Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization

Binyan Xu; Di Tang; Fan Yang; Kehuan Zhang; Xilin Dai

REVIEW 3 major objections 5 minor 1 cited by

Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization

T0 review · 3 major / 5 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a label-only clean-image backdoor can achieve high attack success with negligible clean-accuracy drop by using a conditional InfoGAN to optimize the trigger, and that it extends to regression and segmentation.

desk verdict GCB delivers on its main empirical claim and is a genuine new baseline for clean-image backdoors — but the transfer assumption is asserted rather than tested, and the abstract oversells defense resilience. read the letter →

arxiv 2511.07210 v3 pith:3CNCQVGV submitted 2025-11-10 cs.CV cs.CRcs.LG

Binyan Xu , Fan Yang , Di Tang , Xilin Dai , Kehuan Zhang This is my paper · ORCID

classification cs.CVcs.CRcs.LG

keywords clean-imagebackdoorlabel-onlyattackconditionalInfoGANgenerativetriggeroptimizationstealthinesspoisonratesuccesslabelpoisoning

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is trying to establish that a backdoor can be planted using only label flips, with no image modification, while escaping the trade-off that forced earlier clean-image attacks to exchange clean accuracy for attack success. The proposed mechanism is a conditional InfoGAN that discovers naturally occurring image features that are easy for the model to separate but irrelevant to the task; those features become the trigger, and a recognizer network selects which images to mislabel. If the paper is right, a malicious annotator can achieve near-perfect attack success while the victim's clean accuracy barely moves, and the same recipe works for classification, multi-label, regression, and segmentation. The broader significance is that the current defense assumption—poisoned training data is detectable by accuracy loss or latent separability—may not hold for this attack class.

What carries the argument

C-InfoGAN, a conditional InfoGAN whose generator G(x,c) is used as the trigger function and whose recognizer Q is used as the score function for selecting poisoned images. The adversarial discriminator enforces that generated triggered images lie on the natural data manifold (existence), the mutual-information objective maximizes separability between c=0 and c=1 series, and conditioning on the ground-truth class label y forces the trigger to be class-irrelevant. The paper shows that maximizing the mutual information objective is equivalent to maximizing a weighted Jensen–Shannon divergence between the triggered and benign conditional distributions, which is what makes the backdoor learnable

What would settle it

Relabel only the real training images that Q scores as triggered, train a victim, then evaluate with triggers G(x,c=1) on a disjoint test set; if attack success drops to chance whenever the distribution of generated triggered images measurably deviates from the distribution of the relabeled real images—for example, when the Frechet Inception Distance between the two exceeds a small threshold—the central transfer assumption is falsified.

Watch

Extended reading notes

Core claim

GCB claims that the stealth–potency trade-off in clean-image backdoors is not fundamental: it can be broken by optimizing the trigger rather than raising the poison rate. The paper introduces C-InfoGAN, a conditional InfoGAN in which a binary latent code c separates naturally occurring image features into triggered and benign series; the generator G(x,c=1) acts as the trigger function and the recognizer Q as a poison-scoring function. Maximizing mutual information between c and generated images is shown to be equivalent to maximizing the Jensen–Shannon divergence between the triggered and benign conditional distributions, which simultaneously makes the poisoned subset easy for the victim mod

Load-bearing premise

The attack assumes the GAN's learned split between triggered and benign images transfers from generated images to real ones—that Q's scores on real training images pick out exactly the subset whose relabeling creates a backdoor, and that G(x,c=1) on unseen test images reproduces the same trigger; if GAN generalization is imperfect, the trigger and the poisoned subset decouple.

