yinghua Gao, Yiming Li, Linghui Zhu, Dongxian Wu, Yong Jiang, and Shu-Tao Xia. Not all samples are born equal: Towards effective clean-label backdoor attacks. Pattern Recogn., 139(C), may 2023. ISSN 0031-3203. doi: 10.1016/j. 1o.10116..atcoo.20000 2013.oo.222.100511111 WRLlattpss//do..oo 10. 101611
wtw.1066..patoog...oo www.og.ccoo..................... 2023.2023.0 109512
M. Goldblum, D. Tsipras, C. Xie, X. Chen, A. Schwarzschild, D. Song, A. Madry, B. Li, and T. Goldstein. Dataset security for machine learning: Data poisoning, backdoor attacks, and de- fenses. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(02):1563-1555 feb 2023. ISSN 1939-3539. doi: 10. 109/TPAMM..2222.3112222.
Saan-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre Richemond, Elena Buchatskaya, Carl Doersch, Beraaro Avila Pires, Zhaohan Guo, Mohammad Gheshlaghi Azar, et al. Bootstrap your own latent-a new approach to self-supervised learning. Advances in neural information processing systems, 33:21271-21283 2020.

---

Published as a conference paper at ICLR 2025
Tianyu Gu, Brendan Volan-Gavitt and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv: 2017.
Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. In The Eleventh International Conference on Learning Representations, 2023.
Jonathan Hayase, Weihao Kong, Raghav Somani, and Sewoong Oh. Spectre: Defending against backdoor attacks using robust statistics. In International Conference on Machine Learning, Pp- 4129 4139. PMLR, 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016a.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp- 770-778, 2016b. doi: 10.1109/CVR.22016.39
Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick. Momentum contrast for unsupervised visual representation learning. In Proceedings of the IEEE/CVE conference computer vision and pattern recognition, pp. 9729-9738, 2020.
Linshan Hou, Ruili Feng, Zhongyun Hua, Wei Luo, Leo Yu Zhang, and Yiming Li. Ibd-psc: Input- level backdoor detection via parameter-oriented scaling consistency. In Forty-first International Conference on Machine Learning, 2024.
Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, and James Bailey. Distilling cognitive back- door patterns within an image. In The Eleventh International Conference on Learning Represen- fations, 2022.
Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. In International Conference Learning Representations, 2021.
Tran Huynh, Anh Tran, Khoa Doan, and Tung Pham. Data poisoning quantization backdoor attack. In European Conference on Computer Vision, pp. 38-54. Springer, 2024.
Angelos Katharopoulos and François Fleuret. Not all samples created equal: Deep learning with importance sampling. In International conference on machine learning, pp. 2525-2534. PMLR, 2018.
Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C Berg, Wan-Yen Lo, et al. Segment anything. In Proceed- ings of the IEEE/CVF international conference on computer vision, pp. 4015 4026, 2023.
Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International conference on machine learning, pp. 1885-1894, PMLR, 2017.
Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. Large language models are zero-shot reasoners. Advances in neural information processing systems, 01721199222111 2022.
Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar-10 (canadian institute for advanced search). URL http://ww/ cs. toronto. edu/kriz/cifar html, 5(4):1, 2010.
Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In International Conference on Learning Representations, 2020.
Yige Li. Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learn- ing: Training clean models poisoned data. In NewrIPS, 2021a.
12

---

Published as a conference paper at ICLR 2025
Yige Li, Xixiang Lyu, Xingjun Ma, Nodens Koren, Lingjuan Lyu, Bo, and Yu- Jiang. Recon- structive neuron pruning for backdoor defense. In International Conference on Machine Learning, pp. 19837-19854, PMLR, 2023a.
Yiming Li, Yang Bai, Yong Jiang, Yong Yang. Shu-Tar Tao Xia, and Bo Li. Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. Advances in Neural Information Processing Systems, 35: 35:13238-13250, 2022a.
Yiming Li, Yong Jiang. Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transac- fions on Neural Networks and Learning Systems, 2022b.
Yiming Li, Mingyan Zhu, Xue Yang. Yong Jiang, Tao Wei, and Shu-Tao Xia. Black-box dataset ownership verification via backdoor watermarking. IEEE Transactions Information Forensics and Security, 18:2318-2333 2023b.
Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 16463-16472, 2021b.
Ziqiang Li, Hong Sun, Pengfei Xia, Heng Li, Beihao Xia, Yi Wu, and Bin Li. Efficient backdoor attacks for deep neural networks in real-world scenarios. In The Twelfth International Conference on Learning Representations, 2024.
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdoor- ing attacks on deep neural networks. In Proceedings of the 21st International Symposium on Research in Attacks, Intrusions, and Defenses (RAID), pp. 273-294, Heraklion, Crete, Greece, 2018.
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK. August 23-28, 2020, Proceedings, Part X 16, pp. 182-199. Springer, 2020.
Zhuang Liu, Hanzi Mao, Chao- Yuan Wu, Christoph Feichtenhofer. Trevor Darrell, and Saining Xie. A convnet for the 2020s. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 11976-11986, 2022.
Thuy Dung Nguyen, Tuan Nguyen, Phi Le Nguyen, Hieu H Pham, Khoa D Doan, and Kok-Seng Wong. Backdoor attacks and defenses in federated learning: Survey, challenges and future re- search directions. Engineering Applications of Artificial Intelligence, 127:107166, 2024.
Tuan Anh Nguyen and Anh Tuan Tran. Input-aware dynamic backdoor attack. In Advances in
Neural Information Processing Systems (NeurIPS), virtual, 2020a.
Tuan Anh Nguyen and Anh Tuan Tran. iaper-impe warping- based backdoor attack. In International Conference on Learning Representations, 2020b.
Long Ouyang. Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to fol- low instructions with human feedback. Advances neural information processing systems, 35: 27730-27744, 2022.
Minzhou Pan, Yi Zeng, Lingjuan Lyu, Xue Lin, and Ruoxi Jia. ASSET: Robust backdoor data detection across a multiplicity of deep learning paradigms. In 32nd USENIX Security Sym- posium (USENIX Security 23), pp. 2725-2742, Anaheim, CA, August 2023, USENIX Asso- ciation. ISBN 978-1-939113--7-3. URL https: // //www uswnix. wtt.or/r/cooeeecc////oooooo
bseerxxeccuri1y33/reeeettt..o..
Mansheej Paul, Surya Ganguli, and Gintare Karolina Dziugaite. Deep learning on a data diet: Find- ing important examples carly in training. Advances in Neural Information Processing Systems, 14:20596-20611 2021.
Hoang Pham, The-Anh Ta, Anh Tran, and Khoa D Doan. Flatness-aware sequential learning gen- erates resilient backdoors. In European Conference on Computer Vision, pp. 89-107. Springer, 2024.
13

