Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization

2025/11/10 by Binyan Xu, Xu, Binyan, Fan Yang +7 · 1 citation
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Backdoor #Deep learning #Generative grammar #Obstacle #Resilience (materials science) #Security and Verification in Computing #Set (abstract data type) #Training set #Trojan #acm:68T07 #cs.CR #cs.CV #cs.LG #msc:68T07

paper · pdf · open access · doi:10.48550/arxiv.2511.07210

published in arXiv (Cornell University) (Cornell University) · 19 pages, 22 figures, 15 tables. To appear in AAAI '26 (Oral). This paper extends the AAAI-2026 version by including the Appendix

openalex publication_date 2025/11/10 · openalex created_date 2025/11/12 · openalex updated_date 2026/07/28 · arxiv created 2026/07/29 · arxiv updated 2026/07/30

Abstract

Clean-image backdoor attacks, which use only label manipulation in training datasets to compromise deep neural networks, pose a significant threat to security-critical applications. A critical flaw in existing methods is that the poison rate required for a successful attack induces a proportional, and thus noticeable, drop in Clean Accuracy (CA), undermining their stealthiness. This paper presents a new paradigm for clean-image attacks that minimizes this accuracy degradation by optimizing the trigger itself. We introduce Generative Clean-Image Backdoors (GCB), a framework that uses a conditional InfoGAN to identify naturally occurring image features that can serve as potent and stealthy triggers. By ensuring these triggers are easily separable from benign task-related features, GCB enables a victim model to learn the backdoor from an extremely small set of poisoned examples, resulting in a CA drop of less than 1%. Our experiments demonstrate GCB's remarkable versatility, successfully adapting to six datasets, five architectures, and four tasks, including the first demonstration of clean-image backdoors in regression and segmentation. GCB also exhibits resilience against most of the existing backdoor defenses.

Citations

• From Multi-Agent to Single-Agent: When Is Skill Distillation Beneficial?
• One Surrogate to Fool Them All: Universal, Transferable, and Targeted Adversarial Attacks with CLIP
• Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency
• BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learning
• Progressive Poisoned Data Isolation for Training-time Backdoor Defense
• Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examples
• Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Features
• Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimization
• Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information
• Physical Backdoor Attacks to Lane Detection Systems in Autonomous Driving
• Backdoor Defense via Decoupling the Training Process
• Learning Transferable Visual Models From Natural Language Supervision
• DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentation
• An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
• Input-Aware Dynamic Backdoor Attack
• Learning perturbation sets for robust machine learning
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
• Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustness
• Rethinking the Trigger of Backdoor Attack
• Label-Consistent Backdoor Attacks
• EfficientNet: Rethinking Model Scaling for Convolutional Neural Networks
• A Style-Based Generator Architecture for Generative Adversarial Networks
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Spectral Signatures in Backdoor Attacks
• Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Attention Is All You Need
• InfoGAN: Interpretable Representation Learning by Information Maximizing Generative Adversarial Nets
• Identity Mappings in Deep Residual Networks
• Training Deep Neural Networks on Noisy Labels with Bootstrapping
• Deep Learning Face Attributes in the Wild
• Conditional Generative Adversarial Nets
• Very Deep Convolutional Networks for Large-Scale Image Recognition
• ImageNet Large Scale Visual Recognition Challenge
• ImageNet Large Scale Visual Recognition Challenge
• Gradient-based learning applied to document recognition

Cited by

• CLIP-Guided Backdoor Defense through Entropy-Based Poisoned Dataset Separation
• Contextual Agentic Memory is a Memo, Not True Memory

Related

• Enhancing Clean Label Backdoor Attack with Two-phase Specific Triggers
• An Effective and Resilient Backdoor Attack Framework against Deep Neural Networks and Vision Transformers
• UltraClean: A Simple Framework to Train Robust Neural Networks against Backdoor Attacks
• Imperceptible Sample-Specific Backdoor to DNN with Denoising Autoencoder
• Injection, Attack and Erasure: Revocable Backdoor Attacks via Machine Unlearning