Editorial extensions

If this is right

A label-only adversary can implant a backdoor with near-perfect attack success and under 1% clean-accuracy drop using poison rates at or below 0.5%, often as low as 0.1%.
The attack transfers across multiple architectures and datasets, and extends clean-image backdoors for the first time to regression and segmentation tasks.
Because the training-time trigger is weak and the test-time trigger is strong, defenses that rely on splitting poisoned from benign samples by latent separability fail against GCB.
Class-wise accuracy degradation stays small even for source classes, addressing a failure mode where prior attacks showed large per-class drops despite low average drops.
Even with access to only 10% of the training data, the attack retains high success, broadening the threat to individual annotators with limited access.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If this transfer result holds broadly, backdoor detection should shift from training-set statistics toward test-time behavioral testing, since poisoned training samples are deliberately made indistinguishable from benign ones.
The scheme's need for clean ground-truth labels as conditioning input may limit it to settings where the attacker can infer correct labels, rather than fully outsourced annotation; this is a constraint the paper does not fully explore.
The same generative-trigger recipe could likely be adapted to other modalities—text, audio, tabular data—wherever a generative model can discover a class-irrelevant, naturally occurring feature; this is a testable extension beyond the paper's experiments.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: the central result holds up as an empirical attack. GCB is a well-engineered clean-image backdoor that really does achieve ≥90% ASR at ≤0.5% poison rate with ≤1% CA drop on the tested datasets, and extending to regression/segmentation is a first. The C-InfoGAN construction — class-conditioning a Bernoulli latent code, with the generator as trigger function and Q as scorer — is new and clean. The evaluation is unusually broad: six datasets, five architectures, four tasks, plus corruption robustness and a long defense list. Code is released. This deserves serious referee time.

The soft spots are real but not fatal. The biggest is the GAN-transfer assumption. The appendix just asserts p(hat x)≈p(x) and Q(c|hat x)≈p(c|hat x) and says empirical results bridge the gap. That's a fair criticism: the only direct evidence is the end-to-end ASR, which is circular for justifying the mechanism. It's not circular for the attack's existence — if the trigger function didn't work, ASR would be low — but the theoretical story needs a direct alignment measurement, e.g., how well Q ranks real images vs. generated ones. The reader's stress-test is right to flag this.

Second, the headline numbers in Fig. 3 appear as point estimates with no error bars in the main text; only the low-access and multi-label tables carry stds. Given the known fragility of InfoGAN training, the main takeaways should be accompanied by variance.

Third, hyperparameter sensitivity: Fig. 22 shows ASR swinging from 13.2% to 100% with λ. The paper says these are per-dataset settings, which is acceptable, but a sensitivity table would be more honest than just reporting the best λ. On the other hand, the paper does report the range explicitly, so it's not hiding anything.

Fourth, the abstract's 'resilience against most existing backdoor defenses' overstates what the appendix shows. Tables 13-14 list FT-SAM, SAU, DBD, and their own CGD as effective against GCB. That's still 'most' in their table, but the claim should be tightened.

The threat model point — requiring ground-truth labels y for C-InfoGAN conditioning — is worth raising. In the outsourced-annotation scenario, the attacker may not have the original labels for the data they poison. The paper could clarify this.

Overall: a strong empirical paper with a genuinely new mechanism and an honest, broad evaluation. The gaps are addressable. I'd send it to peer review and ask for direct transfer evidence, error bars, and a revised defense claim.

Referee Report

3 major / 5 minor

Summary. The paper proposes GCB, a clean-image backdoor attack that uses a conditional InfoGAN to identify naturally occurring image features as triggers. During attack preparation, a C-InfoGAN is trained on clean data; the recognition network Q scores real images, and the top-scoring fraction of images is relabeled to a target class. At inference, the generator G applied with c=1 produces triggered images. The authors claim that this breaks the stealth–potency trade-off: on six datasets GCB achieves ≥90% ASR with ≤1% CA drop at ≤0.5% poison rate, transfers across architectures and tasks (including regression and segmentation), and resists most defenses. The paper includes a theoretical appendix relating the mutual-information objective to the JSD between poisoned and benign conditional distributions.

