mlsanityData to 14 Oct 2026

Revisiting Training-Inference Trigger Intensity in Backdoor Attacks

arXiv 2503.12058 ↗First posted 15 Mar 2025cs.CR cs.AIcited by 2

Not on the map. Why?

Abstract (arXiv)

Backdoor attacks typically place a specific trigger on certain training data, such that the model makes prediction errors on inputs with that trigger during inference. Despite the core role of the trigger, existing studies have commonly believed a perfect match between training-inference triggers is optimal. In this paper, for the first time, we systematically explore the training-inference trigger relation, particularly focusing on their mismatch, based on a Training-Inference Trigger Intensity Manipulation (TITIM) workflow. TITIM specifically investigates the training-inference trigger intensity, such as the size or the opacity of a trigger, and reveals new insights into trigger generalization and overfitting. These new insights challenge the above common belief by demonstrating that the training-inference trigger mismatch can facilitate attacks in two practical scenarios, posing more significant security threats than previously thought. First, when the inference trigger is fixed, using training triggers with mixed intensities leads to stronger attacks than using any single intensity. For example, on CIFAR-10 with ResNet-18, mixing training triggers with 1.0 and 0.1 opacities improves the worst-case attack success rate (ASR) (over different testing opacities) of the best single-opacity attack from 10.61% to 92.77%. Second, intentionally using certain mismatched training-inference triggers can improve the attack stealthiness, i.e., better bypassing defenses. For example, compared to the training/inference intensity of 1.0/1.0, using 1.0/0.7 decreases the area under the curve (AUC) of the Scale-Up defense from 0.96 to 0.62, while maintaining a high attack ASR (99.65% vs. 91.62%). The above new insights are validated to be generalizable across different backdoor attacks, models, datasets, tasks, and (digital/physical) domains.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 74 of its 110 references that are in the map. First posted on arXiv 15 Mar 2025.

Builds on

74 of 110 references.

References · 74

  1. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  4. 2015Distilling the Knowledge in a Neural Networkcited by 10,324
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,442
  7. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  8. 2017Squeeze-and-Excitation Networkscited by 4,789
  9. 2016Overcoming catastrophic forgetting in neural networkscited by 4,787
  10. 2014Deep Learning Face Attributes in the Wildcited by 3,693
  11. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  12. 2018UMAP: Uniform Manifold Approximation and Projection for Dimension Reductioncited by 2,898
38 more
  1. 2016Identity Mappings in Deep Residual Networkscited by 1,965
  2. 2021Tokens-to-Token ViT: Training Vision Transformers from Scratch on ImageNetcited by 1,101
  3. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  4. 2021CvT: Introducing Convolutions to Vision Transformerscited by 947
  5. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  6. 2018Spectral Signatures in Backdoor Attackscited by 484
  7. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  8. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
  9. 2020Backdoor Learning: A Surveycited by 426
  10. 2019Hidden Trigger Backdoor Attackscited by 371
  11. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
  12. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  13. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  14. 2019Label-Consistent Backdoor Attackscited by 296
  15. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
  16. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 242
  17. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
  18. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  19. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 199
  20. 2020Blind Backdoors in Deep Learning Modelscited by 182
  21. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 169
  22. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 166
  23. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 161
  24. 2017Neural Trojanscited by 153
  25. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 152
  26. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 134
  27. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 130
  28. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 124
  29. 2020RAB: Provable Robustness Against Backdoor Attackscited by 118
  30. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 113
  31. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 98
  32. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 95
  33. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 95
  34. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 86
  35. 2019Defending Neural Backdoors via Generative Distribution Modelingcited by 84
  36. 2021Backdoor Attack in the Physical Worldcited by 84
  37. 2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 77
  38. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 73

50 most cited of 74 All 74 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026MetaBackdoor: Exploiting Positional Encoding as a Backdoor Attack Surface in LLMscited by 1
  2. 2026Checkerboard: Closed-Form and Data-Independent Trigger Design for Clean-Label Backdoor Attackscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Lilith: Backdoor Generalization under Training-Inference Trigger Shift
  2. 2026When Stronger Triggers Backfire: A High-Dimensional Theory of Backdoor Attacks
  3. 2026Removing the Trigger, Not the Backdoor: Alternative Triggers and Latent Backdoors
  4. 2026Backdoor Unlearning Generalization: A Path Toward the Removal of Unknown Triggers in LLMs
  5. 2026Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors
  6. 2023Demystifying Poisoning Backdoor Attacks from a Statistical Perspective
  7. 2021Backdoor Learning Curves: Explaining Backdoor Poisoning Beyond Influence Functions
  8. 2023Rethinking the Trigger-injecting Position in Graph Backdoor Attack