PaperlayerView exact revision on arXiv

Source-linked AI summary

Low-ASR Backdoors: Exploiting Attack Success Rate Reduction and Attacker-Defender Asymmetry

Arham Riaz, Ting Yu

arXiv:2608.27288v1cs.CR

TL;DR

Existing defenses are built around high-ASR backdoors and may therefore overlook attacks whose observable trigger behavior is deliberately weakened. The paper uses reverse training to generate low-ASR models while preserving clean-input performance, then finds that four evaluated defenses fail to detect their low-ASR counterparts despite residual attacker-useful behavior.

  • Problem

    Existing backdoor defenses are largely designed and evaluated for high-ASR attacks, leaving their reliability against deliberately reduced-ASR backdoors underexplored.

  • Method

    The paper introduces reverse training, which applies the original trigger while assigning triggered inputs their ground-truth labels to weaken the trigger–target association.

  • Results

    Four evaluated defenses successfully identify conventional high-ASR backdoors but fail to detect their low-ASR counterparts, which are consistently classified as clean.

  • Takeaways & Limitations

    Low-ASR backdoors expose an attacker–defender asymmetry: defenders need reliable aggregate evidence, whereas attackers can search a retained local copy for one successful candidate.

  • Takeaways & Limitations

    The evaluation focuses on image classification, uses reverse training as one construction mechanism, and covers only a representative set of defenses.

Abstract

from arXiv · show

Backdoor attacks are among the most effective and stealthy attacks in deep learning. Existing attacks and defenses are largely designed and evaluated under the assumption that successful backdoors exhibit high Attack Success Rates (ASRs). In this paper, we show that this assumption creates a fundamental weakness in existing defense paradigms. ASR is not an intrinsic property of a backdoor; rather, it is an attacker-controlled variable that can be deliberately reduced without eliminating the underlying backdoor behavior. We introduce a reverse-training framework that weakens the trigger-target association, producing low-ASR backdoor models while preserving clean-input performance. Through extensive evaluation across multiple datasets, diverse attack families, and multiple architectures, we show that state-of-the-art defenses fail consistently under low-ASR conditions, exposing a fundamental attacker-defender asymmetry.

1 Introduction

Existing backdoor defenses assume strong, consistent trigger responses, but ASR can be deliberately reduced while preserving clean performance and residual attacker-useful behavior. The paper studies this low-ASR regime, introduces reverse training, and evaluates its effect on defenses and activation.

  • Conventional backdoor evaluations assume strong trigger-induced responses, with widely studied attacks often reporting ASRs exceeding 90%.
  • ASR is attacker-controlled, so reducing it can weaken observable signals without necessarily removing the underlying backdoor.
  • The paper frames low-ASR backdoors as models with deliberately reduced activation rates, preserved clean-input performance, and potentially retained attacker-useful behavior.
  • The attacker–defender asymmetry arises because defenders need aggregate evidence, while attackers can search locally for one successful triggered input.
  • Reverse training applies the original trigger while assigning triggered inputs their ground-truth labels, progressively weakening the trigger–target association.The resulting checkpoints preserve the original trigger, target label, architecture, and attack configuration.
  • The evaluation covers MNIST, CIFAR-10, and GTSRB, four attack families, and Neural Cleanse, STRIP, FreeEagle, and DeBackdoor.

2 Background

Backdoor attacks implant trigger-linked target behavior while preserving clean-input performance, and ASR measures how often triggered inputs induce that behavior. Existing defenses use diverse detection strategies but are largely designed for strong, high-ASR signals, leaving their reliability under reduced ASR as an open question.