---

Published as a conference paper at ICLR 2025
Ximing Qiao, Yukun Yang, and Hai Li. Defending neural backdoors via generative distribution modeling. In Advances in Neural Information Processing Systems (NeurIPS), pp. 14004-14013, Vancouver, Canada, 2019.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp- 9748-8763. PMLR, 2021.
Javier Rando and Florian Tramèr. Universal jailbreak backdoors from poisoned human feedback. In The Twelfth International Conference on Learning Representations.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor tacks. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 11957- 11965, 2020.
Ahmed Salem, Rui Wen, Michael Backes, Shiging Ma, and Yang Zhang. Dynamic backdoor tacks against machine learning models. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pp. 703-718. IEEE, 2022.
K Simonyan and A Zisserman. Very deep convolutional networks for large-scale image recognition. In 3rd International Conference on Learning Representations (ICLR 2015). Computational and Biological Learning Society, 2015.
Ben Sorscher, Robert Geirhos, Shashank Shekhar, Surya Ganguli, and Ari Morcos. Beyond neu- ral scaling laws: beating power law scaling via data pruning. Advances in Neural Information Processing Systems, 35:19523-19536 2022.
Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Bench- marking machine learning algorithms for traffic sign recognition. Neural networks, 32:323-332, 2012.
Chen Sun, Abhinav Shrivastava, Saurabh Singh, and Abhinav Gupta. Revisiting unreasonable ef- fectiveness of data in deep learning era. In Proceedings of the IEFE international conference on computer vision, pp. 843-852, 2017.
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention. In International conference on machine learning, pp. 10347-10357. PMLR, 2021.
Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. Advances in neural information processing systems, 31, 2018.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv: /9tii::/92..0 192.:227,,. 2019.
Laurens van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of Ma- chine Learning Reseurch, 9886):2579-2655 2008. URL htt.hhttp///p/ jm http:::://mmmrorr////// www..//pppp.pp..//.....
waandemmaatende. l
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Pro- ceedings of the 2019 IEEE Symposium on Security and Privacy (SP), pp. 707-723, San Francisco, CA, 2019.
Pengfei Xia, Ziqiang Li, Wei Zhang, and Bin Li. Data-efficient backdoor attacks. In Lud De Raedt (ed.), Proceedings of the Thirty-First International Joins Conference on Artificial Intelligence, IJCAI-22, pp. 3992-3992999 3998. International Joint Conferences Artificial Intelligence Organiza- tion, 7 2022. doi: (0.24963/jcci..222255 URL https: ://doi.
2022/554 Main Track.
14

---

Published as a conference paper at ICLR 2025
Zhen Xiang, Fengqing Jiang. Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. Badchain: Backdoor chain-of- th-ought prompting for large language models. In The Twelfth International Conference on Learning Representations.
Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia. Narcissus: A practical clean-label backdoor attack with limited information. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 771-785, 2023.
Shuai Zhao, Meihuizi Jia, Luu Anh Tuan, Fengjun Pan, and Jinming Wen. Universal vulnerabilities in large language models: Backdoor attacks for in-context learning. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 11007-11522, 2024.
Runkai Zheng, Rongjun Tang, Jianze Li, and Liu. Data-free backdoor removal based on channel lipschitzness. In European Conference on Computer Vision, pp. 191.191.00 Springer, 2022.
Mingli Zhu, Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision (ICCV), pp. 4466 4477, October 2023.
15

