A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers
Authors: Zhixiao Wu
Yao Lu
Jie Wen
Hao Sun
Qi Zhou
Guangming Lu
Venue: NeurIPS 2025 poster ()
Keywords: Backdoor Attack
Sample Selection
Clean-label
Primary area: deep_learning

Abstract: Poison-only Clean-label Backdoor Attacks (PCBAs) aim to covertly inject attacker-desired behavior into DNNs by merely poisoning the dataset without changing the labels. To effectively implant a backdoor, multiple triggers are proposed for various attack requirements of Attack Success Rate (ASR) and stealthiness. Additionally, sample selection enhances clean-label backdoor attacks' ASR by meticulously selecting "hard'' samples instead of random samples to poison. Current methods, however, 1) usually handle the sample selection and triggers in isolation, leading to severely limited improvements on both ASR and stealthiness. Consequently, attacks exhibit unsatisfactory performance on evaluation metrics when converted to PCBAs via a mere stacking of methods. Therefore, we seek to explore the bi-directional collaborative relations between the sample selection and triggers to address the above dilemma.  2) Since the strong specificity within triggers, the simple combination of sample selection and triggers fails to substantially enhance both evaluation metrics, with generalization preserved among various attacks. Therefore, we seek to propose a set of components to significantly improve both stealthiness and ASR based on the commonalities of attacks. Specifically, Component A ascertains two critical selection factors, and then makes them an appropriate combination based on the trigger scale to select more reasonable "hard'' samples for improving ASR. Component B is proposed to select samples with similarities to relevant trigger implanted samples to promote stealthiness. Component C reassigns trigger poisoning intensity on RGB colors through distinct sensitivity of the human visual system to RGB for higher ASR, with stealthiness ensured by sample selection including Component B. Furthermore, all components can be strategically integrated into diverse PCBAs, enabling tailored solutions that balance ASR and stealthiness enhancement for specific attack requirements. Extensive experiments demonstrate the superiority of our components in stealthiness, ASR, and generalization. Our code will be released as soon as possible.

A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers
Zhixiao Wu Harbin Institute of Technology, Shenzhen wwxhh24428gmaii.ccomm com
Yao Lu" Harbin Institute of Technology, Shenzhen luyao20210hit. edu. en
Jie Wen Harbin Institute of Technology, Shenzhen jiewen_pro126.. com
Hao Sun
Qi Zhou
Guangming Lu Harbin Institute of Technology, Shenzhen luguangm@hit. edu.
Harbin Institute of Technology. Shenzhen hitsz. sh@gmail com
Harbin Institute of Technology, Shenzhen mi mickkyeaveeneleeeddggaa...cc com
Abstract
Poison-only Clean-label Backdoor Attacks (PCBAs) aim to covertly inject attacker- desired behavior into DNNs by merely poisoning the dataset without changing the labels. To effectively implant a backdoor, multiple triggers are proposed for various attack requirements of Attack Success Rate (ASR) and stealthiness. Additionally, sample selection enhances clean-label backdoor attacks' ASR by meticulously selecting "hard" samples instead of random samples to poison. Current methods, however, 1) usually handle the sample selection and triggers in isolation, leading to limited performance on both ASR and stealthiness when converted to PCBAs. Therefore, seek to explore the bi-directional collaborative relations between the sample selection and triggers to address the above dilemma. 2) Since the strong specificity within triggers, the simple combination of sample selection and triggers fails to flexibly and generally mitigate the drawback of various backdoor attacks. Therefore, seek to propose set of components based on the commonalities of attacks. Specifically, Component A ascertains two critical selection factors, and then makes them appropriate combination based the trigger scale select more reasonable "hard" samples for improving ASR. Component is proposed to select samples with similarities to relevant trigger implanted samples to promote stealthiness. Component C reassigns trigger poisoning intensity on RGB colors through distinct sensitivity of the human visual system RGB for higher ASR, with stealthiness ensured by sample selection including Component B. Furthermore, all components can be strategically infegrated into diverse PCBAs, enabling tailored solutions that balance ASR and stealthiness enhancement for specific attack requirements. Extensive experiments demonstrate the superiority of our components in stcalthiness, ASR, and generalization. Our code can be seen at git.
Introduction & Related Works
Since the interpretation of Deep Neural Networks (DNNs) still under-explored, effectively defend- ing the backdoor attacks (Doan et al. [2021], Lv et al. [2023], Zeng et al. [2023a]) is a huge challenge.
Corresponding author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Distinet sensitivity of human visual system on RGB mild distortion Among various types of attacks, Poison-only Backdoor Attacks (PBAs) are straightforward to execute since they simply involve contaminating the training dataset for DNNS by embedding pre-designed triggers into selected samples. Such poisoned models will exhibit attacker-desired behavior when processing triggers implanted samples but retain the fundamental functionality with benign samples. Furthermore, Clean-label Backdoor Attacks (CBAs) (Huynh et al. [2024), Zhao et al. [2024]), pre- serving the ground-truth sample labels, attract volume attention due to their better resilience against manual inspection. The above settings correspondingly increase the difficulty of designing effective backdoor attacks. Therefore, is a significant issue to explore an elegant and effective approach to optimize backdoor attacks effective PCBAs for better applicability and stealthiness.
Sample selection (Hayase and Oh [2022], Li al. [2023d]. Li et al. [2024b], Hung- Quang al. [2024], Wang et al. [2025]) are proposed to enhance ASR by poisoning selected "hard" samples instead of random samples. Therefore, the poisoned models tend to learn the implicit projection between the trigger feature and the target label to evade the difficulty of the original classification upon such samples. The SOTA metric, Forgetting Event, selects "hard" samples by comparing the frequency of misclassification transitions during the pre-training phase. However, the Forgetting Event metric neglects the category information in misclassification transitions, limiting the search of "harder" samples. Therefore, it is vital to introduce information jointly integrate with Forgetting Event for further optimizing the selection "hard" samples. Furthermore, existing methods neglect the effect of sample selection the stealthiness enhancement of backdoor attacks. Therefore, is critical to explore an effective mechanism for sample selection the satisfactory enhancement of stealthiness.
appropriate way to employ category
Multiple triggers are designed to effectively implant backdoor for various attack requirements, which can be mainly classified into three categories. (1) Invisible triggers characterized by global low-intensity poisoning are designed for rigorous stealthiness constraints. However, current invisible attacks confront challenges in achieving invisibility with satisfactory ASR in straightforward way. For instance, BppAttack (Wang et al. (2022]). a stealthy attack based on image quantization and dithering, employs adversarial training and label flipping to embed the low-intensity triggers for ensuring ASR. Therefore, (2) visible triggers characterized by local high-intensing poisoning (e.g., Badnets) and (3) visible triggers characterized by global medium-intente remain valuable for their high deployability and higher ASR. However, the stcalthiness of such visible triggers is unsatisfactory. In summary, visible and invisible attacks possess their irrellceabll strengths in different application scenarios. Therefore, the optimization method for effective PCBAs should consider the generalization upon various types of triggers in flexible approach.
poisoning (e.g.. Blend)
Explore the effect triggers sample selection via the enhancenent attack success rate and stealthiness.
Sample Selection
Component A
Component
stealthiness enhancement
highlight
enhaneement
large trigger
Category Diversity (ours)
Trigger concenled black background.
Cancel trieger features dh images by similnrity
Find the appropriate combination A based on the of trigger features
OUP
Trigger 92 can concealed complesly
calcutation.
small trigger highlight
Forgetting Events (traditional)
attack success rale
triggers
frigger
steulthiness ensurement
enhancement
Triggers Component
Explore the effect of sample selection on triggers.
Stealthiness easurement avoid selecting single-color dominated samples.
distortion
subtle distortion
Special samples
Enhance the trigger feature on the Blue color channel.
Green dominated
Bluc
dominated
distinet-color
low tensirivity
poisoning
R
Figure 1: PCBAs optimization by components with collaborative sample selection and triggers.
To resolve the above issues, we propose set of generalized components, which sufficiently induce the bi-directional collaborative relations between the sample selection and triggers, significantly

---

improve both stealthiness and ASR while ensuring generalization for various attacks. Components are demonstrated as below, and more details about related works can be seen at Appendix A.
Component A ascertains two critical selection factors, and searches for an appropriate combination based on the trigger scale select more reasonable "hard" samples for improving the ASR of PCBAs. (a) Firstly, we observe the significance of category information on ASR improvement through exploration experiments at Section 2.1. Thus, a novel selection factor, Category Diversity, is introduced into sample selection. (b) Secondly, experiments demonstrate that the trigger scales can guide the appropriate combination between Forgetting Event and Category Diversity for selecting more reasonable "hard" samples. Details can be seen at Section 3.2.
Component B selects samples with similarities to relevant trigger implanted samples via similarity calculation based on appropriate metrics (e.g., Gradient Magnitude Similarity Deviation (Xue et al. [2013])), thereby promoting stealthiness by exploiting the distinct visibility between the human vision system and computer system. Specifically, the trigger feature can be invisible to the human vision system when placed with a similar feature in benign images while maintaining the visibility in views of the computer system, as depicted in Section 2.2.
Component C is general optimization on trigger design for higher ASR. (a) Through exploration research at Appendix E, we notice the potential of the distinct sensitivity of the human visual system to RGB colors in trigger design. Specifically, poisoning at the blue channel exhibits better stealthiness than poisoning at other colors. Therefore, we reassign trigger poisoning intensity in RGB for a better balance of ASR and stealthiness. (b) Component B prevents the adversary from implanting triggers into blue-dominated samples, thereby further ensuring the stealthiness of enhanced triggers.
In summary, Components A&B introduce the trigger to optimize the sample selection. Specifically, Component A selects more "harder" samples by searching the appropriate combination between For- getting Event and Category Diversity based on the trigger scale for ASR enhancement. Component B considers the trigger feature to select samples for stealthiness enhancement. Furthermore, Component C reassigns trigger poisoning intensity in RGB for ASR enhancement, of which stealthiness can be ensured by introducing the sample selection, especially Component B. What is more, multiple collaborative components will be effective for different attacks due to the attack commonalities introduced in the mechanism of the above components. Extensive experiments validate the superiority of our components in terms of generalization capability.
2
Our Methods
2.1 Component A: Appropriate Combination of Metrics Based on Trigger Scale
Part A Classification results at the pre-training stage
Part B Number of samples with different Category Diversity
Part C
Performance of sample selection on enhancement of ASR
label 1
Sample X with higher category diverity (num- 5)
num (10.69%)
label 2
Higher Category Diverity enhunce the ASR of Badnets from 37.24% to 76.50%
label 4
label
num 3 (15.76%)
Category
label
Diversity
Farget
Forggeting Events (frequency)
opoch
Sample Y with lower category diverity (num
BOM =
'Higher Forgetting Event enhance the
Bum = (28.51%)
(45.04%)
ASR Badnets from 37.24% 71.74%
Remark: label 1-9 represents the non-targed labels with as the target label
Remark:
number categury in misclassification results
Remark:
feature demotes the relation of Category Diversity and frequency in number of samples
Figure 2: Pilot experiments of Category Diversity. In Part A&B, we explore the significant difference in Category Diversity between samples. In Part C, we ascertain two critical selection factors and the potential internal conflict between Forgetting Event and Category Diversity.
Poisoning the "hard" samples leads the model to learn the strong correspondence between triggers and the target label y, to avoid the hard-to-learn challenge in such samples. Component A ascertains two critical selection factors and utilizes the trigger seale to guide an optimal combination for selecting "harder" samples, thereby enhancing attacks' ASR.
3

---

Forgetting Event Given a sample (zz, 3t) in the target-label set D,, Forgetting Event denotes the event when the sample is classified from y/ (ym * ye). whose frequency can be represented as formfrret (Ts). Sample selection based on Forgetting Event can be represented as:
D, arg D.CD (DNN)EDD
Σ
(z)
(I)
Category Diversity Through exploration experiments Figure A&B, samples exhibit a signifi- cant difference in category diversity during misclassification events of samples. According to Part C, higher category diversity can enhance the ASR of Badnets, thereby serving as a significant metric in sample selection. We use μ to represent the mean of [Ne(( y/), ym (ym + ye)3. The selected samples are expected to exhibit higher Category Diversity in relatively balanced proportions:
D, = arg
min D,CDt
Σ (D.D))DD
[[Ne((2,, Uc), vm) - 1ll2.
(2)
We devise a series of distinct negative functions NF to adjust weights of categories according to Forgetting Event (frequency) varied rates (O(log(æ)), O(x), O(+²)), and O(e²)) for exploring the reasonable combination. Higher rates highlight the significance of Category Diversity in sample selection. We exhibit the details of metric calculation with NF at log(æ)). dubbed 'Res-x', in Algorithm and algorithms with other negative functions in Appendix C. Experiments in Section 3.2 imply that the appropriate combination of two factors depends on the trigger scale.
Algorithm Metric Caleulation with Negative Function NF (llg(z))
Input: Train Dataset Dtr. Target Label yt, Misclassification Events Ne((T;, Vi), Vm.)
Output Calculated Metric of Samples
for image (I;, Ur) E Drr do
Num [Wm]
for ym E Y do
Num
Num(um)] + Ne ((2rss vt), Mm)
end for end for
for ym Y do
Sum = Sum + log(1 + Numlyya)
end for for Um Y do
Cls[ym] = Ioo[1+ Num[ym]
Sum
end for for image (nra Mt) E Der do
Metric xi| =
for ymm E Y do Metric[x:] Metricfad) + Cls[ym] No((1, Ye)s 9m)
end for end for
2.2 Component B: Selection of Samples Exhibiting Visual Insensitivity to Triggers
Typical traditional triggers can be classified as high-intensity local visible triggers (e.g., Badnets), medium-intensity global visible triggers (e.g.. Blended), and low-intensity global invisible triggers (e.g., BppAttack). As depicted in Figure 1, Component enhances the stealthiness of attacks by concealing visible triggers in similar parts of the selected benign images. For example, the {h w) patch on poisoned images XP X implanted by Badnets trigger (all-black patch) and the selected
images Xbx...
with | < can be represented as:
0
0
20,0
F0
F0,
0
0
0
F1,0
F1,1
4 1,,0
XP
X
(3)
kxww
0
hxw
Fh.0
Th.1
hxw

---

Therefore, the trigger can be stealthy on the human vision system when é is a relatively small integer closest zero. Furthermore, the strong discriminative property of the all-zero feature in machine learning leads the Badnets trigger to remain visible on the computer system, thereby avoiding the significant decline in ASR. In our paper, we search the samples exhibiting the most visual insensitivity for the Badnets trigger by calculating the sum of Mean Squared Errors (MSE) in varying patches.
However, Component with MSE used in bobaal-poioonig triggers (e.g.. Blended and BppAttacck is insensitive to severe local distortions. In global poisoning attacks, Gradient Magnitude Similarity Deviation (GMSD) shows the superiority in searching appropriate samples for trigger concealment. Details of GMSD can be seen in Appendix D. What is more, when collaborating with Component A, the pseudocode for sample selection upon GMSD can be seen in Algorithm 2.
Algorithm 2 Sample Selection with Components A&B
Input: 'Trget Label yt. Samples selected by Component A Da, Input: The weight of Component A a, Output: Samples selected by Component A&B Dab Initialize: : Empty array R., to save the GMSDs of Da for image (Iz, ye) E De do Implant the trigger into image I; to get poisoned image Tp Compute the GMSD between image 24 and poisoned image xy Save the tuple [z., GMSD(I,, I,)] into Ra
end for sorted tuples sorted Ra., key=lambda 0:9(1]) Deb = [g[0] for g in sorted_ (tpeess:ttssss a * num Da)]]
2.3 Component C: Trigger Optimized with Stealthiness Assurance in Sample Selection
In this section, with the stealthiness enhancement by Component B, we further optimize the triggers via distinct-color poisoning for ASR enhancement based on the distinct insensitivity of human visual systems to colors. Research about the human visual system can be seen in Appendix E.
Optimization on Badnets& Blended triggers Badnets implant triggers by completely replacing the pixels of the predetermined patch in the original image. According to experiments in Appendix F, triggers with alternating black-and- patterns achieve significantly higher ASR than using single- color patterns. However, Black-and-whit triggers are more easily detectable by human inspection and pose difficulties in Component B to select images for stealthiness enhancement, Distinct-color poisoning is introduced to combine the advantages single-color and black-and-white triggers by employing (single-color trigger, single-color trigger, black-and- -nchhhee trigger) in RGB channels.
For Blended attacks, triggers are linearly blended with the image using specified weighting proportions (e.g., 0.2 in all channels). Experiments in Section 3.1 demonstrate concentrating the poisoning intensity on a single channel leads to higher ASR compared to the even poisoning way. Distinct-color poisoning reassigns the weight in RGB from {0.2, 0.2, 0.2) to (0.2, 0.1, 0.3). Therefore, the intensity of triggers in the green channel, which visually sensitive to humans, weakened. The enhanced intensity in the blue channel, which is visually insensitive to humans, leads to ASR enhancement.
Optimization on BppAttack triggers BppAttack reduces the color palette of depth from my bits to smaller color depth (mp bits) in all color channels. The trigger fi is defined in Eqn.4, where round represents the integer rounding function:
round(
(2th 1))
fx)
(2 - 1).
n
The optimized BppAttack, dubbed MultiBpp, optimizes the original quantization process by exploiting the difference of the human visual system to colors. (1) We replace the color palette m,, mp in Eqn.4 Nº 2n, 1) to precisely control the
by the number of representable colors N (N, = 2 strength of the poisonous feature in Eqn.5. (2) We differentiate the poisoning intensity in the three color channels (e.g..Ng, No. c E G, instead of maintaining uniform intensity.
round( Ng
(ND))
[((x)
(NE)-
(5)
Ne p
5

