Stealthy Backdoor Attack via Confidence-driven Sampling
Authors: Pengfei He
Yue Xing
Han Xu
Jie Ren
Yingqian Cui
Shenglai Zeng
Jiliang Tang
Makoto Yamada
Mohammad Sabokrou
Venue: Accepted by TMLR ()

Abstract: Backdoor attacks facilitate unauthorized control in the testing stage by carefully injecting harmful triggers during the training phase of deep neural networks. Previous works have focused on improving the stealthiness of the trigger while randomly selecting samples to attack. However, we find that random selection harms the stealthiness of the model. In this paper, we identify significant pitfalls of random sampling, which make the attacks more detectable and easier to defend against. To improve the stealthiness of existing attacks, we introduce a method of strategically poisoning samples near the model's decision boundary, aiming to minimally alter the model's behavior (decision boundary) before and after backdooring. Our main insight for detecting boundary samples is exploiting the confidence scores as a metric for being near the decision boundary and selecting those to poison (inject) the attack. The proposed approach makes it significantly harder for defenders to identify the attacks. Our method is versatile and independent of any specific trigger design. We provide theoretical insights and conduct extensive experiments to demonstrate the effectiveness of the proposed method.

Yingqian Cui Published in Transactions on Machine Learning Research (11/2024)
Stealthy Backdoor Attack via Confidence-driven Sampling
Pengfei Hc
hepengfl @msu edu
Deportment of Computer Science and Engineering, Michigan State University
Yue Xing
ringyuel
Sangguee@mms....mmmmmmmm &msu. edu
Department of Statistics and Probubility, Michigan State University
Han Xu Department of Electrical and Computer Engineering. University of Arizona
muhan2Qarizona edu
Jie Ren
renjie3 edu
Department of Compuler Science and Engineeringg, Michigan State University
cukyingg edu
Deportment of Computer Science and Engineering, Michigan State Uninersity
Shenglai Zeng
zengshel @msu edu
Department of Computer Science and Engineering, Michigan State University
Jiliang Tang
langjili Sangjili@msu.. @msu edu
Department of Computer Science and Engineering, Michigan State University
Makoto Yamada
makoto.yamadee Goist.jp
Machine learning and data science (MLDS), Okinawa Institute of Science and Technology
Mohammad Sabokrou
mohammmad-sboorrrokoost...
Machine learning and data science (MLDS), Okinawa Institute of Science and Technology
Reviewed on OpenReview: https: // openreview. net/ forum? id= FLA5EX284A
Abstract
Backdoor attacks facilitate unauthorized control the testing stage by carefully injecting harmful triggers during the training phase of deep neural networks. Previous works have focused on improving the stealthiness of the trigger while randomly selecting samples to attack. However, find that random selection harms the stealthiness of the model. In this paper, we identify significant pitfalls of random sampling, which make the attacks more detectable and easier to defend against. To improve the stealthiness of existing attacks, we introduce method of strategically poisoning samples near the model's decision boundary, aiming to minimally alter the model's behavior (decision boundary) before and after back- dooring. Our main insight for detecting boundary samples is exploiting the confidence scores as metric for being near the decision boundary and selecting those to poison (inject) the attack. The proposed approach makes significantly harder for defenders identify the attacks. Our method is versatile and independent of any specific trigger design. We provide theoretical insights and conduct extensive experiments to demonstrate the effectiveness of the proposed method.
1
Introduction
While deep neural networks (DNNs) on large datasets and third-party collaborations demonstrate promising performance in various applications, concerns have been raised about potential malicious triggers injected

---

Published in Transactions on Machine Learning Research (11/2024)
into the models. These triggers lead to unauthorized manipulation of the model's outputs during testing, causing a "backdoor" attack (Li et al. 2022 Doan et al. 2021a). In particular, attackers can inject triggers into a small portion of training data in specific manner, then provide either the poisoned training data or backdoored models trained on it to third-party users [Li et al. 2022). In the inforence stage, the injected backdoors are activated via triggers, causing triggered inpuls to be misclassified as a larget label. In the existing literature, many backdoor attack methods have been developed and demonstrate strong attack performance, e-g., BadNets (Gu et al.) (217)). WaNet (Nguyen & Tran (021), and label-consistent (Turner et al. 2019). These methods can achieve high attack success rates while maintaining high accuracy on clean data within mainstream DNNs.
An important research direction in backdoor attacks is to enhance the stealthiness of poisoned samples while ensuring their effectiveness simultaneously. While trigger design (e.g., hidden triggers et al. 2020 clean- label (urnner et al.) 2019) has been a primary focus in existing research, recent studies have increasingly explored sampling methods for selecting optimal data points for poisoning and trigger inscrtion. However,
for sampling methods, most. existing works (Toneva et al., 2018 Han et. al. 2023 Li et al.) 2023 Xia et. al.,
2023 Wu et al.) 20233 Zhu et al., (023) focus on the attacking effectiveness while ignoring the stealthiness of backdoors. Our preliminary study (in Section 4.1 observes that the randomly selected poisoned samples are highly likely to be detected by the defenders. Such a weakness raises a natural question:
Is there a better sampling strategy to enhance the stenlthiness of backdoors?
To investigate this question, we follow the common understanding to assume that the attackers can access the training data while maybe only allowed to manipulate a part of the training data. For example, the allackers may contribute malicious data to publicly sourced datasets via uploading their own data online (Li et al. 2022). Besides improving the trigger pattern, they also need a sampling strategy to determine the data to update.
To better understand the behavior of the backdoor attacks, in Section 4.1 we investigate the latent space of the backdoored model to take a closer look at the random sampling strategy. We draw two findings from the visualizations in Figure I First, most randomly chosen samples are close to the center of their true classes in the latent space. Second, the closer a sample is from its true class on the clean model, the farther it gets from the target class on the backdoored model (Section 4.1g h. These two observations reveal an important concern about the "stealthiness" of the random sampling strategy, where the randomly sampled data points may be easily detected as outliers. To gain a deeper understanding, we further build a theorelical analysis of SVM in the latent space (Section 4.3) to demonstrate the relation between the random sampling strategy and attack stealthiness. Moreover, our observations suggest an alternative to random sampling-it is better to select samples closer to the decision boundary. Our preliminary studies show that these boundary samples can be manipulated to be closer the clean samples from the target class and can greatly enhance their stealthiness under potential outlier detection (see Figure Ic and Id].
Inspired by the above observations, we propose novel method called confidence-driven boundary sam- pling (CBS). Specifically, we identify boundary samples with low confidence scores based on surrogate model trained on the clean training set. Intuitively, samples with lower confidence scores are closer to the boundary between their own class and the target class in the latent space Karimi et al. (0199 compared to random samples. Therefore, this strategy makes it more challenging to detect attacks. Moreover, our sampling strategy is independent from existing attack approaches, making it exceptionally versatile. It can be easily integrated with various backdoor attacks, offering researchers and practitioners a powerful tool to enhance the stealthiness of backdoor attacks without requiring extensive modifications to their existing methods or frameworks. Extensive experiments combining proposed confidence-basee boundary sampling with varions backdoor attacks illustrate the advantage of the proposed method over random sampling.
2 Related works
2.1 Backdoor attacks and defenses
As mentioned in the introduction, backdoor attacks are shown be a serious threat to DNN. BadNet (Gu et al. 2017) is the first. exploration that attaches small patch to samples to introduce backdoors into
2

---

Published in Transactions on Machine Learning Research (11/2024)
DNN model. Later, many efforts are put into developing advanced attacks to boost the performance improve the resistance against potential defenses. Various trigger designs are proposed, including image
blending (Chen et al. ), image warpping (Nguyen & Tran 2021). invisible triggers (Li et al. 2020 Saha
ct al. 2020; Doan et al.
2021b), clean-label attacks (Turner et al. 2019: Saha et al. 2020 sample-specific
triggers (Li el al.
2021b
Souri el al. 2022 elc. These allacking met have demonstrated strong allack
performance (Wu al.
2022). Mcanwhile, the study of effective defenses against these attacks also remains
active. One popular type of defense detects outliers in the latent space (Tran et al.) 2018 Chen et al., 2018
Hayase et al.
2021 Gao al. 2019 Chen et al. 2018). Other defenses incorporate netron pruming (Wang
et al.
2019). detecting abnormal labels (Li et al.
2021a.. model pruning (Liu et al. 2018 fine-tuing Sha
et al.
2022
etc.
2.2 Samplings in backdoor attacks
Despite the development of triggers in backdoor attacks, the impact of poisoned sample selection also at- tracting more and more attention. Xia et al. (2022) proposed a filtering-and und-ddaaiiddd strategy (FUS) to select samples with higher contributions to the injection of backdoors by computing the forgetting event (Toneva ct al. 2018) of cach sample. For each itcration, poison samples with low forgetting events will be removed,
and new samples will be randomly sampled to fill out the poisoned (raining set. Han et al. 2023
et al. (2023); Xia et al. (2023) followed this line and also adopted the forgetting score for sample selection. Wu et al. )202)) Zhu et al. (2023) leverages masks and l2 distance in representation space respectively to improve the effectiveness of the backdoor. Though these works can improve the success rate of backdoor
attacks via sample selection, they ignore the backdoor's ability to resist defenses, known as the 'stealthiness' of backdoors. To the best of our knowledge, we are the first study the stealthiness problem from the sampling perspective.
3 Definition and Notation
This section rntrodeees preliminaries about backdoor attacks, including the threat model considered in this paper and a general pipeline that is applicable to many attacks.
3.1 Threat model
We follow the commonly used threat model for the backdoor attacks (Gu et al. 2017 Doan et al. 2021b). We assume that the attacker can access the clean training set and modify a proportion of the training data. Then, the victim trains his own models on this data, and the attacker has no knowledge of this training procedure. In real-world situation, the attacker proportion of them by inserting triggers. Then they upload the poisoned data to the Internet and victims unknowingly download and use it for training (Gu et al.
access some clean datasets, and modify
2017 Chen et al.] 2017). Note that many existing 2019 Saha et al. 2020) have already adopted this
backdoor attacks (Nguyen & Tran 2021 Turner et al.] assumption, and our proposed method does not demand additional capabilitics from attackers beyond what is already assumed in the context of existing attack scenarios. Furthermore, our method, detailed Section addresses practical scenarios where attackers are limited to poisoning samples from specific subset, not the entire dataset, with empirical results in Section 5.5 For example, attacker might only control their data and not have access to alter public datasets.
3.2
A general pipeline for backdoor attacks
In the following, we introduce a general pipeline, which is applicable to a wide range of backdoor attacks. The pipeline consists of two components.
(1) Poison sampling. Let D,, (1,, v;)) denote the set of clean training samples, where 2; E X is each individual input sample with y E y as the true class. The attacker selects a subset of data U C Drr. with p = Drrl the poison rate, where the poison rate p usually small.
3

---

Published in Transactions on Machine Learning Research (11/2024)
(2) Trigger injection. Attackers design strategy T to inject the trigger into samples selected in the first step. In specific, given subset of data U, attackers generate poisoned set (UU) as:
- ,/) Gr(z), S(x, v). v(r,))))))))) EU}
(1)
where G. X +
the attacker-specifee poisoned image generator with trigger pattern t, which satisfies the following constraints: G+(x) A x and (x), where d is some distance function such 22/12 distance, and S indicates the attacker-specified target label generator. After training the backdoored model f+) where 8 denote parameters of the backdoored model, on the poisoned set, the injected backdoor will be activated by trigger t. For any given clean test set Die, the accuracy of f(=;0") evaluated on trigger- embedded dataset. T(Dee) is referred to as success rate, and attackers also expect to see high accuracy on any clean samples without triggers.
4 Method
In this section, we will first analyze the commonly used random sampling method, and then introduce our proposed method as well as some theoretical understandings.
(a) BadNeet-Randon
Rando
(c) Boundaary
(d) Bleud+Boundary
Figure 1: Latent space visualization of BadNet and Blend via Random and Boundary sampling.
4.1 Revisit random sampling
Visualization of Stealthiness. Random sampling selects samples to poisoned from the clean training set with the same probability and is commonly used existing attacking methods. However, we suspect that such unconstrained random sampling easy detect outliers of the target class in the latent space. To examine the sample distribution in the latent space, first conduct TSNE (Van der Maaten & Hinton 2008h visualizations for the backdoored model of (1) clean samples of the target class, and (2) the poisoned samples from other classes but labeled the target class. We consider these poisoned samples are obtained by two representative attack algorithms, BadNet (Gu et al. 2017) and Blend (Chen el al. 2017) both of which apply random sampling, on CIFAR10 (Krizhevsky et al. 2009), in Figure La and [b In detail, the visualizations show the latent representations of samples from the target class, and the colors red and blue indicate poisoned and clean samples respectively. One can see a clear gap between poisoned and clean samples. For both attacks, most of the poisoned samples form distinct cluster outside the clean
4

---

Published in Transactions on Machine Learning Research (11/2024)
samples. This indicates separation in latent space which can be easily detected by potential defenses. For example, Spectral Signature (Tran et al. 2018 SPECTRE, (Hayase et al. 2021), SCAn (Tang et al. 2021
are representative defenses relying on detecting outliers in the latent space and show great power defending various backdoor attacks
(Wu et al. 2022
Al Randto Boundary
Random Boundary
Frequency.
04
Frequency 03-
04-
0.3
0.1
do
do
(a) BadNet
(b) Blend
do
(c) BadNet.
(d) Blend
The left figures depict the distribution of when samples Randomly selected BadNet and Blend. The right figures shows the relationship between and for BadNet and Blend.
Figure 2:
Relation between Stealthiness & Random Sampling. In our study, we also observe the potential relation between random sampling and the stealthiness of backdoors To elaborate, we further calculate the distance from each selected sample (without trigger) to the center of their true classes computed on the clean model, which denoted dg- As seen in Figure 2a and 2b random sampling likely to select samples that close the center of their true classes. However, distance between the sample and the target class which we visualize in the previous Figure ! Formally, we define the distance between each selected sample (with trigger) and the center of the target class computed on the backdoored model as dy
find d, may have obvious correlation with the
From Figure 2c and 2d we observe a negative correlation between d, and do indicating that samples closer to the center of their true classes the clean model tend to farther from the target class after poisoning and thus easier to detect. These findings imply that random sampling often results in the selection of samples with weaker stealthiness. Our observations also suggest that samples closer to the boundary may lead to better stealthiness and motivate proposed method.
4.2 Confidence-driven boundary sampling (CBS)
One key challenge for boundary sampling is how determine which samples are around the boundaries. Though we directly compute the distance from each sample to the center of the target class in the latent space and choose those with smaller distances, this approach can be time-consuming as one needs to compute the center of the target class first and then compute the distance for each sample. This problem can be more severe when the datasct's size and dimensionality grow. Consequently, a more efficient and effective method is pursuit.
We provide detailed discussion of "stcalthiness" in Appendix 8.5
2 A formal definition da and is shown in Appendix 8.5
We also include discussion the relationship between raw input space and latent, space in Appendix 8.11

