mlsanityData to 7 Oct 2026

A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attacks

arXiv 2306.08313 ↗First posted 14 Jun 2023cs.CR cs.CVcited by 5

Not on the map. Why?

Abstract (arXiv)

Poisoning efficiency is crucial in poisoning-based backdoor attacks, as attackers aim to minimize the number of poisoning samples while maximizing attack efficacy. Recent studies have sought to enhance poisoning efficiency by selecting effective samples. However, these studies typically rely on a proxy backdoor injection task to identify an efficient set of poisoning samples. This proxy attack-based approach can lead to performance degradation if the proxy attack settings differ from those of the actual victims, due to the shortcut nature of backdoor learning. Furthermore, proxy attack-based methods are extremely time-consuming, as they require numerous complete backdoor injection processes for sample selection. To address these concerns, we present a Proxy attack-Free Strategy (PFS) designed to identify efficient poisoning samples based on the similarity between clean samples and their corresponding poisoning samples, as well as the diversity of the poisoning set. The proposed PFS is motivated by the observation that selecting samples with high similarity between clean and corresponding poisoning samples results in significantly higher attack success rates compared to using samples with low similarity. Additionally, we provide theoretical foundations to explain the proposed PFS. We comprehensively evaluate the proposed strategy across various datasets, triggers, poisoning rates, architectures, and training hyperparameters. Our experimental results demonstrate that PFS enhances backdoor attack efficiency while also offering a remarkable speed advantage over previous proxy attack-based selection methodologies.

Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Builds on 50 of its 82 references that are in the map. First posted on arXiv 14 Jun 2023.

Builds on

50 of 82 references.

References · 50

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Language Models are Few-Shot Learnerscited by 32,199
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2018Neural Tangent Kernel: Convergence and Generalization in Neural Networkscited by 2,597
  5. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  7. 2016Universal adversarial perturbationscited by 774
  8. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  9. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  10. 2020Backdoor Learning: A Surveycited by 412
  11. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  12. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
38 more
  1. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  2. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  3. 2019Label-Consistent Backdoor Attackscited by 285
  4. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  5. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  6. 2020Blind Backdoors in Deep Learning Modelscited by 174
  7. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  8. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  9. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  10. 2021Active Learning by Acquiring Contrastive Examplescited by 154
  11. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  12. 2020Cold-start Active Learning through Self-supervised Language Modelingcited by 128
  13. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  14. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
  15. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  16. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  17. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  18. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 93
  19. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  20. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  21. 2020Backdoor Attack against Speaker Verificationcited by 62
  22. 2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 60
  23. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 57
  24. 2019Terminal Brain Damage: Exposing the Graceless Degradation in Deep Neural Networks Under Hardware Fault Attackscited by 55
  25. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  26. 2020Backdoor Attacks against Transfer Learning with Pre-trained Deep Learning Modelscited by 43
  27. 2022Post-Training Detection of Backdoor Attacks for Two-Class and Multi-Attack Scenarioscited by 29
  28. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 29
  29. 2020Backdoors in Neural Models of Source Codecited by 27
  30. 2020A Systematic Survey of Regularization and Normalization in GANscited by 27
  31. 2022Just Rotate it: Deploying Backdoor Attacks via Rotation Transformationcited by 19
  32. 2020Active Sentence Learning by Adversarial Uncertainty Sampling in Discrete Spacecited by 17
  33. 2021Enhancing Backdoor Attacks with Multi-Level MMD Regularizationcited by 15
  34. 2019CryptoNN: Training Neural Networks over Encrypted Datacited by 14
  35. 2022Data-Efficient Backdoor Attackscited by 13
  36. 2020A New Perspective on Stabilizing GANs training: Direct Adversarial Trainingcited by 12
  37. 2022A temporal chrominance trigger for clean-label backdoor attack against anti-spoof rebroadcast detectioncited by 10
  38. 2022BATT: Backdoor Attack with Transformation-based Triggerscited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 0; 2025: 2; 2026: 1.

5 papers.

  1. 2025Dual Frequency Branch Framework with Reconstructed Sliding Windows Attention for AI-Generated Image Detectioncited by 10
  2. 2023Explore the Effect of Data Selection on Poison Efficiency in Backdoor Attackscited by 7
  3. 2025RunawayEvil: Jailbreaking the Image-to-Video Generative Modelscited by 7
  4. 2023Efficient Trigger Word Insertioncited by 2
  5. 2026Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attackscited by 0