---

We also follow the BppAttack by introducing the Floyd-Steinberg dithering to enhance the stealthiness of the MultiBpp triggers, as depicted Algorithm We devise two corresponding MultiBpp triggers. One involves poisoning exclusively the blue channel (MultiBpp-B) whereas the other implements differential poisoning across all channels (MulriBpp-RGBB.
Algorithm 3 Quantization with Floyd-Steinberg Dithering
Input: Selected Samples to be Poisoned D,, Diffusion Distribution [di, d2. dÿ. di]
Output : Poisoned Samples
for image x E D2 do for E {R, B} do
for from right to left do
for j from top to bottom do
res"
f
[(]]
x
[+][]]
x
+
res
x
11 =x ++
+ res di
w
i +
1
i -] x [ + res * di
x
i
+
+ res do res dd
x i
-
end for
end for
end for
end for
3 Experiments
We optimize (Badnets-C, Blended-C. BppAttack] to demonstrate the superiority of our components on various types of attacks {local high-intensity poisoning attacks, global medium-inteenitty poisoning attacks, global low-intensity poisoning attacks). Blended-C and Badnets-C represent the clean-label variants of Blended and Badnets attacks. N NG N in MultiBpp attacks represents the concrete quantization setting of poisoning intensity in RGB channels. Specifically, the default bit depth of BppAttack in the original work is which can be seen as 32 32 32 in this paper. Base represents the quantization attack by 32 32 32 without the training control and label flipping in BppAttack. Details of attack setup can be seen in Appendix G.
3.1
Main Results
Table I: Performance of sample selection upon CIFAR- with 1 1% samples poisoned.
Sample Selection
Badnets- C
B
MultiBpp-B B
MultiBpp-ROC RGB
Type no.
Selection
ASR
BA
ASR
BA
ASR
BA
ASR
BA
a
Random
37.24
94.42
53.41
94.90
1.37
94.51
1.16
94.95
b
Loss
52.71
94.71
59.43
95.10
28.02
94.84
47.85
94.76
Bench
Gradient
52.56
94.45
58.45
94.77
38.26
95.04
53.28
95.03
d
Forget
71.74
94.90
71.05
94.55
74.39
94.92
78.10
94.90
e
Res-log
82.13
94.98
82.34
94.73
77.10
94.54
80.20
94.82
Res-æ 68.65
94.71
82.31
94.31
76.73
94.21
83.07
94.63
Ours
g
Res-E2 78.76
94.94
84.88
94.38
82.54
94.58
83.88
94.59
h Res-e"
76.50
94.47
71.81
94.80
53.92
94.72
62.28
94.85
Effect of Component A with different Negative Functions upon ASR enhancement: We adopt the same experimental setup as BppAttack (Wang et al. [2022]). We use Res-X (X E (log, x. e )²))
represent Component A with different Negative Functions various rates X. According to Table 1, Component A (Ours) significantly enhances the ASR. Specifically, for BadNets attacks, Res-log outperforms the Forget metric (Forgetting Event) upon ASR from 71. 71% 83.1% For Blended attacks, R exceeds the Forget metric upon ASR from 71. 71.05% to 84.88%. The optimal metrics of (Badnets-C. C, Blended-C, MultiBpp-E B, MultiBpp-Red RGBB) are (Res-log, Res-X, Res-z?, Res-x²). Therefore, the significance of Category Diversity is highlighted in decreases on Res-e" imply the negative impact of inappropriate combination. The stable ASR enhancement the [local high-intensity poisoning attack, global medium- iintensity poisoning attack, global low-intensity poisoning attack) shows the superiority of Component A on generalization with collaborative sample selection and triggers.
attacks. The ASR

---

Table 2: Performance of sample selection upon CIFAR- 100.
Sample
Poisoning Rate a = 0.2%
Poisoning Rate a = 0.5%
Selection
Badnets- C
Blended-C
Badnets C
Blended-C
Type
Selection
ASR
BA
ASR
BA
ASK
BA
ASR
BA
Random
7.49
77.86
40.48
77.70
51.49
78.46
65.55
78.51
Loss
17.84
78.01
46.59
78.83
70.97
78.06
70.42
78.27
Bench
Gradient
25.25
78.28
53.03
78,62
82.02
78.67
72.51
78.33
d
Forget
59.39
78.21
63.11
78.10 10
79.69
78.53
73.31
78.43
Res-log
62.64
78.22
67.53
78.04
83.71
78.33
73.63
78.17
Res-r
80.48
78.25
73.48
78.29
84.05
78.46
76.36
78.30
Ours
Res-x*
72.48
78.08
66.27
78.08
85.06
78.56
77.45
77.92
Res-e
52.14
78.18
60.04
78.16
71.41
78.27
72.20
78.31
The poisoning rate of clean-label attacks merely 1% CIFAR-I00 when poisoning all target-label samples. Therefore, selecting 50% of the target-label set is reasonable to ensure ASRs of attacks, in which the gap between selecting methods significantly narrowed. Specifically, according Table 2, the ASR difference between Forget and Loss on Badnets- C decreases from 31.55% (59.39% 17.8 17.84%) to 8.72% (79.69%- 70.97%). In contrast, our method can still maintain its superiority under relatively larger poisoning rates. Furthermore, Badnets- achieves 80.48% ASR with Res-r strategy, 21 % higher than the Forgetting Event metric. Blended-C achieves 73.48% ASR with Res-r strategy, 10% higher than Forgetting Event. The optimal methods of Badnets-C on (CIFAR-10, CIFAR-100) are (Res-log, Res-r), which indicates the enhanced significance of Category Diversity in datasets with more categories. In summary, Component A can significantly improve ASR with generalization upon various attacks via searching the appropriate combination of Forgetting Event and Category Diversity based on the trigger scale.
GMSD
GMSD
Higer GMSD
MSF
MSE
Hither
Figure 3: Images poisoned by Badnets attacks with different evaluation metrics in Component B.
Effect of Component B on stealthiness enhancement: As depicted in Figure poisoned images with lower GMSD and MSE values both exhibit superiority in the stealthiness of triggers for Badnets attacks. Component with GMSD tends to find samples with complex colors where the visual sensitivity to MultiBpp triggers will significantly weaken (GMSD E [0.0274, 0.0769)). In contrast, single-color dominated images where GMSD e [0.3806, 0. 0.4927] are selected by Component as bad samples. Component B with GMSD tends to find samples with complex backgrounds where the visual sensitivity to Badnets triggers will weaken. contrast, Component with MSE tends to find samples with patches similar to the triggers, where the visual sensitivity to Badnets triggers will significantly weaken. Therefore, MSE exhibits superiority in the stealthiness enhancement of Badnets attacks compared to GMSD and will be applied in this paper. Visual performance (Blend-C, BppAttack) can be seen in Appendix I.
We select a specific image set to be visualized according to the stealthiness rankings sorted by Component B for various attacks in Figure 4. Images from top bottom represent (MultiBpp-B (255:255:8), Blended-C, Badnets-C) and images depicted from left to right represent the GMSD
7

---

Figure 4: Images sorted by Component with similarity calculation.
value from high to low, corresponding to the decrease of visual sensitivity measured by Component B. In summary, samples are equal in visual sensitivity, and the stealthiness ranking of samples dynamically varies in different attacks. In summary, Component B enhances the stealthiness by concealing the trigger feature on the part of benign images similar triggers, which can retain generalization ability upon various attacks. Visual presentation of poisoned images selected by Component with different MSD and GMSD values provided in Appendix I. For any machine- quantifiable evaluation metric provided, component B can rapidly identify images that achieve optimal performance upon the selected metric.
Table 3: Performance of
attacks by poisoning 2.5% samples of CIFAR-10.
Attack
Metric
Attack Setting
Type
no.
Method Benign
ASR
BA
Clean-label
Training Control
Stealthy
95.0
b Base
8.2
94.8
Benchmark
BppAttack
12.5
94.5
d
Blended-C
66.4
94.3
255:255:8
68.6
94.8
MultiBpp (our methods)
f
255:255:12
60.0
94.9
X
g
24:48:8
76.6
94.7
36:72:12
57.7
94.6
8:255:255
84.1
94.7
MultiBpp
255:8:255
72.2
94.3
(others)
k
12:255:255
67.6
94.5
255:12:255
73.8
94.5
Effect of Component on ASR enhancement: According to Tables 3c, BppAttack exhibits merely 12.5% ASR with label flipping and training control without optimization by the proposed components. As shown in Table 3g. MultiBpp attains an ASR of 76.6% when quantized with the intensity of 24 : 48 8 in RGB color channels. Therefore. the BppAttack can be optimized as effective clean-label poison-only attacks with higher ASR. According to Table 3(e, i, j), the red and green channels demonstrate superior attack performance with 84.1% ASR by poisoning at the red channel and 72.2% ASR by poisoning the green channel. The differential learning sensitivities imply that the model can infer that the feature in the red and green channels are more valuable. Tables (e).f and (g.h} indicate that increasing the quantization step improves ASR. However, MultiBpp with the quantization intensity of (36 72 12) yields lower ASR of 57.7%, compared to 60.0% achieved with 255 255 : 12. We hypothesize that the learning effectiveness of the poisoning feature is not solely influenced by the quantization step. Specifically, in scenarios like [f.h), the model needs to focus on features from all three channels when learning under the configuration of h, whereas only needs attend to feature from one channel when learning the trigger feature. Experiments of component upon [Badnets-C, Blended-C) can be seen in Appendix F.
Collaborative effect of our components on ASR enhancement As depicted in Table 4, the positive ASRs of attacks occur when optimized by components A&C because optimal improvement in ASR cannot be achieved when consideration is given to stealthiness. Taking Badnets-C for example, the ASR decreases from 86. 15% to 77.67% as Component B slightly reduces the effect of Component B on ASR enhancement. Compared to the ASR of vanilla, solely applying Component

---

Table 4: Performance of optimized attacks upon CIFAR-10 with 1% samples poisoned.
Additive
Poisoning Rate a = 1%
Poisoning Rale a
2.5%
Components
Badnets-C
Blended-C
Badnets-C
Blended-C
Method
ASR
BA
ASR
BA
ASR
BA
ASR
BA
Vanilla
20.47
94.50
53.41
94.90
34.09
94.88
$2.03
94.22
Component A
70.03
94.16
70.65
93.93
73.19
93.19
85.15
93.70
Component B
21.33
94.17
57.89
94.13
70.38
93,43
74.12
94.07
Component C
38.67
94.47
60.46
94.16
45.59
94.31
74.77
93.92
Components A&B
67.47
93.71
75.00
93.71
73.59
94.18
81.63
93,41
+ Components A&C
86.15
93.90
84.13
93.97
89.85
93.65
94.32
94.11
+ Components B&C
58.57
94.03
70.66
94.03
70.75
93.68
85.20
93.78
Components A&B&C
77.67
94.01
77.51
94.11
84.49
93.45
87.54
93.76
will cause the reduction of ASR (from 20.47% to 21.33%) Furthermore, when applied at higher poisoning rate, Component B can improve nearly 20% ASR of Badnets-C (Blended-C) from 34.09% 52.03% (from 52.03% 74.12%). respectively. The underlying cause may reside in the diminished competition between triggers and the target-class features, which is induced by the high similarity between triggers and benign images.
Furthermore, all components can be strategically integrated into diverse PCBAs, enabling tailored solutions that balance ASR and stealthiness enhancement for specific attack requirements. For invisible attacks such as Narcissus (Zeng et al. [2023a]), applying components A&C is enough. For example, achieve
SOTA performance in Backdoor Attack based the SOTA attack (Narcissus), By poisoning merely images (poison rate = 0.00004), the optimized Narcissus achieves 96.12% ASR and 10% BA in CIFAR-10 with 0 as the target-label. Guides of applicability to recent PCBAs can be seen in Appendix J.
Table 5: Performance of methods ASR when defended by defense methods.
Attack
Method
Original
ABL
AC
I-BAU
NC
RNP
FST
random
18.8
18
14.4
8.0
18.8
10.3
22
forget
52.9
8.4
36.3
31
17.3
52.9
8.8
54.7
Component
56.2
14
47.7
36.5
27.9
56.2
36.3
62.4
Badnets-C
Component
37.9
3.5
25.6
20.2
32.5
37.9
34.9
40.5
+ Component
53.7
5.5
28.4
28.9
7.4
1.0
24.1
50.4
+ Components B&C
54
0.2
51.8
25.9
5.9
54
0
37.2
+ Components A&C
87.5
1.6
68
51.2
14.8
81.2
47.6
86.4
random
57.6
15.1
52.4
39.8
28.3
57.6
27.1
42.8
forget
76.1
9.2
73.2
63.5
7
76.1
0
64.1
+ Component A
77.9
3.9
76.9
64.3
20.0
77.9
36.1
69.5
Blended-C
+ Component B
71.7
3.4
67.7
60.1
14.3
71.7
19.7
58.6
Component
74.8
6.1
62.9
74.5
48.2
74.8
0
64.2
+ Components B&C
8.9
85.5
92.8
91
71.7
84.3
+ Components A&C
97.1
1.8
93.9
98.5
46.1
96
97.3
90.9
Effect of Our Components on Backdoor Defense We consider (ABL: Anti-backdood Learning (Li et al. [2021b]). AC: Activation Clustering (Chen et al. [2018]), FP: Fine-pruning (Liu et al. [2018]). I-BAU: Implicit Hypergradient (Zeng al. [2022]). NC: Neural Cleanse (Wang al. [2019]). RNP: Reconstructive Neuron Pruning (Li et al. [2023e]), FST: Feature Shift Tuning (Min et al. (2023))) to analyze the impact of our methods on existing defense methods. All results are evaluated on CIFAR-10 by poisoning 3% samples at the clean-label setting. According to Table 5, each component exhibits positive influence upon Badnets-C and Blended-C when defended by various defense methods in most cases for ASR. Specifically, Badnets-C enhanced by components A&C achieve 87.5% ASR, which 68.7% higher than the original Badnets-C. Furthermore, the effectiveness of backdoor defenses sometimes depends mainly the characteristics of the backdoor attacks and defense methods themselves. Badnets-C and Blended-C fail to penetrate the ABL. In such a case, the attacks optimized by method also remain futile with ASR less than 1.8%. In general, our methods outperform or keep the performance the original attacks upon ASR when defended by defense methods. Supplementary experiments are provided in Appendix H.
3.2 Ablation Study
Effect of trigger scales: BlendXs (X E {20, ( 24, 28, 32}) are denoted to explore the effect of trigger scale X on the optimal combination in Component A for ASR enhancement. According to Table

---

Table 6: Performance of BlendXs upon CIFAR-I0 with I % samples poisoned.
Sample Selection
Blend32
Blend28
Blend24
Blend20
Type
no.
Selection
ASR
BA
ASR
BA
ASR
BA
ASR
BA
a
Random
53.44
94.95
48.47
94.69
39.45
94,89
18.15
94.68
b
Loss
60.93
94,89
58,85
94.77
54.11
94.63
39.78
94.73
Bench
Gradient
60.32
94.24
58.82
94.87
54.21
94.63
36.09
94.96
Forget
70.53
94.59
79.49
94.33
72.01
94.70
66.80
94.15
c
Res-log
82.34
94.73
82.69
94.56
76.42
94.95
67.49
94,48
Ours
f
Res-r
82.31
94.31
80.85
94.66
76,49
94.36
70.65
94.76
g
Res-wr
84.88
94.38
83.85
94.55
75.42
94.60
68.00
94.66
6, the optimal selection strategies for (Blend32, Blend28, Blend24, Blend20) are (Res-w², Res-x* Res-z, Res-r). As discussed in Section 2.1, Res-x² puts more emphasis category diversity than Res-I. The model poisoned by Blend20 can learn the backdoor feature by focusing on a smaller area compared to Blend32, thereby decreasing the interference from the feature in other classes. Therefore, the significance of Forgetting Event is enhanced. According to the increasing gaps in ASR from Blend20 to Blend32, larger trigger scales highlight the significance of Category Diversity.
18
Ro-qgaree
Raisquare
Revequore
Fergel
04-
Rate
(a) Blend20
(b) Blend24
(c) Blend28
(d) Blend32
Figure 5: BlendX optimized by Component A (Res-z?) with different poisoning rates.
Effect of the poisoning rate According to Figure 4, the ASR gaps between the two methods upon (Blend20, Blend24 Blend32) gradually increase when the poisoning rate decreases from 0.25% to 0.05%. Therefore, the superiority of our method becomes more pronounced when poisoning fewer samples, in which situation the significance of sample selection is highlighted. Furthermore, Component A consistently outperforms Forgetting Event across various poisoning rates.
Forgel
71.05
7622 7435 76.00
70
Forget
70
Vorget
R15
$2.51
55.56
83.72
87.07
75
R15
94.33
14.47
$2.79
53.10
R15
$4.00
52.56
5L.0
15.26
H15
94.55
$4.03
52.96
54.00
110 54.5
01.15
SL35
16.11
N16
69
96
99.13
94.79
VIS
78.11
83.99
85
V16
94.53
50.17
51.00
0131
22.55
13.17 84.35 87.09
D121
94.00
94.56
$5.06
03.00
D121
785
12.81
$5.29
D121
94.5
05.00
92.40
94.20
R15
R3A
416
gi2
g3a
V16
p17l
N19
V16
p121
(a) ASR (Res-z)
(b) BA (Res-I)
(C) ASR (Res-x?)
(d) BA (Res-22)
Figure 6: Performance of Component A upon Blended-C with different model structures. Row: models for pretraining. Column: victim models. 'Forget' indicates the results of poisoning samples selected based on the Forgetting Event calculated with Resnet18 8 (R (R18) as the model for pretraining.
Effect of Model Structure: We use [R18, R34, V16. D121] to represent [Resnet18. Resnet34, VGG16, 1e1) As shown in Figure 5, Component A consistently outperforms Forgetting Event regardless of the concrete structure used in different stages. Most models optimized by Component A can get 10% ASR improvement over the current SOTA metric (Forgetting Event). Furthermore, BAs of Blended-C remain stable around 94%. Therefore, Component A can transfer across different model structures in both the pretraining stage and the training stage.
4 Conclusion & Limitation
Current attacks usually handle the sample selection and triggers in isolation, leading to severely limited improvements on both ASR and stealthiness. Consequently, it is challenging to exhibit satisfactory performance when simply converted to PCBAs. A set of generalized components is proposed to improve both stealthiness and ASR of attacks to achieve effective PCBAs by sufficiently exploring the bi-directional collaborative relations between the sample selection and triggers, which can retain generalization ability upon various attacks. At the end, we list the limitations the paper as follows: 1) The approach of integrating components A and B is rudimentary, and we will explore more scientific methods in future research. 2) Further research on exploring the collaborative relations between the sample selection and triggers remains necessary.
10