---

Published in Transactions on Machine Learning Research (11/2024)
To solve this issue, consider the confidence score. To be more specific, we follow the notations from Section 3.2 and further assume there exist K classes, i.e., 3 = (I,... K). for simplicity. Let f(;:0) denote a classifier with model parameter 0, and the output of its last layer is a vector E B Confidence score is calculated by applying the softmax function on the vector 2, i.c. sc(f(x;0) = (z) E [0, where o(-) is the softmax function.
This confidence score considered the most accessible uncertainty estimate for deep neural network (eearee et al. 2021) and is shown to be closely related to the decision boundary (Li et al. 2018 Fawzi et al., 2018). Since primary goal is to identify samples that closer to the decision boundary, with similar confidence for both the true class and the target class. Thus, we can define boundary samples: Definition 4.1 (Confideece-baseed boundary samples). Given a data pair (I. model f(;;0) a con-
can find samples
fidence threshold and a target class y', if
(s 0)) se(f(1; 0s,, then (I, is noted as e-boundary sample with target y/-
To explain Definition 4.1 since se([(x;0)) represents the probability of classifying x class y, then when there exists another class y', for which so(f(z;))) about whether to classify x as class y or class y'. This uncertainty suggests that the sample is positioned near the boundary that separates class from class y' (Karimi et al. 2019
sc(f(z;)),, it signifies that the model is uncertain
The proposed Confidence-driven boundary sampling (CBS) method is based on Definition 4.1 In general, CBS selects boundary samples in Definition 4.1 for a given threshold c. Since we assume the attacker has no knowledge of the victim's model, we apply a surrogate model like what black-box adversarial attacks often do (Chakraborty et al. 2018). In detail, pre-trained surrogate model ((:;0) is leveraged to estimate confidence scores for each sample, and e-boundary samples with pre-specified target y² are selected for poisoning. The detailed algorithm is shown in Algorithm poison rate in Section 3.2 and we can determine é so that (U(y", = x |Derl- Since we claim that our sampling method can be casily adapted to various backdoor attacks, we provide an example that adapts our sampling methods to Blend (Chen et al., 2017), where we first select samples to be poisoned via Algorithm and then blend these samples with the trigger pattern to generate the poisoned training set.
Note that the threshold is closely related to
Algorithm CBS
Input Clean training set Di. = ((2,, v:)] model f(:0), pre-train epochs E, threshold e, target class y² Output Poisoned sample set U, poisoned label set Sp.
Pre-train the surrogate model on Der for T epochs and obtain f(: Initialize poisoned sample set U = for = I.....N do if (s,[((r;)) - ==(((e);))) $ then - ((x, end end for Return poisoned sample set U
4.3 Theoretical understandings
To better understand CBS, we conduct thcoretical analysis on a simple SVM model. As shown in Figure 3 in a 2-dimensional space, we consider binary classification task where two classes are uniformly distributed in two balls centered at fn (orange circle) and #2(blue circle) with radius r respectively latent space G
C ~ pi (x) = πr² [[] - 44 2|2 < r], and
(3)
C₂ ~ (2(p)(0)= 2
1 [[| 122 2| S r].
"For correctly classified sample, the true class possesscs the largest score. 5 Discussion of computation overhead included Appendix 8.4 6hii analysis suitable for any neural networks whose last. layer fully connected layer.
6

---

Published in Transactions on Machine Learning Research (11/2024)
C2
12
22
X
F4
C1
Figure 3: Backdoor on SVM
where let μ22 =2=00 0 for simplicity. Assume that each class contains n samples. We consider a simple attack that selects one single sample from class C1, add trigger to it to generate a poisoned ã. and assign label class C2 for it. Let C1, O2 denote the poisoned data, and we obtain new backdoored decision boundary of SVM on the poisoned data. To study the backdoor effect of the trigger, assume I + el/l||] where t/||t]l, e denote the direction and strength of the trigger, respectively.
To explain this design, we assume that the trigger introduces a 'feature' to the original samples [ et al. 2023), and this 'eeature' closely related to the larget class while nearly orthogonal to the prediction features In addition, we assume is fixed for simplicity, which means this trigger is universal and we argue that this is valid because existing attacks such BadNet (Gu et al.] 2017] and Blend (Chen et al. 2017) inject the same trigger to every sample.To To ensure the backdoor effect, we further assune (N2 M1 otherwise the poisoned sample will be even further from the target class (shown as the direction of the green dashed arrow) and lead to subtle backdoor effects. We are interested in two questions: (Q1) Are boundary samples harder to detect? (Q2) How do samples affect the backdoor performance?
O,
To investigate (Q1), we adopt the Mahalanobis distance (Mahalanobis) 2018) between the poisoned sample & and the target class C2 as an indicator of outliers. A smaller distance means 0 is less likely to be an outlier, indicating better stealthiness. For (Q2), we estimate the success rate by estimating the volume (or area in 2D data) of the shifted class C1 to the right of the backdoored decision boundary. This is because when triggers are added to every sample, the whole class will shift in the direction of t, shown as the orange dashed circle in Figure 3 The following series of theorems and propositions answer the above two questions. We begin with the Manahalnobis distance:
Theorem 4.2 (Mahalanobis distance). Assume ã = x + et/l|e/2 = x + a for some arbitrary x and some trigger t and strength e. Also assume #2 = O, (μ2 - 2 0. Denote ua and S2 as the sample mean and covariance matrir of the poisoned data with label Cz. Then the Mahalanobis distance between i and the target class C2 is defined as
2z (i P1z)T T5, (3 - piz).
There crists some large constant no so that when 2 no, dhs (5, O2) satisfies
P( dhs 02)
4 1
21 S ca exp (-c2t2)
(4)
22
for some positive constants e₁ and C2.
The proof of Theorem 4.2 can be found in Appendix 8.1
Since jo and 3g are sample mean and covariance, we use concentration incqualities for vector average and matrix average to describe their behavior.
Prediction feature here is referred features used prediction when triggers involved.
7

---

Published in Transactions on Machine Learning Research (11/2024)
Theorem 4.2 shows the Mahalanobis distance (d, C2) from the fixed C2. When n increases, dM (7. C2) converges to its limit 4||=||//r* In addition, to answer (Q1), the limit /|/2 is determined by the distance between I and (= 0): A larger ||]| results in a larger Mahalanobis distance, leading to a higher chance of & being detected as an outlier (i.e., identified by the defender). To compare CBSand random selecting, if the attacker selects the support vector to attack, then 4|/i|///r minimized. Otherwise, /||=||//> will be larger.
In the following, to answer (Q2), we first discuss the attack success rate assuming infinite training samples and then study how the finite sample affects the selection of the poisoned data and the margin of SVM.
Theorem 4.3 (Attack success rate, population). Under the same conditions as Theorem 4.2 assume n - 0c and a hard margin erists, then the success rate for an arbitrary E = x + is an increasing function of
e ecosaa, I - --)) - ||
pm 11/2 r/2
The proof of Theorem 4.3 can be found in Appendix 8.1
To figure out the attack success rate, we directly
calculate the area of incorrect classification.
affects the attack success rate. However, the existence of hard margin depends the selected sample x and trigger 4, which in turn determines whether an attack is effective. We provide Figure 4 for better illustration. For the trigger t, we need (-w1) > O, which indicates that the trigger moves the clean sample æ (from C1) towards the target cluster C2. To guarantee a hard margin, we require the poisoned sample to fall into the shaded area, which is determined by fı, f2 and Ct. f1: are the common tangent. lines to C C2, and are two extreme hyperplane that separates two clusters. Formally, we can define the area I E {ar] ([]k [|llc a mill2 2 r) n [fi(z a) < <0 (/2(x + a) > 0}) U (fr + a) > 0} U {f2(x + a) < 0}}. These conditions indicate that samples closer to the decision boundary more likely to result in hard margin in the poisoned data and guarantee an effective attack.
Remark 4.4 (Existence of hard margin). Theorem 4.3 describes how the attack
G
P
Figure 4: An illustrating figure for the existence of hard margin. The shaded area represents the region of E where a hard margin exists.
On the other hand, unlike random sampling, since CBSrelies on the estimate of the confidence, we provide the following results to illustrate the impact of finite sample size on CBSand random sampling. We first present Theorem 4.5 below to explain the change of the SVM margin under the finite-sample scenario using clean data:
Theorem 4.5 (Finite-sample scenario). Under the same conditions as Theorem 4.2 consider the classifica- tion with clean data. Assume there samples from C1 and n samples from Cz. Take 6, (log n)/ /n. With probabilily at least.
1-2 1-2(1+2
d1.f dr,miu
n )
c log n nar?
1+2
8n
uniformly for all hyperplane which separates Ci and Oz, the corresponding margin for the 2n samples is O(V8,)-close to the margin for C₁ and Cz. The terms di,f and di,min are constant values, and their definition can be found in and 7 in Appendir 8.1
8

---

Published in Transactions on Machine Learning Research (11/2024)
The proof of Theorem 4.5 is in Appendix 8.1 The general idea is to construct some regions in C1 and C2 along their boundary and demonstrate that with high probability, there is at least one sample that falls in each of the regions. Then we use these regions to quantify the difference between the margin to the population and the margin to the finite samples.
Based on Theorem 4.5 with a large enough n, the margin of SVM converges probability. While Theorem 1.5 describes the margin using clean training data, the results can be further extended to discuss the sample selected by CBS, as well as the margin under poisoned data. In the following, Proposition 4.6 is for CBS, and Proposition 4.7 is for random sampling.
Proposition 4.6 (CBSin finite-sample scenario). Under the conditions in Theorem 4.5 with the same prob- ability as in Theorem 4.5 the sample selected by CBSis O(v5,))closs to the support vector in the population. If I. and are chosen such that. the hard margin erists Sollowing Remark 444 the maryin of the decision boundary determined by the finite poisoned samples is O(yon))close to its population version.
Proposition 4.7 (Random poisoning in finite-sample scenario). Under the conditions in Theorem 4.5 with the same probability in Theorem 4.5 if and I are chosen such that the hard margin exists following Remark 4.4 then the margin of the decision boundory determined by the finâte poisoned samples is (m)ō)) close to its population version.
Proposition 4.6 and 4.7 shows the consistency of these methods: When n + co, the sample selected by CBSis close to the support vector in the population version. In addition, the margin of both methods converges to their population version respectively.
Remark 4.8 (Bffectivenes--teelthiii dy, reducing the likelihood of being detected corresponds to higher success rate without defenses. These observations highlight the trade-off between stealthiness and backdoor performance without defenses. Our experiments in Section S further demonstrate that incorporating boundary samples significantly improves stealthiness with only a slight reduction in success rate without defenses
trade-off). Based the theorem, a smaller || results in a smaller
outlier. Additionally, closer proximity between ž and #i
Remark 4.9 (Hard margin does not exist). We also compare cases when the poisoned sample is too far from the target center 1/2. When the poisoned sample is far enough from μ2 and the decision boundary, e.g., the poisoned sample こ, is still within reach of its true class, a hard margin will not exist. In this case, the misclassification of the single poisoned example will be ignored when n is large enough, and the decision boundary of the SVM (with a soft margin) will be the same as the one from the clean SVM. Consequently, the poisoning effect is significantly reduced. To achieve better success rate, the attacker needs poison more samples, which can cause inefficieney and worse stealthiness. Therefore, poisoning samples closer to the boundary can even achieve better effectiveness while maintaining stealthiness.
5 Experiment
In this section, we conduct experiments to validate the effectiveness CBS, and show its ability to boost the stealthiness of various existing attacks. We evaluate CBS and baseline samplings under no-defense and various representative defenses in Section (5.2 and 5.3 In particular, we select poisoned samples from the whole training data in these three sections and provide results when only partial data is accessible in Section 5.5 to validate the effectiveness of our approach in broad and practical scenario. In Section 5.6 we will provide more empirical evidence to illustrate that CBS is harder to detect and mitigate. We also direct readers to additional experiments regarding larger datasets and more defenses in the Supplementary for a more comprehensive evaluation.
5.1 Experimental settings
To evaluate CBS and show its ability to be applied to various kinds of attacks, we consider 3 types of attacking methods that cover most of existing backdoor attacks.
Code can be found in httpp://gii http://gttuubccco//enggeeeeeeeee cowm/Peegeeeieeeeee///orrrr.reee We determine the types based on threat models allacking methods.