Significance. If the central claim holds, this is a meaningful advance: it would show that clean-image backdoors can be much more potent and stealthy than previous label-only attacks, and it expands clean-image backdoors to new task families. The paper has concrete strengths: a broad evaluation across six datasets, five architectures, four tasks, and many defenses; code release; unusually low reported poison rates; and a defense-aware discussion. The main risk is that the attack depends on two unverified transfer assumptions about the GAN: Q, trained on generated images, must correctly rank real images as the poison set, and G(·,1) must reproduce the same trigger on never-seen test images. The empirical validation is broad but mostly consists of point estimates, and the sensitivity of the headline results to the chosen hyperparameters is not fully quantified. These issues affect the strength of the first-to-break-the-trade-off claim, so the paper needs revision rather than rejection.

major comments (3)

[Attack Deployment / Appendix 'Discussion on Assumptions'] The core mechanism assumes that the recognition network Q and the generator G transfer from generated images to real images: Q learns to score real images so that the top-pr subset X1 is exactly the set whose relabeling creates the backdoor, and G(x,c=1) applied to never-seen test images reproduces the trigger present in X1. The paper asserts this with 'Since the GAN has converged, x and xhat follow the same distribution' and the appendix assumes p(xhat)≈p(x) and Q(c|xhat)≈p(c|xhat). No quantitative evidence is provided for either assumption; the only validation is the final ASR, which is the quantity the assumption is meant to explain, making the justification circular. The appendix itself concedes that GAN convergence can be imperfect. Please add direct transfer checks: e.g., the distributional distance between real images and G(x,1), the rank correlation between Q scores on real vs. g
[Evaluation / Fig. 22 and Table 8] The headline '≥90% ASR with ≤1% CA drop at ≤0.5% poison rate' is presented as a general property, but Fig. 22 shows that ASR varies from 13.2% to 100% as the information-loss weight λ changes, and Table 8 uses different λ and learning rates for every dataset. The paper does not report how λ was selected, how many seeds were run, or confidence intervals for the main ASR/CA numbers. Because the central quantitative claim is an empirical universal, point estimates without variability make it impossible to assess robustness. Please report multiple seeds/poison-set draws with confidence intervals for the headline numbers, and describe the hyperparameter selection protocol (e.g., validation-based or fixed per dataset).
[Preliminary / Threat Model and C-InfoGAN Irrelevancy] The threat model is an outsourced annotator who can only mislabel a small fraction of images. However, C-InfoGAN conditions the generator and discriminator on the ground-truth label y of each image, and the appendix states that label conditioning is important for the irrelevancy property. In a realistic outsourced-annotation scenario, clean ground-truth labels are exactly what the annotator is supposed to supply and may not be available for images before annotation. The paper does not explain how the attacker obtains y for the full training set. If the attacker can view the dataset but not the labels, the method loses its label conditioning and may suffer the mode collapse described in the ablation study. The threat model should state explicitly what label information the attacker has and how the conditioning on y is obtained.

minor comments (5)

[Table 5] The text names Gaussian Smoothing as a tested corruption but Table 5 lists only JPEG, Color Shift, Color Shrink, and Affine transformations. Either add the missing column or remove the mention.
[Evaluation / Attack Performance] The ASR numbers are inconsistent between the abstract/introduction and Table 10 (e.g., 97.9% on CIFAR-10 in the introduction vs. 100.0% in Table 10 with the default PreActResNet18). Please align the reported values and clarify which configuration each refers to.
[Figure 3] The marker labels showing poison rates are difficult to read at print resolution. Consider using a table or larger annotations.
[Supplementary Material] Several references to 'Appendix 9' and 'Table 11' are imprecise. Number appendix sections and refer to them by title so readers can locate the relevant details.
[Discussion of FLIP] The comparison to FLIP uses different poison rates (3% for FLIP, 1% for GCB). This is reasonable for practical comparison, but the text should state this explicitly where the architecture comparison is introduced.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: GCB's ASR/CA claims are empirically measured, and the only self-citation (the authors' own CGD defense, used as one baseline) is not load-bearing.