---

5 Acknowledgments
This work was supported in part by the NSFC fund (NO. 62206073, 62176077), in part by the
Shenzhen Key Technical Project (NO. JSSGG2020081199288000000 JSGG2200231 0 105603006, JSGG20201 103153800006, KIZD22023022111511705 KJZD20024990311001120011
part by
the Guangdong International Science and Technology Cooperation Project (NO. 2023A0555050008) in part by the Shenzhen Fundamental Research Fund (NO. JCY/220110321332200222 and in part by the Guangdong Provincial Key Laboratory of Novel Security Intelligence Technologies (NO. and part by the Natural Science Foundation of Shenzhen General Project under Grant JCYJ202408 13 10007010, in part by the Natural Science Foundation of Guangdong Province under Grant 2023A1515010893, in part by the Shenzhen Pengcheng Peacock Startup Fund.
References
Jiawang Bai, Kuofeng Gao, Dihong Gong, Shu-Tar Tho Xia, Zhifeng Li, and Wei Liu. Hardly perceptible trojan attack against neural networks with bit flips. In European Conference on Computer Vision, pages 104-121. Springer, 2022.
M. Barni, K. Kallas, and B. Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In 2019 IEEE International Conference on Image Processing (ICIP), pages 101-105, 2019a.
doi: (109///CIP..0188802999999
Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In 2019 IEEE International Conference on Image Processing (ICIP), pages 101-105. IEEE, 2019b.
Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig. Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. In SafeAI@ AAAI, 2018. URL https: //tp:://///xii /arxxvxxvvvv. org hts/a/aa.///1//11/////////111111
Peng Chen, Jirui Yang, Junxiong Lin, Zhihui Lu, Qiang Duan, and Hongfeng Chai. A practical clean-label backdoor attack with limited information in vertical federated learning. In 2023 IEEE International Conference on Data Mining (ICDM), pages 41-50. IEEE, 2023.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05520 2017.
Sheng-Yee Yen Chou, Pin- Chen, and Tsung-Yi Yi Ho. Villandiffusion: unified backdoor attack
framework for diffusion models. Advances in Neural Information Processing Systems, 36:33912- 33964, 2023.
Khoa Doan, Yingjie Lao, and Ping Li. Backdoor attack with imperceptible input and latent modifica- tion. Advances in Neural Information Processing Systems, 34:18944-18957 2021.
Yansong Gao, Chang Xu, Derui Wang. Shiping Chen, Damith C. Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks deep neural networks. In 2019 Annual Computer Security Applications Conference (ACSAC), pages 113-128, San Juan, PR, USA, Dec 2019. ACM. doi: 10.1 1411443599999333593333 URL https: / //tp://///vvv////a www.oo/g/////////e///oooeeeeeeee aaaaabaa19900 http//99..065......
Yinghua Gao, Yiming Li, Linghui Zhu, Dongxian Wu, Yong Jiang, and Shu-Tao Xia. Not all samples are born equal: Towards effective clean-label backdoor attacks. Pattern Recognition, 139: 109512, 2023.
Yinghua Gao, Yiming Li, Xueluan Gong, Zhifeng Li, Shu-Tao Xia, and Qian Wang. Backdoor attack with sparse and invisible trigger. IEEE Transactions Information Forensics and Security, 2024.
Tianyu Gu, Brendan Davin, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint
2017.
Xingshuo Han, Yutong Wu, Qingjie Zhang. Yuan Zhou, Yuan Xu, Han Qiu, Guowen Xu, and Tianwei Zhang. Backdooring multimodal learning. 2024 IEEE Symposium on Security and Privacy (SP), pages 3385-3403. IEEE, 2024.

---

Jonathan Hayase and Sewoong Oh. Few-shot backdoor attacks via neural tangent kernels. arXiv preprint urXiv:2210.05929, 2022.
Kaiming He. Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2016a.
Kaiming He. Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition. pages 770-778, 2b.
Andrew G Howard. Mobilenets: Efficient convolutional neural networks for mobile vision applica- tions. arXiv preprint arXiv: 011.77444.488.. 2017.
Gao Huang. Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4700-4708, 2017.
Zirui Huang, Yunlong Mao, and Sheng Zhong. {UBA-Inf): Unlearning activated backdoor attack with Jofluence-Driven camouflage. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4211-4228 2024.
Nguyen Hung- Quang, Ngoc-Hieu Nguyen, Thanh Nguyen-Tanne Kok-Seng Wong, Hoang Thanh- Tung, Khoa D Doan, et Wicked oddities: Selectively poisoning for effective clean-label backdoor attacks. In The Thirteenth International Conference on Learning Representations, 2024.
Tran Huynh, Dang Nguyen, Tung Pham, and Anh Tran. Combat: Alternated training for effective clean-label backdoor attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 1436-2444 2024.
Forrest N landola, Song Han, Matthew W Moskewicz, Khalid Ashraf, William J Dally, and Kurt Keutzer. Squeezenet: Alexnet-level accuracy with 50x fewer parameters and< 0.5 mb model size. arXiv preprint arXiv:/602.077660 2016.
Alaa Khaddaj, Guillaume Leclere, Aleksandar Makelov, Kristian Georgiev, Hadi Salman, Andrew Ilyas, and Aleksander Madry. Rethinking backdoor attacks. In International Conference on Machine Learning, pages 16216-16236. PMLR, 2023.
Edwin H Land and John J McCann. Lightness and retinex theory. Journal of the Optical society of America, 61(1):1-1, 1971.
Changjiang Li, Ren Pang, Zhaohan Xi, Tianyu Du, Shouling Ji, Yuan Yao, and Ting Wang. An em- barrassingly simple backdoor attack on self-supervised learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 4367 October 2023a.
Haoyang Li, Qingqing Ye, Haibo Hu, Jin Li, Leixia Wang, Chengfang Fang, and Jie Shi. 3dfed: Adaptive and extensible framework for covert backdoor attack in federated learning. In 2023 IEEE Symposium on Security and Privacy (SP), pages 1907.1907. IEEE, 2023b.
Sen Li, Junchi Ma, and Minhao Cheng. Invisible backdoor attacks on diffusion models. arXiv preprint Xr0vv22406. 00816, 2024a.
Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, and Xinpeng Zhang. Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, 18(5):2088-27) 2105, 2021a. 3021407.
doi: 10. 10.11009TDSC.2000.
Yige Li. Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. In M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan, editors, Advances in Neural Information Processing Systems, volume 34, pages 14900-14912. Curran Associates, Inc., 2021b. URL. https::t//////ceeddinngg neurips. .df..
12

---

Yige Li, Xixiang Lyu, Xingjun Ma. Nodens Koren, Lingjuan Lyu, Bo Li, and Yu-Gang Jiang. Reconstructive neuron pruning for backdoor defense. In Proceedings of the 40th International Conference on Machine Learning (ICMI. 2023), volume 202, pages 19837-19854. PMLR, 2023c. doi: 10. 10.485550/rxxv.23355. 14876. URL https: aattps://arxiv/ /at.ii...v.og/ae..a...../.. . 14876.
Ziqiang Li, Pengfei Xia, Hong Sun, Yueqi Zeng. Wei Zhang. and Bin Li, Explore the effect of data selection on poison efficiency in backdoor attacks. arXiv preprint arXiv:2310.09744, 2023d.
Ziqiang Li, Hong Sun, Pengfei Xia, Beihao Xia, Xue Rui, Wei Zhang, Qinglang Guo, Zhangjie Fu, and Bin Li. A proxy attack-free strategy for practically improving the poisoning efficiency in backdoor attacks. IEEE Transactions on Information Forensics and Security, 2024b.
Junyu Lin, Lei Xu, Yingqi Liu, and Xiangyu Zhang. Composite backdoor attack for deep neural network by mixing existing benign features. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security, pages 113-131, 2020.
Kang Liu, Brendan Dolan- and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In International Symposium Research in Attacks, Intrusions, and Defenses (RAID), 2018. Also available as arXiv preprint arXiv:1805.
Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Backdoor attacks against dataset distillation. arXiv preprini arXiv:2301.01 2023.
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In Computer vision-ECCCV 2020: 16th European conference, Glasgow, UK, August 23-28, 2020, proceedings, part X 16, pages 182-199. Springer, 2020.
Peizhuo Lv, Chang Yue, Ruigang Liang, Yunfei Yang, Shengzhi Zhang, Hualong Ma, and Kai Chen. A data-free backdoor injection approach in neural networks. In 32nd USENIX Security Symposium (USENIX Security 23), pages 2671-2601 1-2688, Anaheim, CA, August 2023. USENIX Association. ISBN 978-1-939133-37-3. URL https://wws usenix. org/
Rui Min, Zeyu Qin, Li Shen, and Minhao Cheng. Towards stable backdoor purification through feature shift tuning. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Information Processing Systems, volume 36, pages 75286-75306. Cur- ran Associates, Inc., 2023, URL https: http:///poceeedeeieeeeeee wtw.rrrceeeiiinnnnnini....... neurips. cctpppcr_cppceeeeeeeeeeee filfffel///lee ffleespaper/ paper/ Paper- Conference.
Xiangyu Qi, Tinghao Xie, Ruizhe Pan, Jifeng Zhu, Yong Yang, and Kai Bu. Towards practical deployment-stage backdoor attack on deep neural networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 13347-13357, 2022.
Xiangyu Qi, Tinghao Xie, Yiming Li. Saeed Mahloujifar, and Prateek Mittal. Revisiting the assump- tion of latent separability for backdoor defenses. In The Eleventh International Conference on Learning Representations, 2023. URL https: http///vppeeeeeeeeeeeeee/ee wwwpee/eeeee..eee/ttuttttttaaaee -
Huming Qiu, Junjie Sun, Mi Zhang, Xudong Pan, and Min Yang. Belt: Old-school backdoor attacks can evade the state-of-the-ar defense with backdoor exclusivity lifting. In 2024 IEEE Symposium Security and Privacy (SP), pages 2124-2141 IEEE, 2024.
Filip Radenovic, Abhimanyu Dubey, and Dhruv Mahajan. Neural basis models for interpretability. Advances in Neural Information Processing Systems, 35:8414 15:8444-8422,, 2022.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma. Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115:211-252, 2015.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv: 2014.
13

---

Sebastian U Stich, Jean-Baptist Baptiste Cordonnier, and Martin Jaggi. Sparsified sgd with memory. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett, ed- itors, Advances in Neural Information Processing Systems, volume 31. Curran Associates, Inc., 2018. URL 444000a0000SssSShccceeeeffdaa--- Pdf.
wewriigggnneuursseeeeeee. heurips.cc/paper. httpae/flleee/pppr////////////
Mingxing Tan and Quoc Le. EfficientNet: Rethinking model scaling for convolutional neural networks. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, volume 97 of Proceedings of Machine Learning Research, pages 6105-60 6114. PMLR, 09-15 Jun 2019. URL https: http://pooeeedeeggeee mlr. press/ /eess/vv/// 1tvvvv9///a tt///ann190 19a.
html.
Di Tang, XiaoFeng Wang, Haixu Tang, and Kehuan Zhang, Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection. In USENIX Security Symposium, Virtual Event, Aug 2021. USENIX Association. doi: 10.48550/arXiv. wet.i.90800000 URL https: saaxiv.org//baa.. wttp:org///aa//o/oooo 1900b. 00686.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771, 2019.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP), pages 707-723. IEEE, 2019. doi: 10.1109/SP. 2019.00031.
Tianshi Wang, Fengling Li, Lei Zhu, Jingjing Li, Zheng Zhang, and Heng Tao Shen. Invisible black-box backdoor attack against deep cross modal hashing retrieval. ACM Transactions Information Systems, 42(4):1-21 2024.
Xutong Wang, Yun Feng, Bingsheng Bi, Yaqin Cao, Ze Jin, Xinyu Liu, Yuling Liu, and Yunpeng Li. Not all benignware are alike: Enhancing clean-label attacks on malware classifiers. In THE WEB CONFERENCE 2025, 2025.
Zhenting Wang. Juan Zhai, and Shiqing Ma. Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning. In Proceedings of the IEEE/CVE conference on computer vision and puttern recognition, pages 15074-15084, 2022.
Emily Wenger, Roma Bhattacharjee, Arjun Nitin Bhagoji, Josephine Passananti, Emilio Andere, Heather Zheng, and Ben Zhao. Finding naturally occurring physical backdoors in image datasets. Advances in Neural Information Processing Systems. 35:22103-22116, 2022.
Yutong Wu, Xingshuo Han, Han Qiu, and Tianwei Zhang. Computation and data efficient backdoor attacks. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 4805 4814, 2023.
Zhixiao Wu, Yao Lu, Jie Wen, and Guangming Lu. Alrmr-gec: Adjusting learning rate based on memory rate to optimize the edit scorer for grammatical error correction. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 21608-21616, 2025.
Wufeng Xue, Lei Zhang, Xuanqin Mou, and Alan C Bovik. Gradient magnitude similarity deviation: A highly efficient perceptual image quality index. IEEE transactions image processing, 23(2): 684-695, 2013.
Yuan Xun, Xiaojun Jia, Jindong Gu, Xinwei Liu, Qing Guo, and Xiaochun Cao. Minimalism is king! high- high-frequency energy-based screening for data-efficient backdoor attacks. IEEE Transactions on Information Forensics and Security, 2024.
Yi Zeng, Si Chen, Won Park, Z. Morley Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient. In International Conference on Learning Representations (ICLR), 2022. URL. https:/ /ttp////avvvvv/////// arXiv:2110.037
www.ii.wrg................. org/ abs/2110.00773. Also available arXiv preprint
14

---

Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia. Narcissus: practical clean-label backdoor attack with limited information. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS '23, page 771-785, New York, NY, USA, 2023a. Association for Computing Machinery. ISBN 9798400700507.. doi: 10.11453576915536166
URL http:::/t//eee //t:://ddooo///oo http://tiooogoo///////..oooooeet ottpeoorgg11.111. 11.....1/35669111111 3616617.
Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia. Narcissus: A practical clean-label backdoor attack with limited information. In Proceedings of the 2023 ACM SIGSAC Conference Computer and Communications Security, pages 771-785, 2023b.
Shuai Zhao, Luu Anh Tuan, Jie Fu, Jinming Wen, and Weiqi Luo. Exploring clean label backdoor attacks and defense in language models. IEEE/ACM Transactions on Audio, Speech, and Language Processing, 2024.
Zihao Zhu, Mingda Zhang. Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu. Boosting backdoor attack with a learnable poisoning sample selection strategy. arXiv preprint arXiv:2307.07322 2023.
15

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
We check the results and analysis in Abstract carefully ensure the correct-
ness.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We specially discuss about the limitation in the Section 4. The analysis of experimental results also provide some analysis about limitations of our methods.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiatiinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
16

---

Answer: [Yes]
Justification: We provide the full set of assumptions and a complete proof if we need to provide theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The code will released as soon as possible. All results in our paper can be reproduced.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reprodueibility may be tricky in some cases, in which authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
5. Open access to data and code
17

---

The authors should provide scripts to reproduce all experimental results for the new reproducible, they Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, described in the supplemental material?
Question:
Answer: [Yes]
Justification: The code will released as soon as possible. All results in our paper can be reproduced.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips. cc/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: / cii.ps.cc/publii hembblicgguiiee gttp///ideeeeeee/ CCodeSubmeaaac ssi asionnooicyy for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
proposed method and baselines. only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We provide the training and test details far possible in Appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer:
[Yes]
Justification: We carefully check the experiments to ensure the report error bars be suitably and correctly defined
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
18

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative enror rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [NA]
Justification: Our work focus on poison-only backdoor attacks and do not extend to model training. Additionally, abnormal resource overhead was observed during our experimental process.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https /tte::///neeeee /tt///nuurirrr/e hcc/ppblcc/.thccsuddeeeleleeeeee
Answer: [Yes]
Justification: We ensure that the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We discuss the effect backdoor attacks on the society to highlight the significance of exploration backdoor attacks.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
19

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: our work poses no such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification:
we cite the original paper that produced the code package or dataset.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
20

---

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is available online, the authors encouraged to reach out the asset's s creators.
13. New assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: we discuss whether and how consent was obtained from people whose asset is used.
Guidelines:
The answer NA means that the paper does not release assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: the paper does not involve crowdsourcing nor research with human subjects Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: the paper does not involve crowdsourcing nor research with human subjects
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
21

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy ptttp://neeriige http://eerrrss.ccoeeeeereeeeeeee / for what should or should not be described.
22