---

Published in Transactions on Machine Learning Research (11/2024)
Table 1: Performance on Type backdoor attacks (Cifar10).
Model Defense
18
ResNet18 - VGG16
Attacks
Random
FUS
CBS
Random
FUS
CBS
BadNet
99.9:1022
99.9+0.1
93.6=0.3
99.7+0.1
99.9-1006
94.5
Blend
89.7#1.6
93. 93.1+14
86.5=0.6
81.6113
86.240.8
78.3
No Defenses
Adapt-blend
76.5
7..4
73.6=0.6
72.2+1.9
71.911.1
68.6+0.5
Adapt-patch
97.5+1..2
98.6:10.9
95.1=0.8
93.1+114
95.2100.7
91.410.6
BadNet
0.5
1.7:0.22
20.24:..3
1.9:0.9
3.6+0.6
11.8=0.4
Blend
43.7#3.4
42.611.7
55.7+0.99
16.5+2.3
17.4119
21.5=00.8
Ss
Adapt-blend
62:12.9
61.5+1.4
70.1+0.6
38.213.1
36.1
43.2:10.9
Adapt-patch
93.1+2.3
92.9+1.1
98.710.77
49.1+2.7
48.1+1.3
52.9-0.6
BadNet
0.4
8.540.9
23.7::0.8
0.8+0..3
9.6
1..7
Blend
54.722.7
57.2+1.
60.610.9
49.1#2.3
50.6+1.7
56.9=0.8
STRIP
Adapt-blend
0.7:0.22
5.541.8
8.6
1.840.9
3.9
6.3
Adapt-patch
21.3+2.1
24.61:1.8
29.8+1.2
26.5+1.7
27.8+1.
29.7=0.5
BadNet 16.843.1
17.3:22.3
31.311..
14.212.3
15.74:.00
23.6
Blend
57.2+3.8
55.1+2.7
65.7+2.1
55.1+1.9
53.8+1.3
56.2+1.1
ABL
Adapt-blend
4.5412.7
5.142.3
6.911.7
25.4122.6
21.7:22.1
2..3
Adapt-patch
5.2+2.3
7.4
8.7+1.3
10.8+2.7
11.11.5
1.3
BadNet 1.110.77
13.5::0.4
24.6110.3
2.5:10.9
11.411.3
17.5.10.8
Blend 82.5+1.7
83.7+1.1
81.7=0.6
79.7+1.5
77.6+1.6
78.5+0.9
NC
Adapt-blend 72.412.3
71.51188
74.211.2
59.811.7
59.211.2
62.1110.6
Adapt-patch
2.2+0.7
6.6
14.3+0.3
10.9
13.4+1.4
16.2+0.9
In detail, Type I backdoor attacks allow attackers to inject triggers into a proportion of training data and release the poisoned data to the public. Victims train models them from scratch. The attack aims to misclassify samples with triggers the pre-specified target class (also known the all-to-one scenario). Type II backdoor allacks share the same threat model with Type I atlacks, and the difference is that victims finetune pre-trained models on poisoned data, and the adversary's goal is to misclassify samples from one specific class with triggers as the pre-specified target class (also known as the ono-to-onc scenario). Distinct from the preceding categories, Type III backdoor allacks necessitate an additional degree of control over the training process of the victim's model. This control affords attackers the ability to concurrently optimize both the backdoor triggers and the model parameters, particularly in all-to-one attack scenarios.
Baselines for sampling. We compare CBS with two baselines Random and FUS (Xia et al. 2022 The former selects samples to be poisoned with uniform distribution, and the latter selects samples that con- tribute more to the backdoor injection via computing the forgetting events (Tonea et al. 2018) for each sam- ple. In our evaluation, we focus on image classification tasks on datasets Cifar10 and Cifar100 (Krizhevsky let al. 2009 10 and model architectures ResNet18 (He et al. 2016), VGG16 (Simonyan & Zisserman, 2014). We 18 as the surrogate model for CBS and FUS not specified. The surrogate model is trained the clean training set via SGD for 60 epochs, with initial learning rate of 0.01 and reduced by 0.1 after 30 and 50 epochs. We implement CBS according to Algorithm and follow the original setting in (Xia ett al. 2022) to implement FUS, i.c., 10 overall iterations and 60 epochs for updating the surrogate model in each iteration. After the generation of poisoned samples, we test the attacking performance on ResNet18 (the same architecture as the surrogate model) as well as transferring to another model architecture VGG16 (denoted as ResNet18 + VGG16 in tables 1
5.2 Performance of CBS in Type backdoor attacks
Attacks & Defenses. We consider representative attacks this calegory BadNet (Gu el al. 2017 which attaches a small patch pattern as the trigger to samples inject backdoors into neural networks;
Additional datasets included Appendix Discussion of surrogate models Appendix 3.10
10

---

2018) and STRIP (Gao et al. 2019 which are outliee-deetcciion--aadd defenses, Anti-Backdoor Learning (ABL) Li et al., 2021a] and Neural Cleanser (NC) (Wang al. 2019) which are not detection- based defenses. We follow the default settings for backbone attacks and defenses. For CBS, we set = 0.2 and the corresponding poison rate is 0.2% applied for Random and FUS, to guarantee that poisoning rates are the same for all sampling methods. We retrain victim models on poisoned training data from scratch via SGD for 200 epochs with an initial learning rate of 0.1 and decay by 0,1 at epochs 100 and 150. Then we compare the success rate which is defined as the probability of classifying samples with triggers as the target class. We repeat every experiment 5 times and report average success rates (ASR) as well as the standard error if are Published in Transactions on Machine Learning Research (11/2024)
Table 2: Performance on Type Il backdoor attacks.
Model Defense
ResNet18 FUS
ResNet18 - VGG16
Attacks
Random
CBS
Random
FUS
CBS
sidignrtrigger
81.9+1.5
84.241.2
76.3400.8
83.422.11
86.2+1.3
79.620.7
No Defenses
LC
90.3+1.2
92.1+0.88
87.2
91.74114
93.7+0.9
87.1
Hidden-Lrigger
6.311.4
5.911.1
9.710.9
10.71:2.4
11.211.
14.710..6
NC
CIFAR10
LC
8.912.1
8.111.6
12.611.1
11.31:2.6
9.811.1
12.910.9
Hidden-trigger
11.712.6
9.91:13
14.310.9
8.612.4
8.11144
11.810.8
FP
LC
10.31
13.5:11.2
20.410.7
7.91
8,211.1
10.610.77
Hidden-trigger
1.7+0.8
5.6+1.6
10.5+1.1
3.6+1.1
8.8+0.8
10.4+0.6
ABL
L,C
0.8+0.3
8.9+
12.1+0.8
1.5+0.7
9.
12.6+0.8
Hidden-trigger
80.6+2.1
84.1
78.9+
78.24:2.3
81.4+1.
7..++1.2
No Defenses
LC
8..312.3
87.211.4
84.740.99
84.742..8
85.21144
81.5+111
Hidden-Lrigger
3.811.4
4.2::0.9
7.610.7
4.4
5.111.2
6.8
NC
CIFAR100
LC
6.1
5.411.1
8.3::0.5
3.911.2
3.8::0.9
8.3.1..7
Hriden-triigger
15.313.1
16.710..9
23.210.7
8.911.3
9.311.1
12.310.7
FP
LC
13.8122.
12.7111.
16.910.6
10.3::1.4
0.910.88
14.2:0..5
Hidden-trigger
2.3+0.99
3.9+1.3
6.5+
3.7+0.9
3.5+0.77
6.4+0.4
ABL
L.C
0.9+0.22
2.7+0.88
6.2+0066
2.5+0.8
2.1+0.7
6.7+0.5
Blond (Chen et al. 2017) which applics the image blending to interpolate the trigger with samples; and Adaptive backdoor [Qi et al. 2022) which introduces regularization samples to improve the stealt of backdoors, as backbone attacks. We include 4 representative defenses: Spectral Signiture (SS) (Tran al.
not specified [3 Results on Cifar10 are shown in Table I and results on Cifar100 and shown in the Appendix.
Performance comparison. Generally, CBS enhances the resilience of backbone attacks against various defense mechanisms. achieves notable improvement compared to Random and FUS without a significant decrease in ASR when no defenses are in place. This is consistent with our analysis in Section [43] We notice that CBS has the lowest success rate when no defenses are active, which is consistent with our analysis in Remark 4.14 Nonetheless, CBS still achieves commendable performance, with success rates exceeding 70% and even reaching 90% for certain attacks. It is important to note that the effectiveness of CBS varies for different attacks and defenses. The improvements are more pronounced when dealing with stronger defenses and more vulnerable attacks. For instance, when facing SS, a robust defense strategy, CBS significantly enhances ASR for nearly all backbone attacks, especially for BadNet. In this case, CBS can achieve more than a 20% increase compared to Random and a 15% increase compared to FUS. Additionally, it's worth mentioning that CBS consistently strengthens resistance against detection-based (first two) and non-detection--aase defenses (the other two). This further supports the notion that boundary samples are inherently more challenging to detect and counteract. While the improvement of CBS VGG16 is slightly less pronounced than ResNet18, it still outperforms Random and FUS in nearly every experiment, indicating that CBS can be effective even on unknown models.
12 Adaptivo-Blend and Adaptive-Patch included Accuracy on the clean samples included in Appendix 8.7
14 Additional discussion can be found in Appendix 8.8
11

---

Published in Transactions on Machine Learning Research (11/2024)
Table Performance on Type III backdoor attacks.
Model Defense
ResNet18 FUS
VGG16
Attacks
Random
CBS
Random
FUS
CBS
Lira WaNet
91.511.4 90.3+1.6
92.910.7
88.210.8
98.311..8
99.2:00.5
93.610.4
No Defenses
91.4+1.3
87.9+0.7
96.7+1.4
97.3=0.99
94.5=0.5
WB
88.512.1
90.911.99
86.31122
94.11111
95.710.8
92.810.7
Lira
10.3+1.
12.5
16.1=0.7
14.9
18.311.1
19.6+0.8
NC
WaNet
8.941.
10.11133
13.4-0.9
10.51:11
12.240.7
13.7:0.9
WB
20.742.1
19.6
27.2+0.6
23.1
24.9
28.7+0.5
CIFARIO
Lira
81.5+3.2
82.31:.3
87.7+1.1
82.842.4
81.51177
84.6+1.3
STRIP
WaNet
80.243.4
79.742.55
86.5=1.4
77.643.1
79.342.2
78,241.5
WB
80.112.9
81.71188
86.611.2
83.412.77
82.611..8
87.311.1
Lira
6.7
6.241.2
12.5=0.7
10.4
9.8+0.8
13.3+0.6
FP
WaNet
4.84:1.3
6.110.9
8.2.0.8
6.810.9
6,410.6
8.310.4
WB
20.8+2.3
21.91777
28.3+1.11
25.7+1.3
26,2+1.2
29.1+0.7
Lira
98.2+00.7
99.3+0.22
96.1
97.1
99.3+10.4
94.5
No Defenses
WaNet
97.740.9
99.140.44
94.311.2
96.311.2
98.7=0.9
94.110.7
WB
95.1
96.411.11
94.7.0.9
93.240..9
96.711044
91.910.8
Lira
0.240..1
L71112
5.810.9
3.400.7
3.91100
7.2:0.9
NC
WaNet
1.610.8
3.41133
8.210.8
2.910.6
2.510.8
5.111.2
WB
7.741.5
7.5+0.9
15.7=0.7
8.5
7.640.9
14.9+0.7
CIFAR100
Lira
84.3+22.7
83.7
87.2=1.1
82.7+:.55
83.4
87.8+1.4
STRIP
WaNet
82.542.4
82.011.6
8.9
81.412.77
84.511..7
82.610.8
WB
8..8
86.411.2
88.1+0.8
82.94:244
82.3+1.5
86.5+1.4
Lira
7.411.9
8.9111
15.2-0.9
8.5:3.22
11.822
14.7+111
FP
WaNet
6.711.77
6.310.9
11.3
9.712.9
9.31..
12.611.3
19.2+1.5
19.7+0.7
26.1=0.5
17.642.4
18.3+1.7
24.9+0.8
5.3 Performance of CBS in Type Il backdoor attacks
Attacks & Defenses. We consider 2 representative attacks in this category Hidden-trigger (Saha et al. 2020), which adds imperceptible perturbations to samples to inject backdoors, and Clean-label (LC) (Turner et al. 2019), which leverages adversarial examples to train a backdoored model. We follow the default settings in the original papers and adapt 22-norm bounded perturbation (perturbation size 6/255) for LC. We test all attacks against three reprosentative defenses that are applicable to these attacks. We include NC, SS, Fine Pruning (FP) [Luu al. 2018), Anti- Backkoo Learning (ABL) (Li et al 2021a). We set == 0.3 for CBS and p = 0.2% for Random and FUS correspondingly. For every experiment, source class and target class are randomly chosen, and poisoned samples are selected from the source class. The success rate defined as the probability misclassifying samples from the source class with triggers as the target class. Results on dataset Cifar10 and Cifar100 are presented in Table We include additional results on Tmay-Ima the Supplementary for further illustration.
Performance comparison. As detailed in Table CBS displays enhanced capacity to withstand various defense mechanisms, akin to Type I attacks, while sacrificing marginal degree of success rate. Notably, in the presence of defenses, CBS consistently surpasses both Random and FUS strategies in performance, demonstrating its adaptability across various challenging conditions. This is particularly evident when tack- ling susceptible attack strategies like BadNet, where CBS not only achieves substantial gains outperforming Random by upwards of 10% and FUS by more than 5%-but also maintains smaller standard errors. These smaller errors reflect CBS's stability, which is critical in real-world applications where consistent performance is crucial.
12

---

Published in Transactions on Machine Learning Research (11/2024)
ASR under Defenses
SPECTRE
20
STRIP ARL
ASR of No
10
0
6.19
03
0.25
0.3
0.3
0.15
0.2
0.75
0.3
011
0.13
0.2
0.23
0.3
0.1
0113
0.2
0,25
0.3
0.1
0.15
0.2
25
0.3
0.3
0173
02
023
Figure 5: An illustration on the influence of é in CBS when applied to BadNet. The magenta bar represents
ASR without defenses while the left bars present ASR under defenses.
5.4 Performance of CBS in Type III backdoor attacks
Attacks & Defenses. We consider 3 Representative attacks in this calegory -iira (Doan al. 2021 which involves a stealthy backdoor transformation function and iteratively updates triggers and model pa- rameters; WaNet (Nguyen & Tran 2021) which applics the image warping technique to make triggers more stealthy; Wasserstein Backdoor (WB) (Doan et al. 2021a) which directly minimizes the distance ween poisoned and clean representations. Note that Type III attacks allow the attackers to take control of the training process. Though our threat model does not require this additional capability attackers, we follow this assumption when implementing these attacks. Therefore, we directly select samples based on ResNet18 and VGG16 rather than using ResNet18 as surrogate model. We conduct 3 representative defenses that are applicable for this type of attacks NC, STRIP, FP. We follow the default settings to implement these attacks and defenses. We set c= 0.37 which matches the poison rate p 0.1 in the original settings of backbone attacks. Results on Cifar10 and Cifar100 are presented in Table 3
Performance comparison. Except for the common findings in previous attacks, where CBS consistently outperforms baseline methods in nearly all experiments, we observe that the impact of CBS varies when applied to different backbone attacks. Specifically, CBS tends to yield the most significant improvements when applied to WB, while its effect less pronounced when applied to WaNet. For example, when confronting FP and comparing CBS with both Random and FUS, we observed an increase in ASR of over 7% WB. In comparison, the increase on WaNet amounted to only 3%, with Lira showing intermediate results. This divergence may be attributed to the distinct techniques employed by these attacks to enhance their resistance against defenses. WB focuses on minimizing the distance between poisoned samples and clean samples from the larget class in the latent. space. By selecting boundary samples that are closer to the larget class, WB can reach smaller loss than that optimized on random samples, resulting in improved resistance. The utilization of the fino-tuning process and additional information from victim models in Lira enable a precise estimation of decision boundaries and the identification of boundary samples. WaNet introduces Gaussian noise to some randomly selected trigger samples throughout the poisoned dataset, which may destroy the impact of CBS if some boundary samples move away from the boundary after adding noise. These observations suggest that combining CBS with proper trigger designs can achieve even better performance, and it an interesting topic to optimize trigger designs and sampling methods at the same time for more stcalthiness, which leaves for future exploration.
5.5
CBS with Partial Backdoor
We investigate scenarios where attackers can only manipulate partial training data. Specifically, we conduct experiments the ResNet18 model using the Cifar10 dataset, employing the BadNet attack method with various sampling strategics. We designate different subset rates (10% 5%, 1%) of the training set as accossible to the allacker, who can only poison this fraction of the data. From their accessible data, altackers insert triggers into 10% of the samples. The effectiveness of these attacks, under different defense mechanisms, is evaluated. Our findings, presented in Table 4 demonstrate that our method effectively enhances the stealthiness of backdoor attacks, even with limited data access. This underscores the practical potential of our approach in real-world situations where attackers cannot access the entire training dataset.
13

