Eminence: Leveraging feature boundary ambiguity for robust backdoor attacks

The researchers propose Eminence, a black-box backdoor attack framework against deep neural networks, by leveraging feature boundary ambiguity, achieving an attack success rate exceeding 90% with a poisoning rate below 1% and negligible clean accuracy loss. The paper first theoretically analyzes how sparse decision boundaries allow a very small number of label-flipped samples to cause a large number of misclassifications, and uses influence function analysis to quantify the parameter shifts caused by these boundary samples. Based on this analysis, Eminence optimizes visually imperceptible universal triggers, with interpretability, theoretical guarantees, and stealthiness, maintaining high transferability across multiple models, datasets, and scenarios; experiments also show an exponential relationship between boundary poisoning and adversarial boundary manipulation.