  • Backdoor Attacks: Backdoor attacks implant a trigger-associated target label while preserving normal predictions on clean inputs.Triggers can be visible, blended, reflection-based, physical, semantic, compression-resistant, warping-based, or learning-based.
  • Backdoor Attacks: Backdoor attacks use diverse injection mechanisms, including data poisoning, model poisoning, transfer learning, federated learning, graph neural networks, and reinforcement learning.
  • Attack Success Rate: Conventional attacks maximize ASR while preserving clean accuracy, and widely studied attacks commonly exceed 90% ASR.This high-ASR emphasis shapes how backdoor attacks and defenses are evaluated.
  • Attack Success Rate: ASR is the percentage of non-target triggered inputs classified as the attacker-specified target label, alongside clean accuracy as a standard effectiveness metric.This work considers All2One attacks, mapping triggered inputs from non-target classes to one target label.
  • Existing Defense Paradigms: Existing defenses use trigger reconstruction, prediction or entropy analysis, representation inspection, poisoned-sample identification, and optimization-based trigger recovery.Representative methods include Neural Cleanse, STRIP, FreeEagle, and DeBackdoor.
  • Existing Defense Paradigms: These defenses rely on observable differences between malicious and benign behavior, which are generally strongest when trigger-induced behavior is consistent and high-ASR.The resulting open question is whether detection signals remain reliable when an attacker deliberately reduces ASR.
  • Gradient-Based Adversarial Attacks: Gradient-based adversarial attacks optimize inference-time input perturbations toward an attacker-specified target under a magnitude constraint.The paper uses this optimization effort to examine whether low-ASR models retain target-class bias.

3 Low-ASR Backdoors

Low-ASR backdoors deliberately weaken trigger activation to reduce observability while preserving clean-input performance and attacker-useful behavior. The paper formalizes this setting and uses reverse training to generate controlled low-ASR models for studying defenses and attacker–defender asymmetry.

  • 3 Low-ASR Backdoors: Low-ASR backdoors deliberately reduce activation rates while preserving clean-input performance and attacker-useful target-class behavior.
  • 3.2 Attacker–Defender Asymmetry: Defenders rely on statistically distinguishable signals, but low ASR makes trigger-induced behavior sparse and difficult to distinguish from normal model variability.
  • 3.2 Attacker–Defender Asymmetry: Attackers retain a local compromised-model copy to search for a successful input, whereas defenders must infer backdoors from finite evaluation samples.
  • 3.4 Reverse Training Framework: Reverse training starts from a conventional high-ASR backdoor, applies the same trigger, and assigns triggered samples their original labels to weaken the trigger–target association.
  • 3.4 Reverse Training Framework: ASR is monitored on held-out triggered non-target samples, and reverse training selects a checkpoint within the predefined low-ASR range or stops at the epoch limit.
  • 3.4 Reverse Training Framework: The framework generates controlled low-ASR variants from the same conventional backdoor, enabling analysis of weaker trigger behavior, representations, and defense performance.

4 Experiments and Results

Reverse training lowers ASR while largely preserving clean accuracy, weakening but not eliminating trigger-related representations. Across evaluated defenses, this reduced observability causes low-ASR models to resemble benign models despite residual backdoor behavior.

  • Low-ASR Generation: Across MNIST, CIFAR-10, and GTSRB, reverse training rapidly reduces ASR before converging to a stable low-ASR regime.The evaluation spans increasing visual complexity across the three datasets.
  • Low-ASR Generation: Clean-input performance remains largely unchanged because reverse training primarily weakens the trigger–target association rather than classification capability.Only minor clean-accuracy fluctuations are observed during training.
  • Backdoor Characterization: Low-ASR models retain weaker, less localized trigger activation while attention shifts toward original image content.This intermediate saliency pattern indicates that trigger-related representations persist without dominating prediction.
  • Backdoor Characterization: Low-ASR predictions become more distributed across classes and increasingly resemble clean-model behavior, although a slight target-class bias remains.High-ASR models instead concentrate predictions at the attacker-specified target label.
  • Defense Evaluation: Neural Cleanse fails because low-ASR trigger norms blend into the clean-model background rather than forming a dominant target-class outlier.Reducing ASR eliminates the anomaly exploited by this detector without necessarily removing backdoor functionality.
  • Defense Evaluation: Low-ASR poisoned samples overlap with clean samples under STRIP because weakened triggers lose robustness and the low-entropy detection signature.FreeEagle likewise reports 0.219 for low-ASR versus 2.511 for high-ASR on CIFAR-10, below its threshold mconst = 1.
  • Defense Evaluation: All four evaluated defenses identify conventional high-ASR backdoors but fail to detect their low-ASR counterparts.DeBackdoor also classifies low-ASR variants as clean across WaNet and LIRA while residual trigger behavior remains.

