The community has recently developed various training-time defenses to counter neural backdoors introduced through data poisoning. In light of the observation that a model learns poisonous samples responsible for the backdoor easier than benign samples, these approaches either use a fixed threshold of the training loss for splitting or iteratively learn a reference model as an oracle for identifying benign samples.
The paper demonstrates that a single poisoned data point can successfully create a backdoor in linear models and ReLU neural networks without needing detailed knowledge of the training data. It establishes provable conditions under which this one‑poison attack works with high probability, achieving zero backdooring error while leaving the model’s normal performance largely unaffected. The attack relies only on coarse geometric bounds of the input space and training parameters.
By Thorsten Peinemann, Paula Arnold, Sebastian Berndt, Thomas Eisenbarth, Esfandiar Mohammadi
arXiv:2608. 00732v1 Announce Type: new Abstract: Backdoor attacks pose a serious threat to deep neural networks, especially when training relies on third-party data, allowing adversaries to inject malicious behaviors through data poisoning.
By Zixuan Zhu, Rui Wang, Lihua Jing, Jinwen Zhong
arXiv:2509.06896v3 Announce Type: replace
Abstract: Targeted data poisoning attacks manipulate model predictions on specific test samples by injecting malicious data into training. Yet existing evalu...
By William Xu, Chenyu Zhang, Yihan Wang, Matthew Y. R. Yang, Zuoqiu Liu, Yaoliang Yu, Gautam Kamath, Yiwei Lu
arXiv:2507. 05113v3 Announce Type: replace-cross Abstract: Deep Neural Networks (DNNs) are susceptible to backdoor attacks, where adversaries poison training data to implant backdoor into the victim model.
By Binyan Xu, Fan Yang, Xilin Dai, Di Tang, Kehuan Zhang
The paper introduces NEEDLE, a training‑free technique for removing backdoors from large language models. After a trigger is identified, NEEDLE estimates a backdoor direction and a refusal subspace using activation vectors, then applies sequential weight orthogonalisation to suppress the backdoor while preserving refusal‑related representations. The method requires no clean reference model or original poisoned data and achieves the lowest attack success rate and minimal impact on model performance across multiple model families and attack types.
By Minoo Kim, Vasileios Lampos, George Drayson
arXiv:2609.15029v1 Announce Type: cross
Abstract: Backdoor poisoning attacks add poisoned examples to otherwise-clean finetuning data, pairing a trigger with a target behavior that the model learns t...
By Aashiq Muhamed, Mona T. Diab, Virginia Smith, Andrew Ilyas, Matthew Jagielski
The paper evaluates two training‑time data poisoning attacks—label flipping and backdoor poisoning—on MNIST and Fashion‑MNIST using Logistic Regression, Linear SVM, and Random Forest classifiers. Label flipping degrades performance most for Logistic Regression and Linear SVM, while Random Forest remains relatively stable. Backdoor poisoning achieves near‑perfect attack success rates across all models while largely preserving clean‑test accuracy, highlighting the stealthy nature of targeted backdoors.
By Toshif Khan (Minot State University), Muhammad Abusaqer (Minot State University)
Backdoor attacks compromise training data so that a model retains clean accuracy but predicts an attacker-chosen target on triggered inputs. At very low poisoning rates, only a few samples convey the trigger--target association, making poison-sample selection critical.
The paper introduces Checkerboard, a clean‑label backdoor attack that uses a closed‑form, data‑independent trigger design based on an input‑space Fisher‑separability objective and a ridge four‑neighbor local‑smoothness prior. This approach yields a pixel‑wise checkerboard trigger without requiring data access, surrogate model training, or iterative optimization, and it outperforms existing norm‑bounded clean‑label attacks across four benchmark datasets. On CIFAR‑10, poisoning 20 samples with a 10/255 perturbation achieves a 95.72% attack success rate, while on IN‑100 a 0.4% global poisoning rate yields over 83% ASR without harming clean accuracy, and the attack remains robust against state‑of‑the‑art defenses.
By Yi Yang, Jinyang Huang, Binbin Liu, Feng-Qi Cui, Xiaokang Zhou, Haiming Jin, Zhi Liu, Jie Zhang, Meng Li
arXiv:2511. 07210v3 Announce Type: replace-cross Abstract: Clean-image backdoor attacks, which use only label manipulation in training datasets to compromise deep neural networks, pose a significant threat to security-critical applications.
By Binyan Xu, Fan Yang, Di Tang, Xilin Dai, Kehuan Zhang
Backdoor attacks in Large Language Models (LLMs) are a growing security concern, where models can generate adversary-chosen content. Existing defenses target backdoors one at a time and typically require knowledge of the trigger, leaving the defender at a structural disadvantage when unknown backdoors may exist in a model.