---

Published in Transactions on Machine Learning Research (11/2024)
HighConfidence(999.3
LowConfidence(03.5
Random(99.8 9)
31.3
30
23.7
24.6
20.2
19.6
1.688
0.4
0.5
0.4
0.4
0.6
0.9
0.5
1.1
0
SS
SPECTRE
STRIP
ABL
Figure 6: Illustrating impacts of confidence.
Table 4: Experiments for partially poisoned data. Conducted on model ResNet18 and dataset Cifar10, attacking method BadNet incorporated with different sampling methods.
Subset rate
Random
FUS
CBS
10%
99.9
99.9
93.7
No defenses
5%
98.4
99.7
92.9
1%
97.2
99.7
92.3
10%
1.2
6.8
15.7
5%
0.9
5.3
12.4
1%
0.6
2.8
8.5
10%
2.7
8.2
14.4
NC
5%
1.4
6.5
10.7
1%
2.2
5.3
8.4
10%
1.5
4.9
13.2
Strip
5%
0.9
1%
0.5
2.8
7.2
5.6 Ablation study
Impact of Threshold one key hyperparameter in CBS determine which samples are around the boundary, and to study the impact e, conduct experiments different Since the size of the poisoned set generated by different is different, we fix the poison rate to be 0.1% (50 samples), and for large that generates more samples, we randomly choose 50 samples from it to form the final poisoned set. We consider = 0.1, 0.15 0.2, 0.25, 0.3, and conduct experiments on model ResNet18 and dataset Cifar10 with BadNet as the backbone. Results ASR under no defense and defenses are shown in Figure 5 It is obvious that the ASR for no defenses increasing when inereasing. We notice that large e (0.25,0.3) has higher ASR without defenses but relatively small ASR against defenses, indicating that the stealthiness of backdoors is reduced for larger For small (0.1), ASR decreases for either defenses against defenses. These observations suggest that samples too close too far from the boundary can hurt the effect of CBS, and a proper e is needed to balance between performance and stealthiness.
Impact of confidence. Since our core idea is to select samples with lower confidence, we conduct ex- periments to compare the influence of high-confidencee and low-confidence samples. In detail, we select low-confidence samples with 0.2 and high-confidence samples with e 0. We still conduct experi- ments ResNet18 and Cifar10 with BadNet, and the ASR is shown in Figure 0 Note that low-confidencee samples significantly outperform the other 2 types of samples, while high-confidence samples are even worse than random samples. Therefore, these results further support our claim that low-confidence samples can improve the stealthiness of backdoors.
Here we refer the different direction of Fq L.c. (sc(f(z;))) sc(((r;)))))
14

---

Published in Transactions on Machine Learning Research (11/2024)
We also conduct experiments to study the effect of poisoning rate, and due to the page limit, we include it in Appendix 8.9
6 Conclusion
In this paper, we highlight crucial aspect of backdoor attacks that was previously overlooked. We find that the choice of which samples to poison plays significant role in model's ability to resist defense mechanisms. To address this, we introduce a confidence-driven boundary sampling approach, which involves carefully selecting samples near the decision boundary. This approach has proven highly effective improving an attacker's resistance against defenses. It also holds promising potential for enhancing the robustness of all backdoored models against defense mechanisms.
7
Acknowledgment
This project supported by MEXT KAKENHI Grant Number 24K03004 and SPS KAKENHI Grant Number 24K20806.
References
Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdoep Mukhopadhyay. Adversarial attacks and defences: survey. arXie preprint or
2018.
Bryant Chen, Wilka Carvalho, Nathalic Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Loc, Ian Mol- loy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXic:1811.08723 2018
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint 1il.11552555 2017.
Khoa Doan, Yingjie Lao, and Ping Li. Backdoor attack with imperceptible input and latent modification. Advances in Newral Information Processing Systems, 34:18944-18957 2021a.
Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 11966 11976, 2021b.
Alhussein
Fawzi, Soyed-Mohsen Moosavi-Dezfooli, Pascal Frossard, and Stefano Soatto. Empirical study of the topology and geometry of deep networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 3762-3770, 2018.
Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, pp. 113-125, 2019.
Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg, Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv: 201.707880077..3 2017.
Xingshuo Han, Yutong Wu, Qingjie Zhang, Yuau Zhou, Yuan Xu, Han Qiu, Guowen Xu, and Tianwei Zhang, Backdooring multimodal learning. In 2024 IEEE Symposium Security and Privacy (SP), pp. 31-31. IEEE Computer Society, 2023.
Jonathan Hayase, Weihao Kong, Raghav Somani, and Sewoong Oh. Spectre: Defending against backdoor attacks using robust statistics. In International Conference on Machine Learning, pp. 4129 4139. PMLR, 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. Proceedings of the IEFE conference on computer vision and pattern recognition, pp. 770 778,7 2016.
15

---

Published in Transactions on Machine Learning Research (11/2024)
Ching-Kang Ing and Tze Leung Lai. A stepwise regression method and consistent model selection for high- dimensional sparse linear models. Stalistica Sinico, pp- 1473-1513) 2011.
Hamid Karimi, Tyler Derr, and Jiliang Tang. Characterizing the decision boundary of deep neural networks. arXiv preprint 1rXxi:1912.114400 2019.
Alaa Khaddaj, Guillaune Leclere, Aleksandar Makelov, Kristian Georgiev, Hadi Salman, Andrew Iyas, and Aleksander Madry. Rethinking backdoor attacks. 2023.
Jonas Moritz Kohler and Aurelien Lucchi. Sub-sampled cubic regularization for non-convex optimization. In International Conference on Machine Learning, pp. 1895-1904. PMLR, 2017.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 7(7):3, 2015.
Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, and Xinpeng Zhang. Invisible backdoor allacks deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, 18(5):2088 2105, 2020.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingiun Ma. Auti-backdoor learning: Training clean models on poisoned data. Advances in Newral Information Processing Systems, 34:14900- 14912, 2021a.
Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE Transactions on Newral Networks and Learning Systems, 2022.
Yu Li, Lizhong Ding, and Xin Gao. On the decision boundary of deep neural networks. orXiv preprint arXiv:1808.0 05385, 2018.
Yuczun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran Hc, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEEE/CVF international conference on computer vision, pp. (6463-16477) 2021b.
Ziqiang Li, Penglei Xia, Hong Sun, Yueqi Zeng, Wei Zhang, and Bin Li. Explore the effect of data selection on poison efficiency in backdoor attacks. arXiv preprint arXiv:2310.09744 2023.
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg, Fine-pruning: Defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses, pp. 273-294. Springer, 2018.
Prasanta Chandra Mahalanobis. On the generalized distance in statistics. Sankhyā: The Indian Journal of Statistics, Series A (2008-), 80:S1 S7, 2018.
Anh Nguyen and Anh Tran. Wanet imperceptible warping-based based backdoor attack. arXiv:2102.1 10369, 2021.
arXiv preprint
Tim Pearce, Alexandra Brintrup, and Jun Zhu. Understanding softmax confidence and uncertainty. arXio preprint arXit:2106.04977 2021.
Xiangyu Qi, Tinghao Xic, Yiming Li, Saced Mahloujifar, and Pratock Mittal. Revisiting the assumption of latent separability for backdoor defenses. In The eleventh international conference on learning represen- tations, 2022.
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision (IJCV), 115(3):211-252. 2015. doi: 10. 10.1007/s11263-015--88
Aniruddha Saha, Akshayvarun Subramanya, and Hamed Pirsiavash. Hidden trigger backdoor attacks. Proceedings of the AT conference artificial intelligence, volume 34, pp. 11957- 11965, 2020.
16

---

Published in Transactions on Machine Learning Research (11/2024)
Zeyang Sha, Xinlci He, Pascal Berrang, Mathias Humbert, and Yang Zhang. Fine-tuning is all you need to mitigate backdoor attacks. arXiv preprint wrXiv2221.09006 2022.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint 1rxic:1409 1556, 2014.
Hossein Souri, Liam Fowl, Rama Chellappa, Micah Goldblum, and Tom Goldstein. Sleeper agent: Scalable
hidden trigger backdoors for neural networks trained from scratch. Advances in Neural Information Processing Systems, 35:19165-19178, 2022.
Di Tang, XiaoFeng Wang, Haixu Tang, and Kehuan Zhang. Demon in the variant: Statistical analysis of (DNNs) for robust. backdoor contamination delection. In 30th USENIX Securily Symposium (USENIX Security 21), pp. 1541,1558, 2021.
Mariya Toneva, Alessandro Sordoni, Remi Tachet des Combes, Adam Trischler, Yoshua Bengio, and Ge- offrey J Gordon. An empirical study of example forgetting during deep neural network learning, arXiv preprint 1oXi::811.05111 2018.
Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. Advances in neural information processing systems, 31, 2018.
Joel A Tropp et al. An introduction matrix concentration inequalities. Foundations and Trendoo in Machine Learning, 8(1-2):1-230 2015.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor atlacks. arXiv preprint arXiv:1912.022 02771, 2019.
Laurens Van der Maaten and Geoffrey Hinton. Visualizing data using t-sne. Journal of machine learning research, 9(11), 2008.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposiun on Security and Privacy (SP), pp. 707-723. IEEE, 2019.
Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. Back- doorbench: A comprehensive benchmark of backdoor learning. Advances in Neural Information Processing Systems, 35:10546- 10559, 2022.
Yutong WU, Xingshuo Han, Han Qiu, and Tianwei Zhang. Computation and data efficient backdoor attacks. In Proceedings of the IEEE/CVE International Conference on Computer Vision, pp. 4805 4814, 2023.
Pengfei Xia, Ziqiang Li, Wei Zhang, and Bin Li. Data-efficient backdoor attacks. arXiv preprint
arXiv:2204.1220 2022.
Pengfei Xia, Yueqi Zeng, Ziqiang Li, Wei Zhang, and Bin Li. Efficient trojan injection: 90% attack success rate using 0.04% poisoned samples. 2023.
Zihao Zhu, Mingda Zhang, Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu. Boosting backdoor attack with a learnable poisoning sample selection strategy. arXiv preprint arXiv:2307.07328, 2023.
17

---

Published in Transactions on Machine Learning Research (11/2024)
8 Appendix
8.1 Proofs for Section
Recall the settings in Section 4.3 in the main paper. Suppose two classes C₁ C2 form two uniform distribu- tions of balls centered at Mi, u22 with radius r in the latent space, i.e.
C pi()) मरय 1|| Milla S r), and C2 p2(x) .. 1|1|= Hella S rl
Both classes have n samples. Assume C₁, and trigger is added to such that 2 + et ||tl| 2 Then define the poisoned data U (1/(2) and C2 C1 U {i}. Then train backdoored SVM on the poisoned data. The following thcorem provides estimations for Mahalanobis distance which serves as the indicator of outliers, and success rate.
.......,,,, En from C2 together with the extra example I, the Ma- Proof of Theorem 4-2 Given n samples T1, .2....,
halanobis distance becomes
Ly (5, = Sz (i ji2); where N2 is the sample mean of the samples from C2 and the poisoned example ã = I + +e//||[]2. The notation $2 denotes the sample covariance matrix.
To show we need to study the behavior of üe and $
For ù2, following the vector Bernstein inequality in Kohler & Lucchì (2017). for some constants er and e2;
P
T U2
2
s <exp (-cint? + 02)
As result,
P (1
U2ll 2 t)
1 -/2 +
Ci
n
122
21
n 1
n+
n+ 1
1=1
S
| - 12l
2
t(n 8(n+11 + 1)
+
-
Σ
24 - 42
2 11 +
2
n 1=1
t(n + 1)
(n + 1)2
<
| pell
+ exp
(cq
+
2
where 1(-) is the indicator function. In terms of $2, it can be decomposed as
1
$2
c (2)(21 (22)T + + 1 (5 (22 T02)T
(24 42 + 12 f22) - + p2 -²2² + (i - (ē 122)
+
n
(z, - (2) - -T2) +
n n Σ (m2 - (22) - -H2)²
n+]
i=1
(m2 (1) PT) + (M2 - 122 722) n (5 1i2) 102)
71
Denote Eg the population covariance matrix of the samples in C22 and o; Rdd Following matrix Bernstein incquality in Tropp al. 2015), we obtain that for some Cs and ca,
(- czfn
Σ (x - p2) - -22 Σz 21 < 2dexp
n +
1 c,t)
18

---

Published in Transactions on Machine Learning Research (11/2024)
Besides, we also have
1
P
(12 12) 122)
26
n n+1
1
< P
|| j02
(xi (22)
n2 n+
1 n
)
P P1pp2 - -22l
2 P
Σ
(xt 12)
11 n+
As a result,
P ((| - Σ2ll 2t)
I P
1
(2: (2) - 122 - -2²
2 5
t
+ 2P
1
Σ
(22 (2) - 12)²
-5 (55
1
12 + 1 1=1
n+ 1=1
+P
(102 1i21?² >
n n+ tt)
+1 ( #2212
(n + 1)t
n 5)
< 2dexp (-
I (-1+ cal/5)
c2/5
+ 22( uell ビ 2P
1
Σ 1=1
(x; 12)
2
t
n +
561
+P (102 - T021 >
+ it n 3)
+1
|| أال 2
(n + 1)t
In terms of the inverse of 32, following similar steps for (A.6) in Ing & Lai 2011 we also have 35 -E²²
Σg - - -52) thus
P
[|| $1 - -x ||2)
P( (22 - 82)5; 2 t)
S (( || || S2 || || ' || 2 t)
= P P[|271
|E> - $21 2 t 1|$2
I P([
|| - -5,1 2 <[|E2|l - || - $2
= P (IE= 1 2 ||55
+|
Given the above probability bounds for to and 55 we can further bound the Mahalanobis distance
( - p2) 35'55'1 (3 - [i2) 4 12
P
,2 2t)
4||2|| 2t)
< P
( - M2 + k2 - ) 15/ - Σの¹ + +Σz )2 - 1/2 + H2 + (iz))
x2
4|
< P
( - m2) " Σσ (0- m2)
+1(E - " (3²² Σの ( 2222
p2
=
+2 )22 وΣ 3 ( μ2)1 + 11 /2) 22) ( 1221 2
< P || [|ā-ūūlll 1221
- وو
N 5) 3)
+ P || ا | || 72 12l 2 1)
+P || n2 1 335
Since the poisoned sample म is from C₁, and both C₁ and C2 are bounded, there exists some constant es so that || /22l| < c5 and || الحم < 5 uniformly for all possible choice of & and uniformly for all choices of
19

