Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks

Authors: Nguyen Hung-Quang, Ngoc-Hieu Nguyen, The-Anh Ta, Thanh Nguyen-Tang, Kok-Seng Wong, Hoang Thanh-Tung, Khoa D Doan
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: backdoor attack, data selection

Abstract:
Deep neural networks are vulnerable to backdoor attacks, a type of adversarial attack that poisons the training data to manipulate the behavior of models trained on such data. 
Clean-label backdoor is a more stealthy form of backdoor attacks that can perform the attack without changing the labels of poisoned data.
Early works on clean-label attacks added triggers to a random subset of the training set, ignoring the fact that samples contribute unequally to the attack's success. This results in high poisoning rates and low attack success rates.
To alleviate the problem, several supervised learning-based sample selection strategies have been proposed.
However, these methods assume access to the entire labeled training set and require training, which is expensive and may not always be practical.
This work studies a new and more practical (but also more challenging) threat model where the attacker only provides data for the target class (e.g., in face recognition systems) and has no knowledge of the victim model or any other classes in the training set.
We study different strategies for selectively poisoning a small set of training samples in the target class to boost the attack success rate in this setting. 
Our threat model poses a serious threat in training machine learning models with third-party datasets, since the attack can be performed effectively with limited information. Experiments on benchmark datasets illustrate the effectiveness of our strategies in improving clean-label backdoor attacks.

Decision: accept (poster)
Reviewer scores: 5, 8, 6, 5

Reviews and discussion:
<thread>
creation date:
1730170294253

thread_type:
official_review

<thread_object>
creator: reviewer_f14c

<content>
summary:
This paper explores a practical scenario for clean-label backdoor attacks, where an attacker’s access is limited to a single class of data within a decentralized training setup. This constrained threat model reflects real-world data collection challenges, such as privacy restrictions and geographical limitations. To enhance poisoning efficiency under these conditions, the paper introduces two sample selection methods specifically designed for this limited-access scenario.

strengths:
1. The paper is easy to follow to a large extent.
2. The motivation is clear and with empirical support.
3. The paper introduces a clean-label backdoor attack that works effectively in a constrained scenario where the attacker has limited data access (only one target class). This approach is realistic for scenarios with privacy or geographical constraints, enhancing the practical relevance of the attack model.

weaknesses:
1. Numerous studies [1,2,3,4,5,6,7,8] have addressed sample selection in backdoor attacks, several of which [6,8] specifically focus on sample selection for clean-label backdoor attacks. Omitting these key relevant works is a significant oversight and should be addressed to ensure a comprehensive discussion of the literature.
2. The novelty of this paper is limited, as it leverages a pre-trained model to identify "hard samples" for poisoning—a concept already explored in several studies [6,7,9]. However, the distinctions between this approach and prior work are not clearly articulated.
3. The first contribution claimed by this paper is the introduction of a new backdoor threat model, where an attacker, acting as a data supplier, has access only to the target class data yet can still execute effective clean-label backdoor attacks. However, previous studies [10,11] have already examined this threat model in depth, providing detailed discussions on "Why are dirty-label attacks more effective than clean-label attacks?" Consequently, the originality and contribution of this paper raise some concerns.
4. The discussion of backdoor attacks and defenses in the related work sections of this paper is outdated. 
5. There are some potential over-claims. For example, Line 156-159: Accessing only samples from a single non-target class is more difficult setting than yours.
6. Missing some important experiments.
- Main Experiments
  - The authors should also include the results of methods using all training samples for references, although you have a different setting.
  - It would be better to include the results of Narcissus here instead of in the appendix.
  - I would like to see whether the proposed method is also effective for untargeted clean-label backdoor attacks (e.g., UBW-C in [12])
- The Resistance to Defenses: The authors should evaluate their methods on more advanced backdoor defenses (such as [13, 14] and their baselines). 