full rationale

The paper's central claim—high ASR with ≤1% CA drop at ≤0.5% poison rate—is an empirical result measured with standard ASR/CA metrics across six datasets, five architectures, and four tasks. No fitted parameter is renamed as a prediction: the C-InfoGAN objective (Eq. 1: L = GAN loss − λ I(c;G(x,c))) does not contain downstream ASR or CA, so the reported success is not true by construction. The theoretical appendix does rely on transfer assumptions: 'Our analysis assumes C-InfoGAN converges such that p(ˆx)≈p(x) and Q(c|ˆx)≈p(c|ˆx)' (Supplementary Material, Discussion on Assumptions), and the deployment text states 'Since the GAN has converged, x and x̂ follow the same distribution' (Attack Deployment, Poisoning Stage). These are unproven generalization assumptions about GAN transfer, acknowledged as potentially imperfect; they are a correctness/robustness limitation, not circularity, because the headline results are validated empirically rather than derived from them. The only self-citation is the authors' prior defense CGD (Xu et al. 2025), used as one defense baseline in Table 14 and described as the only tested method fully effective against GCB; it does not justify the attack's validity and is not load-bearing for the central claim. No uniqueness-from-authors, ansatz-smuggled-by-citation, or renaming-of-known-result pattern is present.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

No new physical entities are introduced; the paper's contributions are algorithmic. The load-bearing free choices are per-dataset hyperparameters, and the load-bearing assumptions are GAN transfer, availability of clean labels, and the entropy-to-ASR link.

free parameters (2)

Information-loss weight λ (per dataset) = 0.1 to 0.5 (Table 8)
Hand-tuned per dataset; Fig. 22 shows ASR varies from 13.2% (λ=1.0) to 100% (λ=0.25), so the central attack-success numbers depend on this choice.
Generator/discriminator learning rates (per dataset) = G: 4e-5 to 5e-4; D: 1e-4 to 4e-4 (Table 8)
Adjusted per dataset to achieve convergence; the appendix calls these 'crucial for convergence' and shows extreme values change the trigger pattern and artifact level.

assumptions (5)

domain assumption C-InfoGAN converges such that p(hat x)≈p(x) and Q(c|hat x)≈p(c|hat x), allowing Q to score real images and G to act as a trigger on test images.
Appendix 'Discussion on Assumptions' explicitly assumes this; the main text asserts 'Since the GAN has converged...' and even acknowledges convergence can be imperfect.
standard math Mutual information maximization in InfoGAN equals weighted Jensen-Shannon divergence between p(hat x0) and p(hat x1).
Used in Appendix 'Scoring Function Analysis', Eq. (3); the bound is standard but the paper refers to Chen et al. 2016 for detailed proofs.
domain assumption The 'natural backdoor trigger' effect: clean-label poisoning causes CA drop proportional to poison rate.
Introduction attributes this to Rong et al. 2024 and uses it to motivate the trade-off GCB claims to break; it is not independently tested in this paper.
domain assumption The attacker can access the training dataset and clean ground-truth labels y to train C-InfoGAN.
The threat model says the attacker can view the dataset, but the method needs y as a conditioning input; a third-party annotator may not have clean labels.
domain assumption Minimizing conditional entropy H(Y'|X) of the poisoned training set suffices to obtain a high-ASR backdoor after standard training.
Appendix 'Connection to Clean-Image Backdoors' asserts this link; no sample-complexity or convergence theorem connects the entropy reduction to the trained victim model's ASR.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization." pith.science (2026). https://pith.science/paper/3CNCQVGV

@misc{pith2026251107210,
  author       = {Pith},
  title        = {Pith review of: Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3CNCQVGV}},
  note         = {Machine review of arXiv:2511.07210}
}

read the original abstract

Clean-image backdoor attacks, which use only label manipulation in training datasets to compromise deep neural networks, pose a significant threat to security-critical applications. A critical flaw in existing methods is that the poison rate required for a successful attack induces a proportional, and thus noticeable, drop in Clean Accuracy (CA), undermining their stealthiness. This paper presents a new paradigm for clean-image attacks that minimizes this accuracy degradation by optimizing the trigger itself. We introduce Generative Clean-Image Backdoors (GCB), a framework that uses a conditional InfoGAN to identify naturally occurring image features that can serve as potent and stealthy triggers. By ensuring these triggers are easily separable from benign task-related features, GCB enables a victim model to learn the backdoor from an extremely small set of poisoned examples, resulting in a CA drop of less than 1%. Our experiments demonstrate GCB's remarkable versatility, successfully adapting to six datasets, five architectures, and four tasks, including the first demonstration of clean-image backdoors in regression and segmentation. GCB also exhibits resilience against most of the existing backdoor defenses.