---

A Related Work
In backdoor attacks, the adversary aims to embed designed trigger in the victim model. Therefore, the poisoned models misclassify the trigge--mmeedeed samples to the predefined target label (Gu et al. [2017], Chen al. [2017]) while maintaining high accuracy for unaltered inputs. Multiple backdoor attacks prove their effectiveness in multimodal learning (Wang et al. [2024], Han et al. (2024), federated learning (Li et al. [2023b], Chen et al. [2023], diffusion model (Chou et al. [2023], Li et al. [2024a]), dataset distillation (Liu et al. [2023]), and other scenarios (Zhao et al. [2024]).
Among current backdoor attacks, Poison-only Backdoor Attacks (PBAs) have attracted huge attention given their widespread use and case of construction in real-world scenarios (Li et al. [2021a],Qi al. [2023]). PBAs poison the models by merely manipulating the training dataset, in which the effectiveness of attacks hinges on Trigger Design and Sample Selection.
A.1 Trigger Design
Simply designed visible triggers in traditional attacks (Gu et al. [2017]. Chen al. [2017] can be effectively detected by humans and machines. Therefore, the adversary relies on the design of invisible triggers and physical triggers to ensure the stealthiness of the attacks.
In computer vision (CV), invisible triggers involve incorporating minor perturbations by tweaking the pixel values and positions of the original image (Bai et al. [2022]). The constraint of invisibilityy poses a significant limitation to achieving high ASR in the clean-label poison-only setting. Wenger al. [2022] introduces natural triggers based on the hypothesis that there may be naturally occurring physically colocated objects already present in popular datasets such as ImageNet. Furthermore, some attacks(Lin al. [2020], Zeng et al. [2023a]) propose triggers formulated from a combination of existing benign features to bypass the backdoor defense methods.
Efforts to overcome the dilemma frequently result in unsatisfactory performance (e.g., high poi- soning rates, ineffective backdoor embeddings, limited transferability, and weakened robustness). For instance, Wang al. [2022] introduces BppAttack, stealthy attack that leverages image quan- tization and dithering to induce triggers into victim models. Given the constrained effectiveness of imperceptible modifications, adversaries struggle to enhance the ASR by employing adversarial training combined with label flipping. Recently, (Gao et al. [2024]) formulates a bi-level optimization problem balance the conflict of ASR and stealthiness with sparsity and invisibility constraints.
The upper-level optimization problem aims to minimize the loss on poisoned samples by optimizing the trigger. Mcanwhile, the lower-level problem focuses on minimizing the loss across all training samples through the optimization of model weights, which deviates from a poison-only attack.
Summary Current PBAs primarily focus on the design of triggers, leading to multiple triggers that exhibit unique advantages under different metrics (e.g., design complexity, feature intensity, the ability to bypass defenses, stealthiness, and dataset dependency). Therefore, it is valuable to explore generalization optimization strategies to enhance various triggers on both ASR and stealthiness. Additionally, current research overlooks the effect of sample selection in the design process.
Although statc-of-the-art backdoor attacks (Zeng et al. [2023a]. Gao et al. [2024] currently manage to design potent invisible triggers through steps like training trigger generators, they come at the cost of substantial training overhead and the requirement for comprehensive knowledge of the entire dataset. Exploring the enhancement of the traditional attacks via simple yet effective approaches represents a research topic worthy of in-depth investigation.
A.2 Sample Selection
Clean-label backdoor attacks are seen as the stealthiest attacks, as adversaries can only poison samples from the target class without changing their labels. The dilemma of unsatisfactory ASR of current PBAs that merely depend on the trigger design led to the research study of sample selection. Gao et al. [2023] reveals differential sample importance and selects "hard" samples via three metrics (e.g.. Forgetting Event (as depicted in Section 2.1), Loss Value, and Gradient Norm) to enhance the PBAs. The poisoned models tend to learn the implicit projection between the trigger feature and the target label to evade the difficulty of the original classification upon such "hard" samples. Details of Loss Value and Gradient Norm can be seen as follows.
23

---

Loss Value Given benign model fo (trained on the benign training set Dtr), the loss value of model on sample (2,, yi) can be represented as ((fo(=;). y.). We choose samples with the greatest * Darl values in the subset D, are chosen for poisoning:
D2 arg max D,C.
E
L(fo(z))
(ELB))ED,
Gradient Norm Given a benign model fo (trained on the benign training set Dwv), the 12- gradient norm of model sample (zi, y:) can be represented as [[VoL(f (x))) with the greatest a * |Dell values in the subset Dr are chosen for poisoning:
w)ll2. We choose samples
D3 = org max D.C.
Σ (DAR))D,,
Han et al. [2024] further improves the efficiency of attacks based an optimized backdoor gradient- based score. Moreover, Hayase and Oh [2022] formulates sample selection as a bi-level optimization problem: construct strong poison examples that maximize the ASR. Furthermore, some scientists propose novel sample selection methods based on poisoning masks (Zhu et al. (2023)), confidence- based scoring (Wu al. [2023]), and high-frequency energy (Xun al. [2024]).
Summary Current research on sample selection focuses on designing new metrics or training derivations construct data-efficiency attacks, overlooking the synergistic effect between triggers and sample selection on ASR enhancement. Meanwhile, current methods overlook the effect of sample selection on stealthiness enhancement.
B Preliminaries
B.1
Model Training
The model output function of the image classification can be denoted by So X + Y, where
x E X = 1.... 255] represents an image domain, Y {3/1 9/2 ......... Vk is a set of k classes, and 9 denotes the parameters that DNN learned form the begin training dataset Drr = {(x,, ) The benign training with Drr can be seen as single-level optimization problem. The optimization seeks model fe by solving the following problem during training:
No.
min L(D fo) =
Σ
Mass Yis So);
(8)
where is the loss function (e.g., the cross-entropy), and (Ii, Wi) E Dzr.
B.2 Poison-only Clean-label Backdoor Attacks
B.2.1 Attack Knowledge
In poison-only backdoor attack, an adversary has access to the original training dataset Dtr and allowed to inject the pre-defined trigger into small subset of the training set. Specifically, attacks can be called clcan-label attacks if the adversary does not change the ground-truth label of the original data. Furthermore, the adversary has no knowledge and the ability to modify other training components (c.g.. loss functions, model architecture, training schedule, optimization algorithm, etc). Consequently, attackers can only influence model weights through data poisoning. The latent connection between the trigger and the target label learned only during the training process.
B.2.2 Attack Workflow
We detail the workflow of poison-only clean-label backdoor attacks to formalize the theoretical foundations. How to generate the poisoned dataset D, is the cornerstone of the attack. Details about the attack, knowledge of poison-only clean-label backdoor attacks can seen Appendix B. We remark on the important evaluation criteria at the following steps.
24

---

Step 1: Select samples to be poisoned (by attackers). Dp consists of two disjoint parts. Given target label yt. a subset D, selected from target-label set D. = { 84) (2,, Y:) Dr.3/ 3t to be poisoned and the remain benign samples can be denoted as D3 = Dtr <rr>D, D, Here we define a binary vector M = [M M MD MID..II {0, 13IDI to represent the poisoning selection. Specifically, M; = indicates that z; is selected to be poisoned while M; 0 means the benign sample. We |Pal
denote a = [D+-| as the poisoning rate. Note that most existing backdoor attack methods randomly
select Dr samples to be poisoned. serves as crucial indicator of stealthiness in poison-only attacks. Backdoor attacks are supposed to maintain a high attack success rate with a as small as possible evade both machine and manual inspections.
Step 2: Trigger Insertion (by attackers). computer vision applications, the adversary designs a trigger pattern by tweaking the pixel values and positions of the benign image. The generator of poisoned images can be denoted as fg X + X. For example, fz(x) = (1 - m) * x + m * w, where the mask m E [0, 1]CxX*X representing the poison area of the trigger w and * representing the deement-wise product. Therefore, given the target label yr in a clean-label attack, the generated
poisoned training dataset could be denoted as Dr {(2,, y:)lif m,=U, or (fg( ye)liy m,=1) Pi-l For stronger stealthiness, the trigger w is expected to be sufficiently invisible, which means the distance (f(fg (x:), should be small.
Step 3: Model Training (by users). Once the poisoned dataset Dp is generated, users will train the poisoned DNN via the period described in section 3.1.1. The stealthiness and utility of backdoor attacks demand imperceptible dataset modifications, requiring the poisoned model fe to maintain high accuracy on benign test data. Otherwise, users would not adopt the poisoned model and no backdoor could be implanted. The accuracy on clean Deleen can be computed by:
Notenn
Clean = Nelean
ACC((((.)).))
where Nelean means the number of clean test set. (I;, ys) E Delean and ys is the ground-ruth label. ACC(ypree y) will be set to 1 if Upre = y and 0 otherwise.
Step Activate the backdoor using the trigger during the inference stage (by attackers). The attackers expect to activate the injected backdoor using the trigger defined in step 2. Given the poisoned model fe. the Attack Success Rate (ASR) of backdoor attack can be computed by:
Neleen
ASR
Σ
(CC()o(()(a)))
(10)
Netean
where Neteon means the number of clean test set Delaan (x:) represents the poisoned image on image o; and ye is the target label. So and ACC y) are defined Step
C Algorithms with other negative functions
In this chapter, we present the pseudocode implementation related to Res-X in our experiments. Here, the 'X' in Res-X correlates with the weight assigned to category diversity. Analogous to algorithmic complexity, Res-X places greater emphasis on the contribution of category diversity to the metrics compared to Res-log. As demonstrated in the main text, the optimal weight ratio is associated with trigger characteristics (e.g., the size of the poisoned region).
Currently, achieving the optimal integration of category diversity and forgetting events remains largely reliant empirical approaches. Moving forward, we will delve deeper into uncovering more underlying patterns and focus on developing algorithms for automated integration.
25

---

Algorithm 4 Metric Calculation with Negative Function NF at O(n)
Input: Train Dataset Dtr. Target Label ye, Misclassification Events (e(( Vi), fm))
Output Calculated Metric of Samples
for image (Iz, Der do
Num Sum = 0
for ym Y do
Num Num [Jm] + No Na(( Vm) Sum Sum + N Num Wml
end for end for
for 7/m Y do
Clslym) =
N Nam(um) Sum
end for for image (It, yc) Der do
Metric [ra] = =0 for Ym Y do
Metric[x;] = Metriclad + Cls[ym] Ne(((a, Ue), vm)
end for end for
Algorithm& 5 Metric Calculation with Negative Function Np at O(n?)
Input: Train Dataset Drr, Target Label ye. Misclassification Events Ne((I;, Wi), Hm) Output Calculated Metric of Samples
for image (It,, Be) E Drr do
Num [yml
for Um E Y do
Num[ym] Num[ym] + No Ne((Fe Bt), Fm)
end for end for
for 7/m E Y do
Sum = Sum + N [mmmmm]= N turffym)
end for for ymm E
Cls[ym] =
Nam ym Num you
Sum
end for
for image (I y1) E Der do
Metric xij] = 0 for ym E Y do
Metric(æ1] Metric(ax) + Cls[ym] (e ye), vm)
end for end for
Algorithm Metric Calculation with Negative Function Ne at O
Input:
Train Dataset Dtr. Target Label yr, Misclassification Events (e 3m) Output : Calculated Metric of Samples
for image (I,, Dty do
Num [unl
for ym Y do
Num = Num(ym) + Ne((Fi we), vm)
end for
end for
for Um Y do
Sum = Sum + exp(-Num
end for
for ym E Y do
Cls[ym]] = 1
empl Num
Sum
26

---

end for
for image (Ii, 3t) E Drr do
Metric [i] = for Ym Y do
Metric(zy] Metric(a)) + Cls[um] (e( ve), Um)
end for end for
D Gradient Magnitude Similarity Deviation
Images visually insensitive to triggers selected by calculating the GMSD between benign images and poisoned images to conceal the trigger feature in the target-label feature. GMSD a full-reference image quality assessment (FR-IQA) model that leverages pixel-wise gradient magnitude similarity (GMS) to quantify local image quality and the standard deviation of the global GMS map to quantify the final image quality, Specifically, the gradient magnitude derived using the Prewitt filter, which estimates horizontal æ and vertical gradient components via convolution by the following kernels:
1/3
-1/37
1/3
1/3
1/3
h =
1/3
-/3 3
ho =
0
0
(11)
1/3
0
-1/3
-1/3
1/3
-1/3
Convolving h and hy with the reference and distorted images yields the horizontal and vertical gradient images of and d. mi)(i) and ma(i) represent the gradient magnitudes of r and d at location i, which can be computed as follows:
m, - / & (1) + (i)),
ma(i) - (d h₂ & (1)
(12)
where symbol "&" denotes the convolution operation. The gradient magnitude similarity (GMS) map computed based the gradient magnitude images mi.(i) and ma(1) follows:
2m, (1) +e
GMS(
(13)
(t) + m2 (i) +
where is positive constant that supplies numerical stability. Gradient Magnitude Similarity Mean (GMSM) serves as the local quality map (LQM) of the distorted image with average pooling applied
assume that each pixel has the same importance in estimating the overall image quality:
GMSM = N
GMS(1)
(14)
where N is the total number of pixels in the image. Clearly, a higher GMSM score means higher image quality. Based on the idea that the global variation of image local quality degradation can reflect its overall quality, Gradient Magnitude Similarity Deviation (GMSD) proposed to compute the standard deviation of the GMS map as the final IQA index:
N
GMSD N
(GMS()) GMSM)²
(15)
1=1
GMSD serves as quantitative measure of the spatial distribution of distortion severity within an image. Specifically, higher GMSD values indicate wider range distortion magnitudes across local regions, which correlates with degraded perceptual quality due to the exacerbated spatial inconsistency of degradation effects.
E
Human Visual System
Computers encode image colors based on the three primary color channels (RGB). However, current design of triggers neglects the differences human visual perception (Land and McCann [1971]) and machine representation. Therefore, knowledge of the human visual system (HVS) can assist adversary in more scientifically leveraging the disparities between the human eye and machine systems to enhance the stealthiness and functionality of triggers in backdoor attacks.
27

---

Human Visual System
1931 Standard Chroma Observer
L Cone Cells (Sensitive to Red)
Spectral Tristimulus Values
Cone Cells (Sensitive Green)
20-
S Cone Cells (Sensitive Blue)
Enerry
Results in the distinet sensitivity colors
400
630
700
Wavelength
Poisoning on R channel; Medium degree of distortion
Poisoning on G channel: High degree of distortion
Poisoning on B channel: Low degree of distortion
Figure 7: Distinct Sensitivity to Colors Human Visual System.
E.1 Distinct Sensitivity to RGB
The human retina contains three types of cone cells, each playing a crucial role color vision by being sensitive to different wavelengths of light. These three types of cone cells work together to provide us with color vision. Each type of cone cell contains a different photopigment that is sensitive specific range wavelengths. When light enters the eye and stimulates these cone cells, they send signals to the brain, which then processes this information to produce our perception of color.
Long- Wavelength Sensitive (L) Cone Cells:
These cone cells are most responsive to long-wand wavelengn light, with a peak sensitivity around 560 nm, which corresponds the yellow-green -rren region of the visible spectrum.
They are often referred to "red" cone cells because their relative sensitivity to longer wavelengths, although their peak is not precisely at the red end of the spectrum.
L cone cells are abundant in the retina and are essential for distinguishing between colors in the red-yellow-greet range.
Medium-
Wavelength Medium-Wavveengle
Sensitive (M) Cone Cells:
M cone cells have their peak sensitivity around 530 nm, in the green region of the spectrum.
These cells erucial for perceiving colors in the green range and involved in color discrimination tasks that require distinguishing between different shades of green and yellow.
Together with L cone cells, M cone cells form the basis for our perception of wide range colors the visible spectrum.
Short- Wavelength Sensitive (S) Cone Cells:
S cone cells are most responsive to short- wavelentt light, with peak sensitivity around 420 nm, which corresponds the blue-vion violev region of the spectrum.
They are often referred to as "blue" cone cells and are essential for perceiving colors in the blue range.
S cone cells are less abundant in the retina compared and M cone cells, but they play critical role in our ability to distinguish between colors that have blue component.
28

---

The RGB color system is based on the three primary colors of human vision. Experiments have revealed that when certain spectral colors are represented using the color-matching functions of the RGB color system, negative values emerge. This implies that there are spectral colors that cannot be expressed using the visual primary colors RGB. Therefore, the XYZ. color space system in the International Commission on illumination (CIE-XYZ) is introduced to address the dilemma.
We use {Rt G, B} represent value of pixels in the three color channels { ",, The core objective of the CIE-RGB system is to establish an anchored relationship between color and physical parameters, ensuring a one-to-one correspondence between color perception and tristimulus values. Its design focuses on color appearance through the proportioning of the three primary colors, rather than directly quantifying the sensitivity of the human visual system. The phenomenon that human eyes are most sensitive to green light (555nm) is reflected in the subsequent CIE-XYZ system through the luminance function JY = 0.2126 + 0.7152G + 0.0722 but this weight distribution is characteristic of the CIE-XYZ. system, not the original design of the CIE-RGB system.
x²).
In 1931, CIE standardized conversion relationships between the two systems to resolve the RGB system's s negative value issue, guaranteeing positive tristimulus values in XYZ. Converting RGB values to CIE-XYZ tristimulus values follows standardized process and the overall process of selecting samples can be outlined step-by-step below:
Step 1: Normalize CIE-RGB values. Step aims convert the value of image (R, G, B) to the range [0, 1]:
x
R+G+B CE G,
(16)
norm
Specifically, we use (r,g, to represent the normalized result {m 2.G
norm 2
#norm]
Step 2: Convert normalized CIE-RGB to normalized CIE-XYZ. The conversion formulas of chromaticity coordinate conversion can be denoted as:
X (0.490r + 0.310g + 0.2006) (0.607r 1.132g 1.2006)
Y (0.117r + 0.812g + 0.010b) (0.607r + 1.132g + 1.200b) Z (0.000r + 0.010g + 0.9906) / (0.607r + 1.132g + 1.2006)
(17)
CIE 1931 Standard Chroma Observer Spectral tristimulus Values, abbreviated as CIE Standard Chroma Observer, characterizes human ocular spectral sensitivity across wavelengths, as depicted in Figure 7. Furthermore, humans exhibit limited sensitivity to blue light because the blue-sensitive cone cells comprise merely 5% in the human visual system.
Summary Based on the above observations, it is appropriate to reassign the poisoning intensity of the trigger design with a particular enhanced poisoning intensity in the blue channel.
F
Supplemental Experiments about Injection Intensities of Triggers
Table Performance Badnets attacks upon CIFAR-10 with 1% samples poisoned.
Trigger
Poisoning Rate a = 1%
Poisoning Rate a = 2.5%
Pattern
Random
Res-
Random
Res-z
Type
no.
Method
ASR
BA
ASR
BA
ASR
BA
ASR
BA
a
0:0:0
41.99
94.16
90.74
94.11
78.29
94.68
92.97
94.58
b
1:1:1
12.13
94.23
70.00
94.13
34.09
94.88
74.63
94.36
RGB
2:2:2
10.42
94.08
60.79
93.81
37.37
94.48
80.04
94.24
1:1:0
37.31
94.45
86.15
93.90
63.62
94.92
89.52
94.51
2:2:0
20.50
94.31
83.08
94.10
71.80
94.97
90.36
94.29
f 3:3:0
40.92
94.79
74.74
94.86
68.05
94.75
91.23
94.01
B
g
3:3:1
12.15
94.05
53.42
94.97
26.47
94.39
70.80
94.42
3:3:2
28.80
94.96
60.85
94.63
49.75
94.62
68.49
94.52
As depicted in Table {a.f), Badnets attained a notably higher ASR when employing black-and- white trigger compared to monochromatic triggers (all-black, all-white). Currently, the distinctive
29