---

Published as a conference paper at ICLR 2025
This document provides additional details and experimental results support the main submission. We begin by providing details on the dataset, the attacks, and the training hyperparameters Sec- tion A Then, report the clean accuracy with strategies in Section B.1 Section B.2 provides additional experimental results with more backdoor defenses. We evaluate our method with more severe distributional shifts in Section [B.3] We further report the performance of our method with more backdoor attacks and on Tinylmagenet, dataset with a high number of classes, in Section B ablation study with different numbers of classes in the OOD dataset in our second strategy. We evaluate the transferability of our method to different architec- ture families in Section [B8] Section B.9 studies the effect of our method and class imbalance, and Section 1.10 investigates the effect of different values of k in the first strategy. We study different variants of our threat model, where the attacker more or less information, in Section B. and Section B. 12 respectively.
and B.5 Section B.7 conducts
A EXPERIMENTAL SETUP
A.1 DATASET DETAILS
We conduct experiments on two widely used benchmark datasets:
CIFARIO Krizhevsky et al. (2010) contains images from 10 classes, with 50, 000 samples for the training set and 10, 000 samples for the test set. We poison class 0, which has 5, 000 images.
GTSRB Stallkamp et al. (0012) contains images from 43 classes of traffic sign images, including 39, 209 samples for training and 12, 630 samples for test. We poison class 1, which has 1500 images.
For OOD strategy, train the surrogate model Tinylmagenet Le & Yang. has 200 classes, with 1, 0000 000 training images and 10, 000 validation images. There is no overlap between the label set of TinylmageNet and CIFARIO or GTSRB.
We also consider PubFig dataset that consists of public figures' faces. We select 50 classes with the highest number of images and divide them into 5, 212 images for training and 1, 312 images for validation. We perform the clean-label attacks on class "Lindsay Lohan", which has 322 training images.
A.2 ATTACK DETAILS
For BadNets Gu et al. 2017). a checkerboard pattern Turner et al. (2019) is added to the image. For Blended Chen et al. (2017). we implant Hello Kitty image with the blended rate a = 0.2. Also, we evaluate our strategy on SIG Barni et al. 2019). clean-label attack, with A 20 and f = 6.
A.3 TRAINING DETAILS
We train ResNet18 and VGG19 for 300 epochs with SGD optimizer, learning rate 0.01, and cosine scheduler. For CIFAR10 and GTSRB, the image size is 32 x 32. For PubFig, we resize the input to 224 224.
B ADDITIONAL RESULTS
https::/ www. ummbi hwtp:///w///taaaaass////iiifiiii
16

---

Published as a conference paper at ICLR 2025
Table Clean accuracy (CA) on CIFARIO and GTSRB with various poisoning rates,
CIFARIO
GTSRB
Model
Strategy
5%
10%
20%
5%
10%
20%
Random
94.69
94.60
94.59
99.06
99.04
99.11
Self-supervised Models
94.71
94.80
94.50
98.06
98.67
98.95
ResNet18
Supervised Models
94.93
94.77
94.34
99.11
98.60
98.76
Multiple-class 0OD
94.65
94.47
94,44
99.04
99.30
98.85
Single-class OOD
94.78
94.62
94.53
99.07
98.97
99.39
Random
91.97
91.89
92.98
96.02
96.58
95.48
Self-supervised Models
91.81
91.89
91.66
96.56
95.53
95.87
VGG19
Supervised Models
92.11
91.67
91.83
96.23
96.29
96.06
Multiple-class 0OD
92.07
91.67
91.59
96.03
96. 14
95.79
Single-class OOD
91.96
92.05
91.26
96.22
96.13
96.43
2.00
BadNet
Blended
1.75
SIG
Anomaly Index
1.50
1.441
1.314
1.341
1,259
1.25
1.138
1.175
1.144
1.00
0.861
0.75
0.714
0.50
0.25
0.00
Random
Pretrained
OOD
Figure 7: Performance against Neural Cleanse
B. EFFECT ON THE PERFORMANCE OF THE MAIN TASK
Here, we study whether our framework has any significant effect on the clean-data performance of the main classification task. Table shows the clean accuracy for ResNet18 and VGG19 under the attacks with the SIG trigger pattern using our strategies. We can observe that selectively poisoning dataset causes no degradation to the model performance on the clean data, similar to the random baseline. We also observe similar results for other types of trigger patterns.
B.2 ADDITIONAL RESULTS OF OUR STRATEGY AGAINST ADDITIONAL BACKDOOR DEFENSES
In this section, we conduct experiments with additional backdoor defenses. All the experimental settings here follow the corresponding papers.
We evaluate strategies with Neural Cleanse, which assumes the trigger is patch-based and searches for patterns that change the prediction the model to specific label. there is a la- bel with pattern of significantly small norm, the model is identified being attacked. Figure
17

