The paper introduces Checkerboard, a clean‑label backdoor attack that uses a closed‑form, data‑independent trigger design based on an input‑space Fisher‑separability objective and a ridge four‑neighbor local‑smoothness prior. This approach yields a pixel‑wise checkerboard trigger without requiring data access, surrogate model training, or iterative optimization, and it outperforms existing norm‑bounded clean‑label attacks across four benchmark datasets. On CIFAR‑10, poisoning 20 samples with a 10/255 perturbation achieves a 95.72% attack success rate, while on IN‑100 a 0.4% global poisoning rate yields over 83% ASR without harming clean accuracy, and the attack remains robust against state‑of‑the‑art defenses.
By Yi Yang, Jinyang Huang, Binbin Liu, Feng-Qi Cui, Xiaokang Zhou, Haiming Jin, Zhi Liu, Jie Zhang, Meng Li
The paper demonstrates that a single poisoned data point can successfully create a backdoor in linear models and ReLU neural networks without needing detailed knowledge of the training data. It establishes provable conditions under which this one‑poison attack works with high probability, achieving zero backdooring error while leaving the model’s normal performance largely unaffected. The attack relies only on coarse geometric bounds of the input space and training parameters.
By Thorsten Peinemann, Paula Arnold, Sebastian Berndt, Thomas Eisenbarth, Esfandiar Mohammadi
arXiv:2607. 09532v1 Announce Type: new Abstract: We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks.
By Andrej Bogdanov, Alon Rosen, Neekon Vafa
arXiv:2608. 02271v1 Announce Type: new Abstract: Parameter-Efficient Fine-tuned (PEFT) models are frequently downloaded from open repositories by practitioners.
By Nicola Pitzalis, Donald Shenaj, Giacomo Cignoni, Andrea Cossu, Davide Bacciu, Antonio Carta
Parameter-Efficient Fine-tuned (PEFT) models are frequently downloaded from open repositories by practitioners. This widespread practice creates a significant attack surface, as malicious actors can publish backdoored models that induce specific behaviors in response to predefined triggers.
arXiv:2605.13214v3 Announce Type: replace-cross
Abstract: Recent cryptographic results establish that neural networks can be backdoored such that no efficient algorithm can distinguish them from a cl...
By Marte Eggen, Eirik Reiestad, Kristian Gj{\o}steen, Inga Str\"umke
arXiv:2607. 05516v2 Announce Type: replace-cross Abstract: Model-specific adversarial attacks have been extensively studied.
By Paul K. Mandal, Pavan Reddy, Tristan Malatynski
arXiv:2607. 05516v1 Announce Type: cross Abstract: Model-specific adversarial attacks have been extensively studied.
By Paul K. Mandal, Pavan Reddy, Tristan Malatynski
Model-specific adversarial attacks have been extensively studied. We study a different failure mode: naturally occurring statistical signals in vision data that can behave like backdoor-like triggers without being maliciously inserted.
arXiv:2606. 02267v1 Announce Type: new Abstract: The vulnerability of deep neural networks to adversarial examples poses a significant challenge for real-world deployment.
By Nicolas Stalder, Benjamin F. Grewe, Matteo Saponati, Pau Vilimelis Aceituno
arXiv:2406. 05670v3 Announce Type: replace Abstract: Modern machine learning pipelines leverage large amounts of public data, making it infeasible to guarantee data quality and leaving models open to poisoning and backdoor attacks.
By Philip Sosnin, Mark N. M\"uller, Maximilian Baader, Calvin Tsay, Matthew Wicker
The paper introduces TRIM, a black‑box defense for backdoor attacks in computer vision models. TRIM identifies and removes malicious trigger regions at inference time using region‑based segmentation, adaptive trigger discovery via inpainting and diffusion, and selective purification, without needing model internals, training data, or clean samples. Experiments on various datasets and trigger types show TRIM reduces attack success rates to as low as 1.16% while maintaining high clean accuracy.
By Ahmed Abdelnaby, Mohamed Elmahallawy