Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper reveals a critical vulnerability in existing backdoor attack defenses by demonstrating that Attack Success Rate (ASR) is a controllable variable for attackers, which can be reduced without compromising the backdoor's functionality. The authors introduce a reverse-training framework that weakens the association between triggers and targets, allowing for the creation of low-ASR backdoor models that maintain performance on clean inputs. Extensive evaluations across various datasets and architectures reveal that current defenses are ineffective against these low-ASR backdoors, highlighting a significant asymmetry in the attacker-defender dynamic.
Attackers can exploit low-ASR backdoors to bypass state-of-the-art defenses, revealing a critical flaw in current security paradigms.
Backdoor attacks are among the most effective and stealthy attacks in deep learning. Existing attacks and defenses are largely designed and evaluated under the assumption that successful backdoors exhibit high Attack Success Rates (ASRs). In this paper, we show that this assumption creates a fundamental weakness in existing defense paradigms. ASR is not an intrinsic property of a backdoor; rather, it is an attacker-controlled variable that can be deliberately reduced without eliminating the underlying backdoor behavior. We introduce a reverse-training framework that weakens the trigger-target association, producing low-ASR backdoor models while preserving clean-input performance. Through extensive evaluation across multiple datasets, diverse attack families, and multiple architectures, we show that state-of-the-art defenses fail consistently under low-ASR conditions, exposing a fundamental attacker-defender asymmetry.