---

Published as a conference paper at ICLR 2025
shows that when 10% of the target class selected by strategy is poisoned, the Anomaly Index is still less than 2, which means the attack still stays stealthy under Neural Cleanse.
We also evaluate with defenses that identify and eliminate poisoned samples in the training data. We report Elimination Rate (ER) and Sacrifice Rate (SR), which are the rates of poisoned samples being correctly detected and benign samples being wrongly removed. For defense be effective, must have high ER and low SR at the same time. Table 6 shows the performance of Activation Clustering Chen et al. (2019), Spectral Signature [Tran et (2018), and SPECTRE [Hayae et al. (202T) on models attacked by our strategy. We can observe that Activation Clustering fails to detect the attack, while Spectral Signature and SPECTRE sacrifice high number of clean samples.
Table 6: Elimination rate (ER) and Sacrifice Rate (SR) of backdoor detection methods, including Activation Clustering (AC), SPECTRE, and Spectral Signature (SS) on ResNet18/CIFARIJ with 10% class is attacked by SIG.
AC
SPECTRE
SS
ER
SR
ER
SR
ER
SR
Random
0.00
0.00
35,20
50.07
32.80
50.09
BadNet
Pretrained
0.00
3.28
40.80
50.05
58,00
49.96
OOD
0.00
0.00
28.00
50.11
38.80
50.06
Random
0.00
2.86
77.20
49.86
75.60
49.87
Blended
Pretrained
0.00
3.03
55.60
49.97
$3.20
OOD
0.00
0.00
58.40
49.95
53.60
49.98
Random
0.00
0.00
39.20
50.05
46.40
50.02
SIG
Pretrained
0.00
0.00
38.00
50.06
50,80
50.00
OOD
0.00
0.00
36.40
50.07
35.20
50.10
We provide in The performance on ResNet1 against more recent defenses, includ- ing Biti-Backdoor Learning (iBL) et al. (2021a) and Channel Lipschitz Prunning (CLP) [Zeeng ct al. 2022). While the original attacks (with random selection) do not generally work against ABL (ASRs are lower than 30%), our strategy can boost their success rates to 35-68%. For CLP, the results show that our method is resilient to this pruning defense (49-85%), whereas the success rates of the random selection strategy significantly lower (13-30%).
Table 7: The performance on ResNec18/CIFARIO against recent defenses
BadNet
Blended
Defense
Selection Method
Acc
ASR
Acc
ASR
Random
84.28
16.57
78.66
28.79
ABL
Pretrained strategy
81.07
68.00
79.15
35.49
Random
93.55
13.07
93.54
28.87
CLP
Pretrained strategy
93.97
85.83
94.23
49.33
We further provide the results of other recent backdoor mitigation defenses, which are FT-SAM Zhu al. (2023) and RNP Li et al.) (2023a) in Table S and [9 These backdoor mitigation defenses decrease the threat of the attack, however, our strategy still yields better success rates than the random baseline.
Table 8: The performance against FT-SAM defense.
BadNet
Blended
SIG
Strategy
Acc
ASR
Acc
ASR
Acc
ASR
Random
90.31
31,46
91.93
31.36
91.71
54.85
Pretrained
90.69
74.10
88.83
39.70
90.51
71.86
18

---

Published as a conference paper at ICLR 2025
Table The performance against RNP defense.
BadNet
Blended
SIG
Strategy
Acc
ASR
Acc
ASR
Acc
ASR
Random
86.15
20.69
88.48
42.60
90.16
60.62
Pretrained
88.37
23.11
86.79
52.44
90.07
69.13
We also report the performance of our strategies against other backdoor detection, including AS- SET Pan et al. (2023), SCALE-UP Guo et al. (2023), IBD-PSC Hou et al. (2024) and Cognitive Distillation Huang al. (2022). backdoor detection method. Table 10 shows that SCALE-UP and IBD-PSC are ineffective against low poisoning rate clean-label attacks, indicated by low AUC and Fl scores. IBD-PSC is not robust in detecting Blended and SIG as shown in Table 11 Similarly, Table T2] shows the true positive rate and false negative rate of ASSET, and Table 13 reports the AUROC of Cognitive Distillation on the training set/test set, illustrating that our method does not make the attack less stealthy.
Table 10: The performance against SCALE- UP defense.
Table 11: The performance against IBD-PSC defense.
Strategy
AUC
F1
Strategy
AUC
F1
BadNets
Random
0.611
0.511
BadNets
Random
0.999
0.955
Pretrained
0.487
0.441
Pretrained
0.999
0.976
OOD
0.530
0.495
OOD
0.995
0.950
Blended
Random
0.742
0.543
Blended
Random 0.861
0.331
Pretrained
0.612
0.565
Pretrained
0.523
0.000
OOD
0.687
0.578
OOD
0.848
0.321
SIG
Random 0.468
0.371
SIG
Random 0.788
0,238
Pretrained
0.464
0.371
Pretrained
0.728
0.049
OOD
0.543
0.470
OOD
0.869
0.273
Table 12: The performance against AS-
SET defense.
Strategy
TPR
FPR
Table 13: The performance against Cognitive Distilla-
Badnets
Random
0.708
0.543
tion.
Pretrained
0.624
0.534
OOD
0.420
0.549
Strategy
BadNet
Blended
SIG
Blended
Random 0.332
0.561
Random
0.738/0.527 0.763/0.569
0.504/0.558 0.662/0.527
0.954/0.712
Pretrained
0.572
0.542
Pretrained
0.803/0.687
OOD
0.356
0.464
SIG
Random 0.697
0.615
Pretrained OOD
0.328
0.540
0.984
0.540
B.3 THE PERFORMANCE OF OUR STRATEGY AGAINST DISTRIBUTION SHIFT
Face Classification Task. We also evaluate strategies a face classification task with the PubFig dataset. Table 14 illustrates the performance Single-class OOD strategy and Pretrained strategy with self-supervised features. For OOD strategy, employ the same architecture of the victim model as the surrogate model. The results show that our strategies are effective in boosting clean-label attacks face recognition tasks, posing serious security threat. Selecting samples
19