Figures

Figures reproduced from arXiv: 2511.07210 by the authors.

**Figure 2.** Framework of Generative Adversarial Clean-Image Backdoors (GCB). In the preparation stage, a specific clean feature [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗

**Figure 3.** Stealth-potency trade-off of clean-image backdoor methods across datasets. Marker size and text indicate poison rates [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (17 more)

**Figure 4.** Figure 4: GCB’s test ASR on CIFAR-10 converges fast, but its training ASR lags, resisting fast-learning defenses like ABL. Method Metric VOC07 VOC12 ASR ↑ 87.5±14.2 85.2±13.0 CIB MAP ↑ 91.8±1.1 91.3±1.4 MAP (src) ↑ 74.8±3.1 72.6±4.9 ASR ↑ 67.5±7.2 70.1±8.5 GCB MAP ↑ 93.9±0.3 93.…

**Figure 5.** Figure 5: Results with error bars under low access rates. [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]

**Figure 7.** Figure 7: Fine-pruning [PITH_FULL_IMAGE:figures/full_fig_p006_7.png]

**Figure 10.** Figure 10: Confidence for two different label issues. [PITH_FULL_IMAGE:figures/full_fig_p007_10.png]

**Figure 9.** Figure 9: STRIP normalized entropy distribution of GCB. [PITH_FULL_IMAGE:figures/full_fig_p007_9.png]

**Figure 11.** Figure 11: UMAP visualization of the latent space for three classes in CIFAR-10. [PITH_FULL_IMAGE:figures/full_fig_p013_11.png]

**Figure 12.** Figure 12: Box plot comparing the class-wise clean accuracy [PITH_FULL_IMAGE:figures/full_fig_p013_12.png]

**Figure 14.** Figure 14: Results under different dataset sizes for CIFAR [PITH_FULL_IMAGE:figures/full_fig_p014_14.png]

**Figure 13.** Figure 13: ASR vs. poison rates for different attack methods. [PITH_FULL_IMAGE:figures/full_fig_p014_13.png]

**Figure 15.** Figure 15: Sample images from MNIST, CIFAR-10, CIFAR-100, GTSRB, and ImageNet-1K. The selected training images are [PITH_FULL_IMAGE:figures/full_fig_p015_15.png]

**Figure 17.** Figure 17: Metric design for irrelevancy: The closer the Trig [PITH_FULL_IMAGE:figures/full_fig_p017_17.png]

**Figure 16.** Figure 16: Image samples from different datasets. From top to [PITH_FULL_IMAGE:figures/full_fig_p017_16.png]

**Figure 18.** Figure 18: One example of our GCB without Label Condition [PITH_FULL_IMAGE:figures/full_fig_p018_18.png]

**Figure 19.** Figure 19: UMAP Visualization of different backdoor attack methods in the CIFAR-10 dataset. [PITH_FULL_IMAGE:figures/full_fig_p019_19.png]

**Figure 20.** Figure 20: UMAP Visualization of different layers on PreActResNet in GCB. [PITH_FULL_IMAGE:figures/full_fig_p019_20.png]

**Figure 21.** Figure 21: Effect of learning rate on the trigger patterns and [PITH_FULL_IMAGE:figures/full_fig_p019_21.png]

**Figure 22.** Figure 22: Effect of the information loss weight factor [PITH_FULL_IMAGE:figures/full_fig_p019_22.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

From Internal Diagnosis to External Auditing: A VLM-Driven Paradigm for Data-Free Online Backdoor Defense
cs.LG 2026-01 conditional novelty 7.0 of 10

PRISM uses a frozen VLM as an evolving semantic gatekeeper, reporting average attack success below 1% on CIFAR-10 while preserving clean accuracy.