**References**
1. Computation and data efficient backdoor attacks
2. Explore the effect of data selection on poison efficiency in backdoor attacks
3. Boosting backdoor attack with a learnable poisoning sample selection strategy
4. A proxy-free strategy for practically improving the poisoning efficiency in backdoor attacks
5. Minimalism is King! High-Frequency Energy-based Screening for Data-Efficient Backdoor Attacks
6. Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attacks
7. Confidence-driven Sampling for Backdoor Attacks
8. Clean-label Backdoor Attacks by Selectively Poisoning with Limited Information from Target Class
9. Not all samples are born equal: Towards effective clean-label backdoor attacks
10. Efficient backdoor attacks for deep neural networks in real-world scenarios
11. Narcissus: A practical clean-label backdoor attack with limited information
12. Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection
13. Towards Reliable and Efficient Backdoor Trigger Inversion via Decoupling Benign Features
14. IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency

questions:
1. The authors should include more related works and advanced baselines in their paper.
2. The authors should better clarify their main contributions than those introduced in existing works.
3. The authors should avoid overclaims.
4. The authors should conduct more comprehensive experiemnts. 

More details are in the 'Weakness' section.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730493060644

thread_type:
official_review

<thread_object>
creator: reviewer_pvcb

<content>
summary:
The paper proposes a method for improving the effectiveness of clean-label attacks. It introduces a threat model where the attacker only has access to data belonging to a specific class and has no knowledge about other classes in the dataset. The paper proposes a method for using samples with hard to learn features to create poison-efficient clean label attacks. The proposed method finds these samples by clustering the latent features of a surrogate model. The paper explores using a pretrained model and a model trained on OOD data as the surrogate model. The paper evaluates the clean-label attack against backdoor defenses and data cleaning methods.

strengths:
- The proposed method is a widely applicable technique to enhance to clean label attacks.
- The experiments do a good job differentiating the surrogate model from victim model and therefore the attack shows convincing transferability.

weaknesses:
- The paper trains for 300 epochs which is significantly longer than it should take to train the model on CIFAR-10/GSTRB [1,2] and makes attack success due to over-fitting very likely. Around 100 epochs seems to be more standard. Ideally, to simulate a competent defender early stopping should be employed. I.e. stopping the run when validation loss plateaus.

- The experiments use very weak baselines. The paper only evaluates how the method performs compared to random sampling. At minimum the paper should compare against [3]. Especially because [3] could easily be adapted to adhere to this paper's threat model by using a pretrained model. Therefore, the experiments are not sufficent to jusifty that the proposed method is stronger than a slightly adapted version of [3].

- The paper claims that it's threat model represents *"the **most** constrained data-poisoning threat."* However, there are other perfectly reasonable threat models that would make this attack unrealistic. For example, an opportunistic attacker that doesn't get to choose the subset of samples in the dataset they are able to manipulate.

- When evaluating the attack against defenses the paper does not describe the hyperparameter settings used by each defense nor how those settings were derived.

Minor:
- Bolding of best methods or aggregation would make Tables 2 and 3 more interpretable.
- There are many typos in the manuscript.

questions:
- Why would an attacker use the OOD strategy proposed in section 4.4, as it requires training a surrogate model and appears to work worse than using a pretrained model?
- Why use a latent space clustering approach instead of using the loss from a pretrained zero-shot image classifier like CLIP?
- Why use VICReg instead of a more general feature extractor like CLIP?
- Where are the training settings used in experiments adapted from?

References

[1] Alexander Turner, Dimitris Tsipras and Aleksander Madry. "Label-Consistent Backdoor Attacks.", 2019.  

[2] He, Kaiming, et al. "Deep Residual Learning for Image Recognition," 2016.  