---

nature of the alck-aad-whiie trigger poses a greater challenge in identifying appropriate images for trigger concealment with Component B. According to the results between b,c and d,e, incorporating more pronounced trigger features exclusively within the blue channel also increases ASR in Badnet attacks. Consequently, integrating robust features solely into the blue channel, which exhibits lower sensitivity to human perception, can solve the dilemma about the sample selection for stealthiness.
(a) Benign
(b) Base
(c) BppAttack
(d) Blended-C
(c) 255:255:8
(f) 255:255:12
(g) 24:48:8
(h) 36:72:12
() 8:255:255
i 255:8:255
(k) 12:255:255
() 255:12:250
Figure 8: Visualizations of images in global-poisoning attacks. Compared to the benchmark (the first line), images that are visually insensitive to MultiBpp are selected in Component B. NR NG NB represent the distinct quantization intensity in R: G B channels.
As depicted in Figure 8, the original BppAttack randomly selects data for poisoning. To maintain the stealthiness of the trigger, BppAttack must adopt smaller quantization step (32 32 32), making difficult to learn the trigger feature. We optimize the BppAttack based on two key observations. Firstly, current research on colorimetry reveals that the human visual system exhibits vastly different sensitivities to colors, as depicted Appendix E. For example, we can observe that enhanced attacks by increasing the intensity of poisoning in the blue channel can still maintain invisibility to the human eye (Figure 8e) compared to enhanced attacks on other channels (Figure 8i, Figure 8j).
Different images exhibit different visual insensitivity to the specific trigger. For example, we can observe that the MultiBpp attack can still maintain more invisibility to the human visual system by poisoning images in Figure 8e compared to images in other images (e.g., image in Figure 8b). However, the image in Figure 8b is more visually insensitive for Blended-C compared to the images in Figure Se. Therefore, the stealthiness of the trigger can be effectively preserved by carefully selecting appropriate samples based on the characteristics of the trigger pattern.
G Details of Experiment Setting
We conduct experiments on three benchmark datasets, including CIFAR- 10, CIFAR-100, and Tiny-ImageNet. ResNet18 is the default model used to train the poisoned dataset. Among datasets, the first class (y = 0) designated as the target class. The target class of each dataset is fixed across all the attacks adopting it. Standard augmentations adopted on each dataset
Dataset and Model
30

---

Table 8: Hyperparameters and settings used in various datasets.
Dataser
CIFAR-1O
CIFAR-100
Tiny- Imyg-meeeeer
# of Classes
10
I00
200
Input Size
(3. 32, 32)
(3, 32, 32)
(3, 64, 64)
of Images Target Class
50000
50000
100000
(Airplane)
(Apple)
0 (Goldfish)
Epochs
200
200
400
Optimizer
SGD (Stich et al. (2018))
SGD (Stich et al. [2018))
SGD (Stich et al. [2018])
Augmentation
[Crop. HI-Filp]
[Crop, Rotation]
[Crop, Rotation, H-Filp] Resnet18
Model
Resnet18
Resnet18
increase the model performance following existing training pipelines (He al. [2016a], Tan and Le [2019]). Details of the dataset can be seen in Table 8.
Attack Setup Three types of backdoor attacks (Badnets, Blended, BppAttackk) are used as baselines to demonstrate the generalization ability of our components in (local high-intensity poisoning attacks, global caddium-intensttyy poisoning attacks, global low-intensity poisoning attacks).
(a) 0:0:0
(b) 1:1:1
(c) 2:2:2
Figure 9: Visualizations of different trigger patterns in Badnets attacks. Specifically, we use (0,1,2.3) represent (black and white striped, all-black, all-white, vanilla) triggers. Futhermore, Nn No NB represent the distinct trigger pattern applied in R G B channels.
As depicted in Figure 9, for BadNets attacks, a 3 x 3 random noise checkerboard pattern is utilized is utilized the trigger in BadNets attacks. {0, 1, 2, 3} represents the distinct (black and white striped, all-black, all-white, vanilla) trigger pattern and NR Ng NB represent the distinct trigger pattern applied R G B channels, depicted in Figure 8. The origin Badnets attack can be seen attacks with whole-black triggers (1 1 1). The Badnets trigger optimized by Component can be represented as (1 1 0). The experiments about Component A in Tables 1&2 follow the same setting as the original paper Gao et al. [2023], in which the Badnets trigger can be seen as (0 0 0).
as the trigger in CIFAR- and CIFAR-100. For Tiny-ImageNet,
Secondly, for Blended attacks, a Mello-Kitty image is selected as the trigger and blended with the original images. Nn. NG : NB represents the distinct trigger intensity applied R G B channels. The default of Blended attacks can be seen attacks with transparency parameter of 0.2 0.2 0.2. The Blended trigger optimized by Component can be represented as (0.2 0.1 0.3).
Furthermore, in MultiBpp attacks, the ratio (NR NG NND) denotes the specific quantization configuration for poisoning intensity across the RGB channels. Notably, the default bit depth employed by BppAttack in the original study is set at 5, which, in the context of this paper, corresponds quantization ratio of 32 32 32, Consequently, the "Base" scenario in our analysis refers quantization attack executed with the 32 32 32ratio. excluding any training control mechanisms or label flipping operations inherent to the BppAttack methodology.
H Extended Ablation Study
Features in backdoor attacks can be classified into (trigger feature, target-label feature, feature in non-target classes). Given the trigger feature is adjustable, the proposed components |Component A. Component B, Component C) mainly explore the potential of the inner relation between (trigger feature, feature in non-target classes), (trigger feature, target-label feature) and (trigger feature, trigger feature). Overall visualization can be seen in Figure 10.
31

---

high seasirivity
multi-color poisoning
large polsoming
eahance trigger mainly on the part visually insensitivity to human visual system.
hightlight the signiflance calegory diversity.
Trigger Features
intensity unhancement
hightlight the signifiance frequeney.
low sensitivity
poisoning area
Part C: explore effect of sample selection on trigger design.
PartA: explore the effect triggers on sample selection via the cobancement attack suecess rate
Select the hard-to-leara samples optimal category diversity frequency
based the trigger features
stealthiness enhamcement
D,
B
Troqueney (proposed by current methods)
Part B: euploze the eled triggers on sample selection via stealthiness enhancement
the optimal metric
Trade-off
imapes
calegory diversity (proposed by our method)
trigger features all are conceled on the part of benign images.
D.
Σ (Kllesslaa
Figure 10: Overall visualization of our proposed components.
H.1
Effect of Target Label
Table 9: Performance of Badnets- C with different target labels CIFAR- 100.
Target Label:
Target Label
10
Target Label: 20
Selection
ASR
BA
Selection
ASR
BA
Selection
ASR
BA
Forget
59.39
78,21
Forget
85.4
78.11
Forget
59.4
78.8
Res-e
80.48
78.25
Res-E
91.68
78.12
Res-r
73.48
78.5
Target Label
30
Target Label:
40
Target Label:
30
Selection
ASR
Selection
ASR
Selection
ASR
BA
Forget
72.94
78.31
Forget
93.23
78.74
Forget
82.3
78.69
Res-z
75.83
78.41
Res-r
96.28
78.27
Res-r
89.46
78.45
Target Label:
60
Target Label:
70
Target Label:
: 80
Selection
ASR
BA
Selection
ASR
BA
Selection
ASR
BA
Forgetting Event
38.78
78.5
Forgetting Event
81.96
78.56
Forgetting Event 88.46
78.61
Res-E
46.57
78.68
Res-z
79.51
78.55
Res-r
89.1
78.32
Result Analysis To explore the effectiveness of the proposed strategy (e.g., Res-x) different target labels, we select labels (y E {0. 10, 20,...,,80 ,0}}) from CIFAR- and 20% of the samples from the target class (representing 0.2% of the total samples) poisoned for Badnets-C.
As depicted in Table 9, Component A exhibits higher ASR compared to the existing state-of-the- the-trt metric, Forgetting Event (Forget), across overwhelming majority of experimental conditions. Notably, substantial variation in the efficacy backdoor attacks and corresponding defensive filtering mechanisms is contingent upon the specific target class under consideration. To illustrate, attack success rate of the Badnets model exhibits stark contrast, registering at 46.57% when the target class is 60, yet surging to an impressive 06.28% when the target class is 40. Furthermore, application
our method yields notable enhancement 21 percentage points in performance when the target class is O, conversely experiencing marginal decline of 3 percentage points when the target class is 70. Therefore, Component A exhibits the widespread applicability and robust superiority upon ASR enhancement across diverse target labels.
H.2 Category Similarity
In CIFAR-10 10, the correspondence between y and the true labels is (O:airplane, l:automobile, 2:bird, 3:cat, 4:deer, 5:dog, 6:frog, 7:horse, 8:ship, 9:truck). Samples of class A but frequently misclassified as class B suggest a high level of similarity between A and As illustrated in Figure 11, significant variations exist in the similarity among different categories. For instance, the proportion of trucks
32

---

y-o
y=1
y 2
y
y
y 9
8
y=4
y=5
y
y
y
y
y 9
3
y=1
y
y=4
Figure 11: Category stability CIFAR-10. We systematically arrange the proportions of misclassified categories across various data categories y. emphasizing the most prevalent category through white text highlighting. Above each visualization, the correct category corresponding to the pie chart, as well as its representative color in the context of other pie charts, is distinctly labeled.
(y=9) substantially larger than that of birds (y=2). Therefore, automobiles (y=1) exhibit much higher similarity trucks than to birds in the pic chart representing automobiles (y=1). Furthermore, the similarity pattern displays symmetry. For the set y=(0, 1, 2, 3, 4, 8, 9), the class with the highest proportion in its corresponding pie chart also dominates the pie chart of the corresponding class. Although y=(6, 7) deviates from this trend, they still occupy the second-hig -ighhet proportion in the corresponding pie charts y= 4).
Label 2
Our methods
Current methods
Label 9
21 60%
Label
12.88%
8%
Label: 3.48%
Label: :
5.90%
Label 7
6.50%
3.13%
31.10%
Label :
7.30%
Label: 8
Label 6
Label 3
Visualization of misclassification results of label 0 in CIFAR-10. We use the edge lengths and associated numerical values indicate the proportion of category information Forgetting Event according to the pretraining stage.
Figure 12:
Similar to entropy theory, samples belonging to class y (e.g., automobile) but frequently misclassified into dissimilar class (e.g., bird) are more challenging be learned by models and potentially more valuable than samples misclassified into a similar class (e.g., truck). For example, as depicted in Figure 12, samples belonging (0: airplane) are often misclassified as (8: ship) (31.10%) rather than [8: frog] (3. (311%) because of the distinct similarity. We hypothesize that samples misclassified as (8: frog) may more informative and, therefore, should be considered in sample selection. Component B balances Forgetting Events and Category Diversity in sample selection. Poisoning selected samples encourages the model adopt shortcuts, facilitating the learning of the trigger feature. (3, 5) ((cat, dog)) 1) are both moall-to-medium siized animals, sharing high similarity color and body shape, which collectively drives the model to prioritize learning of these two classes. In contrast, frogs exhibit lower similarity compared to other animal categories and do
33

---

not establish a synergistic relationship with them. Similarly, when juxtaposed with other modes of transportation (automobile, ship, truck), airplanes possess fewer common attributes with frogs. resulting in diminished model attention toward this category.
Part A
Part B
Distinct stability between various types of backdoor attacks
The effect of Component A on stability of backdoor attacks
high stability with visable triggers
high stability with Component A
Badnets-C
Blended-C
255:255:12
36:72:12
0.8
0.8
S
0.4
0.4
R
0.2
0.2
0.0
0.0
y
low stability
low stability
Q255:255:12
Q36:72:12
Q255:255:12
Q36:72:12
Figure 13:
Inference of category similarity on backdoor attacks in CIFAR-10. 10. Part A exhibits the effect of categories upon various backdoor attacks when randomly selecting samples to poison. Part further explores the effect of Component A on the quantization attacks. Q-X denotes the simple quantization attack without Component A in which X the quantization strength.
What is more, it is important to note that the similarity metrics depicted in Figure 11 represent the relative proportion of similarity to other classes rather than reflect the absolute magnitude similarity between two classes. Consequently, the trigger feature embedded in classes with reduced model attention receives less focus, ultimately undermining the efficacy backdoor attacks. As shown in Figure 13 Part A. Badnets-C and Blended-C exhibit superior attack performance (maxima) at y {3.5} (cat, dog). In contrast, they demonstrate inferior attack performance at y= (0, 6} (airplanes, frog). For quantization methods without Component A, the attack is entirely ineffective in scenarios other than y (2, 3). The efficacy of backdoor attacks exhibits substantial fluctuations tied to class characteristics and reflects inadequate stability when randomly selecting samples to poison.
In contrast, the merits of backdoor attacks with Component A manifest themselves in the following ways: (1) Component A can enhance the ASR of backdoor attacks. For example, with = O. the ASR of BadNet attacks with component receives 40 percentage point enhancement. (2) Component can ensure the stability of backdoor attacks. The variability in attack success rates across different classes is notably mitigated when our methodology is implemented. attacks characterized by weak trigger feature, component A leads the models to circumvent class- specific constraints and detect the embedded backdoor patterns. However, while an effective trigger strategy can attenuate, but not eliminate, the impact of class-related factors, quantization attacks remain ineffective in the context of (horse).
particular, for quantization
Res-square
0.8
Res-square
Random
Random
0.4
0.4
0.2
0.2
0.0
0.0
Seed
Seed
(a)
y=0
(b) y=3
Figure 14: Stability of Badnets attacks by selecting samples using Res-r.
34

---

Figure 14 delineates the failure probabilitiess associated with backdoor attacks aimed at the aircraft class (y=0) and the cat class (y=3), alongside the attack efficacy following the implementation of our devised poisoning data selection methodology, referred to as Res-x². The term "seed" denotes the random seed employed to regulate and replicate stochastic processes. experiments where poisoning data is chosen arbitrarily, the model consistently fails to acquire quantized backdoor patterns across all ten iterations within the attack configuration targeting the aircraft class. Conversely, in the scenario focusing on the cat class, the model achieves a 90% likelihood of acquiring a quantized backdoor feature, with a singular instance of failure observed under the condition seed=5.
The aforementioned observations underscore that the model's 's capacity to assimilate backdoor features contingent upon random variables, exhibiting a strong correlation with class-specific attributes. A judicious poisoning data selection strategy can markedly bolster the robustness of the attack. Upon integrating our proposed Res-z² poisoning data selection strategy, the model demonstrates a flawless 100% success rate in learning backdoor features over twenty iterations, thereby significantly attenuating the detrimental influence exerted by the choice of target class on backdoor attacks.
H.3 Applying our methods poisoned-label backdoor attacks
In this section, we examine the applicability of these strategies to enhance poisoned-label backdoor attacks. In the poisoned-lahel scenario, the selection of poisoned samples is conducted across the entire training dataset rather than being confined to the target class. {0.05%, 0.1%) } of the total samples are poisoned for Badnets. We evaluate our plug-in methods (Res-r) against the standard version with random selection (dubbed 'Random').
Table 10: Performance of poison-label attacks in CIFAR- 100 with different poisoning rates.
Poisoning Rate
0.05%
Poisoning Rate
0.1%
Attack
Selection
ASR
BA
Attack
Selection
ASR
BA
Random
69.25
78.19
Random
80.77
78.72
Badnets
Forget
7.00
78.26
Badnets
Forget
53.98
78.51
Res-æ
27.55
78.59
Res-æ
54.53
78.55
Random
73.01
78.21
Random
81.76
78.42
Blend
Forget 64.07
78.31
Blend
Forget 73.29
78.70
Res-æ
62.66
78.74
Res-æ
71.33
78.47
Effect of Component in dirty-label attacks As illustrated in Table 10, there is a (41.70%
(69.25% 27.55 27.55%), 10.35% 773.01% -2..66%) decrease compared to the Random upon ASR of the (Badnets, Blend) attacks when optimized by our method with 0.05% samples poisoned in CIFAR-10 Therefore, Component A exhibits limited applicability within poison-label attack scenarios.
However, remediation to the dirty label is unnecessary in our paper. We aim optimize dirty-label attacks to clean-label attacks while preserving high ASR, rendering further optimization in dirty-label scenarios less critical in our paper. The reason will be explored future work. We also provide an analysis of the phenomenon. Under clean-label settings with airplane as the target label, component selects images of airplanes that least resemble airplanes based on the forgetting events with its category diversity. According to the phenomenon of models taking shortcuts discussed in another paper, models tend rely on learning triggers as a shorteut solve the hard task in the selected images. Therefore, component A gets higher ASRs because generic airplane features exert minimal interference from backdoor features. to directly use cat images for poisoning instead of selecting airplane images that least resemble airplanes. The model faces the greatest difficulty in classifying cats as airplanes and resorts to backdoor shortcuts, resulting in higher ASRs.
contrast, under dirty-label settings, it is more effective
H.4
The effect of Component A in Tiny-Imagenet
Analysis on Tiny-imagenet We conduct experiments on Tiny-Imagenet, which simplified version of Large Scale Visual Recognition Challenge 2016 Russakovsky et al. [2015], with ResNet-18 (He al. [2016b]). We compare our plug-in methods against the standard version with random selection (dubbed 'vanilla") and existing sample selection strategies based on current metrics (such as
35

