mlsanityData to 7 Oct 2026

Generalization Bound and New Algorithm for Clean-Label Backdoor Attack

arXiv 2406.00588 ↗First posted 2 Jun 2024cs.LG cs.CR math.STcited by 11

Not on the map. Why?

Abstract (arXiv)

The generalization bound is a crucial theoretical tool for assessing the generalizability of learning methods and there exist vast literatures on generalizability of normal learning, adversarial learning, and data poisoning. Unlike other data poison attacks, the backdoor attack has the special property that the poisoned triggers are contained in both the training set and the test set and the purpose of the attack is two-fold. To our knowledge, the generalization bound for the backdoor attack has not been established. In this paper, we fill this gap by deriving algorithm-independent generalization bounds in the clean-label backdoor attack scenario. Precisely, based on the goals of backdoor attack, we give upper bounds for the clean sample population errors and the poison population errors in terms of the empirical error on the poisoned training dataset. Furthermore, based on the theoretical result, a new clean-label backdoor attack is proposed that computes the poisoning trigger by combining adversarial noise and indiscriminate poison. We show its effectiveness in a variety of settings.

Key facts. Cited by 11 papers in the map (data through 7 Oct 2026). Builds on 54 of its 76 references that are in the map. First posted on arXiv 2 Jun 2024.

Builds on

54 of 76 references.

References · 54

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  7. 2016Universal adversarial perturbationscited by 774
  8. 2017Spectrally-normalized margin bounds for neural networkscited by 681
  9. 2017Exploring Generalization in Deep Learningcited by 595
  10. 2019Fine-Grained Analysis of Optimization and Generalization for Overparameterized Two-Layer Neural Networkscited by 562
  11. 2015Train faster, generalize better: Stability of stochastic gradient descentcited by 547
  12. 2017Computing Nonvacuous Generalization Bounds for Deep (Stochastic) Neural Networks with Many More Parameters than Training Datacited by 527
38 more
  1. 2019Hidden Trigger Backdoor Attackscited by 359
  2. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  3. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  4. 2018Stronger generalization bounds for deep nets via a compression approachcited by 306
  5. 2017Nearly-tight VC-dimension and pseudodimension bounds for piecewise linear neural networkscited by 304
  6. 2021Deep learning: a statistical viewpointcited by 239
  7. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  8. 2019Generalization Bounds of Stochastic Gradient Descent for Wide and Deep Neural Networkscited by 221
  9. 2023Transformers as Algorithms: Generalization and Stability in In-context Learningcited by 220
  10. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
  11. 2020Blind Backdoors in Deep Learning Modelscited by 174
  12. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  13. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  14. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  15. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  16. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  17. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  18. 2019Polylogarithmic width suffices for gradient descent to achieve arbitrarily small test error with shallow ReLU networkscited by 120
  19. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  20. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  21. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 93
  22. 2017Data-Dependent Stability of Stochastic Gradient Descentcited by 90
  23. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  24. 2020On the Effectiveness of Mitigating Data Poisoning Attacks with Gradient Shapingcited by 82
  25. 2019Data-dependent Sample Complexity of Deep Neural Networks via Lipschitz Augmentationcited by 71
  26. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
  27. 2019Generalization bounds for deep convolutional neural networkscited by 58
  28. 2019NeuronInspect: Detecting Backdoors in Neural Networks via Output Explanationscited by 49
  29. 2020Train simultaneously, generalize better: Stability of gradient-based minimax learnerscited by 43
  30. 2020Generalization bounds for deep learningcited by 38
  31. 2022Robust Unlearnable Examples: Protecting Data Against Adversarial Learningcited by 34
  32. 2022Stability Analysis and Generalization Bounds of Adversarial Trainingcited by 30
  33. 2018Approximation and Estimation for High-Dimensional Deep Learning Networkscited by 22
  34. 2022Holistic Robust Data-Driven Decisionscited by 17
  35. 2022Generalization Error Bounds for Deep Neural Networks Trained by SGDcited by 14
  36. 2022On Optimal Learning Under Targeted Data Poisoningcited by 14
  37. 2023Detection and Defense of Unlearnable Examplescited by 13
  38. 2019SmoothFool: An Efficient Framework for Computing Smooth Adversarial Perturbationscited by 12

50 most cited of 54 All 54 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 6; 2026: 3.

11 papers.

  1. 2025Red-Teaming Text-to-Image Systems by Rule-based Preference Modelingcited by 8
  2. 2025BadThink: Triggered Overthinking Attacks on Chain-of-Thought Reasoning in Large Language Modelscited by 7
  3. 2026CBV: Clean-label Backdoor Attacks on Vision Language Models via Diffusion Modelscited by 3
  4. 2025Seal Your Backdoor with Variational Defensecited by 2
  5. 2025Provable Watermarking for Data Poisoning Attackscited by 2
  6. 2024Generalizability of Memorization Neural Networkscited by 1
  7. 2025BadSR: Stealthy Label Backdoor Attacks on Image Super-Resolutioncited by 1
  8. 2024Trading Devil Final: Backdoor attack via Stock market and Bayesian Optimizationcited by 0
  9. 2025Provable one-poison backdoor attacks on linear models and ReLU neural networkscited by 0
  10. 2026Invisible Clean-Label Backdoor Attacks for Generative Data Augmentationcited by 0
  11. 2026Checkerboard: Closed-Form and Data-Independent Trigger Design for Clean-Label Backdoor Attackscited by 0