Lilith: Backdoor Generalization under Training-Inference Trigger Shift

2026/07/28 by Zhou Feng, Jiahao Chen, Chunyi Zhou +6
Computer Science · #cs.CR #cs.LG

paper · pdf

arxiv created 2026/07/28 · arxiv updated 2026/07/30

Abstract

Machine-learning services increasingly rely on public data, third-party providers, and outsourced training, creating opportunities for data-poisoning attacks that implant persistent malicious behavior while preserving benign utility. However, existing backdoor studies largely evaluate exact trigger reuse, training-exposed trigger diversity, or variations along predefined transformation axes. They therefore leave a critical blind spot: whether a backdoor learned from one training-time trigger can generalize to an inference-time trigger family absent from victim training. We formulate this problem as backdoor generalization under training--inference trigger shift and introduce Lilith, a black-box anchor-to-family framework. Using only disjoint surrogate resources, Lilith first induces a compact target-side vulnerability with a single training anchor, then constructs a bounded inference-only family that preserves the anchor-induced representation geometry. We characterize this mechanism through anchor clearance and family reach, deriving sufficient conditions for family-wise target preservation under local regularity and bounded surrogate--victim discrepancy. Experiments across datasets, architectures, poisoning rates, and defenses show that Lilith achieves high family-wise attack success with limited utility degradation and a small trigger generalization gap. Additional analyses show that family activation depends on representation alignment rather than the proposal mechanism, exposing a broader threat overlooked by exact-trigger evaluation.

Citations

• When Backdoors Speak: Understanding LLM Backdoor Attacks Through Model-Generated Explanations
• Mellivora Capensis: A Backdoor-Free Training Framework on the Poisoned Dataset without Auxiliary Data
• IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency
• Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency
• Towards Stable Backdoor Purification through Feature Shift Tuning
• Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency
• Black-box Backdoor Defense via Zero-shot Image Purification
• SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistency
• Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information
• Backdoor Defense via Decoupling the Training Process
• Adversarial Unlearning of Backdoors via Implicit Hypergradient
• Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch
• Backdoor Attack in the Physical World
• Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks
• Invisible Backdoor Attack with Sample-Specific Triggers
• An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
• Input-Aware Dynamic Backdoor Attack
• Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks
• Clean-Label Backdoor Attacks on Video Recognition Models
• Label-Consistent Backdoor Attacks
• Spectral Signatures in Backdoor Attacks
• Low Frequency Adversarial Perturbation
• The Unreasonable Effectiveness of Deep Features as a Perceptual Metric
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Procedural Content Generation via Machine Learning (PCGML)
• Universal adversarial perturbations
• Grad-CAM: Visual Explanations from Deep Networks via Gradient-Based Localization
• Deep Residual Learning for Image Recognition
• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Multi-digit Number Recognition from Street View Imagery using Deep Convolutional Neural Networks

Related

• Revisiting Training-Inference Trigger Intensity in Backdoor Attacks
• Marksman Backdoor: Backdoor Attacks with Arbitrary Target Class
• Rethinking Backdoor Attacks on Dataset Distillation: A Kernel Method Perspective
• Demystifying Poisoning Backdoor Attacks from a Statistical Perspective
• Prototype-Guided Robust Learning against Backdoor Attacks