[3] Gao, Yinghua, et al. "Not All Samples Are Born Equal: Towards Effective Clean-Label Backdoor Attacks.", 2023.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730635611487

thread_type:
official_review

<thread_object>
creator: reviewer_btab

<content>
summary:
The paper studies clean-label backdoor attacks in a very constrained setting, where the attacker only needs access to the training data from the target class and has no prior knowledge of the victim model, training process, and the other classes, and focuses on data-selection strategies to boost the performance of existing clean-label attacks in this constrained setting. The proposed data selection strategies include (1) the use of a pretrained model (when such exists) or (2) the use of an OOD dataset (when the pretrained model is not available) to train a surrogate model.  The experimental results demonstrate the proposed strategies significantly enhance the ASR and several existing clean-label backdoor attacks, compared to random selection strategies. In addition, the paper demonstrates that the proposed strategies are resilient against several existing defenses.

strengths:
The main strengths of the paper lie in its studied threat model, proposed sampling strategies and experimental evaluation.

- I think that the proposed threat model is important as it exposes yet another backdoor threat where an attack only needs access to the data of the target class. The demonstrations that existing backdoor attacks under this threat model are not satisfactorily effective are an important contribution of the paper.
- The proposed sampling strategies are novel, especially when they could be used with existing backdoor attacks, such as BadNets, SIG, Narcissus, etc…) to boost their backdoor performances under the studied threat model. It’s also interesting finding where the effectiveness of the proposed strategies even when there is less and less assumptions on the pretrained models or the OOD datasets. 
- The paper includes thorough analysis of the proposed strategies, demonstrating their effectiveness when they’re used with several existing backdoor attacks across different datasets. The evaluation also shows the effectiveness against several defenses.

weaknesses:
I find that the paper has the following concerns:
* The Narcissus results, while interesting, are different from what reported in their original paper. Can the authors explain why there are such differences? 
* The OOD approach rely on out-of-distribution data but it’s not clear how this dataset could be obtained, or whether there are any specific requirements of the datasets to maintain the effectiveness of the attacks?
* Assuming that the victim could distribute the target class data collection to multiple sources, how does the proposed attacks perform in this case? 
* Do the authors have any suggestions about potential mitigation approaches against the proposed attacks in the studied threat model?

questions:
Please see the questions in weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730700618220

thread_type:
official_review

<thread_object>
creator: reviewer_8tyj

<content>
summary:
The paper proposes a method for enhancing clean-label backdoor attacks on deep neural networks. Unlike traditional clean-label attacks that apply triggers randomly, this approach selectively poisons challenging samples within the target class, boosting attack success rates with fewer poisoned samples. The authors introduce two strategies: using pretrained models to identify "hard" samples and leveraging out-of-distribution data for sample selection. Tested on CIFAR-10 and GTSRB datasets, this method outperforms random poisoning and is resilient against popular defenses like STRIP and Neural Cleanse, highlighting a need for stronger countermeasures against selective clean-label attacks.

strengths:
1. The paper improves traditional clean-label backdoor attacks by proposing a threat model that is more applicable in real-world scenarios.

2. The method is claimed to achieve higher attack success rates with a lower poisoning rate, showcasing efficient use of resources.

weaknesses:
1. In my opinion, the method primarily introduces a data selection strategy, which lacks sufficient novelty.

2. The evaluation is conducted only on CIFAR-10 and GTSRB datasets, limiting insight into the method's performance across other dataset types and application domains.

3. The paper primarily tests against older defense strategies. Implementing more recent and sophisticated defenses, including adaptive methods like sample-specific anomaly detection, would strengthen the evaluation.

4. The pretrained model strategy relies on the availability of pretrained models in similar domains, which may not always be accessible in real-world applications.

questions:
The authors should clarify the novelty, choice of limited datasets, the use of older defense strategies, and the dependency on pretrained models.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732482948239

thread_type:
official_comment

<thread_object>
creator: area_chair_yz7e

<content>
comment:
Dear reviewers,

Thanks for serving as a reviewer. As the discussion period comes to a close and the authors have submitted their rebuttals, I kindly ask you to take a moment to review them and provide any final comments.