---

Table 11: Current methods on Tiny-ImageNe
Table 12: Our methods on Tiny-lmageNer.
Method
Metric
Badnets-C C
Blended-C
Method
Metric
Badnets-C
Blended-C
BA
57.50%
57.27%
BA
57.03&
57.24%
Vanilla
res-log
ASR
17.06%
27.71%
ASR
34.46%
42.02%
BA
57.17%
57.49%
BA
57.17%
57.16%
Value
res-linear
ASR
32.22%
37.63%
ASR
32.22%
41.48%
BA
57.69%
57.82%
BA
58.01 %
57.02%
Gradient Norm
ASR
31.74%
38.74%
res-square
ASR
38.96%
43.93%
BA 57.60%
57.48%
BA
57.60%
57.58%
Forgetting Event
ASR
32.29%
40.59%
res-exp
ASR
32.29%
38.31% %
forgetting events, gradient norm, and loss value). Across all these attacks upon Tiny-Imagenet, 50% of the samples from the target class (representing 0.25% of the total samples) are poisoned, with the first class designated as the target class. Results can be seen Tables 11& 12.
Badnets-CC with Res-square achieves 38.96% ASR, which is 6.67% higher than the current optimal metric (Forgetting Event). Blended-C with Res-square achieves 43.93% ASR, which is 3.34% higher than Forgetting Event. Furthermore, Badnets-C reaches optimal ASR when adopting the more aggressive Res-square strategy on Tiny-ImageNet instead of the optimal strategy (Res-log) when trained on CIFAR10. This indicates that in the Kiny-Imagene, dataset with more categories (200), Category Diversity should be highlighted when searching for the appropriate combination of Forgetting Event and Category Diversity in Component A. Most clean-label attacks exhibit ineffective performance in large datasets. For Tiny-ImageNer with 200 classes, the clean-label poisoning rate constrained to be less than 0.005. In that case, each part of the poisoning process must be meticulously designed, thereby highlighting the value our proposed methods.
H.S Supplemental Experiments on Backdoor Detection
In this section, we investigate the effectiveness of our components against existing clean-label backdoor attacks. Specifically, select SIG (Barni et al. [2019a]) and CTRL (Li et al. [2023a]) as representative attacks for experimentation. SIG represents standard clean-label attacks, while CTRL exemplifies self-supervised learning (SSL) backdoor attacks in the clean-label setting. Other experimental configurations remain consistent with the experiments in Section 3.2.
Table 13: Performance of our methods on PCBAs when defended by defense methods.
SIG
CTRI.
Defense Methods
original
method bASR
original
method
bASR
ASR
bASK
ASR
bASR
ASR
Anti-Bacee Backdoor Learning
94.2
0.4
97.2
91.3
66.5
96.5
85.8
Activation Clustering
94.2
93.5
97.2
97.5
91.3
84.2
96.5
91
Fine Pruning
94.2
61.6
98
88.4
91.3
94.9
97.2
99.2
Adversarial Unlearning
94.2
8.9
97.2
42.4
91.3
39
65.7
Neural Cleanse
94.2
94.2
98
98
91.3
94.8
94.8
Reconstructive Neuron Pruning
94.2
0
97.1
91.3
26.3
96.5
84.9
Feature Shift Tuning
94.2
51.2
97.1
89
91.3
93.6
97.2
98.7
According to Table 13, our methods outperform the original attacks when defended by backdoor defense methods most cases. Defended by Neural Cleanse, the ASR of CTRL drops from 91 % to 1%. Optimized by our method, CTRL exhibits 94.8% ASR. What is more, the effectiveness of backdoor defenses primarily hinges on the characteristics of backdoor attacks and backdoor defense methods themselves. For example. SIG fails to penetrate the STRIP (Gao et al. [2019]). In such case, the attacks optimized by our method also remain futile. Furthermore, our work may benefit Backdoor Defense by considering the distinct importance of samples.
I Stealthiness of our components on multiple attacks
In this section, high-quality images of the same category ImageNet are used facilitate the comparison between the visibility of various methods.
36

---

Higer GMSD Value
GMSD [0.027,
[0.051,
vensiiivity
10,061. 0.880)
Lower GMSD Value
10.267, 0.340)
high senitivity
[0,47,, 0.508]
Figure 15: Images poisoned by Blended attacks with different GMSD values.
The effect of GMSD values in stealthiness enhancement of Blended attacks As depicted in Figure 15, poisoned images with lower GMSD values exhibit superiority in the stealthiness of triggers for blended attacks. Component B with GMSD tends to find samples with complex backgrounds where the visual sensitivity Blended triggers will significantly weaken (GMSD E [0.027, 0.080) In contrast, the Hello Kitty triggers are easy to find when poisoned in images with a simple hackground (specifically, all-white patch) where GMSD [0.471, 0.500). Therefore, Component B with GMSD can significantly enhance the stealthiness of Blended attacks.
Muttilipp GMSD [0.0274,
0.97691
Beniga
Buisto
MuteiMip
GMSD
[0.1886,
0.4927)
BuistO
Figure 16: Images poisoned by MultiBpp-B attacks with different GMSD values.
The effect of GMSD values in stealthiness enhancement of MultiBpp attacks As depicted in Figure 16, MultiBpp attacks exhibit satisfactory performance in Stealthiness even in the images with the lowest GMSD. Component B with GMSD tends to find samples with complex colors where the visual sensitivity to MultiBpp triggers will significantly weaken (GMSD E (0.0274, 0.0769)). In contrast, single-color dominated images where GMSD E [0.3806, 0.4927] are selected by Component to serve as suboptimal samples. The results of lower GMSD suggest that single-channel color variations may amplify susceptibility to MultiBpp attacks under extreme conditions. Specifically,
37

---

attenuation of intensity in the green channel (a region of heightened visual sensitivity in the human visual system) and elevation the blue channel (a region of reduced sensitivity in the human visual system) both result in lower GMSD values. Therefore, single-color dominated samples will not be selected for poisoning. In summary, Component B with GMSD can significantly enhance the stealthiness of MultiBpp attacks and benefit the performance of Component C.
J Applicability on recent PCBAs and Deployment Cost
We provide guide to integrate all components with recent PCBAs like Narcissus and Combat. Component A be simply applied by modifying the poisoning indices. Stronger trigger highlights the Forgetting Events. Triggers with a larger poisoning scope and larger number of categories the dataset highlight category diversity. Component B selects samples by comparing the similarity before and after data poisoning which does not require additional processing. Recent PCBAs typically ensure stealthiness by setting limit pixel perturbation thresholds. Component C suffices apply RGB differentiation processing to these thresholds (e.g., 2:1:3) when training the generator.
What is more, components intended be flexibly applied according to the characteristics of the trigger and task requirements. For invisible attacks such as Narcissus, applying components A&C is enough. Thus, achieve (Narcissus). Narcissus achieved a 99% ASR by poisoning 25 images. The ASR of Narcissus drops to 46.11% % when we reduce the poisoning rate 0.00004 (just 2 images). Our methods enhance the ASR from 46.1 1% to 96.12% with res-log.
SOTA performance in Backdoor Attack based on the SOTA attack
Our deployment cost is low. The cost of Component A is the same as the SOTA methods (Forgetting Events), and no training introduced Components B or C. Component requires only a single traversal through the target class (1/10 in CIFAR-I0 and 1/100 in SIFAR-100) by maintaining set with minimal metrics. Component C only requires modification of the poisoning intensity without additional overhead.
38


