Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information

1. 01What problem does this paper attempt to solve?

   The authors study whether clean-label backdoor attacks remain feasible when the attacker can only access target-class training data.

   Core question: can a clean-label backdoor attack succeed when the attacker can only access training data of the target class?

   • Problem scenario: training DNNs requires large amounts of data, and practitioners often outsource data collection, allowing external parties to control model behavior by manipulating training data; the authors note that in reality training sets are often aggregated from multiple independent sources (e.g., face images from different users), and it is difficult for an attacker to obtain data of all classes.
   • Shortcomings of existing methods: the authors state that the effectiveness of existing clean-label attacks (LC, HTBA, SAA) critically depends on knowledge of training data of all classes; for example, LC requires non-target-class data to train a GAN or generate adversarial perturbations, and HTBA and SAA require a feature extractor or surrogate model trained on all-class data.
   • Core observation: the authors argue that the fundamental limitation of existing methods is that the trigger is chosen arbitrarily and is unrelated to the target class, so a high poisoning rate is needed to associate it with the target class; the authors propose optimizing the trigger into a direction that "points into the target class," and this direction can be found without accurate knowledge of other classes.
   • Method proposed in the paper: NARCISSUS, a clean-label backdoor attack algorithm that requires only representative samples of the target class and public out-of-distribution (POOD) samples; the authors also evaluate five defenses and extend the attack to the physical world.
   • Threat model (Section III-A):
     • Goal: make the victim model classify any test input bearing a predefined trigger δ into the target class t, while maintaining accuracy on clean inputs.
     • Knowledge: the attacker knows representative samples Dt of the target class and general information about the learning task (e.g., "this is a face recognition task"), but does not know the specific set of classes; the attacker can obtain POOD samples that are related to the task but do not overlap with the classes in the training data.
     • Capability: as a data provider, manipulate the portion of training data that it supplies; perturbations are constrained by the lp-norm, and poisoned samples must be clean-label (label and content are consistent to a human observer).
     • Victim system: a machine learning model (victim model) trained on a dataset aggregated from multiple sources.

   Collapse this answer

2. 02What related research exists?

   Related work is divided into three categories: dirty-label attacks, direct target-class poisoning, and feature/gradient collision poisoning, plus five categories of defense work.

   Dirty-label backdoor attacks

   • BadNets [4], Blend [5], etc. — select clean samples from non-target classes, stamp a trigger, and change the label to the target class; the authors note that the injected samples are obviously mislabeled and easy to detect by manual inspection. The paper adapts BadNets and Blend into clean-label versions (BadNets-c, Blend-c) as baselines.

   Direct target-class poisoning (clean-label)

   • Label-Consistent (LC) attack [6] — uses GAN interpolation or adversarial perturbations to make the original features of target-class samples harder to learn, then inserts an arbitrary trigger; the authors note two limitations: the arbitrary choice of trigger leads to a high required poisoning rate, and non-target-class data is needed to train the GAN or generate perturbations.

   Feature/gradient collision poisoning (clean-label)

   • HTBA [7] — perturbs target-class samples so that they are close in feature space to non-target-class samples bearing the trigger; the authors note that it only supports one-to-one attacks and requires a pretrained feature extractor, and that the original work was evaluated only under the transfer learning setting.
   • Sleeper Agent Attack (SAA) [8] — aligns the gradients of perturbed samples and trigger-bearing samples through bilevel optimization; the authors note that it likewise only supports one-to-one attacks, and that gradient computation requires a victim model or an ensemble of surrogate models trained on all-class data.

   Backdoor defenses

   • Model-level unlearning: Neural Cleanse [11] (reverse-engineers triggers for each class and performs outlier detection), TABOR [40], Fine-pruning [12] (prunes neurons inactive on clean inputs and then fine-tunes), I-BAU [13] (alternates trigger synthesis and unlearning).
   • Model-agnostic detection: frequency-based detector [15], which assumes benign samples are dominated by low-frequency features while backdoor samples contain high-frequency artifacts; that work also proposes the Smooth attack with low-pass filtering.
   • Robust training: Anti-Backdoor Learning (ABL) [14], which exploits the phenomenon that poisoned samples have the lowest loss early in training to isolate suspicious samples and reverse their gradients.

   Baselines and benchmarks: the attack baselines are HTBA, SAA, LC (adversarial perturbation mode only), and the adapted BadNets-c/d and Blend-c/d; the defense baselines are the five above; the datasets are CIFAR-10, PubFig, and Tiny-ImageNet.

   The authors position this paper as: under a weaker (target-class data only) and more realistic threat model, outperforming existing clean-label attacks that require all-class data, and supporting the all-to-one setting and a physical-world demonstration (Table I summarizes the differences from each attack).

