mlsanityData to 13 Oct 2026

Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Trigger

arXiv 2312.04584 ↗First posted 3 Dec 2023cs.CR cs.AI cs.CVcited by 4

Not on the map. Why?

Abstract (arXiv)

Currently, sample-specific backdoor attacks (SSBAs) are the most advanced and malicious methods since they can easily circumvent most of the current backdoor defenses. In this paper, we reveal that SSBAs are not sufficiently stealthy due to their poisoned-label nature, where users can discover anomalies if they check the image-label relationship. In particular, we demonstrate that it is ineffective to directly generalize existing SSBAs to their clean-label variants by poisoning samples solely from the target class. We reveal that it is primarily due to two reasons, including (1) the `antagonistic effects' of ground-truth features and (2) the learning difficulty of sample-specific features. Accordingly, trigger-related features of existing SSBAs cannot be effectively learned under the clean-label setting due to their mild trigger intensity required for ensuring stealthiness. We argue that the intensity constraint of existing SSBAs is mostly because their trigger patterns are `content-irrelevant' and therefore act as `noises' for both humans and DNNs. Motivated by this understanding, we propose to exploit content-relevant features, a.k.a. (human-relied) attributes, as the trigger patterns to design clean-label SSBAs. This new attack paradigm is dubbed backdoor attack with attribute trigger (BAAT). Extensive experiments are conducted on benchmark datasets, which verify the effectiveness of our BAAT and its resistance to existing defenses.

Key facts. Cited by 4 papers in the map (data through 13 Oct 2026). Builds on 55 of its 85 references that are in the map. First posted on arXiv 3 Dec 2023.

Builds on

55 of 85 references.

References · 55

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,950
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,321
  3. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,713
  4. 2016Overcoming catastrophic forgetting in neural networkscited by 4,753
  5. 2018Neural Tangent Kernel: Convergence and Generalization in Neural Networkscited by 2,610
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,047
  7. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  8. 2017VGGFace2: A dataset for recognising faces across pose and agecited by 913
  9. 2016Universal adversarial perturbationscited by 782
  10. 2017Channel Pruning for Accelerating Very Deep Neural Networkscited by 701
  11. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 579
  12. 2018Spectral Signatures in Backdoor Attackscited by 481
38 more
  1. 2020Backdoor Learning: A Surveycited by 424
  2. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 352
  3. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 323
  4. 2020Input-Aware Dynamic Backdoor Attackcited by 312
  5. 2019Label-Consistent Backdoor Attackscited by 294
  6. 2017Generalized End-to-End Loss for Speaker Verificationcited by 292
  7. 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 264
  8. 2017AttGAN: Facial Attribute Editing by Only Changing What You Wantcited by 241
  9. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  10. 2020Blind Backdoors in Deep Learning Modelscited by 181
  11. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 169
  12. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 161
  13. 2017Neural Trojanscited by 153
  14. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 151
  15. 2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 134
  16. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 132
  17. 2020Adversarial Camouflage: Hiding Physical-World Attacks with Natural Stylescited by 126
  18. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 114
  19. 2021ArtFlow: Unbiased Image Style Transfer via Reversible Neural Flowscited by 113
  20. 2020Graph Backdoorcited by 112
  21. 2021SynFace: Face Recognition with Synthetic Datacited by 106
  22. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 96
  23. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 94
  24. 2018Is feature selection secure against training data poisoning?cited by 93
  25. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 85
  26. 2021Backdoor Attack in the Physical Worldcited by 83
  27. 2021HairCLIP: Design Your Hair by Text and Reference Imagecited by 79
  28. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 78
  29. 2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 77
  30. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 73
  31. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 71
  32. 2020Backdoor Attack against Speaker Verificationcited by 66
  33. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 53
  34. 2021A Backdoor Attack against 3D Point Cloud Classifierscited by 52
  35. 2019NeuronInspect: Detecting Backdoors in Neural Networks via Output Explanationscited by 50
  36. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 46
  37. 2023Towards Stealthy Backdoor Attacks against Speech Recognition via Elements of Soundcited by 30
  38. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 26

50 most cited of 55 All 55 (JSON)

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2025: 2; 2026: 2.

4 papers.

  1. 2025Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attackcited by 4
  2. 2025Coward: Collision-based OOD Watermarking for Practical Proactive Federated Backdoor Detectioncited by 0
  3. 2026TimeGuard: Channel-wise Pool Training for Backdoor Defense in Time Series Forecastingcited by 0
  4. 2026DRL-CLBA: A Clean Label Backdoor Attack for Speech Classification via DDPG Reinforcement Learningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers
  2. 2024Clean-image Backdoor Attacks
  3. 2023Label Poisoning is All You Need
  4. 2024Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks
  5. 2022Enhancing Clean Label Backdoor Attack with Two-phase Specific Triggers
  6. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information
  7. 2025Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization
  8. 2024Impart: An Imperceptible and Effective Label-Specific Backdoor Attack