Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors

Summary

This paper studies label-only backdoor attacks such as FLIP, where flipping 3% of CIFAR-10 labels makes a ResNet-32 misclassify 99.7% of triggered source-class images. The authors hold the test, labels and metric fixed and vary only the feature space, judging each defense by retraining the victim on the data it keeps. Detection works far better in a space that never learned the labels, such as frozen DINOv2 features, and a higher detection score does not guarantee a lower attack success rate.

Related items

• InfoRFLDefense: robust federated learning defense against targeted attacksSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoCancerous Backdoor Attack: Gradual Activation via Invisible Tokens and A Stage ControllerSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• LowGNN-Guided Selection of Benign-like Anomalies for Backdoor Attacks Against Network Intrusion Detection SystemsSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoStrong evasive backdoor attacks and an ensemble defenseSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoRolling the cyber dice with open-source and open-weight AI modelsSimilar attack · CSO Online