Search papers, labs, and topics across Lattice.
This paper introduces a novel sample-specific backdoor attack, termed Density-aware Sample-specific Attack (DASA), that optimizes trigger construction by steering poisoned samples into low-density regions of the clean data distribution. DASA uses a bilevel optimization framework with conditional time-score matching to estimate density ratios and a mixture-model objective to place triggers in sparse regions. Experiments across multiple datasets show DASA achieves significantly higher attack success rates post-defense compared to existing methods, particularly against fine-tuning and neuron-pruning defenses, highlighting a vulnerability in current defense strategies.
Backdoor attacks can become virtually immune to pruning and significantly more resilient to fine-tuning by carefully crafting triggers that push poisoned samples into low-density regions of the clean data distribution.
Despite recent progress in backdoor attacks, existing methods remain susceptible to post-training defenses that erase the backdoor through fine-tuning or pruning. We revisit the core objectives of backdoor attacks and derive principled criteria characterizing optimal sample-specific trigger construction under a Bayes-optimal model of the victim's training. Our analysis reveals that both attack success and clean-accuracy preservation are simultaneously optimized when triggered samples are steered into low-density regions of the clean data distribution, a distributional condition that controls all moments of the poisoned distribution at once rather than a handful of input-space summary statistics. We introduce a bilevel optimization framework that estimates density ratios via conditional time-score matching and optimizes a mixture-model objective to place triggered samples in these sparse regions. Extensive evaluations on MNIST, CIFAR-10, GTSRB, and TinyImageNet demonstrate that our method achieves above 99\% attack success rate before defense and retains 50--85 percentage points higher post-defense ASR than the strongest baselines under fine-tuning defenses. Against neuron-pruning defenses, the method exhibits complete immunity, with zero neurons identified for removal across all pruning thresholds. These results expose a fundamental gap in current defense paradigms and underscore the need for defenses that operate beyond the support of the clean distribution.
