Adversarial Robustness & Backdoor Attacks

Backdoor and Poisoning Attacks Under Constrained Training-Time Access

Barrier to removePartly addressed

Possible candidate · 3/5 runs4 papers report this50% from 2025+

Generated automatically from the limitations stated in 4 papers (ICCV, ICML, NeurIPS), listed under Evidence. It is not a paper, and it does not come from papers submitted to CSPaper.

The problem

Current advanced backdoor injection and model manipulation techniques strictly require full white-box access to the target architecture, parameters, and unconstrained control over the training optimization process. In realistic supply chain or outsourced training scenarios, an adversary or security auditor rarely has end-to-end control over the victim's training loss, optimization hyperparameters, and internal architecture. Because existing techniques break down when these white-box preconditions are removed, security assessments dramatically overestimate attacker capabilities or fail to evaluate practical threat surfaces.

Why it matters

Enables realistic threat assessment and auditing of third-party training data pipelines when the auditor or adversary has zero visibility or control over downstream model architecture and training hyperparameters.

Ways to approach it

Prior-work checks are free with an account. Results someone already ran are shown to everyone.

1
Data-only trigger injection with surrogate architecture ensembles: Construct universal trigger patterns optimized against an ensemble of open surrogate models and measure attack success rate (ASR) and clean accuracy across unseen victim architectures trained with standard unpoisoned loss objectives.
2
Bilevel optimization under black-box training hyperparameters: Formulate poisoning sample generation as a meta-learning problem assuming only query or black-box feedback from the training pipeline, measuring trigger activation rates across varying learning rates, optimizers, and batch sizes.
3
Clean-label feature collision without optimization-control: Generate subtle feature-space perturbations on training data alone without modifying loss functions or training scripts, measuring transferability across diverse model families and training schedules.

Have a different approach?

Describe how you would tackle this problem and we'll look for papers that already do it. Free; your text stays private.

Why it might fail

If clean-label or transfer-based data-only poisoning methods from adjacent threat models already achieve high attack success rates across arbitrary training pipelines, rendering optimization-level control fundamentally redundant.

Evidence

Each paper's own statement of the limitation, verbatim.

Dissecting the Safety Circuit: Neuronal Intervention for Transferable Adversarial Attacks on VLMsICML 2026
Requires white-box access to a surrogate model and preliminary attack execution (UMK and FORCE) to construct probing datasets.
SPD: Shallow Backdoor Protecting Deep Backdoor Against Backdoor DetectionICCV 2025
Requires a white-box threat model with full control over the training process and optimization objective.
WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural NetworksNeurIPS 2024
Requires the adversary to have full control over the training process and dataset to implement the asymmetric obfuscation and regularization samples.
LIRA: Learnable, Imperceptible and Robust Backdoor AttacksICCV 2021
Requires full white-box access to the victim model structures and parameters during the training/poisoning phase.