If you have already updated your comments, please disregard this message.

Thank you once again for your dedication to the OpenReview process.

Best,

Area Chair
</content>
</thread_object>

</thread>
<thread>
creation date:
1733309501300

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Summary of our responses and paper revision during the rebuttal phase

comment:
We'd like to thank the reviewers for their constructive and helpful comments during the rebuttal and discussion phases. During these phases, we have:

- Clarified the novelty of our threat model and sample selection strategy. Our threat model is important and realistic, as acknowledged by Reviewer BTAB and F14C. Reviewer BTAB and PVcB appreciate the novelty and transferability of our strategy.
- Provided additional results of 4 backdoor defenses as suggested by Reviewer 8TyJ and F14C, proving that our method is robust against a wide range of backdoor defenses as we had shown in the original manuscript (10 defenses already provided in the submitted version).
- Clarified that our approach does not require the pretrained model or the OOD dataset to have the same domain as the victim dataset, showing the practicality of our method.
- Discussed a scenario where the victim could distribute the target class data collection to multiple sources in response to Reviewer BTAB. Our strategy is still threatening in this case as shown in the original manuscript.
- Clarified the experimental setting in our paper.
- Provided additional results of the strategy in Gao et al. Although having less information, our strategy is not less effective than that method.
- Provided additional results of using CLIP to select samples and discussed why CLIP does not perform as well as other vision-only pretrained models chosen in this work.
- Clarified the constraint setting in our threat model. We propose the most constrained threat model in terms of the amount of information the attacker can use to launch the clean-label attacks.

We have added these discussions in the revised submissions. We would be grateful if the reviewer could kindly consider our responses in their opinions when making the final decision, as we believe that we already addressed all their concerns. Again, thank you for the helpful and valuable comments.
</content>
</thread_object>

</thread>
<thread>
creation date:
1744543879650

thread_type:
public_comment

<thread_object>
creator: ~quang_h_nguyen2

<content>
title:
Camera-ready update

comment:
We'd like to update the results of our strategy against IBD-PSC defense due to a minor bug in the previous implementation. The table below demonstrates that although IBD-PSC can detect BadNets, our method with Blended and SIG trigger is still stealthy under this defense, showing the significant threat of our method.



|  | Strategy   | AUC   | F1    |
|---------|------------|-------|-------|
| BadNets | Random     | 0.999 | 0.955 |
|         | Pretrained | 0.999 | 0.976 |
|         | OOD        | 0.995 | 0.950 |
| Blended | Random     | 0.861 | 0.331 |
|         | Pretrained | 0.523 | 0.000     |
|         | OOD        | 0.848 | 0.321 |
| SIG     | Random     | 0.788 | 0.238 |
|         | Pretrained | 0.728 | 0.049 |
|         | OOD        | 0.869 | 0.273 |

We've updated this result in the camera-ready version of the paper.
</content>
</thread_object>

</thread>


Metareview:
metareview:
This paper examines clean-label backdoor attacks in a highly constrained setting, where the attacker only has access to training data from the target class and lacks prior knowledge of the victim model, training process, or other classes. In this senario, the authors manage to propose a data-selection strategy to improve the performance of clean-label attacks, like using a pre-trained model or OOD trained surrogate model. Experimental results demonstrate the methods effectiveness.

Strength:

1. The paper introduces a clean-label backdoor attack that works effectively in a constrained scenario where the attacker has limited data access (only one target class). This approach is realistic for scenarios with privacy or geographical constraints, enhancing the practical relevance of the attack model.

2. Comprehensive experiments to demonstrate their effectiveness.

Weakness:

Evaluation settings are not enough. For example, they only test ResNet-18 and VGG. If transformers are also involved, the impact will be greater.

Most reviewers show postive attitude towards this paper. The only remaining conerns are still need to adding empirical settings. However, regarding that the paper has already done a lot evaluations. I think missing some settings are acceptable. Therefore, I tend to accept this paper.