Reviews:
[{"review_id": "WTlb23Zlpo", "reviewer": "Reviewer_CWuV", "summary": "This work introduces a modular framework of three “generalized components” that jointly optimize sample selection and trigger design to boost the success rate and stealth of clean-label backdoor attacks. Component A selects hard-to-learn images via a balance of forgetting events and category diversity; Component B uses visual-quality metrics to hide triggers in images; Component C reallocates poisoning strength across RGB channels according to human perceptual sensitivity. Integrated into various backdoor attacks, these components yield 20–60 pp ASR gains on CIFAR with <1% clean-accuracy drop.", "questions": "1. Can you provide a formal analysis of why and when the combination of forgetting events and category diversity (Component A) yields consistent ASR gains?\n\n2. Have you tested the framework on larger datasets (e.g., ImageNet) or non-vision domains (e.g., NLP), and what challenges arise?\n\n3. Why does Component A degrade performance under dirty-label poisoning, and how might this be addressed?\n\n4. What are the additional runtime and resource costs of each component, and how do they scale to larger models or higher-resolution images?\n\n5. Do you plan any human-in-the-loop studies to confirm that triggers remain imperceptible under real viewing conditions?\n\n6. How does your modular framework compare or integrate with recent PCBAs like Combat or Narcissus?\n\n7. Have you explored any defense or detection mechanisms (e.g., spectral analysis, data sanitization) to counteract your enhanced backdoor attacks?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "- Well-structured, clear presentation; the modular design is easy to adapt.\n\n- Component A’s dynamic balance of forgetting events and category diversity yields up to +15 pp ASR improvement over prior metrics.\n\n- Component B’s use of perceptual metrics (GMSD) to select concealment-friendly samples is novel in clean-label attacks.\n\n- Component C’s exploitation of RGB-channel sensitivity enhances ASR while preserving stealth.\n\n- Experiments cover CIFAR-10/100, multiple poisoning rates, trigger types, and architectures with comprehensive ablations—yet remain limited to small-scale vision tasks.\n\n### weakness\n\n- The theoretical rationale for Component A’s collaboration is not formally analyzed; empirical gains lack mathematical underpinning.\n\n- Component A performs worse under dirty-label settings (Table 6), but no remediation or analysis is provided.\n\n- Computational overhead of the three components is not quantified, raising questions about scalability.\n\n- Stealth is measured only via automated metrics (MSE/GMSD); no human perceptual study validates trigger invisibility.\n\n- No concrete defenses or detection strategies are evaluated against the enhanced attack framework.", "was_revised": true, "final_justification": "Authors' responses have resolved most of my concerns, so I will maintain my original score (5).", "rebuttal": "We sincerely appreciate your valuable suggestions and will reply to all concerns in order of importance. \n\nWe complete the experiments about **Backdoor Defense** and apply the components to **recent PCBAs**, achieving a **new SOTA performance** in Backdoor Attacks.  Related codes and analysis about the new results during the rebuttals will be updated in the paper.\n\n# A: Applicability on recent PCBAs and Deployment Cost \n\n{Weakness3,Question4,Question 6}\n\n## A.1 We achieve a **new SOTA performance** based on the SOTA attack (Narcissus).\n>By poisoning merely **2 images (poison rate = 0.00004)**, Narcissus with res-log achieves 96.12% ASR and 95.10% BA in CIFAR-10 with 0 as the target-label. \n\n>We follow the default settings in the official code repository. ASRs and BAs are the mean ASR between epochs {180-200}. \n\n|Methods|ASR|BA|\n|:-|:-|:-|\n|Narcissus|46.11|94.79|\n|ours|**96.12**|**95.10**|\n\n## A.2 We provide a **guide** to integrate all components with recent PCBAs like Narcissus and Combat.\n>Component A can be simply applied by modifying the poisoning indexes. Stronger trigger highlights the forgetting events. Triggers with larger poisoning scope and larger number of categories in the dataset highlight category diversity. \n\n>Component B selects samples by comparing the similarity before and after data poisoning, which does not require additional processing.\n\n>Recent PCBAs typically ensure stealthiness by setting a limit on pixel perturbation thresholds. Component C suffices to apply RGB differentiation processing to these thresholds when training the generator.\n\n## A.3 Components are intended to be **flexibly applied** according to the characteristics of the trigger and task requirements. \n>For invisible attacks such as Narcissus, applying components A&C (even only A) is enough.\n\n## A.4 Our deployment cost is **low**.\n>The cost of Component A is the same as the SOTA methods (forget), and no training is introduced in Components B or C. Component B requires only a single traversal through the target class (1/10 in CIFAR10 and 1/100 in CIFAR100) by maintaining a set with minimal metrics. Component C only requires modification of the poisoning intensity without additional overhead.\n\n# B: Lack of Defense Experiments\n\n{Weakness5,Question7}\n\n**{abl: Anti-backdoor learning,ac: activation clustering,fp: Fine-pruning, i-bau: Implicit Hypergradient, nc: Neural Cleanse, np: Reconstructive Neuron Pruning}**\n\n>Given the defense method X, bASR and X-ASR denote the pre-defense and post-defense ASR.\n\n**Badnets**\n\n|method|bASR|abl-ASR|ac-ASR|fp-ASR|i_bau-ASR|nc-ASR|rnp-ASR|\n|:-|:-|:-|:-|:-|:-|:-|:-|\n|random|18.8|0|18|14.4|8.0|18.8|10.5|\n|forget|52.9|8.4|36.3|31|17.3|52.9|8.8|\n|+A|56.2|**14**|47.7|36.5|27.9|56.2|36.3|\n|+B|37.9|3.5|25.6|20.2|**32.5**|37.9|34.9|\n|+C|53.7|5.5|28.4|28.9|7.4|1.0|24.1|\n|+A&C|**87.5**|1.6|**68**|**51.2**|14.8|**81.2**|**47.6**|\n|+B&C|54|0.2|51.8|25.9|5.9|54|0|\n\n**Blend**\n\n|method|bASR|abl-ASR|ac-ASR|fp-ASR|i_bau-ASR|nc-ASR|rnp-ASR|\n|:-|:-|:-|:-|:-|:-|:-|:-|\n|random|57.6|**15.1**|52.4|39.8|28.3|57.6|27.1|\n|forget|76.1|9.2|73.2|63.5|7|76.1|0|\n|+A|77.9|3.9|76.9|64.3|20.0|77.9|36.1|\n|+B|71.7|3.4|67.7|60.1|14.3|71.7|19.7|\n|+C|74.8|6.1|62.9|74.5|48.2|74.8|0|\n|+A&C|**97.1**|1.8|**93.9**|**98.5**|46.1|**96**|**97.3**|\n|+B&C|91|8.9|85.5|92.8|22|91|71.7|\n>The design of A&B depends on the specific requirements for concealment and ASR. The following results adequately address the concerns as the expected results of A&B are between \\[B, A\\].\n>Optimal improvement in ASR cannot be achieved when consideration is given to stealthiness. Therefore, components A&C exhibit the best ASR improvement.\n\n**Other attacks**.\n\n|Attack|Defense|pr|bASR(random)|ASR(random)|bASR(forget)|ASR(forget)|bASR(ours)|ASR(ours)|\n|:-|:-|:-|:-|:-|:-|:-|:-|:-|\n|ctrl|abl|0.03|91.3|66.5|95.7|57.4|96.5|**85.8**|\n|ctrl|ac|0.03|91.3|84.2|95.7|**93.6**|96.5|91|\n|ctrl|fp|0.03|91.3|94.9|95.7|97.4|97.2|**99.2**|\n|ctrl|i-bau|0.03|91.3|39|95.7|**98**|96.5|65.7|\n|ctrl|nc|0.03|91.3|1|95.7|**95.7**|94.8|94.8|\n|ctrl|rnp|0.03|91.3|26.3|95.7|42.2|96.5|**84.9**|\n|sig|ac|0.03|94.2|93.5|96.5|96.4|97.2|**97.5**|\n|sig|fp|0.03|94.2|61.6|96.5|75.8|98|**88.4**|\n|sig|i-bau|0.03|94.2|8.9|96.5|17.7|97.2|**42.4**|\n|sig|nc|0.03|94.2|94.2|96.5|96.5|98|**98**|\n\n## B.1 Our methods **outperform** the original attacks when defended by backdoor defense methods. \n\n>Defended by nc, the ASR of CTRL drops from 91% to 1%. Optimized by our method, nc exhibits 94.8% ASR. \n\n## B.2 The effectiveness of backdoor defenses primarily hinges on the characteristics of backdoor attacks themselves.\n>sig fails to penetrate the STRIP. In such a case, the attacks optimized by our method also remain futile.\n\n## B.3 Our work may benefit Backdoor Defense by **considering the distinct importance of samples**.\n\n# C: Concerns about Dirty-label Poisoning\n\n{Weakness2,Question3}\n\n## C.1 Remediation of the dirty label is **unnecessary** in our paper. \n>We aim to optimize dirty-label attacks to clean-label attacks while preserving high ASR, rendering further optimization in dirty-label scenarios less critical in our paper.\n\n## C.2 We provide an analysis of the phenomenon. \n>Under clean-label settings with airplane as the target label, component A selects images of airplanes that least resemble airplanes based on the forgetting events with its category diversity. According to the phenomenon of models taking shortcuts discussed in another paper, models tend to rely on learning triggers as a shortcut to solve the hard task in the selected images.  Therefore, component A gets higher ASRs because generic airplane features exert minimal interference from backdoor features.\n\n>In contrast, under dirty-label settings, it is more effective to directly use cat images for poisoning instead of selecting airplane images that least resemble airplanes. The model faces the greatest difficulty in classifying cats as airplanes and resorts to backdoor shortcuts, resulting in higher ASRs.\n\n# D: Stealthiness Evaluation\n\n{Weakness4,Question5}\n\n## D.1 **Visual presentation of poisoned images selected by Component B** with different MSD and GMSD values is provided in **Appendix I**.\n\n## D.2 We select the advanced metric to ensure the evaluation of similarity. \n>GMSD demonstrates higher sensitivity to structural distortions (such as blurring and compression artifacts) than SSIM. Additionally, SSIM suffers from instability in white noise assessment and exhibits deviations from subjective scores under specific distortion conditions. In contrast, GMSD shows stronger consistency with human subjective evaluations.\n\n## D.3 Your concerns are entirely justified, but this stems from inherent flaws in the evaluation metric design **rather than** flaws of Component B.\n>Component B is designed for machine-based applications. For any machine-quantifiable evaluation metric provided, it can rapidly identify images that achieve optimal performance under that metric. Given a fixed trigger, component B selects images with optimal stealthiness rather than making a visible trigger totally invisible.\n\n## D.4 The idea of Component B is to enhance stealthiness via sample selection, which is universally applicable to both machine and human evaluations.\n\n# E: Theoretical Concerns\n\n{Weakness1,Question1}\n\n## E.1 We relocated a significant portion of the theoretical analysis in the Appendix.\n>In total, we dedicate **Our methods** and **Appendix {B, C, D}** to establish the theoretical foundation of the components. Additionally, background knowledge of the human visual system related to Component C is provided in **Appendix E**.\n\n## E.2 Macroscopic analysis of component A is provided in the paper. \n>Component A selects images of airplanes that least resemble airplanes based on the forgetting events with its category diversity. According to the phenomenon of models taking shortcuts discussed in another paper, models tend to rely on learning triggers as a shortcut to solve the hard task in the selected images.  Therefore, component A gets higher ASRs because generic airplane features exert minimal interference from backdoor features.\n\n>Models with triggers covering larger poisoning regions require analysis of more pixels in the corresponding areas for classification, and thus are more susceptible to being interfered with by features of other classes. Samples with larger category diversity are inherently \"cross-class,\" which mitigates the interference.\n\n## E.3 Model interpretability itself has long been a significant challenge in the field of AI.\n>The mathematical interpretation of Component A needs to encompass the mathematical relationship between changes in inputs (e.g., triggers and trigger variations) and corresponding changes in outputs of DNNs. A precise mathematical underpinning of the irrelation between inputs and outputs of DNNs is currently impractical.\n\n>Therefore, the mathematical sections in most papers of Backdoor Attack focus on algorithm elaboration for trigger generation and modeling of Backdoor Attack objectives.\n\n## E.4 Our work aims to motivate the community to prioritize and investigate this new direction. \n>As a pioneering approach, establishing a comprehensive theory on the collaboration between sample selection and triggers is a long-term and arduous task.\n\n# F: Performance on Large Dataset\n\n{Question 2}\n\n## F.1 We provide the experimental results on Tiny-ImageNet in **Appendix H**. \n\n>The ASR of the optimized Badnets is 38.96%, which is 21.90% higher than random and 6.67% higher than the SOTA metric (forget).\n\n>Most clean-label attacks exhibit ineffective performance in large datasets. For Tiny-ImageNet with 200 classes, the clean-label poisoning rate is constrained to be less than 0.005. In that case, each part of the poisoning process must be meticulously designed, thereby highlighting the value of our proposed methods.\n\nWe hope our response can help resolve your confusion, and we will continue to optimize the parts that may cause confusion"}, {"review_id": "NKmpadfNBU", "reviewer": "Reviewer_AdY7", "summary": "This paper proposed a framework for improving poison-only clean-label backdoor attacks (PCBAs) by introducing a set of generalized components that jointly optimize sample selection and trigger design. Specifically, the paper introduces three core components: A, B and C. The paper demonstrate that these components can be flexibly combined to improve a wide range of existing PCBA methods (e.g., Badnets, Blended, BppAttack) across CIFAR-10 and CIFAR-100 datasets.", "questions": "1) The current component integration strategy relies on heuristic rules and thresholds. Is there a way to formalize the combination of Components A and B under a joint optimization objective? \n2) How does your framework perform under standard backdoor defense methods, such as STRIP, Neural Cleanse, or Fine-Pruning? Since your method emphasizes stealthiness, it would be especially valuable to show how the selected samples and RGB-optimized triggers evade detection by these defenses. \n3) While the paper explores pairwise combinations, a more in-depth analysis of why certain combinations (e.g., A+B vs. A+C) lead to better or worse ASR would be useful.  What are the interactions (e.g., synergistic or conflicting effects) between the three components, and how do they influence each other’s effectiveness?\n4) Since Component C exploits perceptual RGB sensitivity, it would be valuable to include a perceptual user study or visibility score (e.g., via SSIM or psychometric testing) to support the stealthiness claim from a human inspection perspective.", "limitations": "See Questions and Weaknesses.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths: \n1) The paper introduced a two-way collaborative mechanism of sample selection and trigger design, which is different from the previous studies that treated the two in isolation. In the optimization of trigger concealment, the mechanism of the difference in the sensitivity of the human visual system to RGB was introduced for the channel reallocation design (Component C) for the first time, which is novel and practical.\n2) It has strong adaptability to scenarios with low poisoning rates and practical value in actual attack applications.\n3) The method can be used in various model structures (such as ResNet-18, VGG16, DenseNet121), it has strong generalization.\n\nWeaknesses: \n1) The application scope is limited to the clean label scenario.\n2) There is a lack of a unified theoretical framework or optimization objective function support among the three components. The combination of Component A and B is based on simple sorting and threshold sampling, lacking a more systematic optimization strategy.\n3) Resistance to existing defense methods such as STRIP, Fine-Pruning, Neural Cleanse was not analyzed.\n4) The experiments present conflicting results. Table 1 shows that adding Component B can lead to a decrease in ASR (e.g., for Badnets-C at 1% poisoning rate, ASR drops from 86.15% with Component A&C to 77.67% with Components A&B&C). In addition to that, in some cases, the BA also declines with Component B's inclusion.", "was_revised": true, "final_justification": "The rebuttal address most of my concerns. I will raise my score.", "rebuttal": "We sincerely appreciate your valuable suggestions and will reply to all concerns in order of importance. \n\nWe complete the experiments about **Backdoor Defense** and apply the components to **recent PCBAs**, achieving a **new SOTA performance** in Backdoor Attacks.  Related codes and analysis about the new results during the rebuttals will be updated in the paper.\n\n# A Lack of Defense Experiments\n\n{Weakness3, Question2}\n\n**{abl: Anti-backdoor learning,ac: activation clustering,fp: Fine-pruning, i-bau: Implicit Hypergradient, nc: Neural Cleanse, np: Reconstructive Neuron Pruning, STRIP}**\n\n>Given the defense method X, bASR and X-ASR denote the pre-defense and post-defense ASR.\n\n**Badnets**\n\n|method|bASR|abl-ASR|ac-ASR|fp-ASR|i_bau-ASR|nc-ASR|rnp-ASR|\n|:-|:-|:-|:-|:-|:-|:-|:-|\n|random|18.8|0|18|14.4|8.0|18.8|10.5|\n|forget|52.9|8.4|36.3|31|17.3|52.9|8.8|\n|+A|56.2|**14**|47.7|36.5|27.9|56.2|36.3|\n|+B|37.9|3.5|25.6|20.2|**32.5**|37.9|34.9|\n|+C|53.7|5.5|28.4|28.9|7.4|1.0|24.1|\n|+A&C|**87.5**|1.6|**68**|**51.2**|14.8|**81.2**|**47.6**|\n|+B&C|54|0.2|51.8|25.9|5.9|54|0|\n\n**Blend**\n\n|method|bASR|abl-ASR|ac-ASR|fp-ASR|i_bau-ASR|nc-ASR|rnp-ASR|\n|:-|:-|:-|:-|:-|:-|:-|:-|\n|random|57.6|**15.1**|52.4|39.8|28.3|57.6|27.1|\n|forget|76.1|9.2|73.2|63.5|7|76.1|0|\n|+A|77.9|3.9|76.9|64.3|20.0|77.9|36.1|\n|+B|71.7|3.4|67.7|60.1|14.3|71.7|19.7|\n|+C|74.8|6.1|62.9|74.5|48.2|74.8|0|\n|+A&C|**97.1**|1.8|**93.9**|**98.5**|46.1|**96**|**97.3**|\n|+B&C|91|8.9|85.5|92.8|22|91|71.7|\n\n>Optimal improvement in ASR cannot be achieved when consideration is given to stealthiness. Therefore, components A&C exhibit the best ASR improvement.\n\n>The design of A&B depends on the specific requirements for concealment and ASR. The following results adequately address the concerns as the expected results of A&B are between \\[B, A\\].\n\nWe also provide the results of other attacks with defense methods.\n\n|Attack|Defense|pr|bASR(random)|ASR(random)|bASR(forget)|ASR(forget)|bASR(ours)|ASR(ours)|\n|:-|:-|:-|:-|:-|:-|:-|:-|:-|\n|ctrl|abl|0.03|91.3|66.5|95.7|57.4|96.5|**85.8**|\n|ctrl|ac|0.03|91.3|84.2|95.7|**93.6**|96.5|91|\n|ctrl|fp|0.03|91.3|94.9|95.7|97.4|97.2|**99.2**|\n|ctrl|i-bau|0.03|91.3|39|95.7|**98**|96.5|65.7|\n|ctrl|nc|0.03|91.3|1|95.7|**95.7**|94.8|94.8|\n|ctrl|rnp|0.03|91.3|26.3|95.7|42.2|96.5|**84.9**|\n|sig|ac|0.03|94.2|93.5|96.5|96.4|97.2|**97.5**|\n|sig|fp|0.03|94.2|61.6|96.5|75.8|98|**88.4**|\n|sig|i-bau|0.03|94.2|8.9|96.5|17.7|97.2|**42.4**|\n|sig|nc|0.03|94.2|94.2|96.5|96.5|98|**98**|\n\n|Attack|method|pr|bASR(random)|TPR(random)|bASR(forget)|TPR(forget)|bASR(ours)|TPR(ours)|\n|:-|:-|:-|:-|:-|:-|:-|:-|:-|\n|ctrl|STRIP|0.03|91.3|51.9|95.7|52|96.5|44.2|\n|sig|STRIP|0.03|94.2|82.4|96.5|93.8|98|95.7|\n|badnets|STRIP|0.03|18.8|6.7|52.9|69.8|87.5|14.9|\n|blend|STRIP|0.03|57.6|1.1|76.1|2.4|91|1.9|\n\n## A.1 Our methods **outperform** the original attacks when defended by backdoor defense methods in most cases. \n>Defended by nc, the ASR of CTRL drops from 91% to 1%. Optimized by our method, nc exhibits 94.8% ASR. \n\n## A.2 The effectiveness of backdoor defenses primarily hinges on the characteristics of backdoor attacks themselves.\n>sig fails to penetrate the STRIP. In such a case, the attacks optimized by our method also remain futile.\n\n## A.3 Our work may benefit Backdoor Defense by considering the distinct importance of samples.\n\n# B Questions about ASR\n\n{Weakness4,Question3}\n\n## B.1 Optimal improvement in ASR cannot be achieved when consideration is given to stealthiness. \n>Component B serves as a sample selection method aimed at **enhancing stealthiness**, whereas Component A is designed to improve the asr. Component C is a reasonable adjustment for better ASR and stealthiness.\n\n>Component B eliminates some images that contribute to improving the ASR  but are detrimental to stealthiness. Therefore, components A&C exhibit the best ASR improvement.\n\n## B.2 Components are intended to be flexibly adjusted according to the characteristics of the trigger and task requirements. \n>For invisible attacks such as Narcissus, applying components A&C (even only A) is enough. We achieve a **new SOTA performance** based on the SOTA attack (Narcissus). \n>>By poisoning merely **2 images (poison rate = 0.00004)**, Narcissus with res-log achieves 96.12% ASR and 95.10% BA in CIFAR-10 with 0 as the target-label. We follow the default settings in the official code repository. ASRs and BAs are the mean ASR between epochs {180-200}. \n\n|Methods|ASR|BA|\n|:-|:-|:-|\n|Narcissus|46.11|94.79|\n|ours|**96.12**|**95.10**|\n\n## B.3 Compared to benign BA results (94%), the decrease of BA within 0.5% in backdoor attacks (min: 93.70%, max: 94.22%) is a normal and imperceptible training perturbation of accuracy.\n\n# C Concerns about Dirty-label Poisoning\n\n{Weakness1}\n\n## C.1 Remediation to the dirty label is **unnecessary** in our paper. \n>We aim to optimize dirty-label attacks to clean-label attacks while preserving high ASR, rendering further optimization in dirty-label scenarios less critical in our paper.\n\n## C.2 We provide an analysis of the phenomenon. \n>Under clean-label settings (e.g., take airplane as the target label), component A selects images of airplanes that least resemble airplanes based on the forgetting events with its category diversity. According to the phenomenon of models taking shortcuts discussed in another paper, models tend to rely on learning triggers as a shortcut to solve the hard task in the selected images.  Therefore, component A gets higher ASRs because generic airplane features exert minimal interference from backdoor features.\n\n>In contrast, under dirty-label settings, it is more effective to directly use cat images for poisoning instead of selecting airplane images that least resemble airplanes. The model faces the greatest difficulty in classifying cats as airplanes and resorts to backdoor shortcuts, resulting in higher ASRs.\n\n# D Stealthiness Evaluation\n\n{Question4}\n\n## D.1 **Visual presentation of poisoned images selected by Component B** with different MSD and GMSD values is provided in **Appendix I**.\n>GMSD demonstrates higher sensitivity to structural distortions (such as blurring and compression artifacts) than SSIM. Additionally, SSIM suffers from instability in white noise assessment and exhibits deviations from subjective scores under specific distortion conditions. In contrast, GMSD shows stronger consistency with human subjective evaluations.\n\n## D.2 Your concerns are entirely justified, but this stems from inherent flaws in the evaluation metric design rather than flaws of Component B.\n>Component B is designed for machine-based applications. For any machine-quantifiable evaluation metric provided, it can rapidly identify images that achieve optimal performance under that metric. Given a fixed trigger, component B selects images with optimal stealthiness rather than making a visible trigger totally invisible.\n\n## D.3 Component B is the pioneering work to enhance stealthiness via sample selection, which is universally applicable to both machine and human evaluations.\n\n# E Theoretical Concerns\n\n{Weakness2,Question1}\n\n## E.1 We relocate a significant portion of the theoretical work to the Appendix.\n>In total, we dedicate **Our methods** and **Appendix {B, C, D}** to establish the theoretical foundation of the components. Additionally, background knowledge of the human visual system related to Component C is provided in **Appendix E**.\n\n## E.2 Unlike other work being demanded to train a powerful model to use, we need to design components that can easily be applied to most attacks at the code level.\n>Achieving simplicity while maintaining efficiency is a core design principle for plug-and-play components for strong applicability and low computational overhead. \n\n>The difference may potentially lead to misinterpretations where our advantage is misconstrued as a limitation.