mlsanityData to 14 Oct 2026

When Stronger Triggers Backfire: A High-Dimensional Theory of Backdoor Attacks

arXiv 2605.22481 ↗First posted 21 May 2026cs.LG math.ST stat.THcited by 0

Not on the map. Why?

Abstract (arXiv)

Backdoor poisoning attacks behave counter-intuitively in high dimensions: stronger training triggers can help the defender. We study regularised generalised linear models on Gaussian-mixture data in the proportional regime (p/n → kappa), varying the training trigger strength α against a fixed test trigger. Three phenomena emerge: (i) clean test accuracy increases with α; (ii) attack success peaks at a finite α and then declines; and (iii) the most damaging trigger direction is the minimum eigenvector of the data covariance. We prove all three results in closed form for the squared loss, and extend (i) and (ii) to general convex GLM losses via a Gaussian-proxy fixed-point system. We identify a finite-sample noise floor proportional to kappa as the mechanism behind (i), invisible to classical n gg p analysis. Experiments on CIFAR-10 and Gaussian surrogates match the theory closely; ResNet-18 experiments show the same phenomena beyond the convex setting.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 31 of its 40 references that are in the map. First posted on arXiv 21 May 2026.

Builds on

31 of 40 references.

References · 31

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  3. 2018Reconciling modern machine learning practice and the bias-variance trade-offcited by 927
  4. 2019Benign Overfitting in Linear Regressioncited by 549
  5. 2019Surprises in High-Dimensional Ridgeless Least Squares Interpolationcited by 513
  6. 2020Backdoor Learning: A Surveycited by 426
  7. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
  8. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  9. 2019Label-Consistent Backdoor Attackscited by 296
  10. 2021Deep learning: a statistical viewpointcited by 240
  11. 2015High-Dimensional Asymptotics of Prediction: Ridge Regression and Classificationcited by 148
  12. 2017Optimal Errors and Phase Transitions in High-Dimensional Generalized Linear Modelscited by 116
19 more
  1. 2021Backdoor Attack in the Physical Worldcited by 84
  2. 2018A modern maximum-likelihood theory for high-dimensional logistic regressioncited by 81
  3. 2019A Model of Double Descent for High-dimensional Binary Linear Classificationcited by 81
  4. 2025Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samplescited by 72
  5. 2022High-dimensional limit theorems for SGD: Effective dynamics and critical scalingcited by 70
  6. 2021Learning Gaussian Mixtures with Generalised Linear Models: Precise Asymptotics in High-dimensionscited by 54
  7. 2020A Precise High-Dimensional Asymptotic Theory for Boosting and Minimum-ℓ1-Norm Interpolated Classifierscited by 44
  8. 2013A framework to characterize performance of LASSO algorithmscited by 40
  9. 2024Machine Unlearning Fails to Remove Data Poisoning Attackscited by 37
  10. 2019The generalization error of max-margin linear classifiers: Benign overfitting and high dimensional asymptotics in the overparametrized regimecited by 28
  11. 2022Homogenization of SGD in high-dimensions: Exact dynamics and generalization propertiescited by 27
  12. 2023Hitting the High-Dimensional Notes: An ODE for SGD learning dynamics on GLMs and multi-index modelscited by 26
  13. 2023Exploring the Limits of Model-Targeted Indiscriminate Data Poisoning Attackscited by 23
  14. 2022Data-Efficient Backdoor Attackscited by 13
  15. 2021Lower Bounds on the Generalization Error of Nonlinear Learning Modelscited by 6
  16. 2025High-Dimensional Analysis of Single-Layer Attention for Sparse-Token Classificationcited by 6
  17. 2025A Linear Approach to Data Poisoningcited by 2
  18. 2026Theory of Minimal Weight Perturbations in Deep Networks and its Applications for Low-Rank Activated Backdoor Attackscited by 1
  19. 2026Safety-Efficacy Trade Off: Robustness against Data-Poisoningcited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Density-aware Sample-specific Attack
  2. 2025Revisiting Training-Inference Trigger Intensity in Backdoor Attacks
  3. 2021Backdoor Learning Curves: Explaining Backdoor Poisoning Beyond Influence Functions
  4. 2023Demystifying Poisoning Backdoor Attacks from a Statistical Perspective
  5. 2026Trapping Attacker in Dilemma: Examining Internal Correlations and External Influences of Trigger for Defending GNN Backdoors
  6. 2023What Distributions are Robust to Indiscriminate Poisoning Attacks for Linear Learners?
  7. 2026Why Backdooring Neural Networks is so Easy?
  8. 2023Stealthy Backdoor Attack via Confidence-driven Sampling