   Collapse this answer

3. 03How does the paper address this problem?

   NARCISSUS trains a surrogate model with POOD data plus target-class samples, optimizes a trigger pointing inside the target class, and implements it in four steps.

   Overall idea: instead of choosing a trigger arbitrarily, optimize on a surrogate model a perturbation that "points into the target class" as the trigger, so that any input with this perturbation added is more likely to be predicted as the target class. The method is named NARCISSUS, and the pipeline has four steps (Fig. 2).

   Problem formalization

   • Ideally, if the attacker could access an oracle model fθorc trained on the target dataset, then solve δ* = arg min over samples in Dt of L(fθorc(x+δ), t), i.e., find the perturbation that makes each target-class sample predicted as the target class with higher confidence.
   • In practice the oracle does not exist, so the authors use a surrogate model fθsur instead, solving δ^∗ = argmin_{δ ∈ Δ} ∑_{(x,t)∈ Dt} L(f_θsur(x+δ), t), where ∆ is the set of allowed triggers; this expression means: minimize, on the surrogate model, the loss of "the perturbed target-class sample being predicted as the target class."
   • The authors state that this perturbation has an "inward-pointing" property: it raises the confidence of all target-class samples, and its direction depends mainly on the clustering of target-class data rather than on the decision boundary, so it is robust to mismatch between the surrogate model and the victim model in architecture and data (Section III-B).

   Step 1: Poi-warm-up (surrogate model construction)

   • First pretrain the surrogate model on POOD samples to obtain general low-level features, then fine-tune it on target-class samples Dt for several epochs so that it quickly captures features that distinguish the target class.
   • The authors' rationale: a model trained directly on POOD does not contain the target class, and trigger optimization would require many rounds to be effective; whereas one-step mixed training on POOD and Dt requires retraining when the target class changes, the two-step approach requires training on POOD only once and fine-tuning per new class.
   • Parameters: fine-tune for 5 epochs; pretraining uses the RAdam optimizer (learning rate 0.1) and a cosine annealing schedule.

   Step 2: Trigger-Generation (trigger synthesis)

   • Solve the above optimization with mini-batch stochastic gradient descent: each round sample a batch from Dt, compute and average gradients, update the trigger and project it back to ∆ (Algorithm 1).
   • In the non-adaptive setting ∆ is an l∞-norm ball (radius 16/255), and projection is per-dimension clipping; in the adaptive setting ∆ can be set to a low-frequency perturbation set, and projection is implemented by low-pass filtering.
   • Parameters: 1000 gradient descent iterations, RAdam optimizer, learning rate 0.01.

   Step 3 and Step 4: Poisoning and test query manipulation

   • Trigger Insertion: randomly select a small fraction of target-class samples, add the trigger while keeping the original label, and hand them to the victim as data supplied by the attacker.
   • Test Query Manipulation: at test time, amplify the trigger by a certain factor (e.g., 3×) and paste it onto the test input; the authors state that test samples are subject to less scrutiny than training samples, and that the amplified trigger norm is still smaller than existing triggers (Table IV); in the physical-world attack the amplification step is omitted because the pixel values perceived by the sensor cannot be controlled.

   Physical-world extension (Section V)

   • Challenges: camera sensing causes information loss (hue changes, pixel loss), and the trigger will be captured under different viewpoints, rotations, and backgrounds.
   • Design: constrain the trigger to an 8×8 square, simulate random positions via random padding (padding lengths on the top, bottom, left, and right are each randomly chosen from 8 to 64 and padded to 64×64) while keeping the computation graph unchanged; add ±0.3 hue variation and random rotation, and use the expectation over transformation (EOT) technique to compute gradients.

   Collapse this answer

4. 04What experiments did the paper conduct?

   On three datasets, NARCISSUS reaches 85.81%–99.89% ASR at a 0.05% poisoning rate, and the authors report that none of the five defenses can robustly mitigate it.