---

Published in Transactions on Machine Learning Research (11/2024)
{ri)i=1...... As result,
1|
P
3 12 p22)
2t
p2
1
6
S P
|5 Σ
P
1 1 - /22l
2
P
[1
3c5
30g
tr²
tr²
=
P
| Σ '11
3c5
+ P
j12 Hell N
12cs
+
|
u2ll
2
12
cat
Σ2 1|
2d exp
25 (3c
15 ||
1)2
5cal
02 (3cg)
122 1 + +1)
(1 + 1)
(-c1tf
(n 1)²
(n (n+ + 1)
+
2 1
|| pell
+ exp
+ +022)
+2exp
[c1
02
2
n
72 + 1
(n+ 1)t
t
(n + 1)3
+
1
- H2l
||
+ exp
-01 5
02
2
5n
n²
12 + 1
lr
1
(n + 1)2
+
1 μ2|
+ exp
+ 02
2
120s
144
n
+ 1
tr
fr
(n + 1)a + 02
+
T [2
exp
-C
2
12
n
When t is small while in is large enough, the indicator functions all become O. To simplify the above result, there exists some constants co, that when 2 no for some large constant no:
4| 2
p ( 222)" -52)
21 < cs exp (-o7En).
Proof of Theorem 4-3
To simplify the analysis, we first investigate the scenario of n - oo, and then discuss
the impact of finite n.
As shown in Fig 7a (for Random) and 7b (for CBS), for given sample (red point), == z 2 &
(blue point), where uI''t 2 0. Since C2 is not changed, the backdoored decision boundary (the bold black line) is determined by & and C1. Specifically, the decision boundary is determined by and center 141 Connect the center of C₁ with and we obtain au interaction point on Ci, which is fl + r T between it and 5 is
f-m and the center
11 +
7
3- + 3 2-
(5)
Then we can derive the equation for the backdoored decision boundary:
(6)
where we assume this decision boundary is not overlapped with Cz. During the inference, triggers will be added to samples in Oi which means that the circle of Ci will shift by ' (denoted as C1) as shown in Fig 7a and 7b then the yellow area will be misclassified Cz. Thus the success rate without any defenses is determined by the area of the yellow area. Since the circle of C₁ is fixed,
only need to compare the distance from the center of C₁ to the backdoored decision boundary, which is the bold green line in Fig 7a and 7b.. Notice that μ1 - ã is orthogonal to the decision boundary defined in Eq thus the length of the
green bold line is the length of ? T in the direction of μn - where & is the center of č, thus the distance
20

---

Published in Transactions on Machine Learning Research (11/2024)
is computed as:
(x) (2] - (M1 - σ)
1
111 +
1 11
2-
M1 +
(3 - 11)
|111 8112
1 11l
2
az (T M1)) 1 P1l
| M1ll
2
11 |
||a|| cos(a, (2)
2
The above formulation indicates that smaller || 1 -ill and cos(a, E 111 leads larger dn(2). Therefore, the closer the selected sample the decision boundary, the smaller the area of the yellow area is, and the smaller the success rate for the backdoored attack. Note that here only consider the case that a a 11) 2 0 otherwise the poisoned sample will remain in the original Ct. These results reveal the trade-off between stealthiness and performance.
1
(a) Random
(b) CBS
Figure 7: Illustrating figures for SVM under Random and CBS. The red point a sample x from C1, and the blue one the triggered sample न. The grey dashed line and black bold line represent the decision boundary of clean and backdoored SVM respectively. We are interested in the Mahalanobis distance between f and the target class Cz. The yellow area is in proportion to the success rate and the length of the green bold line is positively correlated with the area of the yellow part. It is obvious that CBShas smaller Mahalanobis distance and smaller area of yellow.
Denote F as the set of all linear functions which can separate Ci and C2, and define x² as the point of tangency of the common tangent line to two clusters and x" C₁, as shown in Figure
Proof of Theorem 4.5
Denote 8n = (log n)/ /n and
d1,ia- = min uf (I -11, =EC,
(7)
- -11,,
(8)
d maxzeC, 14 (x))). Then one can define the following regions for 1,..., [(d,, + A di di for some small positive constant A:
0=,== f Gillff pi) E (di, d1,min 5n))
21

---

Published in Transactions on Machine Learning Research (11/2024)
C2
C
P2
Gua
Figure 8: Illustration of impact of finite training samples.
CI, (o E Gillf( mi) E [di,min + kōn, di (k + 1)6,), sin(æ,
su si)( C1o = C1,022 = C1.0-
C1 = fo E CilleT (x - pn)l E [di,min + kó d1 + (k + 1)8n). sin(z,
inf sin(x',
C2 {x E C2lluf (x - p1) E (122,mxx - En; d22,ax]].. C2a,11 C2 C2
C2 = fo E C2llpT( - M2) E (d2,max (k + 1)6n, d2,max k6,]. sin p1)
sup,/EC2,-1.2 sinfs',
C2 fo C2lluT( Mn) (d2,max (k + 1)8,, d2, sin,,,,1 H1)
infx'C2a-112 sin(x',p1)
Note that all the above sets have no overlap with each other, and Figure..
Denote |C| as the area of a region C, then it is casy to see that for all C E {Ci,o, C.,.,h, , |C] = 22(log n) n//n). Suppose there are n samples in C1, then since all examples are i.dd. sampled uniformly from C1, we have for some constant e, for all C E CC..,,
P(Vi, x, CC) = (1
Cl xr②
(1
clog² n nxr²
As result, for both i 1,2,
dd. di,min On
P There exists at least one sample in each Co, and C.R.. for ke 1, 1....,
.j 1,2)
2 1 1+2 di.f - d1,min 1) (1 clog² n 12
8n
Based on the above, when taking n + 0o, all the Ci,..s and C.o regions have at least one sample falls in each them.
Given the above result, now we look at the minimum distance from the samples in C and C2 to any f F. For region C, denote d(C)- SSEC || æ2|1. Then for Cr,,, caleulate that
d d(Cr,2) = V/2² (r- + 2rōn.
For the other Ci one can also see that d(Cr,..)) O(V5n).
As result, if denote d(ʃ, C) as the distance from to region C, and d(J, (xx)iizz) then when all the Cikk and Cop regions have at least one sample falls in each of them, have uniformly for all f F,
d(f. C1) = inf C1,5)) = d(f. (xif(xi)zeeu (x:)),ecCin)) 0(v5.) = d(s. (xele + 0 0(von),
k3
22

---

Published in Transactions on Machine Learning Research (11/2024)
which also implies that the sample selected by CBSis O(Vō,))close to the point in C1 which is closest to C2. And when n > 00, 8n + O.
8.2
Implementation details
In this section, we provide details of attacks and defenses used in experiments as well as implementation details.
8.2.1 Implementations for samplings
We implement Random with uniform distribution on Dir. We implement CBS according to Algorithm 1 in the main paper, and the surrogate model is trained via SGD for 60 epochs with an initial learning rate of 0.01 and decreases by 0.1 at epochs 30,50. We implement FUS according to its original settings, i.c. overall iterations and 60 epochs for updating the surrogate model each iteration, and the surrogate model is pre-trained the same as in CBS.
8.2.2 Attacks
We will provide brief introduction and implementation details for all the backbone attacks implemented in this work.
Type I attacks:
BadNet (Gu et al,, 2017). BadNet the first work exploring the backdoor attacks, and attaches a small patch to the sample create the poisoned training set. Then this training set is used train a backdoor model. We implement. it based the code of work (Qi et. al. 2022 and following the default setting.
Blend (Chen et al. 2017). Blend incorporates the image blending technique, and blends the selected image with a pre-specified trigger pattern that has the same size as the original image. We implement this attack based on the code of work (Qi et al. 2022 and following the default setting, i.e. mixing ratio a = 0.2.
Adaptive backdoor (Qi al., 2022). This method leverages regularization samples to weaken the rela- tionship between triggers and the target label and achieve better stealthiness. We implement two versions of the method: slaptive-blend and Adaptive-patel During the implementation, consider the conservatism ratio of 0.5 and mixing ratio = 0.2 for adaptive-blend; conservatism ratio v 2/3 and patches for Adaptive-patch.
Type attacks:
Hidden-trigger (Saha et. al., 2020). This attacking method first attaches the trigger a sample and then searches for an imperceptible perturbation that achieves a similar model output (measured by l2 norm) the triggered sample. We follow the original settings in work (Saha al.) 2020 i.c. placing the trigger at the right corner of the image, setting the budget size 16/255, optimizing the perturbation for 10000 iterations with a learning rate of 0.01 and decay by 0.95 for every 2000 iterations.
Label-consistent (LC) Turner et al., 2019). This attacking method leverages GAN or adversarial examples to create the poisoned image without changing the label. We implement the one with adversarial examples bounded by norm. We set the budget size as 600 to achieve a higher success rate.
Type III attacks:
Lira DDaan et al., 2021b). This method iteratively learns the model parameters and trigger generator. Once the trigger generator is trained, attackers will finetune the model on poisoned samples attached with triggers generated by the generator, and release the backdoored model to the public. Our implementation is based on the Benchmark (Wu et al. 2022).
WaNet (Nguye Tran 2021). WaNet incorporates the image warping technique to inject invisible triggers into the selected image. To improve the poisoning effect, they introduce special training mode
23

---

Published in Transactions on Machine Learning Research (11/2024)
that add Gaussian noise to the warping field to improve the success rate. Our implementation is based the Benchmark (Wu et al. 2022).
Wasserstein Backdoor (WB) (Dann et al., 2021a). This method directly minimizes the distance between poisoned samples and clean samples in the latent space. We follow the original settings, ie. training epochs for Stage T and 450 epochs for Stage II, set the threshold of constraint as 0.01.
8.2.3 Defenses
Outlier detection defenses:
Spectral Signature (SS) (Tran et al., 2018) This defense detects poisoned samples with stronger spectral signatures the learned representations. We remove 1.5 p of samples each class.
Activation Clustering (AC) (Chen et al., 2018). This defense is based the clustering of activations of the last hidden neural network layer, for which clean samples and poisoned samples form distinct clusters. We remove clusters with sizes smaller than 35% for each class.
SCAn (Tang et al., 2021). This defense leverages an EM algorithm to decompose an image into its identity part and variation part, and detection score is constructed by analyzing the distribution of the variation.
SPECTRE (Hayase et al., 2021) This method proposes novel defense algorithm using robust covari- ance estimation to amplify the spectral signature of corrupted data. We also remove 1.5 of samples in each class.
STRIP (Gao et al., 2019). STRIP a samitation-based method relying on the observation that poisoned samples are easier to be perturbed, and detect poisoned samples through adversarial perturbations.
Other defenses:
Fine Pruning (FP) (Liu et al., 2018 This is model-pruning-base backdoor defense that eliminates model's backdoor by pruning these dormant neurons until certain clean accuracy drops.
method that restores triggers by optimizing the input domain. It based on the intuition that the norm of reversed triggers from poisoned samples will be much smaller than clean samples.
Neural Cleanse (NC) (Wang et al., 2019). This is a
Anti- Mati-Backdoor Learning (ABL) (Li et al., 2021a). This defense utilizes local gradient ascent isolate 1% suspected training samples with the smallest losses and leverage unlearning techniques to train cleansed model on poisoned data.
8.3 Algorithms
In this section, provide detailed algorithms for CBS and its application Blend (Chen al.
201
As shown in Algorithm in the main paper, CBS first pretrain a surrogate model f(;;0) on the clean training set Drr for E epochs; then f(; is used to estimate the confidence score for every sample; for given target y", samples satisfying [s 0)),. - s=([(x; y))y S e are selected as the poison sample set U.
As shown Algorithm 2 the poison sample set is first selected via Algorithm 1; then for each sample U, trigger is blended to this sample with a mixing ratio via z' =a+t+ (1 a) x and generate the poisoned training set Dp-
24

---

Published in Transactions on Machine Learning Research (11/2024)
All data
data Random
2000
Random
2000
Boundary
Boundary
Freguency
1500-
Frequency
1500
1000
1000
500
500
10
12
8
10 12
do
do
(a) BadNet
(b) Blend
Algorithm 2 BBend+CBS
Input Clean training set Der = ((,,, Wo surrogate model f(:0), pre-train epochs F., threshold 6, target class y', mixing ratio trigger pattern
Output Poisoned training set Dr
Initialize poisoned training set Dr
Select poison for U do
from Der via Algorithm
Inject triggers samples: a' =ast+++ (1=
D2 = D, U (2')
end for Return poisoned training set Dp
8.4 Discussion of computation overhead of CBS
Since CBS selects samples based on confidence score a clean model, it is necessary to analyze its computation overhead compared with simple random selection. Suppose the sample size is N, poison rate is For the random selection, we need to randomly select rN samples from the dataset and the time complexity is OrrN). For the proposed method, select those smaller than e. Suppose the average time for computing the confidence score for sample is I, and the time complexity for the proposed method is O(N(L ( 1)). Therefore, both complexilies are in the linear order of sample size N. When the inference time is shorter, CBS is more efficient.
need to first compute the confidence score for each sample and then
8.5 Details for the discussion in Section
We provide more details for the discussions in Section 4.1
Additional figures. To supplement Figure we present the distributions of distance do for different selections of samples. In specific, in Figure we present the kernel density curve of cach category for a clearer comparison, and this why there are curves in the negative region. In the real data of distances, all values are non-negative. The original histograms can be found in Figure 9a and Figure 9b
Formal definition of do and de- We also provide the formal definition of distances do and de for clearer understanding. Assume sample æ comes from the class and the target class is yt, model f mapping from input space to the latent space, classifier mapping from latent space to label space. We then can define the center of samples in class y and yt the latent space as: f(x) = D( E(r f(z'), f ((z)) model and backdoored model respectively. Then we can define d,y dl as:
H( we.. f(z'), where f denote the clean
dx(x) = [=](x)) f(x) d=x):= 115(x + - Meayll
25

