Title: A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers
Venue: NeurIPS 2025
Accepted: yes
Keywords: Backdoor Attack

Sample Selection

Clean-label
Abstract: Poison-only Clean-label Backdoor Attacks (PCBAs) aim to covertly inject attacker-desired behavior into DNNs by merely poisoning the dataset without changing the labels. To effectively implant a backdoor, multiple triggers are proposed for various attack requirements of Attack Success Rate (ASR) and stealthiness. Additionally, sample selection enhances clean-label backdoor attacks' ASR by meticulously selecting "hard'' samples instead of random samples to poison. Current methods, however, 1) usually handle the sample selection and triggers in isolation, leading to severely limited improvements on both ASR and stealthiness. Consequently, attacks exhibit unsatisfactory performance on evaluation metrics when converted to PCBAs via a mere stacking of methods. Therefore, we seek to explore the bi-directional collaborative relations between the sample selection and triggers to address the above dilemma.  2) Since the strong specificity within triggers, the simple combination of sample selection and triggers fails to substantially enhance both evaluation metrics, with generalization preserved among various attacks. Therefore, we seek to propose a set of components to significantly improve both stealthiness and ASR based on the commonalities of attacks. Specifically, Component A ascertains two critical selection factors, and then makes them an appropriate combination based on the trigger scale to select more reasonable "hard'' samples for improving ASR. Component B is proposed to select samples with similarities to relevant trigger implanted samples to promote stealthiness. Component C reassigns trigger poisoning intensity on RGB colors through distinct sensitivity of the human visual system to RGB for higher ASR, with stealthiness ensured by sample selection including Component B. Furthermore, all components can be strategically integrated into diverse PCBAs, enabling tailored solutions that balance ASR and stealthiness enhancement for specific attack requirements. Extensive experiments demonstrate the superiority of our components in stealthiness, ASR, and generalization. Our code will be released as soon as possible.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a set of generalized components aimed at enhancing the effectiveness of Poison-only Clean-label Backdoor Attacks (PCBAs). The core idea revolves around exploring the bidirectional collaborative relationships between sample selection and trigger design. By proposing Component A, Component B, and Component C, the paper seeks to significantly boost both Attack Success Rate (ASR) and stealthiness while maintaining generalization. The work conducts extensive experiments to analyze the impact of these proposed components on various types of backdoor attacks.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths:\n- Exploration of ASR Enhancement Mechanisms: Building upon existing research, the paper innovatively explores the collaborative relationship between sample selection (especially by introducing category diversity) and trigger design (e.g., distinct-color poisoning) to improve the ASR of clean-label backdoor attacks. This exploration into the deeper influencing factors of attack mechanisms provides new insights for the field of backdoor attacks.\n- Comprehensive Experimental Analysis: The paper conducts a large number of experiments, analyzing how the proposed components (Component A, B, C) impact the ASR and stealthiness of various attack types. This includes analyses of the effects of different negative functions and trigger scales, demonstrating the thoroughness of the research.\n### Weaknesses:\n- Lack of Backdoor Defense Comparison Experiments: The paper primarily focuses on enhancing backdoor attack effectiveness but completely omits comparative experiments against existing backdoor defense methods. Given that backdoor attacks and defenses are an evolving adversarial process, and numerous mature defense strategies already exist to effectively mitigate backdoor impacts, not considering the attack's performance under practical defense environments constitutes a significant flaw in this paper. Assessing whether these enhanced attacks remain effective in real-world scenarios with active defenses is crucial for evaluating their threat level. To address this, the authors should incorporate experiments comparing their proposed attack against a range of established backdoor defense mechanisms. This should include, but not be limited to, backdoor detection methods such as SCAn [1], and backdoor mitigation/purification methods like RNP [2] and FST [3].\n- Inadequate Evaluation of Stealthiness: The paper's evaluation of stealthiness primarily relies on visual demonstrations through images combined with metrics like GMSD. However, the metric and visual presentations alone are insufficient to demonstrate a substantial increase in stealthiness conclusively.\n\n[1] Demon in the variant: Statistical analysis of DNNs for robust backdoor contamination detection\n\n[2] Reconstructive neuron pruning for backdoor defense\n\n[3] Towards stable backdoor purification through feature shift tuning\n\nQUESTIONS:\nIn some tables, the 'no.' column appears to serve only as an experiment identifier. Is there any other practical purpose for this column? If it is merely for numbering, I suggest removing it to improve the tables' conciseness and readability.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-25"}

comments: SUMMARY:
This paper proposes a novel method, using trigger scales and features to select better ones, and leverages RGB channels to enhance the trigger’s backdoor attack performance.

STRENGTHS AND WEAKNESSES:
Strengths:
- This paper provides a brand new perspective to enhance image trigger using RGB channels, which can also decrease the interference with the original trigger.
- The authors conducted multiple experiments to show the performance of their methods, they also carried out several ablation studies.

Weaknesses:
- Component A seems to be overweighted, which doesn’t show much technical contribution and innovation, as it is simply based on the selection of trigger scales.  
- Some claims would be more convincing with proper evaluations and validations. For examples, the authors claim that the proposed method can bypass human inspection. It would be worthy providing quantitively comparison between original images and perturbation samples for Component B. MSE or SSIM would be good metrics for that.
- The correlation between design choice and the attack performance remains unclear. For example, the combination of Component A and C yields the best performance. Is it an empirical observation or what is the rationale behind this observation? As the main contribution of the paper is the design choices, it would be ideal to elaborate the concreted impact of each component on the attack performance.

