mlsanityData to 7 Oct 2026

Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization

arXiv 2511.07210 ↗First posted 10 Nov 2025cs.CV cs.CR cs.LGcited by 7

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Clean-image backdoor attacks, which use only label manipulation in training datasets to compromise deep neural networks, pose a significant threat to security-critical applications. A critical flaw in existing methods is that the poison rate required for a successful attack induces a proportional, and thus noticeable, drop in Clean Accuracy (CA), undermining their stealthiness. This paper presents a new paradigm for clean-image attacks that minimizes this accuracy degradation by optimizing the trigger itself. We introduce Generative Clean-Image Backdoors (GCB), a framework that uses a conditional InfoGAN to identify naturally occurring image features that can serve as potent and stealthy triggers. By ensuring these triggers are easily separable from benign task-related features, GCB enables a victim model to learn the backdoor from an extremely small set of poisoned examples, resulting in a CA drop of less than 1%. Our experiments demonstrate GCB's remarkable versatility, successfully adapting to six datasets, five architectures, and four tasks, including the first demonstration of clean-image backdoors in regression and segmentation. GCB also exhibits resilience against most of the existing backdoor defenses.

Key facts. Cited by 7 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 37 of its 66 references that are in the map. First posted on arXiv 10 Nov 2025.

Builds on

37 of 66 references.

References · 37

  1. 2017Attention Is All You Needcited by 59,932
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  4. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  5. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  6. 2019EfficientNet: Rethinking Model Scaling for Convolutional Neural Networkscited by 6,415
  7. 2018A Style-Based Generator Architecture for Generative Adversarial Networkscited by 5,986
  8. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  9. 2014Conditional Generative Adversarial Netscited by 2,152
  10. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  11. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  12. 2016InfoGAN: Interpretable Representation Learning by Information Maximizing Generative Adversarial Netscited by 858
25 more
  1. 2020DivideMix: Learning with Noisy Labels as Semi-supervised Learningcited by 691
  2. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  3. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  4. 2018Spectral Signatures in Backdoor Attackscited by 457
  5. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  6. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  7. 2019Confident Learning: Estimating Uncertainty in Dataset Labelscited by 411
  8. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  9. 2014Training Deep Neural Networks on Noisy Labels with Bootstrappingcited by 322
  10. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  11. 2019Label-Consistent Backdoor Attackscited by 285
  12. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  13. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
  14. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  15. 2020Rethinking the Trigger of Backdoor Attackcited by 76
  16. 2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 75
  17. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
  18. 2020Learning perturbation sets for robust machine learningcited by 48
  19. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
  20. 2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
  21. 2022Physical Backdoor Attacks to Lane Detection Systems in Autonomous Drivingcited by 29
  22. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  23. 2025One Surrogate to Fool Them All: Universal, Transferable, and Targeted Adversarial Attacks with CLIPcited by 15
  24. 2024Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistencycited by 13
  25. 2023Progressive Poisoned Data Isolation for Training-time Backdoor Defensecited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 7.

7 papers.

  1. 2026From Multi-Agent to Single-Agent: When Is Skill Distillation Beneficial?cited by 6
  2. 2026Contextual Agentic Memory is a Memo, Not True Memorycited by 5
  3. 2026From Internal Diagnosis to External Auditing: A VLM-Driven Paradigm for Data-Free Online Backdoor Defensecited by 3
  4. 2026LLM Agents Are Latent Context Managers: Eliciting Self-Managed Context via State Proprioceptioncited by 3
  5. 2026When Agent Automation Becomes Profitable: Quantifying and Insuring Autonomous AI Risk through Trace-Economic Underwritingcited by 2
  6. 2026Reviewer Scores Are Not Comparable Across Research Areas in ML Peer Reviewcited by 2
  7. 2026Position: Universal Time Series Foundation Models Rest on a Category Errorcited by 1