---

Published as a conference paper at ICLR 2025
with self-supervised models increases the success rate of clean-label attacks significantly, show- ing the effectiveness of self-supervised features. On the other hand, since there is a high distribution shift from ImageNet and TinylmageNet to PubFig, the improvements of Supervised Pretrained strat- egy and OOD strategy are not as high as Self-supervised Pretrained strategy.
Table 14: The ASR of our strategies with SIG on ResNet 8 with 20% and 50% poisoning rate.
Method
20%
50%
Random
13.20
29.31
Self-supervised models
24.92
62.09
Supervised models
19.26
40.37
Single-class OOD
16.27
48.27
Sketch Images. We also assess our strategy in the where images in the victim dataset have different styles from the domain of the pretrained model. Table 15 reports the success rate when attacking ImageNet- Sketch, showing that our strategy still effective in this case.
Table 15: The ASR on ImageNet-Sketch.
BadNet
Blended
SIG
Random
0.79
19.41
28.71
Pretrained 2.38
31.09
39.21
B.4 EFFECTIVENESS OUR METHOD OTHER ATTACKS
We also study the combination of our strategy with input-aware triggers, in particular, Refool, on CIFARIO. Refool poisons a sample x with reflection image a, as Tode = x + Ty & k, where the kernel & and reflection image v, different for each input Therefore, each poisoned sample has a different trigger. Table shows that our strategy still improves the success rate this case.
B.5 THE PERFORMANCE OF OUR STRATEGY ON TINYIMAGENET
We provide the results Tinylmagenet in Table 17 smaller but not much less complex variant of ImageNet, which has 200 classes. As can be observed, when the victim dataset has a high number of classes, our strategy still yields higher success than the random baseline, posing practical threat.
Table 16: The ASR of Refool.
Table 17: The performance on Tiny- Imagenet..
Strategy
ASR
Strategy
SIG
Narcissus
Random
38.02
Easy samples
2.87
1.88
Pretrained
51.85
Random samples
13.80
90.40
OOD
51.10
Hard samples
38.54
95.78
B.6 THE PERFORMANCE OF OUR STRATEGY WITH DIFFERENT PRETRAINED MODELS
We report the attack success of SIG when using different self-supervised methods, including Sim- CLRv2 Chen et al. (2020b), DINO Caron et al. (2021), and VICReg Bardes et al. (2022). and
different supervised models, including ViT Dosoviiskiy al. 2021a). ConvNext Liu et al. (2022)
and ResNet50 He et al. (2016)), to select samples to poison. Table shows that different pretrained models also increase the success rate of the attack.
We also investigate the effectiveness of multimodal pretrained models in selecting hard samples. More specifically, evaluate strategies with CLIP Radford al. (2021) using the ViT-B/32
20

---

Published as a conference paper at ICLR 2025
Table 18: The performance with different pretrained models.
CLIP
Self-supervised models
Supervised models
Random
CLIP-loss CLIP-KNN SimCLRv2 DINO VICReg ConvNext
ViT
ResNet50
BadNets
45.01
87.75
75.99
84.58
94.27
91.68
86.13
84.02
92.
Blended
37.55
50.90
43.16
54.30
54.68
52.90
54.34
56.02
60.86
SIG
60.54
71.80
65.48
73.57
78.48
80.59
72.68
79.70
85.42
architecture. The first one, named CLIP-loss, computes CLIP loss by cosine similarity of the textual features of the labels and the image features. The second one, named CLIP-KNN, uses Algorithm| with CLIP image encoder as a feature extractor. Table 18 shows that selecting samples with CLIP sub-optimal compared to other vision-only pretrained models. We hypothesize that multimodal models such as CLIP aim to align image features with textual features, thus, ignoring subtle visual details. In addition, zero-shot classification with CLIP is challenging in the case where the user wants to build fine-grained classifier for their specific use case. For example, CLIP struggles to distinguish facial images of different people or images of different species of dogs. In contrast, vision-only pretrained models do good job of detecting hard samples, demonstrated in the experimental results. For generality of the proposed method, the vision-only pretrained models, which capture general vision features, are more suitable.
B.7 THE NUMBER CLASSES IN THE OOD DATASET
Table 19: ASR of Multiple-class OOD strat- egy when varying the number of classes in the OOD dataset.
Table 20: ASR of Single-class OOD strat- egy when varying the number of classes in the OOD dataset.
Number of labels
ResNet18
VGG19
Number labels
ReaNet18
VGG19
Dataset
Dataset
10%
20%
20%
5%
20%
5%
CIFARIO
65.11
80.76
88.79
50.81
65.80
78.28
CIFARIO 200
72.93
79.07
87.18
51.24
72.35
79.04
200
65.89
71.26
77.18
39.13
54.62
66.20
69.74
81.12
86.40
50.33
68.46
80.28
43.56
47.59
52.50
27.93
28.98
31.94
49.07
51.71
55.15
35.91
38.54
38.28
GTSRB
GTSRB 200
200
46.39
48.36
54.00
23.26
27.09
24.32
47.34
50.04
55.52
35.85
42.33
39.03
We study the performance for the OOD strategy with the different number of classes in the OOD dataset. The results Multiple-class OOD strategy using SIG triggers are illustrated in Table [9 In general, these observations suggest that increasing the number of data labels in the OOD dataset does not improve the attack effectiveness.
B.8 THE TRANSFERABILITY OF OUR METHOD TO DIFFERENT ARCHITECTURE
We provide additional results for other architecture in Table 21 We perform clcan-label backdoor attacks on ViT Dosovitskiy et al. (2021b) or DeiT Touvron et (202T) with 500 samples selected by a self-supervised pre-trained ResNet50 model He et al. (2016b). As can be observed, our strategy improves the attack success rate of the random selection strategy by a large margin (more than 30% for BadNet and 10% for Blended and SIG), demonstrating that the selected samples still help to achieve effective attacks on various architectures.
B.9 THE EFFECT OF CLASS IMBALANCE
To study the effect of our method and class imbalance, we sort the classes by the number of samples descendingly and launch the backdoor attacks (with SIG trigger and 10% poisoning rate) the classes at 1st, 14th, 28th, and 43rd sorted positions (as target classes), whose original class indices 11, 16, and 37, respectively. The results in Table 22 show that method consistently
21