---

Published in Transactions on Machine Learning Research (11/2024)
Additional discussion of stealthiness. In this work, we focus on the "stealthiness' that poisoned sam- ples are separable in the latent space given the labels. Assume the backdoored model f mapping from input space to the latent representation space, classifier 9 with label space Y, sample I and trigger t, and also assume the true label for x as y, the triggered label is yt. i.c. 9(f(z)) = and g(f(x + t)) = y where x x+ denote the combination of input and trigger Then the stealthiness measured by the distance between poisoned sample x + and the center of clean samples from the target class Ye the latent space, i.e. d(f(x+ t), [()) where f(x))ymmen = [( Ey f(x'). A larger distance means the poisoned sample is separated from the target class and therefore easy to detect, and vice versa.
In the proposed method, since we take the model output before the last linear layer the latent representa- tion (for example ResNet18), selection based the confidence score is equivalent to that directly based the latent representation. To provide some more details, visualize two classes in Cifar10. In the Figures 10a 10b there are two clusters with different colors. The blue one is the target class, the green one is the original class, and the red points are the poisoned samples. These verify our stalements. In the random selection case, since the poisoned samples are far away from the blue cluster, with the label as the blue class, they are more likely be identified by the defender. For boundary selection, the poisoned samples are less likely to be detected.
Besides the formal definition above, would like to clarify that from more general perspective, the "stcalthiness" of an attack is to what extent the attack can be defended. Since defenses are based on different insights, for instance, Spectral Signature (SS) is based on outlier-detection while anti-backdoor (ABL) is based on the fact that poisoned sample is learned faster than clean data, it is hard to find a formal definition for "stealthiness" accommodating all defenses. In our experiments, we test different defenses and the reduction of success rate measure the "stealthiness" (smaller reduction means better resistance against defenses thus more stealthiness).
(a) Random selection
(b) Boundary selection
8.6 Type III Backdoor Attacks
Due to the page limit of the main text, we present details and comprehensive experimental results in this soction.
Attacks & Defenses. We consider 3 Representative attacks in this category Lira DDoan al. 2021b) which involves a stealthy backdoor transformation function and iteratively updates triggers and model pa- rameters; WaNet (Nguyen & Tran 2021) which applics the image warping technique to make triggers more stealthy; Wasserstein Backdoor (WB) (Doan el al., 2021a) which directly minimizes the distance bet ween poisoned and clean representations. Note that Type III attacks allow the attackers to take control of the training process. Though our threat model does not require this additional capability of attackers, we follow this assumption when implementing these attacks. Therefore, we directly select samples based on ResNet18 and VGG16 rather than using ResNet18 as surrogate model. We conduct 5 representative defenses that
26

---

Published in Transactions on Machine Learning Research (11/2024)
are applicable for this type of attacks SS, NC, STRIP, FP, Activation Clustering (AC) (Chen et al. 2018 including both detection-based (SS,TRIIP, AC) and non-detection-busee (NC, FP). We follow the default settings to implement these attacks and defenses (details in Appendix (.2). We set e = 0.37 which matches the poison rate = 0.1 in the original scttings of backbone attacks. Results on Cifar10 and Cifar100 are presented Table
Performance comparison. Except for the common findings in previous attacks, where CBS consistently outperforms baseline methods in nearly all experiments, we observe that the impact of CBS varies when applied to different backbone attacks. Specifically, CBS tends to yield the most significant improvements when applied to WB, while its effect is less pronounced when applied to WaNet. For example, when confronting FP and comparing CBS with both Random and FUS, we observed an increase in ASR of over 7% on WB, while the increase on WaNet amounted to only 3%, with Lira showing intermediate results. This divergence may be attributed to the distinct techniques employed by these attacks to enhance their resistance against defenses. WB focuses on minimizing the distance between poisoned samples and clean samples from the target class in the latent space. By selecting boundary samples that. are closer to the larget class, WB can reach smaller loss than that optimized fine-tuning process and additional information from victim models in Lira enable a more procisc estimation of decision boundaries and the identification of boundary samples. WaNet introduces Gaussian noise to some randomly selected trigger samples thronghout the poisoned dataset, which may destroy the impact of CBS if some boundary samples move away from the boundary after adding noise, These observations suggest that combining CBS with proper trigger designs can achieve even better performance, and is an interesting topic to optimize trigger designs and sampling methods at the same time for more stealthiness, which leaves for future exploration.
random samples, resulting in improved resistance. The utilization of the
8.7 Additional experiments
In this section, we provide additional experimental results.
Type I attacks. We include additional defenses: Activation Clustering (AC) (Chen et al. 2018), SCAn
(Tang et al. 2021h, SPECTRE (Hayase et al.) 2021 ) Fine Pruning (FP) (Liu ct al. 2018). We also conduct experiments on 100a Results of Type I attacks on Cifar10 and Cifar100 datasets are shown in Table B and 7 respectively. CBS has similar behavior on (ffa1000iimprn the resistance against various defenses while slightly decrease ASR without defenses.
Type II attacks. We also include additional defenses: Spectral Signature (SS) Tran et al. 2018 The results of all defenses on model R8sNet18, VGG16 and datasets Cifar10, C0 are presented in Table Detailed analysis is shown in Section 5.3 in the main paper.
Clean accuracy. We also report the accuracy of clean samples (without triggers) on the backdoored models of all three sampling methods. Results are shown in Table g Tt is clear that CBS can reach better clean accuracy than other selections, which makes it more stealthy. To intuitively explain this, since the poisoned samples are around the original decision boundary, they do not severely change the decision boundary, thus preserving a high clean accuracy when no attack is injected in the testing data.
Imng-ema datasct. Excopt for Cifar10 and Cifar100, we also conduct experiments on a larger dataset Tiny-ImageNel (Le & Yang 2015). We also train model ResNet11 for 60 epochs to select the poisoned samples for each sampling method. Results are shown in Table [0] These results demonstrate that CBSis applicable to larger datascts and consistently improves the stcalthiness of different attacks.
ImageNet-1k dataset. We also consider a large-scale dataset, ImageNet-1k (Russakovsky et al., 2015); which has 1000 object classes and more than 1,200,000 images. We test representative backbone attacks from all three types and representative defenses. Since FUS is timo-consuming and not eligible for large datasets, we only compare CBS with the random baseline. Results are shown in Table II CBS still effective even such big dataset.
27

---

Published in Transactions on Machine Learning Research (11/2024)
Table Performance on Type III backdoor attacks.
Model Defense
ResNet18 FUS
VGG16
Attacks
Random
CBS
Random
FUS
CBS
Lira
91.5+1.4
92.9++.77
88.2-0.8
98.3+0088
99.2+0.5
93.6+0.4
No Defenses
WaNet
90.3+1.6
91.4+1.3
87.9-0.7
96.7+1.4
97.3+0.9
94.5+0.5
WB
88.5+22.1
90.9+1199
86.3=1.2
91.1+111
95.7+0.88
92.8+0.7
Lira 90.7+2.11
90.8+1.4
91.1+00.9
90.5+3.11
89.8+2.3
91.2+1.2
AC
WaNet
90.5+1.3
89.6+0.9
89.9-0.6
90.8++3.5
91.5+2211
90.4+1.4
WB
87.112.3
87.711.5
88.211..
90.4422.8
89.5
91.1+10.9
Lira
86.5+2.7
89.6+1.6
90.1+1.3
90.5+22.5
91.3+1.6
90.1+1.1
SS
WaNet
87.4+3.1
89.4+1.5
88.2+1.4
90.64-2.6
90.8+1.11
91.2++077
CIFAR1O
WB
86.442.8
86.1+2.3
88.111.7
87.623.2
88,242.5
89.911.3
Lira
10.3+1.6
12.5+1.1
16.1+0.7
14.9+1.5
18.3+1.11
19.6+0.8
NC
WaNet
8.9+1.5
10.1+1.3
13.4+0099
10.5+1.1
12.240.7
13.7+0.9
WB
20.712.1
19.6#1.2
27.210.6
23.1+13
24.910.8
28.710..5
Lira
81.5+3.2
82.3+2.3
87.7+1.1
82.8+-244
81.5+1.7
84.6+1.3
STRIP
WaNet
80.243.4
79.7+-2.5
86.5+1.4
77.64-3.1
7..3+2.2
78.2+1.5
WB
80.1+2.9
81.71.8
86.611.2
83.422.7
82.611.8
87.3
Lira
6.7+1.7
6.2+1.2
12.5+0.77
10.4+1.1
9.8+0.8
13.3+0.6
FP
WaNet
4.81133
6.1
8.2.0.8
6.840.9
6.410.6
8.310.4
WB
20.8+2.3
21991.7
28.311.1
25.7+1.3
26,211.2
29.110.7
Lira
98.2+0.7
99.3+0.22
96.1=1.3
97.1+-0.8
99.3+0.4
94.5+
No Defenses
WaNet
97.7+00.9
99.1+10.4
91.3=112
96.3+1122
98.7+0.9
94.1+00.7
WB
95.110.6
96.4+1.1
94.7=0.9
93.2:10.9
96.7:0..4
91.940..
Lira
83.5+2.6
82.4+199
87.1+1.3
85.24-2.8
85.7+-2.1
81.2+1.2
AC
WaNet
82.742.88
82.14-2.1
86.34-0.9
83.84-3.1
84.2+1.8
85.1+0.9
WB
83.2+2.4
84.9#1.6
90.2+1.2
90.5+2.44
8..3
91.8:10.9
Lira
93.2+1.7
94.6+1.33
92.8=0.8
91.8+11.9
90.7+11.3
92.1+0.7
SS
WaNet
92.4+1.9
93.3+1.0
92.7=0.6
90.5++2.33
90.1+1.4
90.3+1.11
CIFAR100
WB
9..9+1.3
92.7+0.8
94.110.9
90.1+2.1
90.4+1.6
92.5+0.8
Lira
0.2+00.1
1.7+1.2
5.8+0.9
3.4+0.77
3.9+1.0
5.2+009
NC
WaNet
1.6400.8
3.11.33
5.2+0.8
2.940.66
2.540088
1.141.22
WB
7.741.5
7.320.9
13.710.7
8.5+1.3
7.640.9
11.910.7
Lira
84.3+2.7
83.7+=1.5
87.2+1.1
82.7+22.5
83.4+1..8
83.8
STRIP
WaNet
82,5+2.4
8241.6
83.910.9
81.422.7
8..5+1.7
82,0+0.8
WB
85.8+1.9
86.4+1.2
88.1
82.9+2.4
82.3+1.5
84.5+1.4
Lira 87.1+1.9
88.2+1.11
89.9+0.9
82.543322
81.842.1
86.7+1.1
FP
WaNet
86.7+1.7
86.310.9
89.310.7
81.742.9
82.1+1.8
85.6+1.3
WB
89.2+1.5
89.7+0.7
92.1
83.642.4
83.3+1.7
87.910.8
GTSRB dataset. GTSRB is a traffic sign recognition benchmark, consisting of traffic signs, and is a different real-world scenario than the standard Cifar10 dataset. We also test representative backbone attacks from all three types and representative defenses. Results are shown in Table II
8.8 Additional discussion effectiveness-seeltthines tradeoff
As discussed in Theorem 4.2 and Remark [.8] there exists an irtettiveness-teeathhiie tradeoff for attacks. In general, when selecting samples closer the decision boundary, is harder to detect but will sacrifice some poisoning effect when facing no defenses. This is also verified by our empirical results in Table Table and Table where CBS has the worst performance when there is defense.
28

---

Published in Transactions on Machine Learning Research (11/2024)
Table Full Performance on Type I backdoor attacks (Cifarl0).
Model Defense
ResNet18 FUS
ResNet18 VGG16
Attacks
Random
Random
FUS
BadNet
99.910.2
99.910.1
93.610.3
99.710.1
99.910.06
94.510.4
Blend
89.7+1.6
93.1+1.4
86.5+0.6
81.6+13
86.2+0.8
78.3+0.6
No Defenses
Adapt-blend
76.5+1.8
78.4+1.2
73.6+0.6
12.2+1.9
74.9+1.1
68.6+0.5
Adapt-patch
97.511.2
98.640.9
95.110.8
93.1114
95.2400.7
91.400.6
BadNet
0.6=0.3
4.7=0.2
23.2=0.3
1.940.9
3.620.6
11.8=0.4
Blend
43.7::3.4
4..61:177
55.7:0.99
16.51223
17.4199
21.5:00.8
SS
Adapt-blend
62+2.9
615+14
70.1=0.6
38.2#3.1
36.1+1.7
43.2=0.9
Adapt-patch
93.1+2.3
92.9+1.1
93.7=0.7
49.142.7
48.1+1.3
52.9=0.6
BadNet
0.620.3
14.210.9
20.5.0.7
5.741.2
5.311.3
10.5
Blend
77.112.8
79.612.6
87.8114
83.113.5
83.212.4
81442.1
AC
Adapt-blend
76.8+2.1
76.1+1.4
79.3+1.6
69.9+2288
70.6+1.5
73.1+1.2
Adapt-patch
97.522.6
94.211.7
96.620.9
92.442.7
93.2+1.4
91.3113
BadNet
0.7=0.4
10.7#1.2
23.5=0.8
12.4=155
10.7#1.2
26.4=1.1
Blend
84.4.13.4
83.612.55
78.312.6
50.613.2
82.112.44
78.2.0.9
SCAn
Adapt-blend
78.2.1..6
77.512.11
81.
71.9125
71.112.1
74.411.3
Adapt-patch
97.5+0.9
94.1+0.8
96.9+0.4
93.1+1.1
93.8+0.9
91.5+0.5
BadNet
0.4+0.2
8.5+0.9
26.2+0.8
0.8+0.3
9.6+
15.7+1.2
Blend
54.742277
37.211.6
60.6.0.9
49.1123
50.611.7
56.9-0.8
STRIP
Adapt-blend
0.7+0.2
5.5+1.8
8.6
1.8+0.9
3.9+1.1
6.3
Adapt-patch
21.311.11
2..6
1..8
26.5+1..7
27.8:1133
29.7:10.5
BadNet
0.9.0..5
10.111.4
19.
0.7.0.33
8.711.2
14.9
Blend
9.2+2.4
16.742.11
24.2+1.7
8.742.6
12.8+199
18.6=0.9
SPECTRE
Adapt-bleud
6943.5
66.8122.7
7..
67.913.2
65,2118
69.410.9
Adapt-patch
91,4+1.4
1.,4+1.2
93.1+0.7
92.5+2244
91.81144
92.1+1.2
BadNet 16.8+3.1
17.3+:2.3
31.3+119
14.2+-233
15.7++2.0
23.6+1..7
Blend
57.243..8
35.11:2.7
65.7:2..1
55.111.9
53.8
56.2+1.1
ABL
Adapt-blend
4.5-2.7
5.1-2.3
6.9-1.7
25.422.6
24.742211
28.3+1.7
Adapt-patch
5.212.3
7.411.5
8.7.1..3
10.8.2.77
11.1.11
13.9
BadNet 75,213.2
80.812.4
81.2.11.3
68.313.11
70.5.1..
73.711.1
Blend
79.5+3.7
81.5+2.4
80.4+1.5
70.2+-2.9
72.5+2.11
79.3+1..5
FP
Adapt-blend
77.5+2.7
75.3+2.3
77.4+1.2
65.1+3..4
64,242.77
68.5+1.6
Adapt-patch
97.511.1
92.74:2.3
96.310.9
93.412.2
93.311.7
93.7-0.8
BadNet 1.1-0.7
13.520.4
24.6+0..3
2.5+00.9
14.4=1.3
17.5=0.8
Blend 82.511.7
83.711.1
81.710.6
79.7.1.55
77.6.11.6
78.5.0.99
NC
Adapt-blend
72.4+2.3
71.+1.8
74.2+1.2
59.8+1.7
59.24112
62.1-0.6
Adapt-patch
222-0.7
6.6-0.5
14.3++.33
10.9+2.3
13.41144
16.2+0.9
To mitigate this limitation, design two strategies. The general idea is to balance the effectiveness- stealthiness trade-off to control the performance change of different defense methods. In the first strategy, we set lower threshold for confidence score during selection, iee E1 S [s,(f(z;; 0)), (o(f(z ()). S e2. The second strategy to mix the boundary samples with some random samples. We conduct experiments test. if these strategies can improve the performance on undefended models. We test with ResNet18 model, Cifar10 datasct, and backbone attacks are BadNet and Blended. For the first strategy, we set the threshold as [0.07, 0.25] (about 100 samples within this interval and a good balance between effectiveness and stealthiness), and for the second strategy, select 70% boundary samples and 30% random samples. The poison rate is 0.2%, i.c. 100 poisoned samples. We report the results of both undefended and 4 representative defenses in Table 2
It clear that both strategies can improve the attacking performance under no defenses and can achieve comparable performance with random sclections. The performance under defenses slightly reduced because the poisoned samples are easier detect by defense methods. Nonetheless, the performance still significantly outperfomms the baselines.
29

