# Systematic Evaluation of Backdoor Data Poisoning Attacks on Image Classifiers

arXiv: https://arxiv.org/abs/2004.11514 · HTML: https://mlsanity.com/paper/2004.11514/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Apr 2020.

## Built on by (most cited first, 23 of 23)

- [Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks](https://mlsanity.com/paper/2101.05930/) (2021)
- [Can You Hear It? Backdoor Attacks via Ultrasonic Triggers](https://mlsanity.com/paper/2107.14569/) (2021)
- [An Overview of Backdoor Attacks Against Deep Neural Networks and Possible Defences](https://mlsanity.com/paper/2111.08429/) (2021)
- [Towards A Proactive ML Approach for Detecting Backdoor Poison Samples](https://mlsanity.com/paper/2205.13616/) (2022)
- [Indiscriminate Poisoning Attacks on Unsupervised Contrastive Learning](https://mlsanity.com/paper/2202.11202/) (2022)
- [Excess Capacity and Backdoor Poisoning](https://mlsanity.com/paper/2109.00685/) (2021)
- [Data and Model Poisoning Backdoor Attacks on Wireless Federated Learning, and the Defense Mechanisms: A Comprehensive Survey](https://mlsanity.com/paper/2312.08667/) (2023)
- [An Equivalence Between Data Poisoning and Byzantine Gradient Attacks](https://mlsanity.com/paper/2202.08578/) (2022)
- [Being Properly Improper](https://mlsanity.com/paper/2106.09920/) (2021)
- [FLTracer: Accurate Poisoning Attack Provenance in Federated Learning](https://mlsanity.com/paper/2310.13424/) (2023)
- [SoK: A Systematic Evaluation of Backdoor Trigger Characteristics in Image Classification](https://mlsanity.com/paper/2302.01740/) (2023)
- [Backdooring Explainable Machine Learning](https://mlsanity.com/paper/2204.09498/) (2022)
- [Defense against Backdoor Attacks via Identifying and Purifying Bad Neurons](https://mlsanity.com/paper/2208.06537/) (2022)
- [Active Learning Under Malicious Mislabeling and Poisoning Attacks](https://mlsanity.com/paper/2101.00157/) (2021)
- [Widen The Backdoor To Let More Attackers In](https://mlsanity.com/paper/2110.04571/) (2021)
- [On the Relevance of Byzantine Robust Optimization Against Data Poisoning](https://mlsanity.com/paper/2405.00491/) (2024)
- [Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergies](https://mlsanity.com/paper/2505.22829/) (2025)
- [An Adaptive Black-box Backdoor Detection Method for Deep Neural Networks](https://mlsanity.com/paper/2204.04329/) (2022)
- [Transparency Attacks: How Imperceptible Image Layers Can Fool AI Perception](https://mlsanity.com/paper/2401.15817/) (2024)
- [2DSig-Detect: a semi-supervised framework for anomaly detection on image data using 2D-signatures](https://mlsanity.com/paper/2409.04982/) (2024)
- [Attacking Deep Learning AI Hardware with Universal Adversarial Perturbation](https://mlsanity.com/paper/2111.09488/) (2021)
- [Anomaly Localization in Model Gradients Under Backdoor Attacks Against Federated Learning](https://mlsanity.com/paper/2111.14683/) (2021)
- [Exploiting Alpha Transparency In Language And Vision-Based AI Systems](https://mlsanity.com/paper/2402.09671/) (2024)

## Abstract (arXiv)

Backdoor data poisoning attacks have recently been demonstrated in computer vision research as a potential safety risk for machine learning (ML) systems. Traditional data poisoning attacks manipulate training data to induce unreliability of an ML model, whereas backdoor data poisoning attacks maintain system performance unless the ML model is presented with an input containing an embedded "trigger" that provides a predetermined response advantageous to the adversary. Our work builds upon prior backdoor data-poisoning research for ML image classifiers and systematically assesses different experimental conditions including types of trigger patterns, persistence of trigger patterns during retraining, poisoning strategies, architectures (ResNet-50, NasNet, NasNet-Mobile), datasets (Flowers, CIFAR-10), and potential defensive regularization techniques (Contrastive Loss, Logit Squeezing, Manifold Mixup, Soft-Nearest-Neighbors Loss). Experiments yield four key findings. First, the success rate of backdoor poisoning attacks varies widely, depending on several factors, including model architecture, trigger pattern and regularization technique. Second, we find that poisoned models are hard to detect through performance inspection alone. Third, regularization typically reduces backdoor success rate, although it can have no effect or even slightly increase it, depending on the form of regularization. Finally, backdoors inserted through data poisoning can be rendered ineffective after just a few epochs of additional training on a small set of clean data without affecting the model's performance.