5 Discussion

The paper argues that treating ASR as both attack effectiveness and detectability obscures low-ASR backdoors. Its results show a shared defense failure mode and motivate detection methods targeting latent trigger-related representations, within stated scope limitations.

  • Discussion: ASR is commonly treated as a proxy for attack effectiveness and detectability, but the paper’s results challenge interpreting reduced ASR as reduced danger.Low-ASR models can evade detection while retaining residual trigger-related behavior and easier target steering.
  • Shared Failure Mode: All four defenses fail qualitatively because successful detection depends on a strong, statistically separable trigger-induced signal.Neural Cleanse, STRIP, FreeEagle, and DeBackdoor each rely on a different manifestation of that signal.
  • Implications: Low-ASR backdoors suppress observable trigger manifestations without necessarily removing underlying trigger-related behavior.The paper therefore suggests focusing future defenses on latent trigger-related representations embedded within models.
  • Limitations: The evaluation focuses on image classification, one reverse-training construction mechanism, and a representative defense set, so generalization remains uncertain.Additional domains, generation methods, or detection approaches may exhibit different behavior.
  • Implications: Consistent behavior across datasets, architectures, trigger families, and defense paradigms suggests that low-ASR backdoors pose a broader challenge for existing detection methods.This conclusion remains bounded by the paper’s stated evaluation limitations.

6 Related Work

Prior backdoor research mainly improves trigger stealth or adapts trigger mechanisms, while defenses seek observable behavioral, data, or representational evidence. This work instead reduces trigger activation frequency, testing whether defenses remain effective and whether residual attacker-useful bias persists.

  • Backdoor attacks: Prior attacks improve stealth by concealing triggers, changing poisoning mechanisms, or making triggers dynamic, but generally retain high-ASR objectives.
  • Positioning of Our Work: This work complements trigger concealment by deliberately weakening activation frequency while retaining the original trigger family and attack configuration.
  • Backdoor defenses: Defenses detect compromised models or inputs through prediction behavior, data and representation anomalies, meta-classification, or trigger reconstruction.
  • Positioning of Our Work: The study tests whether STRIP, Neural Cleanse, FreeEagle, and DeBackdoor remain effective as ASR decreases and whether residual target-class bias remains measurable.
  • Positioning of Our Work: Gradient-based optimization complements global ASR by measuring whether low-ASR models remain easier to activate than clean models.
  • Positioning of Our Work: Reverse training transforms high-ASR backdoors into controlled low-ASR variants while keeping the trigger, target label, architecture, and original attack configuration unchanged.

7 Conclusion

The paper challenges high-ASR assumptions by generating low-ASR backdoors that preserve clean performance and residual trigger-related behavior. Across broad experiments, representative defenses fail consistently, while optimization tests indicate continued adversarial usefulness.

  • Low-ASR backdoors suppress observable trigger-induced behavior while preserving residual malicious functionality, challenging the assumption that effective backdoors require high ASR.
  • Reverse training converts conventional high-ASR backdoors into low-ASR variants while maintaining clean model performance.
  • Experiments across datasets, architectures, trigger families, and attack types show weaker observable signals alongside measurable residual trigger-related behavior.
  • Neural Cleanse, STRIP, FreeEagle, and DeBackdoor consistently fail in the low-ASR regime, including for WaNet and LIRA.
  • The findings suggest ASR is not a direct proxy for backdoor risk because low activation rates can coexist with evasion and exploitable target-class bias.

A Additional Spatial Trigger Analysis

Spatial heatmaps show that MNIST trigger effectiveness is localized near the original insertion region. Reverse training substantially weakens this response, although a small residual spatial footprint remains.

