Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper analyzes backdoor poisoning attacks on regularized GLMs in high-dimensional settings, revealing that increasing the strength of the training trigger can paradoxically improve clean test accuracy and reduce attack success. The authors derive closed-form expressions for squared loss and extend results to general convex GLMs using a Gaussian-proxy fixed-point system, identifying a finite-sample noise floor proportional to $p/n$ as the key mechanism. Empirical validation on CIFAR-10 and ResNet-18 confirms these counter-intuitive phenomena, even beyond the convex setting.
Stronger training triggers in backdoor attacks can backfire in high-dimensional settings, actually *improving* model robustness and reducing attack success.
Backdoor poisoning attacks behave counter-intuitively in high dimensions: stronger training triggers can help the defender. We study regularised generalised linear models on Gaussian-mixture data in the proportional regime ($p/n \to κ$), varying the training trigger strength $α$ against a fixed test trigger. Three phenomena emerge: (i) clean test accuracy increases with $α$; (ii) attack success peaks at a finite $α$ and then declines; and (iii) the most damaging trigger direction is the minimum eigenvector of the data covariance. We prove all three results in closed form for the squared loss, and extend (i) and (ii) to general convex GLM losses via a Gaussian-proxy fixed-point system. We identify a finite-sample noise floor proportional to $κ$ as the mechanism behind (i), invisible to classical $n \gg p$ analysis. Experiments on CIFAR-10 and Gaussian surrogates match the theory closely; ResNet-18 experiments show the same phenomena beyond the convex setting.