---

Published as a conference paper at ICLR 2025
Table 21: The performance of Pretrained strategy on VIT/CIFARIO and DeiT/GTSRB models
BadNet
Blended
SIG
Method
ACC
ASR
ACC
ASR
ACC
ASR
Random
98.78
11.26
98.80
23.10
98.72
35.55
ViT/CIFARIO
Pretrained strategy
98.8 88.84
47.20
98.79
38.63
98.73
45.00
Random
97.85
6.66
98.42
26,90
98.04
31.86
DeiT/GTSRB
Pretrained strategy
97.66
7.49
97.91
54.66
97.91
38.31
boost the success rates of the original attacks (random selection) on target classes from a broad spectrum of sample sizes.
Table 22: The performance of Pretrained strategy on classes with different sizes.
1st
14th
28th
43rd
Number of samples ASR with random selection
1500
900
150
48.07
43.87
1.66
16.30
ASR with Pretrained strategy
57.12
44.70
24.36
27.75
B.10 THE EFFECT OF DIFFERENT VALUES OF A
One our approaches employs k-NN to select samples that have the highest distances to their neighbors in the feature space. We vary the number & of neighbors and perform SIG attack with 10% poisoning rate on CIFAR1O and report the success rate in Table 23 The results imply that k-NN is more effective when the value of is small; we conjecture that KNN with smaller A takes into account the local property of the dataset, increasing the discrepancy between the score hard samples (which outliers) and easy samples. In the extreme case where 10000 (meaning select samples that are far from the mean), while the success rate is still higher than that of random selection, is lower than that of smaller k. Consequently, this suggests the use of small k value when performing the attacks.
Table 23: The performance of Pretrained strategy with different values of k.
k=5
k=50
k=500
k=1000
k=5000
k=10000
Random
ASR
82.35
80.59
78.92
79.41
77.34
74.76
60.54
B.11 ACCESS ONLY A PORTION OF THE DATA FROM THE TARGET CLASS
We study the effectiveness of our method under the setting where the attacker partially accesses the target class's s data. We conducted experiments using different selection strategies on CIFAR-I0 with accessible data comprising 20% and 50% subsets of the target class's data (Table 24). The attack used was SIG, and the poisoning rate was 5%. We can observe that as the size of the accessible data decreases, the corresponding ASR also decreases. However, the method's effectiveness still significantly better than that of random selection. The attackers, using our method, can still launch a very harmful attack (68.92 92%) even with only 20% of the target class's 's data.
B.12 RELAXING THE ASSUMPTION THE THREAT MODEL
Gao et al. (2023) propose three strategies to select samples by examining 1) loss value, 2) forgetting event, and 3) gradient norm, all of which cannot be adapted to launch the attack in our threat model (even when the pretrained model is used). More particularly, computing the forgetting event requires monitoring the training process, while loss value and gradient norm can only be computed when the pretrained model can "return the target class". For example, the attacker cannot model
22

---

Published as a conference paper at ICLR 2025
Table 24: The performance of Pretrained strategy with partial access the target class.
20%
50%
100%
Strategy
Acc
ASR
Acc
ASR
Acc
ASR
Random
94.63
45.27
94.80
43.37
94.69
50.28
Pretrained strategy
94.44
68.92
94.73
70.65
94.71
76.35
pretrained on ImageNet to compute the loss value of images in the GTSRB dataset. Our strategy overcomes this challenge by detecting hard samples based their features, training model the target class and OOD data to compute the loss value.
Nevertheless, we still report the performance of Gao et al. (2023) when we relax the assumption of our threat model to allow access to other classes. More particularly, we train clean model on CIFARIO and compute the loss value to select hard samples. Table 25 shows that although having access to all training samples, the approach in Gao et al. 2023) does not outperform our strategy.
Table 25: The performance of our method and Gao et al. 2023
BadNets
Blended
SIG
Random
45.01
37.55
60.54
Gao et al. (0033)
87.62
58.20
80.76
Pretrained
91.68
66.45
80.59
OOD
81.27
56.89
80.76
C SOCIETAL IMPACTS
Our work proposes novel threat model, where the adversary only has access to the target class that they want to attack. In this constrained setting, show that the attacker can perform selective poi- soning to improve the attack success rate of existing clcan-label attacks. We hereby raise awareness of new potential risk in developing a machine learning system practice.
23