---

Published in Transactions on Machine Learning Research (11/2024)
Table 7: Full Performance on Type I backdoor attacks (Cifar100).
Model Defenses
ResNet18 FUS
ResNet18
VGG16
Attacks
Radnom
Boundary
Radnom
FUS
Boundary
BadNet
82.8+233
81.+1.5
78.1+0.9
83.142.6
86.
80.4+1.2
Blend
82.712.6
83.911.7
77.911.1
79.612.8
82.912.1
75.211.3
No defense
Adapt-blend
07.1+1.9
1..
64.5+0.7
70.6+2.4
1..1+1.5
69.3+0.9
Adapt-patch
78.2+1.
814414
75.12088
82.412.7
86.7118
83.1+1.1
BadNet
0.620.2
3.7+1.3
6.5=0.8
0.7+0.22
4.5=188
6.9=0.9
Blend
0.7.1..3
2.611..5
5.211.1
1.610.77
3.5-1.1 1.1
5.7.10.5
SS
Adapt-blend
7.3+1.7
4.8+133
5.7=0.7
12.8+19
11.7+1.3
15.6=0.7
Adapt-patch
9.512.1
10.911.7
14.2-1.2
10.512.1
11.3.1.2
14.9.0.3
BadNet
0.4+0.1
7.5+1.2
10.1
2.6+0.9
1.6
11.4+1.1
Blend
0.220.1
933223
11.9=1.7
3.41.55
7.6-1.2
9.720.8
AC
Adapt-blend
10.2225
18.74:2.1
23.5
3.44.2.3
4.2-188
6.7
Adapt-patch
13.542.1
21.7+1.3
26.8=1.0
5.2+1.6
5.7=1.2
7.4=0.9
BadNet
85.513.8
849113,2
83.212.1
78.312.
77.612.1
81.911.4
Blend
84.1+1.6
83.5+1.2
82.9+008
80.242.1
81.4+1.3
80.9+0.9
SCAn
Adapt-blend
69.712.7
68.741..8
72.6=1.1
68.813.4
69.421.6
67.911.5
Adapt-patch
71.7+1.5
71.3+0.9
73.9 0.7
81.9+2.7
81.2+166
82.1+1.1
BadNet
72.31277
71881.8
77.1
67.613.2
68.11224
73.711.3
Blend
83.243.2
82.942.5
82.841.6
71.942.7
71.2+1.6
75.1+0.9
STRIP
Adapt-blend
64.4.3.77
67.912.3
7..6
69.2.1288
70.8
68.510.77
Adapt-patch
67.8+2.5
67.5+1.7
72.7-1.3
74.7+119
75.4+1.3
73.5+0.8
BadNet 0.240.1
3.9214
7.320.6
0.6:0.22
2.5-0.7
4.1=0.5
Blend
0.6+0.2
12.4
14.7=0.5
9.5
1.3
14.7:00.9
SPECTRE
Adapt-blend
19.6+1.3
20.3=0.9
15.742.3
20.1+1.2
Adapl-patch
17.912.1
25.811.4
27.
19.3.11.9
20.5.11.3
21.6.10.7
BadNet
9.3+2.4
13.9+1.7
17.4-0.7
5.7+
9.6-1.5
10.2+1.1
Blend
20.812.7
22.7113
25.7=1.1
59.112.7
58.312.11
62.611.4
ABL
Adapt-blend
23.742.5
23.21..5
25.8=0.8
43.31332
44.822.7
46.411.6
Adapi-patch
19.8+1.8
2..4+1.2
21.9 1.0
45.8+-2.8
4..2+1.7
47.9+1.3
BadNet
29.4+2.7
30.1+1.4
35.3=0.9
61.8+3.5
63.7+22.1
64.1=1.6
Blend
67.212.8
68.112.3
71.1-1.1
73.112.9
72.7.11.8
74.211.3
FP
Adapt-blend
60.7+115
57.3+1.11
62.6=0.8
69.7+3.11
70.3+22.5
73.4+1.4
Adapt-patch
66.312.4
64.11119
69.7-1.2
70.112.55
69.711.8
69.511.5
BadNet 35.6++3.4
42.142.99
52.4
43.7433.2
44.8++2.5
49.
Blend 78.142.5
79.4=1.8
77.2#1.
68.442.4
69.2+11.
72.3+1.1
NC
Adapt-blend
66.9.11.7
64.2.11.
70.3 0.9
66.2.1.77
65.4.11.4
67.810.6
Adapt-patch
18.3+1.3
19.5+0.9
23.6=0.4
2.7+0.7
4.1=1.2
4.6=0.8
8.9 Ablation study on poisoning rate
We conduct additional experiments on Cifar10 dataset, ResNet18 model and backbone attack BadNet to test how different poisoning rate affect the proposed mothod. We report the success rate against undofended models and three representative defenses in Table 13 According to the results, poisoning more samples can increase the success rate against undefended models, and slightly increase the poisoning effect against defenses. We notice that while the poisoning rate is incrcasing, the improvement of the poisoning effect against defenses becomes minor. This can be because when the number of poisoned samples increases, samples that are farther from the boundary are included. These samples can achieve better performance when there is no defense but are easy to detect. This also highlights the importance of a proper sample selection strategy in backdoor attacks.
8.10 Discussion on surrogate models
Our experiments in Table D shows that the poisoned samples generated from ResNet18 can be transferred well to VGG16. We further check whether different surrogate models select very different samples. We
30

---

Published in Transactions on Machine Learning Research (11/2024)
Table 8: Full Performance on Type II backdoor attacks.
Model Defense
ResNet18 FUS
ResNet18 - VGG16
Attacks
Random
CBS
Random
FUS
CBS
Hilden-trigger
$1.9+1.5
84.2+1.2
76.3+08
83.4-211
86.2+1.3
79.6+0.7
No Defeuses
LC
90.31:22
92.1=0.8
87.240.5
91.7=144
93.740.9
87.110.8
Hiideen-trigerr
6.3:1.4
5.9111
8.7:0.9
10.7=2.4
11.21:55
14.7:0.66
NC
8.942.1
8.14:16
12.641.1
11.3=2.6
9.811.1
12.940.9
CIFAR1O
Hidden-trigger
68.5.13.2
69.3-2.4
74.111.3
75.7=3.1
74.8::2.3
76.2
S8
LC
87.2=1.3
86.6:0088
86.9-10.5
85.422.7
85.5:1.8
84.241.2
Hulden-trigger
11.7+226
9.9++1.3
14.3+0.9
8.6+2.4
8.1++144
11,8+0.8
FP
LC
10.342.1
1.2
20.420.7
7.941.7
8.2
10.6=0.77
Hidden-trigger
1.740.8
5.641:6
10.511.1
3.611.1
8.820.8
10.4:0.6
ABL
LC
0.8:0.3
8.94
12.110.8
1.520.7
9.321.2
12.6=0.8
Ilideen-rigger
80.611211
84.1188
78.9113
78.2-23
81.41:6
73.811.2
No Defenses
LC
86.312.33
87.2=14
84.710.9
84.7=2.8
85,2+14
81551.1
Hidden-trigger
3.8+1.4
4.240.99
7.6+0.7
4.441.1
5.141.2
6.8-0.9
NC
LC
6.141.8
5.4:1.1
8.3:0.5
3.9:1.2
8.3=0.7
CIFAR100
Hliden-triggee
72.5+2266
71.9=1.7
7..7+1.2
75.3+33.1
74.8+2.1
73.1+1.3
SS
80.4=2.4
80.1=1.4
79.641.3
82.9=2.7
83.511.8
81.411.
Ilideen-trigerr
15.343.1
16.7=009
18.210.7
8.94133
9.3:1111
10.3:10.7
FP
LC
13.842.7
12.7=1.5
14.910.6
10.3=1.4
9.9400.8
12.2:0.5
Hrileen-triger
2.340.9
3.94:13
6.5:1.1
3.740.9
3.5:H0.7
6.4=0.4
ABL
LC
0.940.2
2.7::0.8
6.2.1.2
2.540.88
2.1:0.77
6.7=0.5
Table 9: Accuracy on clean input of each backdoored model with all three sample selections.
ResNet18
VGG16
Attack
Random
FUS
CBS
Random
FUS
CBS
BadNet
92.5
93.2
95.1
90.1
90.4
91.3
Blend
93.7
93.6
94.8
91.6
91.8
92.5
Adapt-blend
93.2
93.7
94.5
91.8
91.4
92.2
Adapt-patch
92.7
92.9
93.8
91.4
91.5
92.3
Cifar10
Hridgn-trigger
94.6
94.3
95.7
92.7
93.0
93.6
LC
93.5
94.2
94.9
92.8
92.5
93.4
Lira
94.2
94.1
95.1
92.6
92.8
93.3
WaNet
94.3
94.7
95.5
92.7
93.1
93.4
WB
93.9
94.2
94.9
92.6
92.7
93.2
BadNet
75.2
76.1
76.8
72.2
72.8
73.4
Blend
76.9
77.3
77.7
73.4
73.6
74.2
Adapt-blend
76.4
76.1
76.9
72.8
73.1
73.8
Adapt-patch
77.1
76.8
77.9
72.9
72.7
73.4
C0
Hidden-trigger
77.6
77.6
78.2
73.7
73.8
74.2
LC
76.8
77.1
77.6
73.6
73.7
73.9
Lira
77.6
77.4
78.1
73.8
73.6
74.3
WaNet
77.7
78
78.3
73.8
73.5
74.1
WB
77.5
77.3
78.2
73.5
73.6
74.3
compare ResNet18 and VGG16, and these two models have similar clean accuracy on the Cifar10 dataset (95.5% and 93.6% respectively). We fix class as the target class and seloct 100 samples using CBSfrom both models. We notice that 67% of selected samples are the same, which quite large proportion. This explain why our method transfer well from R8 to VGG16.
31

---

Published in Transactions on Machine Learning Research (11/2024)
Table 10: Performance of three types of backdoor attacks on Imageem dataset.
Attacks
Random
FUS
CBS
BadNet
89.5+0.8
89.8+0.2
83.1+0.6
Blended
83.4+1.2
85.2+0.3
81.6+0.5
No defenses
Adaptive-Blend Blend
67.2+0.7
68.9+0.4
66.2+0.7
Adaptive-Patch
84.5+11.1
86.3+0.3
81.7+0.5
BadNet
0.4+0.2
10.8+0.1
18.5+0.1
Type I
Blended
37.2+1.2
43.2+0.6
46.3+0.8
SS
Adaptive-Blend
59.4+0.9
61.7+0.4
65.1+0.6
Adaptive-Patch
75.3+1.3
76,5+0.2
78.5+0.4
BadNet 0.6+0.3
5.1+0.1
12.2+0.2
Blended
46.2+1.7
50.9+0.3
54.6+0.6
Strip
Adaptive-Blent
58.4+1.2
61.4+0.5
63.3+0.4
Adaptive-Patch
69.5+1.1
71.2+0.4
72.8+0.5
No defenses
Hidden-trigger
59.7400.8
62.9--0.3
54.3+0.3
Type II
NC
Hidden-trigger 5.3+0.7
8.5++..3
11.5+0.2
FP
Hidden-trigger
8.4+0.9
9.7+0..2
12.1+0.4
ABL
Hidden-trigger
1.8+0.6
2.6+0.2
4.2+0.4
WaNet
98.5+0.5
99.2+0.2
96.1+0.3
No defenses
LiRA
99.3+0.6
99.7+0.11
96.4+0.4
WB
98.240.4
99.5+0.22
92.7+0.2
WaNet
5.4+0.8
11.2++0.4
10.7+0.3
Type III
NC
LiRA
6.3+1.1
9.7++0.3
10.2+0.5
WB
9.6+0.8
13.5
15.1+0.4
WaNet
9.5+
12.6+0.2
13.6+0.4
FP
LiRA
8.7+1.2
10.7+0.3
13.8+0.3
WB
10.2+0.8
13.140.4
16.5+0.6
Table 11: Additional results on ImageNet-1k and GTSRB dataset.
ImageNet-1k Random
GTSRB Random
Attack
Defense
CBS
CBS
No defense
92.5
90.2
90.6
89.4
BadNet
NC
9.6
21.7
1.8
22.3
SS
6.9
19.3
1.2
18.4
No defense
83.2
80.5
78.5
75.3
Hidden trigger
NC
21.3
30.5
10.3
15.7
FP
32.6
39.1
19.8
24.7
No defense
98.1
94.3
98.6
96.4
WaNet
NC
15.9
25.2
17.4
23.8
SS
80.5
84.2
83.1
89.3
8.11
Discussion the difference between raw input space and latent space
CBS based on the observation that poisoned samples can be separate from the target class the latent space, which raises a question of whether detecting outliers in the raw space can defend against such an attack. To investigate, compare the distance between each sample and the center of its class in both
32