\n\n>The integration among components does not require neural networks, thus eliminating the need for objective function design. Once plug-and-play components are incorporated into neural networks, it involves integration with the target attack, leading to increased conflicts at the code level and hindering rapid application.\n\n## E.3 Stealthiness and ASR represent independent dimensions, and the relative importance of their proportions cannot be quantitatively compared. \n\n## E.4 Designing an automated framework is akin to learning rate searching algorithms to find optimal values.\n\n## E.5 Model interpretability itself has long been a significant challenge in the field of AI. A precise mathematical underpinning of the irrelation between inputs and outputs of DNNs is currently impractical.\n>The mathematical interpretation of Component A needs to encompass the mathematical relationship between changes in inputs (e.g., triggers and trigger variations) and corresponding changes in outputs of DNNs. A precise mathematical underpinning of the irrelation between inputs and outputs of DNNs is currently impractical.Therefore, **the mathematical sections in most papers of Backdoor Attack focus on algorithm elaboration for trigger generation and modeling of Backdoor Attack objectives**.\n\n## E.6 Macroscopic analysis of the effect of the poisoning area is provided in the paper. \n>Models with triggers covering larger poisoning regions require analysis of more pixels in the corresponding areas for classification, and thus are more susceptible to being interfered with by features of other classes. Samples with larger category diversity are inherently \"cross-class,\" which mitigates the interference.\n\n## E.7 Our work aims to motivate the community to prioritize and investigate this new direction. \n>As a pioneering approach, establishing a comprehensive theory on the collaboration between sample selection and triggers is a long-term and arduous task.\n\nWe hope our response can help resolve your confusion, and we will continue to optimize the parts that may cause confusion."}, {"review_id": "EXqZnz6FvT", "reviewer": "Reviewer_5WGK", "summary": "This paper proposes a novel method, using trigger scales and features to select better ones, and leverages RGB channels to enhance the trigger’s backdoor attack performance.", "questions": "- Could you please explain why the attack performance degrades when Component B is added (e.g., as shown in section 3.1)?", "limitations": "Yes.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n- This paper provides a brand new perspective to enhance image trigger using RGB channels, which can also decrease the interference with the original trigger.\n- The authors conducted multiple experiments to show the performance of their methods, they also carried out several ablation studies.\n\nWeaknesses:\n- Component A seems to be overweighted, which doesn’t show much technical contribution and innovation, as it is simply based on the selection of trigger scales.  \n- Some claims would be more convincing with proper evaluations and validations. For examples, the authors claim that the proposed method can bypass human inspection. It would be worthy providing quantitively comparison between original images and perturbation samples for Component B. MSE or SSIM would be good metrics for that.\n- The correlation between design choice and the attack performance remains unclear. For example, the combination of Component A and C yields the best performance. Is it an empirical observation or what is the rationale behind this observation? As the main contribution of the paper is the design choices, it would be ideal to elaborate the concreted impact of each component on the attack performance.", "was_revised": true, "final_justification": "The authors addressed my concerns and other reviewers' questions.", "rebuttal": "We sincerely appreciate your valuable suggestions and will reply to all concerns in order of importance. \n\nWe complete the experiments about **Backdoor Defense** and apply the components to **recent PCBAs**, achieving a **new SOTA performance** in Backdoor Attacks. Related codes and analysis about the new results during the rebuttals will be updated in the paper.\n\n# A Concerns about Simplicity and Novelty\n\n{Weakness1}\n\n## A.1 We achieve a **new SOTA performance** in Backdoor Attack by merely using component A based on the SOTA attack (Narcissus). \n>By poisoning merely **2 images** (poison rate = 2 / 50000 = 0.00004), Narcissus with res-log achieves **96.12% ASR** and **95.10% BA** in CIFAR-10 with 0 as the target-label.  \n\n>In other settings, we follow the default settings in the official code repository. ASRs and BAs are calculated by **the mean of ASR** between epochs {180-200}. \n\n|Methods|ASR|BA|\n|:-|:-|:-|\n|Narcissus|46.11|94.79|\n|ours|**96.12**|**95.10**|\n>In the offical paper, Narcissus achieved a 99% ASR by poisoning **25 images**.  The ASR of Narcissus **drops to 46.11%** when we reduce the poisoning rate to 0.00004 (just 2 images). Our method enhance the ASR **from 46.11% to 96.12%** with res-log as component A. To the best of our knowledge, **no other attack has comparable performance in ASR with pr = 0.00004 at the clean-label setting.**\n\n## A.2 Simplicity is not equal to the lack of novelty. The **difference between the design of plug-and-play components and other works** may potentially lead to misinterpretations where our advantage is misconstrued as a limitation.\n>Achieving simplicity while maintaining efficiency is a core design principle for plug-and-play components for strong applicability and low computational overhead. \n\n>Unlike other works simply being demanded to train a powerful model to use, we need to design components that can easily be applied to most attacks at the code level.\n\n## A.3 We relocated a **significant portion** of the theoretical work and ablation study of Component B&C in the **Appendix**. We will adjust our paper for better readability.\n>In total, we dedicate **Our methods** and **Appendix {B, C, D}** to establish the theoretical foundation of the components. Additionally, background knowledge of the human visual system related to Component C is provided in **Appendix E**.\n\n>Furthermore, detailed theoretical explanations and thorough ablation experiments are elaborated in **Appendices {D, E}** and **Appendix {I, F}**.\n\n## A.4 **The innovations are outlined as follows:**\n>**We are the first to investigate the interplay between Trigger Design and Sample Selection in backdoor attacks.**\n\n>**We are the first to focus on universal component design to strengthen generalization across all backdoor attacks.**\n\n>**We are the first to introduce biomedical foundations to optimize trigger design in this domain.**\n\n## A.5 Model interpretability itself has long been a significant challenge in the field of AI.\n>The mathematical interpretation of Component A needs to encompass the mathematical relationship between changes in inputs (e.g., triggers and trigger variations) and corresponding changes in outputs of DNNs. **A precise mathematical underpinning of the irrelation between inputs and outputs of DNNs is currently impractical.**\n\n>Therefore, the mathematical sections in most papers of Backdoor Attack focus on algorithm elaboration for trigger generation and modeling of Backdoor Attack objectives.\n\n## A.6 Macroscopic analysis of the effect of the poisoning area is **provided** in the paper. \n>Models with triggers covering larger poisoning regions require analysis of more pixels in the corresponding areas for classification, and thus are more susceptible to being interfered with by features of other classes. Samples with larger category diversity are inherently \"cross-class,\" which mitigates the interference.\n\n## A.7 As for the issue of **proportions**, components B&C represent the pioneering works with **no methods for comparison**. \n\n# B Stealthiness Evaluation\n\n{Weakness2}\n\n## B.1 **Visual presentation of poisoned images** selected by Component B with different MSD and GMSD values is provided in **Appendix I**.\n\n## B.2 Your concerns are entirely justified, but this stems from inherent flaws in the evaluation metric design rather than flaws of Component B.\n>Component B is designed for machine-based applications. For any machine-quantifiable evaluation metric provided, it can rapidly identify images that achieve optimal performance under that metric. **Given a fixed trigger, component B selects images with optimal stealthiness rather than making a visible trigger totally invisible.**\n\n## B.3 Component B is the pioneering work to enhance stealthiness via sample selection, which is **universally applicable** to both machine and human evaluations.\n\n## B.4 Background knowledge on the human visual system related to Component C is **provided** in **Appendix E**.\n\n## B.5 We select the advanced metric to ensure the evaluation of similarity. \n>GMSD demonstrates higher sensitivity to structural distortions (such as blurring and compression artifacts) than SSIM. Additionally, SSIM suffers from instability in white noise assessment and exhibits deviations from subjective scores under specific distortion conditions. In contrast, GMSD shows stronger consistency with human subjective evaluations.\n\n# C Questions about Results\n\n{Weakness3,Question1}\n\n## C.1 Each component is designed with **distinct objectives**.\n>Component B serves as a sample selection method aimed at enhancing stealthiness, whereas Component A is designed to improve the asr. \n>Component C is a reasonable adjustment for better ASR and stealthiness.\n\n## C.2 **Optimal improvement in ASR cannot be achieved when consideration is given to stealthiness.** Therefore, components A&C without B exhibit the best ASR improvement.\n\n## C.3 Our components are not intended to be used in a bound manner. Adopting a unified objective function and framework for handling is **inflexible**.\n>Given the drawbacks of different scenarios and triggers, it is necessary to allow attackers to freely control the proportion of stealthiness and ASR by utilizing the components either individually or in combination. \n\n>For an invisible Narcrssus attack where the trigger design inherently considers perturbation intensity, Component B is unnecessary, and directly employing Components A constitutes the new SOTA performance.\n\n## D Backdoor Defense\n\n**{abl: Anti-backdoor learning,ac: activation clustering,fp: Fine-pruning, i-bau: Implicit Hypergradient, nc: Neural Cleanse, np: Reconstructive Neuron Pruning}**\n>Given the defense method X, bASR and X-ASR denote the pre-defense and post-defense ASR.\n\n**Badnets**\n\n|method|bASR|abl-ASR|ac-ASR|fp-ASR|i_bau-ASR|nc-ASR|rnp-ASR|\n|:-|:-|:-|:-|:-|:-|:-|:-|\n|random|18.8|0|18|14.4|8.0|18.8|10.5|\n|forget|52.9|8.4|36.3|31|17.3|52.9|8.8|\n|+A|56.2|**14**|47.7|36.5|27.9|56.2|36.3|\n|+B|37.9|3.5|25.6|20.2|**32.5**|37.9|34.9|\n|+C|53.7|5.5|28.4|28.9|7.4|1.0|24.1|\n|+A&C|**87.5**|1.6|**68**|**51.2**|14.8|**81.2**|**47.6**|\n|+B&C|54|0.2|51.8|25.9|5.9|54|0|\n\n**Blend**\n\n|method|bASR|abl-ASR|ac-ASR|fp-ASR|i_bau-ASR|nc-ASR|rnp-ASR|\n|:-|:-|:-|:-|:-|:-|:-|:-|\n|random|57.6|**15.1**|52.4|39.8|28.3|57.6|27.1|\n|forget|76.1|9.2|73.2|63.5|7|76.1|0|\n|+A|77.9|3.9|76.9|64.3|20.0|77.9|36.1|\n|+B|71.7|3.4|67.7|60.1|14.3|71.7|19.7|\n|+C|74.8|6.1|62.9|74.5|48.2|74.8|0|\n|+A&C|**97.1**|1.8|**93.9**|**98.5**|46.1|**96**|**97.3**|\n|+B&C|91|8.9|85.5|92.8|22|91|71.7|\n>The design of A&B depends on the specific requirements for concealment and ASR. The following results adequately address the concerns as the expected results of A&B are between \\[B, A\\].\n>Optimal improvement in ASR cannot be achieved when consideration is given to stealthiness. Therefore, components A&C exhibit the best ASR improvement.\n\n**Other attacks**.\n\n|Attack|Defense|pr|bASR(random)|ASR(random)|bASR(forget)|ASR(forget)|bASR(ours)|ASR(ours)|\n|:-|:-|:-|:-|:-|:-|:-|:-|:-|\n|ctrl|abl|0.03|91.3|66.5|95.7|57.4|96.5|**85.8**|\n|ctrl|ac|0.03|91.3|84.2|95.7|**93.6**|96.5|91|\n|ctrl|fp|0.03|91.3|94.9|95.7|97.4|97.2|**99.2**|\n|ctrl|i-bau|0.03|91.3|39|95.7|**98**|96.5|65.7|\n|ctrl|nc|0.03|91.3|1|95.7|**95.7**|94.8|94.8|\n|ctrl|rnp|0.03|91.3|26.3|95.7|42.2|96.5|**84.9**|\n|sig|ac|0.03|94.2|93.5|96.5|96.4|97.2|**97.5**|\n|sig|fp|0.03|94.2|61.6|96.5|75.8|98|**88.4**|\n|sig|i-bau|0.03|94.2|8.9|96.5|17.7|97.2|**42.4**|\n|sig|nc|0.03|94.2|94.2|96.5|96.5|98|**98**|\n\n## D.1 Our methods **outperform** the original attacks when defended by backdoor defense methods.\n>Defended by nc, the ASR of CTRL drops from 91% to 1%. Optimized by our method, nc exhibits 94.8% ASR. \n\n## D.2 The effectiveness of backdoor defenses primarily hinges on the characteristics of backdoor attacks themselves.\n>sig fails to penetrate the STRIP. In such a case, the attacks optimized by our method also remain futile.\n\n## D.3 Our work may **benefit** Backdoor Defense by considering the distinct importance of samples into consideration.\n\nWe hope our response can help resolve your confusion, and we will continue to optimize the parts that may cause confusion."}, {"review_id": "gVxoD6sTH5", "reviewer": "Reviewer_CDc3", "summary": "This paper introduces a set of generalized components aimed at enhancing the effectiveness of Poison-only Clean-label Backdoor Attacks (PCBAs). The core idea revolves around exploring the bidirectional collaborative relationships between sample selection and trigger design. By proposing Component A, Component B, and Component C, the paper seeks to significantly boost both Attack Success Rate (ASR) and stealthiness while maintaining generalization. The work conducts extensive experiments to analyze the impact of these proposed components on various types of backdoor attacks.", "questions": "In some tables, the 'no.' column appears to serve only as an experiment identifier. Is there any other practical purpose for this column? If it is merely for numbering, I suggest removing it to improve the tables' conciseness and readability.", "limitations": "Yes.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "### Strengths:\n- Exploration of ASR Enhancement Mechanisms: Building upon existing research, the paper innovatively explores the collaborative relationship between sample selection (especially by introducing category diversity) and trigger design (e.g., distinct-color poisoning) to improve the ASR of clean-label backdoor attacks. This exploration into the deeper influencing factors of attack mechanisms provides new insights for the field of backdoor attacks.\n- Comprehensive Experimental Analysis: The paper conducts a large number of experiments, analyzing how the proposed components (Component A, B, C) impact the ASR and stealthiness of various attack types. This includes analyses of the effects of different negative functions and trigger scales, demonstrating the thoroughness of the research.\n### Weaknesses:\n- Lack of Backdoor Defense Comparison Experiments: The paper primarily focuses on enhancing backdoor attack effectiveness but completely omits comparative experiments against existing backdoor defense methods. Given that backdoor attacks and defenses are an evolving adversarial process, and numerous mature defense strategies already exist to effectively mitigate backdoor impacts, not considering the attack's performance under practical defense environments constitutes a significant flaw in this paper. Assessing whether these enhanced attacks remain effective in real-world scenarios with active defenses is crucial for evaluating their threat level. To address this, the authors should incorporate experiments comparing their proposed attack against a range of established backdoor defense mechanisms. This should include, but not be limited to, backdoor detection methods such as SCAn [1], and backdoor mitigation/purification methods like RNP [2] and FST [3].\n- Inadequate Evaluation of Stealthiness: The paper's evaluation of stealthiness primarily relies on visual demonstrations through images combined with metrics like GMSD. However, the metric and visual presentations alone are insufficient to demonstrate a substantial increase in stealthiness conclusively.\n\n[1] Demon in the variant: Statistical analysis of DNNs for robust backdoor contamination detection\n\n[2] Reconstructive neuron pruning for backdoor defense\n\n[3] Towards stable backdoor purification through feature shift tuning", "was_revised": true, "final_justification": "I think the overall amount of experiments and the novelty itself are sufficient. I also hope that the defense during the rebuttal discussion can be included as a way to fully examine the attack.", "rebuttal": "We sincerely appreciate your valuable suggestions and will reply to all concerns in order of importance. \n\nWe complete the experiments about **Backdoor Defense** and apply the components to **recent PCBAs**, achieving a **new SOTA performance** in Backdoor Attacks.  The results sufficiently demonstrate the generalization ability and superiority of our method. Related codes and analysis about the new results during the rebuttals will be updated in the paper.\n\n>By poisoning merely **2 images** (poison rate = 2 / 50000 = 0.00004), the optimized Narcissus with res-log as component A achieves **96.12% ASR** and **95.10% BA** in CIFAR-10 with 0 as the target-label.  To the best of our knowledge, **no other attack has comparable performance in ASR with pr = 0.00004 at the clean-label setting.**\n\n# A: Lack of experiments about Backdoor Defense\n\n{Weakness 1}\n\n**{abl: Anti-backdoor learning,ac: activation clustering,fp: Fine-pruning, i-bau: Implicit Hypergradient, nc: Neural Cleanse, np: Reconstructive Neuron Pruning}**\n\n>Given the defense method X, bASR and X-ASR denote the pre-defense and post-defense ASR.\n\n**Badnets**\n\n|method|bASR|abl-ASR|ac-ASR|fp-ASR|i_bau-ASR|nc-ASR|rnp-ASR|\n|:-|:-|:-|:-|:-|:-|:-|:-|\n|random|18.8|0|18|14.4|8.0|18.8|10.5|\n|forget|52.9|8.4|36.3|31|17.3|52.9|8.8|\n|+A|56.2|**14**|47.7|36.5|27.9|56.2|36.3|\n|+B|37.9|3.5|25.6|20.2|**32.5**|37.9|34.9|\n|+C|53.7|5.5|28.4|28.9|7.4|1.0|24.1|\n|+A&C|**87.5**|1.6|**68**|**51.2**|14.8|**81.2**|**47.6**|\n|+B&C|54|0.2|51.8|25.9|5.9|54|0|\n\n**Blend**\n\n|method|bASR|abl-ASR|ac-ASR|fp-ASR|i_bau-ASR|nc-ASR|rnp-ASR|\n|:-|:-|:-|:-|:-|:-|:-|:-|\n|random|57.6|**15.1**|52.4|39.8|28.3|57.6|27.1|\n|forget|76.1|9.2|73.2|63.5|7|76.1|0|\n|+A|77.9|3.9|76.9|64.3|20.0|77.9|36.1|\n|+B|71.7|3.4|67.7|60.1|14.3|71.7|19.7|\n|+C|74.8|6.1|62.9|74.5|48.2|74.8|0|\n|+A&C|**97.1**|1.8|**93.9**|**98.5**|46.1|**96**|**97.3**|\n|+B&C|91|8.9|85.5|92.8|22|91|71.7|\n\n**Other attacks**.\n\n|Attack|Defense|pr|bASR(random)|ASR(random)|bASR(forget)|ASR(forget)|bASR(ours)|ASR(ours)|\n|:-|:-|:-|:-|:-|:-|:-|:-|:-|\n|ctrl|abl|0.03|91.3|66.5|95.7|57.4|96.5|**85.8**|\n|ctrl|ac|0.03|91.3|84.2|95.7|**93.6**|96.5|91|\n|ctrl|fp|0.03|91.3|94.9|95.7|97.4|97.2|**99.2**|\n|ctrl|i-bau|0.03|91.3|39|95.7|**98**|96.5|65.7|\n|ctrl|nc|0.03|91.3|1|95.7|**95.7**|94.8|94.8|\n|ctrl|rnp|0.03|91.3|26.3|95.7|42.2|96.5|**84.9**|\n|sig|ac|0.03|94.2|93.5|96.5|96.4|97.2|**97.5**|\n|sig|fp|0.03|94.2|61.6|96.5|75.8|98|**88.4**|\n|sig|i-bau|0.03|94.2|8.9|96.5|17.7|97.2|**42.4**|\n|sig|nc|0.03|94.2|94.2|96.5|96.5|98|**98**|\n>The design of A&B depends on the specific requirements for concealment and ASR. The following results adequately address the concerns as the expected results of A&B are between \\[B, A\\].\n>Optimal improvement in ASR cannot be achieved when consideration is given to stealthiness. Therefore, components A&C exhibit the best ASR improvement.\n\n## A.1 Our methods **outperform** the original attacks when defended by backdoor defense methods.\n>Defended by nc, the ASR of CTRL drops from 91% to 1%. Optimized by our method, nc exhibits 94.8% ASR. \n\n## A.2 The effectiveness of backdoor defenses primarily hinges on **the characteristics of backdoor attacks themselves**.\n>sig fails to penetrate the STRIP. In such a case, the attacks optimized by our method also remain futile.\n\n## A.3 Our work may **benefit** Backdoor Defense by considering the distinct importance of samples in backdoor defense.\n\n# B: Stealthiness Evaluation\n\n{Weakness2}\n\n## B.1 **Visual presentation of poisoned images** selected by Component B with different MSD and GMSD values is provided in **Appendix I**.\n\n## B.2 Your concerns are entirely justified, but this stems from **inherent flaws in the evaluation metric design** rather than flaws of Component B.\n>Component B is designed for machine-based applications. For any machine-quantifiable evaluation metric provided, it can rapidly identify images that achieve optimal performance under that metric. Given a fixed trigger, component B selects images with optimal stealthiness rather than making a visible trigger totally invisible.\n\n## B.3 Component B is the pioneering work to enhance stealthiness via sample selection, which is **universally applicable** to both machine and human evaluations.\n\n## B.4 **Simplicity is not equal to the lack of novelty.** The **difference** between the design of plug-and-play components and other works may potentially lead to misinterpretations where our advantage is misconstrued as a limitation.\n>Achieving simplicity while maintaining efficiency is a core design principle for plug-and-play components for strong applicability and low computational overhead. \n\n>Unlike other works simply being demanded to train a powerful model to use, we need to design components that can easily be applied to most attacks at the code level.\n\n## B.5 We select the advanced metric to ensure the evaluation of similarity. \n>GMSD demonstrates higher sensitivity to structural distortions (such as blurring and compression artifacts) than SSIM. Additionally, SSIM suffers from instability in white noise assessment and exhibits deviations from subjective scores under specific distortion conditions. In contrast, GMSD shows stronger consistency with human subjective evaluations.\n\n# C: Advice for the paper\nDue to space constraints, no. are employed here to facilitate textual analysis in the paper. In the formal version, where space limitations are alleviated, the presentation format will be refined accordingly.\n\n# D: Our work is really **valuable**\n##  We achieve a **new SOTA performance** in Backdoor Attack by merely using component A based on the SOTA attack (Narcissus). \n>By poisoning merely **2 images** (poison rate = 2 / 50000 = 0.00004), Narcissus with res-log achieves **96.12% ASR** and **95.10% BA** in CIFAR-10 with 0 as the target-label.  \n\n>In other settings, we follow the default settings in the official code repository. ASRs and BAs are calculated by **the mean of ASR** between epochs {180-200}. \n\n|Methods|ASR|BA|\n|:-|:-|:-|\n|Narcissus|46.11|94.79|\n|ours|**96.12**|**95.10**|\n>In the offical paper, Narcissus achieved a 99% ASR by poisoning **25 images**.  The ASR of Narcissus **drops to 46.11%** when we reduce the poisoning rate to 0.00004 (just 2 images). Our method enhance the ASR **from 46.11% to 96.12%** with res-log as component A. \n\nWe hope our response can help resolve your confusion, and we will continue to optimize the parts that may cause confusion."}]

Author rebuttal:

Meta-review: This paper presents a modular framework comprising three generalized components that collaboratively optimize sample selection and trigger design to enhance both the attack success rate (ASR) and stealthiness of poison-only clean-label backdoor attacks. Prior to the rebuttal, reviewers generally recognized the work’s relevance and practical value, noting its novelty in jointly addressing sample selection and trigger design, as well as its use of human visual system sensitivity for trigger optimization. Nonetheless, they expressed concerns regarding its limited applicability beyond clean-label settings, insufficient evaluation against backdoor defenses, and the mixed effectiveness of component combinations. During the rebuttal and discussion periods, the authors conducted new experiments, clarified the interactions among components, and reinforced their claims through additional analyses. These responses led all reviewers to either maintain or raise their scores, resulting in a consensus leaning toward acceptance. Weighing the methodological innovation, thorough experimental validation, and constructive engagement with reviewer feedback against the remaining minor limitations, I recommend acceptance of this paper.
Decision: Accept (poster)