Reference graph

Works this paper leans on

18 extracted references · 1 linked inside Pith · cited by 1 Pith paper

[1]

transforms benign images to mimic X1. The victim model f ∗ is: f ∗(x) = arg min f X (x0,y0)∈(X0,Y0) L(f(x 0), y0) + X x1∈X1 L(f(x 1), yt) ,(4) with the attack success rate (ASR) defined as: ASR=E x∼p(x)⊮[f ∗(T(x)) =y t]. We optimize this in two steps: Optimizing X1:The model must associate X1 with yt while preserving accuracy on X0. This requires minimizi...

2022
[2]

Inference Stage Mapping benign samples into poison boundary!
[3]

2023): Introduces a random color space shift between -0.1 and 0.1, specifically targeting color-based backdoors in datasets like CIFAR-10

Color Shift(Jiang et al. 2023): Introduces a random color space shift between -0.1 and 0.1, specifically targeting color-based backdoors in datasets like CIFAR-10

2023
[4]

2020): Reduces the color-bit depth of test images to 5 bits

Color Shrink(Li et al. 2020): Reduces the color-bit depth of test images to 5 bits

2020
[5]

2021): Applies stochas- tic affine transformation to each test image as a defense

Affine Transformation(Qiu et al. 2021): Applies stochas- tic affine transformation to each test image as a defense. Table 12 presents the results of these preprocessing de- fenses on the CIFAR-10 and CIFAR-100 datasets. Additive trigger-based attacks, such as BadNets, exhibit reduced ASR when subjected to image transformations. Natural trigger- based atta...

2021
[6]

2016), we identified that certain parameters, such as the learning rate and information loss weight, are crucial for convergence

Following InfoGAN (Chen et al. 2016), we identified that certain parameters, such as the learning rate and information loss weight, are crucial for convergence. The hyperparameters for the learning rate and information loss weight for different structures are presented in Table 8. It is important to note that the provided hyperparameters are not the only ...

2016
[8]

is utilized with five balanced and independent binary labels: Attractive, Mouth Slightly Open, High Cheekbones, Smiling, Wavy Hair
[10]

Poisoning Stage Find samples with unique features to poison. Undetachable with benign samples (hard to defense) Far to benign samples (high ASR) Asymmetric Trigger Figure 11: UMAP visualization of the latent space for three classes in CIFAR-10.Left:Poisoning Stage—We select samples with unique features to poison; these samples are undetachable from clean ...

2024

Show all 18 references

[11]

2023): Applies JPEG com- pression to all testing images at 75% quality

JPEG Compression(Xue et al. 2023): Applies JPEG com- pression to all testing images at 75% quality

2023
[12]

2023): Applies Gaussian blur with a kernel size of 3 pixels to each image

Gaussian Smoothing(Xue et al. 2023): Applies Gaussian blur with a kernel size of 3 pixels to each image. (a) Selected train images (b) Clean test images (c) Triggered test images (d) Trigger in differences Figure 15: Sample images from MNIST, CIFAR-10, CIFAR-100, GTSRB, and Im...

2023
[17]

Similarity between these probabilities indicates that the trigger does not interfere with the benign classification task, thereby satisfying the irrelevance condition. Figure 17: Metric design for irrelevancy: The closer the Trig- gered Accuracy (TA) is to the Clean Accuracy (...
[18]

Clean Accuracy (CA):Measures the accuracy of classify- ing clean imagesxto their ground truth labelsy, denoted asP(y|x, c= 0)
[19]

We conducted experiments by adding triggers to all images in both the training and testing datasets while preserving the original labels

Triggered Accuracy (TA):Measures the accuracy of clas- sifying triggered images x′ to their ground truth labels y, denoted asP(y|x, c= 1). We conducted experiments by adding triggers to all images in both the training and testing datasets while preserving the original labels. ...