  • Figure 16 compares ASR heatmaps for high-ASR and low-ASR MNIST models across different trigger insertion locations.
  • In the high-ASR model, trigger effectiveness is highly localized around the original insertion region.
  • Reverse training substantially suppresses trigger effectiveness, producing a much weaker spatial response in the low-ASR model.
  • MNIST trigger activation rapidly loses effectiveness away from the original location, while reverse training leaves a small residual spatial footprint.

B Additional STRIP Analysis

Per-sample STRIP entropy separates poisoned from clean inputs in high-ASR models but not in low-ASR models. Reverse training therefore changes the entropy pattern that supports STRIP detection.

  • Figure 17 reports per-sample entropy under STRIP perturbations for clean, high-ASR, and low-ASR models.
  • High-ASR poisoned samples form a distinct low-entropy cluster below STRIP’s detection threshold, enabling reliable separation from clean inputs.
  • The low-entropy cluster reflects stable predictions under substantial perturbations, resulting from the strong trigger–target association learned during training.
  • Low-ASR poisoned samples no longer form a distinct low-entropy cluster, weakening the observable pattern used by STRIP.

C Extended DeBackdoor Analysis

Across MNIST, CIFAR-10, and GTSRB, DeBackdoor reliably recovers a dominant target-class signal for high-ASR models, but low-ASR models yield weaker, diffuse, or unstable responses.

  • Across MNIST, CIFAR-10, and GTSRB, high-ASR models produce dominant target-class signals, whereas low-ASR models produce weaker or distributed cASR profiles.
  • On MNIST, low-ASR recovery becomes unstable across trigger types and may produce spurious trigger-like patterns.Some configurations still yield high cASR values, but they do not consistently indicate a reliable trigger–target mapping.
  • On CIFAR-10, low-ASR cASR values distribute across classes, with non-target classes often matching or exceeding the intended target.This ambiguity contrasts with the clear target-class peak recovered in high-ASR configurations.
  • On GTSRB, both ViT and blended-attack evaluations show substantially weaker or more diffuse low-ASR responses than high-ASR responses.

C.4 Cross-Dataset Summary

The cross-dataset results show that reducing ASR consistently suppresses the distinctive optimization signal used by DeBackdoor across static, dynamic, and input-dependent attacks.

  • C.4 Cross-Dataset Summary: Across MNIST, CIFAR-10, and GTSRB, weakened trigger–target associations produce unstable, diffuse, or multi-class cASR responses.
  • C.4 Cross-Dataset Summary: These findings support the conclusion that low-ASR backdoors evade detection by suppressing the optimization signal required for reliable trigger recovery.
  • Dynamic and input-dependent attacks: Dynamic and input-dependent attacks use learned or spatially varying transformations, making recovered cASR distributions less concentrated around one fixed trigger pattern.
  • Dynamic and input-dependent attacks: DeBackdoor recovers a clear target-class peak for high-ASR LIRA models on CIFAR-10, but low-ASR models produce distributed cASR profiles.
  • Dynamic and input-dependent attacks: For LIRA on MNIST, ASR reduction largely removes class separation and weakens the evidence available to optimization-based detectors.

D.3 WaNet on GTSRB

WaNet’s spatial warping produces broad class-wise activation patterns, and reducing ASR makes its recovered trigger signature even more distributed and difficult to identify uniquely.

  • WaNet produces a more distributed activation pattern across classes than static or LIRA-style triggers because it uses spatial warping.
  • In the high-ASR setting, several WaNet classes exhibit elevated cASR values, while low-ASR responses become even more distributed across non-target classes.
  • No single class provides a clean, uniquely identifiable trigger signature for low-ASR WaNet models.
  • WaNet challenges the single-peak assumption underlying cASR-based detection by producing ambiguous class-wise responses rather than a dominant target-class trigger.
  • Across LIRA and WaNet, reducing ASR weakens target-class dominance, with WaNet becoming even less separable because its trigger is spatially distributed.
Loading 2608.27288v1…