QUESTIONS:
- Could you please explain why the attack performance degrades when Component B is added (e.g., as shown in section 3.1)?

LIMITATIONS:
Yes.
TITLE: Official Review
CLARITY: 2
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-07-01

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposed a framework for improving poison-only clean-label backdoor attacks (PCBAs) by introducing a set of generalized components that jointly optimize sample selection and trigger design. Specifically, the paper introduces three core components: A, B and C. The paper demonstrate that these components can be flexibly combined to improve a wide range of existing PCBA methods (e.g., Badnets, Blended, BppAttack) across CIFAR-10 and CIFAR-100 datasets.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths: \n1) The paper introduced a two-way collaborative mechanism of sample selection and trigger design, which is different from the previous studies that treated the two in isolation. In the optimization of trigger concealment, the mechanism of the difference in the sensitivity of the human visual system to RGB was introduced for the channel reallocation design (Component C) for the first time, which is novel and practical.\n2) It has strong adaptability to scenarios with low poisoning rates and practical value in actual attack applications.\n3) The method can be used in various model structures (such as ResNet-18, VGG16, DenseNet121), it has strong generalization.\n\nWeaknesses: \n1) The application scope is limited to the clean label scenario.\n2) There is a lack of a unified theoretical framework or optimization objective function support among the three components. The combination of Component A and B is based on simple sorting and threshold sampling, lacking a more systematic optimization strategy.\n3) Resistance to existing defense methods such as STRIP, Fine-Pruning, Neural Cleanse was not analyzed.\n4) The experiments present conflicting results. Table 1 shows that adding Component B can lead to a decrease in ASR (e.g., for Badnets-C at 1% poisoning rate, ASR drops from 86.15% with Component A&C to 77.67% with Components A&B&C). In addition to that, in some cases, the BA also declines with Component B's inclusion.\n\nQUESTIONS:\n1) The current component integration strategy relies on heuristic rules and thresholds. Is there a way to formalize the combination of Components A and B under a joint optimization objective? \n2) How does your framework perform under standard backdoor defense methods, such as STRIP, Neural Cleanse, or Fine-Pruning? Since your method emphasizes stealthiness, it would be especially valuable to show how the selected samples and RGB-optimized triggers evade detection by these defenses. \n3) While the paper explores pairwise combinations, a more in-depth analysis of why certain combinations (e.g., A+B vs. A+C) lead to better or worse ASR would be useful.  What are the interactions (e.g., synergistic or conflicting effects) between the three components, and how do they influence each other’s effectiveness?\n4) Since Component C exploits perceptual RGB sensitivity, it would be valuable to include a perceptual user study or visibility score (e.g., via SSIM or psychometric testing) to support the stealthiness claim from a human inspection perspective.\n\nLIMITATIONS:\nSee Questions and Weaknesses.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work introduces a modular framework of three “generalized components” that jointly optimize sample selection and trigger design to boost the success rate and stealth of clean-label backdoor attacks. Component A selects hard-to-learn images via a balance of forgetting events and category diversity; Component B uses visual-quality metrics to hide triggers in images; Component C reallocates poisoning strength across RGB channels according to human perceptual sensitivity. Integrated into various backdoor attacks, these components yield 20–60 pp ASR gains on CIFAR with <1% clean-accuracy drop.\n\nSTRENGTHS AND WEAKNESSES:\n- Well-structured, clear presentation; the modular design is easy to adapt.\n\n- Component A’s dynamic balance of forgetting events and category diversity yields up to +15 pp ASR improvement over prior metrics.\n\n- Component B’s use of perceptual metrics (GMSD) to select concealment-friendly samples is novel in clean-label attacks.\n\n- Component C’s exploitation of RGB-channel sensitivity enhances ASR while preserving stealth.\n\n- Experiments cover CIFAR-10/100, multiple poisoning rates, trigger types, and architectures with comprehensive ablations—yet remain limited to small-scale vision tasks.\n\n### weakness\n\n- The theoretical rationale for Component A’s collaboration is not formally analyzed; empirical gains lack mathematical underpinning.\n\n- Component A performs worse under dirty-label settings (Table 6), but no remediation or analysis is provided.\n\n- Computational overhead of the three components is not quantified, raising questions about scalability.\n\n- Stealth is measured only via automated metrics (MSE/GMSD); no human perceptual study validates trigger invisibility.\n\n- No concrete defenses or detection strategies are evaluated against the enhanced attack framework.\n\nQUESTIONS:\n1. Can you provide a formal analysis of why and when the combination of forgetting events and category diversity (Component A) yields consistent ASR gains?\n\n2. Have you tested the framework on larger datasets (e.g., ImageNet) or non-vision domains (e.g., NLP), and what challenges arise?\n\n3. Why does Component A degrade performance under dirty-label poisoning, and how might this be addressed?\n\n4. What are the additional runtime and resource costs of each component, and how do they scale to larger models or higher-resolution images?\n\n5. Do you plan any human-in-the-loop studies to confirm that triggers remain imperceptible under real viewing conditions?\n\n6. How does your modular framework compare or integrate with recent PCBAs like Combat or Narcissus?\n\n7. Have you explored any defense or detection mechanisms (e.g., spectral analysis, data sanitization) to counteract your enhanced backdoor attacks?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}