2022
[645]

Huang, K.; Li, Y .; Wu, B.; Qin, Z.; and Ren, K

Springer. Huang, K.; Li, Y .; Wu, B.; Qin, Z.; and Ren, K. 2021. Back- door Defense via Decoupling the Training Process. InInter- national Conference on Learning Representations. Jang, E.; Gu, S.; and Poole, B. 2016. Categorical Reparam- eterization with Gumbel-Softmax. InInte...

2021 arXiv
[2015]

is used with a focus on samples with semantic seg- mentation annotations, totaling 2,330 training and 583 testing images.Multi-label Binary Classification: CelebA (Liu et al
[2016]

The batch size for all experiments is 256, with a weight decay of 1e-5

is set at 0.5. The batch size for all experiments is 256, with a weight decay of 1e-5. We use the Adam optimizer with betas of 0.5 and 0.999 for training for 100 epochs on each dataset. Both the generator and discriminator steps are set to
[2022]

InProceedings of the 30th ACM International Conference on Multimedia, 2957–2968

Physical backdoor attacks to lane detection systems in autonomous driving. InProceedings of the 30th ACM International Conference on Multimedia, 2957–2968. He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Identity map- pings in deep residual networks. InComputer Vision–ECCV 2016:...

2016
[2023]

Zeng, Y .; Pan, M.; Just, H

Compression-resistant backdoor attack against deep neural networks.Applied Intelligence, 1–16. Zeng, Y .; Pan, M.; Just, H. A.; Lyu, L.; Qiu, M.; and Jia, R. 2023. Narcissus: A practical clean-label backdoor attack with limited information. InProceedings of the 2023 ACM SIGSAC...

2023

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.

[1] [1]

transforms benign images to mimic X1. The victim model f ∗ is: f ∗(x) = arg min f X (x0,y0)∈(X0,Y0) L(f(x 0), y0) + X x1∈X1 L(f(x 1), yt) ,(4) with the attack success rate (ASR) defined as: ASR=E x∼p(x)⊮[f ∗(T(x)) =y t]. We optimize this in two steps: Optimizing X1:The model must associate X1 with yt while preserving accuracy on X0. This requires minimizi...

2022

[2] [2]

Inference Stage Mapping benign samples into poison boundary!

[3] [3]

2023): Introduces a random color space shift between -0.1 and 0.1, specifically targeting color-based backdoors in datasets like CIFAR-10

Color Shift(Jiang et al. 2023): Introduces a random color space shift between -0.1 and 0.1, specifically targeting color-based backdoors in datasets like CIFAR-10

2023

[4] [4]

2020): Reduces the color-bit depth of test images to 5 bits

Color Shrink(Li et al. 2020): Reduces the color-bit depth of test images to 5 bits

2020

[5] [5]

2021): Applies stochas- tic affine transformation to each test image as a defense

Affine Transformation(Qiu et al. 2021): Applies stochas- tic affine transformation to each test image as a defense. Table 12 presents the results of these preprocessing de- fenses on the CIFAR-10 and CIFAR-100 datasets. Additive trigger-based attacks, such as BadNets, exhibit reduced ASR when subjected to image transformations. Natural trigger- based atta...

2021

[6] [6]

2016), we identified that certain parameters, such as the learning rate and information loss weight, are crucial for convergence

Following InfoGAN (Chen et al. 2016), we identified that certain parameters, such as the learning rate and information loss weight, are crucial for convergence. The hyperparameters for the learning rate and information loss weight for different structures are presented in Table 8. It is important to note that the provided hyperparameters are not the only ...

2016

[7] [8]

is utilized with five balanced and independent binary labels: Attractive, Mouth Slightly Open, High Cheekbones, Smiling, Wavy Hair

[8] [10]

Poisoning Stage Find samples with unique features to poison. Undetachable with benign samples (hard to defense) Far to benign samples (high ASR) Asymmetric Trigger Figure 11: UMAP visualization of the latent space for three classes in CIFAR-10.Left:Poisoning Stage—We select samples with unique features to poison; these samples are undetachable from clean ...

2024