   Experimental setup

   • Models under test: except for the surrogate-target mismatch ablation, the target model is ResNet-18; the ABL defense experiment uses WideResNet-16-1 as in the original work; the mismatch ablation uses pairwise combinations of ResNet-18, GoogLeNet, and EfficientNet-B0.
   • Datasets: CIFAR-10 (10 classes), PubFig (83 classes), Tiny-ImageNet (200 classes); the corresponding POOD data are Tiny-ImageNet, CelebA, and Caltech-256, respectively, with no class overlap with the training sets; the target classes are fixed as bird (CIFAR-10), Miley Cyrus (PubFig), and bullfrog (Tiny-ImageNet).
   • Poisoning rates: 0.05% for CIFAR-10 (25/50,000), 0.024% for PubFig (3/12,454), and 0.05% for Tiny-ImageNet (50/100,000); the authors note that poisoning rates in existing literature are mostly 5%–20%.
   • Baselines: clean-label attacks HTBA, SAA, LC (adversarial perturbation mode only), adapted BadNets-c and Blend-c, and dirty-label versions BadNets-d and Blend-d; the surrogate models of existing methods are trained on all-class in-distribution data, whereas NARCISSUS's surrogate model uses only POOD plus target-class data.
   • Metrics: ACC (clean test accuracy), Tar-ACC (clean target-class accuracy), ASR (attack success rate); HTBA and SAA only support one-to-one, so their ASR is computed only on source-class samples, while the rest are all-to-one.
   • Repetitions: random sampling of test samples repeated three times and averaged (Table III, V, VI, IX); the trigger l∞ norm upper bound is 16/255.

   Main results

   According to Table III (average of three runs):

   Swipe horizontally to read the table

   Dataset (poisoning rate)	Metric	Clean	HTBA	SAA	LC	BadNets-d	Blend-d	NARCISSUS
   CIFAR-10 (0.05%)	ASR	0.44	4.87	6.00	3.21	88.12	77.99	97.36
   PubFig (0.024%)	ASR	0.00	0.00	0.00	0.15	0.00	30.17	99.89
   Tiny-ImageNet (0.05%)	ASR	0.13	2.51	4.00	1.72	0.39	0.47	85.81

   Note: the ASR of HTBA and SAA is one-to-one (source class only); BadNets-d and Blend-d are dirty-label, not clean-label attacks; the ASR of BadNets-c and Blend-c is no higher than 2.60 (CIFAR-10) and is omitted from the table. The change in clean ACC before and after each attack is within 0.39% (CIFAR-10), 0.36% (PubFig), and 0.17% (Tiny-ImageNet).

   • The authors state that NARCISSUS achieves the highest ASR under weaker attacker knowledge, and that its perturbation norms at training and test time are smaller (Table IV: 16/255 for poisoning, 48/255 at test time, whereas HTBA/SAA/LC use 255/255 at test time).
   • The authors note that on PubFig, 3 poisoned images suffice, and attribute this partly to the low diversity of face content and the large input size; on Tiny-ImageNet, the highest ASR of existing all-to-one attacks is 1.71% (main text; LC is 1.72% in Table III), and the authors state that NARCISSUS is 50 times higher.
   • The authors note that training on all three datasets uses standard random data augmentation, which makes the trigger harder to memorize, yet NARCISSUS's effectiveness is maintained.

   Effect of poisoning rate and target-class proportion (Fig. 3)

   • What was measured: varying the poisoning proportion within the target class on CIFAR-10, observing the trade-off between Tar-ACC and ASR.
   • Results: when the target-class poisoning proportion is below 1%, the ASR of BadNets-c, Blend-c, and LC is unsatisfactory; when the proportion rises to 70%, the ASR of all three exceeds 90%, but Tar-ACC drops from 94% to about 85%, while the lowest accuracy of other classes is above 89.00%, and the authors state that such inter-class discrepancy is easy to notice.
   • The authors state that NARCISSUS reaches near-perfect ASR at a target-class poisoning proportion of 0.5%, while Tar-ACC is essentially maintained.

   Defense evaluation (Section IV-D)

   • Neural Cleanse and TABOR: on the CIFAR-10 model poisoned by NARCISSUS, no label was flagged as an outlier; checking the trigger generation loss (TABOR's suggestion) also revealed nothing suspicious. The authors explain: both assume the trigger is local, whereas the NARCISSUS trigger spans the whole image, so the reverse-engineered patterns for each class are all global and outlier detection fails.
   • Fine-pruning (Table VII): before defense, ACC/Tar-ACC/ASR are 95.34%/93.44%/97.10%; under each learning rate setting, ASR remains 90.8%–96.5% (e.g., SGD lr=0.001 with 30 epochs of fine-tuning gives 95.0/93.0/94.5); lr greater than 0.01 reduces model ACC to no better than random guessing. The authors attribute this to the NARCISSUS trigger pointing into the target class, possibly activating neurons similar to those for target-class samples.
   • I-BAU (Fig. 5, Fig. 6): the authors state that existing all-to-one attacks are removed by one round of I-BAU, whereas NARCISSUS retains some effect after 100 rounds, and the defense performance is unstable and does not converge; as defense iterations proceed, I-BAU begins to synthesize and unlearn robust features containing obvious semantic information (more pronounced with Adam than SGD), accompanied by a drop in ACC. The authors therefore argue that this trigger is as persistent as the semantic features of the training data, and removing it first harms model accuracy.
   • Frequency detector and adaptive attack (Table VIII, IX, Fig. 7): the original l∞-constrained trigger contains high-frequency artifacts, and the frequency detector achieves 98.34% detection ACC and 100% detection rate on it (75.16%/53.62% for the Smooth trigger); the adaptive version that changes ∆ to a low-frequency set reduces detection ACC to 77.83% and detection rate to 58.96%. At a 0.8% poisoning rate, adaptive NARCISSUS achieves 90.30% ASR, higher than Smooth-c's 12.71% and also higher than dirty-label Smooth-d's 90.13%; ACC 93.16, Tar-ACC 91.30 (Table IX).
   • ABL (Table X): on WideResNet-16-1 and CIFAR-10, after ABL the ASR is still 98.47% at a 0.05% poisoning rate and 100% at 0.5%; at 0.05%, of the 500 samples isolated by ABL, only 3 come from the target class and none are poisoned samples. The authors state that at low poisoning rates the loss of poisoned samples is of similar magnitude to that of clean samples, so they evade loss-scan-based detection.