---

Published in Transactions on Machine Learning Research (11/2024)
Table 12: Two strategies to improve the poisoning performance when no defenses. CBS+1 and CBS+2 denote two strategies respectively.
Attack
Random
FUS
CBS
CBS+1
CBS+2
BadNet Blend
99.9
99.9
93.6
96.3
98.5
No defense
89.7
93.1
86.5
87.3
88.9
BadNet
0.5
4.7
20.2
18.8
17.5
ss
Blend
43.7
42.6
55.7
53.2
51.8
BadNet
0.5
8.5
23.7
22.3
20.9
STRIP
Blend
54.7
57.2
60.6
59.1
58.4
BadNet Blend
16.8
17.3
31.3
29.6
27.7
ABL
57.2
55.1
65.7
63.5
61.8
BadNet Blend
0.9
10.1
19.6
17.5
16.4
SPECTRE
9.2
16.7
24.2
22.1
21.3
Table 13: Ablation study on poisoning rates.
Test on ResNet18 model, Cifar10 dataset and BadNet attack.
Poison rate
0.1%(50)
0.2%(100)
0.5%((25)
1%00)
No defense
91.8
93.6
96.7
98.4
SS
18.7
20.2
23.5
24.2
ABL
27.4
31.3
33.1
34.8
NC
23.7
24.6
28.4
30.6
raw input space and latent space, i.e. draw(x) = ||I Ey.meanll and diatene(x) = -()yee) Il2 where (ax denote the latent representation w.r.t the model f. We use the backdoored ResNet18 model and Cifar10 dataset. Then we plot two distances in the same figure to check their relationship, shown Figure Based on the result, there is obvious relationship between them, and the outliers in the space have very small distance to the center in the latent space. This indicates that when filtering out the outlicrs based on distances in the raw space, the poisoned samples can still be preserved.
11
10
Latent space
10
25
Raw space
Figure 11: Relationship between the distance in the input space and latent space.
33

---

Published in Transactions on Machine Learning Research (11/2024)
To further validate, consider naive defense: ignore data points (z.y) y) from the training set if || Ty.meonl22 2 where mygm := mean(2")<x', ,) E dala). We follow Table [ and test on Cifar10 and ResNet18. We remove samples with 12 distance in the raw space larger than 18, which is about 12% of total samples. Then we train the model on the filtered dataset and test the success rate. We also consider BadNet and Blended as the backbone for illustration.
Table 14: Test on naive defenses that remove outliers in the raw input space.
Attack CBS
BadNet 93.6 Blend
No defense
86.5
BadNet 90.7
Naive defense
Blend
84.2
As shown in Table 14 the success rate after the naive defense does not drop much, which suggests that this defense can not effectively defend the proposed attack. Due to the difference between the raw input space and the latent space, the outliers in the raw input space may not be the actual poisoned samples.
34


Reviews:
[{"review_id": "2gWIhzJOCh", "reviewer": "Reviewer_nHsq", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n* The work takes a unique approach to backdoor poisoning based on sample selection for poisoning. The intuitive motivation of using poison samples that are close to the decision boundary, so that poisoned samples are closer to the typical sample in the target poison class, makes sense.\n* Experiments show significant improvement in attack effectiveness against representative defense methods.\n* The motivating plots in Figures 1 and 2 support the arguments made in the text.\n* The paper is well-written and easy to understand.\n\nWeaknesses:\n* The primary weakness of the proposed method is the significant decrease in the attack effectiveness against undefended models. This phenomenon is perhaps not highlighted as a limitation strongly enough. A solid explanation for this phenomenon and possible approaches for fixing it would greatly strengthen the paper.\n* The techniques used are fairly straightforward. Given the major drawbacks of the proposed method when it comes to attacks against undefended models, I wonder if developing the attack further could address this shortcoming.\n* This is not a major weakness, but it is worth wondering if the attack would be successful against a defender who was aware of this specific attack strategy.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This work studies the problem of crafting a backdoor trigger attack that can bypass existing methods for defending against backdoor attacks. The method is motivated by the observation trigger attacks produce samples that are far from the typical sample in the classifier latent space, which can be easily detected by defenders. To overcome this, the work proposes to replace random selection of samples for poisoning to selection of samples that are close to the decision boundary for a given poison target class (as selected by a surrogate model available to the attacker). Experiments show that the method can improve attack effectiveness against SOTA defense methods, at the cost of attack effectiveness for an undefended model.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "My main requested change is a clear discussion of the reduced effectiveness of the proposed method compared to other attacks on undefended models, and an explanation for this phenomenon.", "broader_impact_concerns": "Not discussed, but this does not impact my assessment.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "LNMNjqgwF3", "reviewer": "Reviewer_RvbD", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Strengths**\nThe core idea is intuitive. Poisoning samples closer to the decision boundary inflates the hardness of the learning task. \n\n\nThis reader perceives two important issues that the authors need to address.\n\n**Weakness 1 : Threat model.**\nThe threat model is weaker than one might think at first sight. The threat model requires access to the full training dataset. In Section 3.1, the following two consecutive sentences that discuss the threat model appear to be different scenarios.\n1)  “We assume that the attacker has access to the clean training set and can modify a proportion of the training data. Then the victim trains his own models on this data and the attacker has no knowledge of this training procedure.”\n2) “In a real-world situation, attackers can upload their datasets to the Internet. They can sneakily insert backdoors into their data and then share it with victims, who unknowingly use it to train their own models (Gu et al., 2017; Chen et al., 2017).”\n\nThe authors should be clearer about stating that their threat model defined in (1) above is not the same as the threat model discussed in (2). \n- The threat model requires access to a surrogate model trained on clean samples. \nCurrently, the impact of surrogate models is restricted to evaluation of the overall success rate of the adversarial attack. Can the authors discuss the effect of the surrogate model on the choice of poisoned samples. I.e., What is the variability in the choice of poisoned samples across different choices of surrogate models? \n- In Theorem 4.2, the authors assume that the attacker is aware of the mean of the clean data distribution (so that one can ensure that the trigger satisfies the constraint $(\\mu_2-\\mu_1)^Tt \\geq 0$  This is stronger than assuming access to i.i.d samples from the clean data distribution. Please explicitly mention that this is stronger than the threat model considered. \n\n**Weakness 2 : Informal presentation.** \nThe lack of formal definitions makes the writing unclear. \n\n- There is likely a version Theorem 4.2 that is correct and precise and makes a similar argument in spirit. However, the current statement and its proof arguments lack precision and ignore necessary details on the effect of randomness of sampling $C_1, C_2$ and $\\tilde{x}$.\n- Theorem 4.2 assumes a hard-margin exists. As a reader I would like to know when the hard-margin exists for a fixed trigger t that satisfies the constraint w.r.t $\\mu_1$ and $\\mu_2$? Presumably, this is a probability event over the randomness of the samples $C_1, C_2$ and the choice of input being targeted. Can the authors clarify and quantify this? In particular, the choice of trigger might restrict the choice of input that can be modified? It is unclear whether this allows for a uniformly random choice or CBS choice in the context of the SVM example.  \n- Page 17, “Let $n\\rightarrow \\infty$, we can obtain the result.”  The set $C_1$ and $C_2$ are random samples. Do the authors mean $$\\lim_{n \\rightarrow \\infty} \\mathbb{E}_{C_1 \\sim p_1, C_2 \\sim p_2, |C_1| = |C_2| = n} \\ldots?$$ To complete this argument one needs a prescription of the choice of $x \\in C_1$ that is modified with trigger t. Further, the choice of $x$ is random since $C_1$ is random and hence $\\|\\|\\tilde{x}\\|\\|_2$ is also random. \n- The authors should explicitly state the following distances (while keeping track of randomness of $C_1, C_2, \\tilde{x}$), $$d_M(\\tilde{x}_b, \\tilde{C}_2), \\text{ and } d_M(\\tilde{x}_u, \\tilde{C}_2)$$ \n- Re: Remark 4.4, why include the $n \\rightarrow \\infty$ in the theorem statement if it does not change the inference (given the above additional technical considerations)?", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This article investigates the role of sampling in the effectiveness of backdoor attack strategies. The authors advocate a sampling algorithm that prioritizes inputs if a surrogate model learned on clean data is uncertain on the predicted label. As a motivation, the authors suggest that their approach could help break defense strategies that rely on outlier detection in the latent representation space. Experimental evidence shows that CBS (confidence-driven boundary sampling) leads to stronger backdoor attacks on CIFAR10, CIFAR100, and TinyImagenet.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "**Potential Improvements**\n- Figure 1 suggests that CBS enables a mixing of the clean and backdoored samples in the latent representation space. Is this also true for the raw input space? Consider a backdoor defense algorithm that ignores data points (x,y) from the training dataset if $\\|\\|x - x_{y, median}\\|\\|\\_2 \\geq \\alpha$ \nwhere $x_{y, median} := \\mathrm{median} \\left(x’  | (x’, y) \\in \\text{ backdoored training data } \\right)$. Intuitively this defense algorithm aims to detect outliers in raw-pixel space rather than learnt representations. Can the authors comment on how CBS will work against this naive strategy? \n- One intuitive argument that could favor CBS vs random sampling is the clean accuracy of backdoored models on clean data. Intuitively one might expect that the clean accuracy is higher for CBS-based backdoored models since only data closer to the decision boundaries are modified. Can the authors report the clean accuracy of backdoored models across the 3 sampling choices - Random, FUS and CBS? \n\n\n**Technical Clarifications**\n\n- _Attack stealthiness_ is not formally defined. Even if the idea appears intuitive there is value in presenting a formal definition of this phenomena as either a separation in latent space or identifiability by a specific class of outlier-detection based defense algorithms. I understand that this is an empirical phenomena but a lack of formal definition obfuscates the inferences from resulting experiments. \n- “_As seen in Figures 2a and 2b, random sampling is likely to select samples that are close to the center of their true classes_” Why do the figures have negative points on the x-axis? Isn’t the x-axis a distance measurement? \n- The authors should clarify what the image generator $G_t (\\cdot)$ guarantees concerning trigger injection. For eg, how does the trigger $t$ manifest in the generated image? I assume $G_t(x)$ cannot be an identity function as that would ignore the trigger $t$, are there any formal constraints? This would help formalize the difference between a clean dataset and a trigger-embedded dataset.\n- “_To elaborate, we further calculate the distance (1) from each selected sample (without trigger) to the center (2) of their true classes computed on the clean model, which is denoted as $d_o$_” I request the authors to please explicitly define the distance $d_o$ rather than the informal description in the footnotes. \n- “_Formally, we define the distance between each selected sample (with trigger) and the center of the target class computed on the backdoored model, as $d_t$_”. Here the authors refer to the representation of the selected samples rather than samples themselves and similarly the authors refer to the average of the representations of samples with class - target label rather than the target class. It is unclear why the reader has to infer these instead of being presented with explicit definitions. At first read, there is a clear type mismatch in measuring distance between samples and a class label. \n- Page 16, The authors write $\\mathbb{E}\\_{x \\sim C_i}$ by which they presumably mean $\\mathbb{E}\\_{x \\sim \\mathrm{Uniform}(C\\_i) }$ i.e, the expectation is taken w.r.t the discrete uniform distribution on the finite set of vectors $C_i$. \n- Page 17, “select $x_b$ such that … $= \\min_{x \\in C\\_1} \\|\\|x- \\hat{\\mu}_2\\|\\|_2$, What is $\\hat{\\mu}_2$ do the authors mean $\\tilde{\\mu}_2$? \n\n**Minor Editorial Clarifications**\n\n- The following sentence is unclear and also has a typo “_Except for the promising results due to trigger designs in existing literature, sampling methods that select **poisonined** data to add triggers are attracting more attention._”\n- The following sentence is unclear due to _type mismatch_ (as explained above), “_Second, the closer a sample is from its true class on the clean model, the farther it gets from the target class on the backdoored model._” The sentence appears to compare the distance of a sample from a class, presumably the authors mean the distance of the same from the region assigned label c, if so, then there needs to be clearer formal definitions. \n- The following two sentences appear to convey the same idea. If I’m misunderstanding can the authors clarify the difference? “_For any given clean test set $D\\_{te}$, the accuracy of $f(·; θ\\_b)$ evaluated on trigger-embedded dataset $T(D\\_{te})$ is referred to as success rate, and attackers also expect to see high success rate on any clean samples with triggers embedded._”\n- In the definition of Trigger injection in Section (3.2), “$G\\_t(x)$ _is the attacker-specified poisoned image generator with trigger pattern $t$”. I think it will be helpful if the authors differentiate between the image generator function $G\\_t$  and the generated image $G\\_t(x)$. This will be consistent with the description of $S$ (instead of $S(x,y)$) as the target label generator. \n- Typo : “_This indicates a separation in latent space which can be easily detected by potential defenses. For example, Spectral **Siginiture** …_”\nIn page 16 and 17, I think the authors mean $d^2\\_M(\\tilde{x} , \\tilde{C}\\_2)$ rather than $d^2\\_M(\\tilde{x} , \\tilde{D}\\_2)$  or $d^2\\_M(\\tilde{x} , \\tilde{C}\\_{2,x})$.", "broader_impact_concerns": "Since the nature of this work concerns the safety of AI systems. I suggest the authors add a small section on the broader impact of designing efficient backdoor attacks.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "65t1LFQZLY", "reviewer": "Reviewer_X7j2", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n1.\tThe paper provides a solid theoretical analysis to support the proposed method, enhancing the credibility of the approach.\n2.\tThe paper is well-structured, with clear explanations of the problem, proposed solution, and experimental results.\nWeaknesses\n1.\tThe relationship between the poison rate and the effectiveness of CBS is not deeply explored, leaving some uncertainty about how the method scales with varying levels of poisoning.\n2.\tWhile CBS is presented as efficient, the paper could benefit from a more detailed discussion on the computational overhead compared to random sampling, especially for large-scale datasets.\n3.\tThe experiments primarily focus on standard datasets like CIFAR-10, which might not fully represent the method's performance in more complex or real-world scenarios. Testing on a wider variety of datasets would strengthen the evaluation.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper introduces Confidence-driven Boundary Sampling (CBS), a novel method that enhances the stealthiness of backdoor attacks in deep neural networks by strategically selecting samples near the decision boundary, identified through low confidence scores. This approach addresses the limitations of random sampling, which often makes attacks more detectable. CBS is versatile, theoretically supported, and can be integrated with various existing backdoor attack strategies, improving their stealthiness with minimal impact on attack success rates. Extensive experiments validate the effectiveness of the proposed method under different defense mechanisms.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "No", "audience_explanation": "", "requested_changes": "Please see weakness.", "broader_impact_concerns": "Not involved.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The paper introduces a novel and intuitive method for selecting examples for backdoor attack based on their distance to the decision boundary. This improves success rates across a range of datasets and attack methods. The empirical results are further supported by theoretical analysis.

Reviewers were all supportive of accepting the paper and appreciated the clarity of the paper.

Reviewers have raised various concerns that from my understanding were largely addressed. In particular, Reviewer RvbD raised the concern that the threat model is weaker than a reader might understand, as it requires access to the full training dataset. Authors have addressed this comment in the revised version. 

All in all, it is my pleasure to recommend accepting the paper.
Decision: Accept (poster)