Reviews:
[{"review_id": "L4mmxp0nOO", "reviewer": "Reviewer_8TyJ", "summary": "The paper proposes a method for enhancing clean-label backdoor attacks on deep neural networks. Unlike traditional clean-label attacks that apply triggers randomly, this approach selectively poisons challenging samples within the target class, boosting attack success rates with fewer poisoned samples. The authors introduce two strategies: using pretrained models to identify \"hard\" samples and leveraging out-of-distribution data for sample selection. Tested on CIFAR-10 and GTSRB datasets, this method outperforms random poisoning and is resilient against popular defenses like STRIP and Neural Cleanse, highlighting a need for stronger countermeasures against selective clean-label attacks.", "questions": "The authors should clarify the novelty, choice of limited datasets, the use of older defense strategies, and the dependency on pretrained models.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper improves traditional clean-label backdoor attacks by proposing a threat model that is more applicable in real-world scenarios.\n\n2. The method is claimed to achieve higher attack success rates with a lower poisoning rate, showcasing efficient use of resources.", "weaknesses": "1. In my opinion, the method primarily introduces a data selection strategy, which lacks sufficient novelty.\n\n2. The evaluation is conducted only on CIFAR-10 and GTSRB datasets, limiting insight into the method's performance across other dataset types and application domains.\n\n3. The paper primarily tests against older defense strategies. Implementing more recent and sophisticated defenses, including adaptive methods like sample-specific anomaly detection, would strengthen the evaluation.\n\n4. The pretrained model strategy relies on the availability of pretrained models in similar domains, which may not always be accessible in real-world applications.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MiQexmrcMH", "reviewer": "Reviewer_BTAB", "summary": "The paper studies clean-label backdoor attacks in a very constrained setting, where the attacker only needs access to the training data from the target class and has no prior knowledge of the victim model, training process, and the other classes, and focuses on data-selection strategies to boost the performance of existing clean-label attacks in this constrained setting. The proposed data selection strategies include (1) the use of a pretrained model (when such exists) or (2) the use of an OOD dataset (when the pretrained model is not available) to train a surrogate model.  The experimental results demonstrate the proposed strategies significantly enhance the ASR and several existing clean-label backdoor attacks, compared to random selection strategies. In addition, the paper demonstrates that the proposed strategies are resilient against several existing defenses.", "questions": "Please see the questions in weaknesses.", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The main strengths of the paper lie in its studied threat model, proposed sampling strategies and experimental evaluation.\n\n- I think that the proposed threat model is important as it exposes yet another backdoor threat where an attack only needs access to the data of the target class. The demonstrations that existing backdoor attacks under this threat model are not satisfactorily effective are an important contribution of the paper.\n- The proposed sampling strategies are novel, especially when they could be used with existing backdoor attacks, such as BadNets, SIG, Narcissus, etc…) to boost their backdoor performances under the studied threat model. It’s also interesting finding where the effectiveness of the proposed strategies even when there is less and less assumptions on the pretrained models or the OOD datasets. \n- The paper includes thorough analysis of the proposed strategies, demonstrating their effectiveness when they’re used with several existing backdoor attacks across different datasets. The evaluation also shows the effectiveness against several defenses.", "weaknesses": "I find that the paper has the following concerns:\n* The Narcissus results, while interesting, are different from what reported in their original paper. Can the authors explain why there are such differences? \n* The OOD approach rely on out-of-distribution data but it’s not clear how this dataset could be obtained, or whether there are any specific requirements of the datasets to maintain the effectiveness of the attacks?\n* Assuming that the victim could distribute the target class data collection to multiple sources, how does the proposed attacks perform in this case? \n* Do the authors have any suggestions about potential mitigation approaches against the proposed attacks in the studied threat model?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "P4hejuQmKi", "reviewer": "Reviewer_PVcB", "summary": "The paper proposes a method for improving the effectiveness of clean-label attacks. It introduces a threat model where the attacker only has access to data belonging to a specific class and has no knowledge about other classes in the dataset. The paper proposes a method for using samples with hard to learn features to create poison-efficient clean label attacks. The proposed method finds these samples by clustering the latent features of a surrogate model. The paper explores using a pretrained model and a model trained on OOD data as the surrogate model. The paper evaluates the clean-label attack against backdoor defenses and data cleaning methods.", "questions": "- Why would an attacker use the OOD strategy proposed in section 4.4, as it requires training a surrogate model and appears to work worse than using a pretrained model?\n- Why use a latent space clustering approach instead of using the loss from a pretrained zero-shot image classifier like CLIP?\n- Why use VICReg instead of a more general feature extractor like CLIP?\n- Where are the training settings used in experiments adapted from?\n\nReferences\n\n[1] Alexander Turner, Dimitris Tsipras and Aleksander Madry. \"Label-Consistent Backdoor Attacks.\", 2019.  \n\n[2] He, Kaiming, et al. \"Deep Residual Learning for Image Recognition,\" 2016.  \n\n[3] Gao, Yinghua, et al. \"Not All Samples Are Born Equal: Towards Effective Clean-Label Backdoor Attacks.\", 2023.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "- The proposed method is a widely applicable technique to enhance to clean label attacks.\n- The experiments do a good job differentiating the surrogate model from victim model and therefore the attack shows convincing transferability.", "weaknesses": "- The paper trains for 300 epochs which is significantly longer than it should take to train the model on CIFAR-10/GSTRB [1,2] and makes attack success due to over-fitting very likely. Around 100 epochs seems to be more standard. Ideally, to simulate a competent defender early stopping should be employed. I.e. stopping the run when validation loss plateaus.\n\n- The experiments use very weak baselines. The paper only evaluates how the method performs compared to random sampling. At minimum the paper should compare against [3]. Especially because [3] could easily be adapted to adhere to this paper's threat model by using a pretrained model. Therefore, the experiments are not sufficent to jusifty that the proposed method is stronger than a slightly adapted version of [3].\n\n- The paper claims that it's threat model represents *\"the **most** constrained data-poisoning threat.\"* However, there are other perfectly reasonable threat models that would make this attack unrealistic. For example, an opportunistic attacker that doesn't get to choose the subset of samples in the dataset they are able to manipulate.\n\n- When evaluating the attack against defenses the paper does not describe the hyperparameter settings used by each defense nor how those settings were derived.\n\nMinor:\n- Bolding of best methods or aggregation would make Tables 2 and 3 more interpretable.\n- There are many typos in the manuscript.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "q0zhjG9bRz", "reviewer": "Reviewer_F14C", "summary": "This paper explores a practical scenario for clean-label backdoor attacks, where an attacker’s access is limited to a single class of data within a decentralized training setup. This constrained threat model reflects real-world data collection challenges, such as privacy restrictions and geographical limitations. To enhance poisoning efficiency under these conditions, the paper introduces two sample selection methods specifically designed for this limited-access scenario.", "questions": "1. The authors should include more related works and advanced baselines in their paper.\n2. The authors should better clarify their main contributions than those introduced in existing works.\n3. The authors should avoid overclaims.\n4. The authors should conduct more comprehensive experiemnts. \n\nMore details are in the 'Weakness' section.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper is easy to follow to a large extent.\n2. The motivation is clear and with empirical support.\n3. The paper introduces a clean-label backdoor attack that works effectively in a constrained scenario where the attacker has limited data access (only one target class). This approach is realistic for scenarios with privacy or geographical constraints, enhancing the practical relevance of the attack model.", "weaknesses": "1. Numerous studies [1,2,3,4,5,6,7,8] have addressed sample selection in backdoor attacks, several of which [6,8] specifically focus on sample selection for clean-label backdoor attacks. Omitting these key relevant works is a significant oversight and should be addressed to ensure a comprehensive discussion of the literature.\n2. The novelty of this paper is limited, as it leverages a pre-trained model to identify \"hard samples\" for poisoning—a concept already explored in several studies [6,7,9]. However, the distinctions between this approach and prior work are not clearly articulated.\n3. The first contribution claimed by this paper is the introduction of a new backdoor threat model, where an attacker, acting as a data supplier, has access only to the target class data yet can still execute effective clean-label backdoor attacks. However, previous studies [10,11] have already examined this threat model in depth, providing detailed discussions on \"Why are dirty-label attacks more effective than clean-label attacks?\" Consequently, the originality and contribution of this paper raise some concerns.\n4. The discussion of backdoor attacks and defenses in the related work sections of this paper is outdated. \n5. There are some potential over-claims. For example, Line 156-159: Accessing only samples from a single non-target class is more difficult setting than yours.\n6. Missing some important experiments.\n- Main Experiments\n  - The authors should also include the results of methods using all training samples for references, although you have a different setting.\n  - It would be better to include the results of Narcissus here instead of in the appendix.\n  - I would like to see whether the proposed method is also effective for untargeted clean-label backdoor attacks (e.g., UBW-C in [12])\n- The Resistance to Defenses: The authors should evaluate their methods on more advanced backdoor defenses (such as [13, 14] and their baselines). \n\n\n\n\n**References**\n1. Computation and data efficient backdoor attacks\n2. Explore the effect of data selection on poison efficiency in backdoor attacks\n3. Boosting backdoor attack with a learnable poisoning sample selection strategy\n4. A proxy-free strategy for practically improving the poisoning efficiency in backdoor attacks\n5. Minimalism is King! High-Frequency Energy-based Screening for Data-Efficient Backdoor Attacks\n6. Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attacks\n7. Confidence-driven Sampling for Backdoor Attacks\n8. Clean-label Backdoor Attacks by Selectively Poisoning with Limited Information from Target Class\n9. Not all samples are born equal: Towards effective clean-label backdoor attacks\n10. Efficient backdoor attacks for deep neural networks in real-world scenarios\n11. Narcissus: A practical clean-label backdoor attack with limited information\n12. Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection\n13. Towards Reliable and Efficient Backdoor Trigger Inversion via Decoupling Benign Features\n14. IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)