   Other ablations and analyses

   • Surrogate-target architecture mismatch (Table V, CIFAR-10, 0.05%): ASR across nine combinations is 82.05%–100.00%; the same-architecture combination (ResNet-18→ResNet-18 is 97.36) is not the highest; when GoogLeNet is the surrogate, ASR is 99.50–100.00 for each target, and the authors state that attack effectiveness aligns with the surrogate model's test performance rather than with architectural similarity.
   • l∞ norm radius (Fig. 4, CIFAR-10): ASR rises as the radius increases, while ACC and Tar-ACC are little affected; at radius 2/255 and a 0.05% poisoning rate, ASR is 30.6% ± 8.12%.
   • Poi-warm-up and trigger iterations (Table VI, CIFAR-10, 0.05%): without target-class fine-tuning (0 epochs), ASR still exceeds 70%; with 5 fine-tuning epochs and 1000 trigger iterations, ASR is highest (97.36); too much fine-tuning (10, 15 epochs) instead decreases it, which the authors explain as overfitting to Dt shrinking the trigger update space.
   • Physical world (Section V-B, Fig. 8): Tiny-ImageNet, 0.05% poisoning rate, ResNet-18, with the trigger displayed on an iPhone 13 screen; the authors state that NARCISSUS is the only one of the three triggers (NARCISSUS, white square, random noise) to succeed as a clean-label attack in the physical world, and the paper does not report a quantitative ASR.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors note that the original trigger can be identified by frequency detection, and propose two research directions: theory and defense; experiments are limited to three image datasets.

   Limitations noted by the authors and future directions

   • The original trigger can be identified by frequency detection (Section IV-D2): the l∞-constrained trigger contains many high-frequency artifacts, and a frequency-based detector can effectively identify it (100% detection rate, Table VIII); the authors' countermeasure is to constrain ∆ to a low-frequency set for an adaptive attack.
   • Better defenses are needed (Section I, VI): the authors state that neither the popular defenses evaluated nor state-of-the-art defenses can robustly mitigate NARCISSUS, and emphasize that empirical research on robustly removing its influence without harming clean-sample performance is a key need.
   • Theoretical research direction (Section VI): existing theoretical characterizations of backdoor attacks all target dirty-label attacks, and the authors emphasize that clean-label attacks should be studied in the same way; explaining why NARCISSUS remains effective under limited knowledge and low poisoning rates is a theoretical direction.
   • Limitations of the physical-world demonstration (Section V-A): the authors note that physical triggers suffer information loss through camera sensing (hue changes, pixel loss), and attackers generally cannot predict sensor-related changes, making adaptive optimization difficult.

   Scope of experiments

   • The datasets under test are three image classification datasets, CIFAR-10, PubFig, and Tiny-ImageNet; the target model is mainly ResNet-18, the ABL experiment uses WideResNet-16-1, and the mismatch ablation additionally includes GoogLeNet and EfficientNet-B0 (Section IV-A).
   • The attack baselines cover HTBA, SAA, LC, and the adapted BadNets and Blend; the defense evaluation covers six in total: Neural Cleanse, TABOR, Fine-pruning, I-BAU, the frequency detector, and ABL (Section IV-B, IV-D).
   • The main results and most ablations are averaged over three repetitions (Table III, V, VI, IX); the paper does not report standard deviations over multiple full trainings (Fig. 4 gives one exception of ±8.12%).
   • The physical-world evaluation is a qualitative demonstration (Fig. 8 screenshots and video), and the paper does not report a quantitative ASR for the physical-world attack.
   • The paper does not report time or computational cost figures for each stage of the attack.

   Collapse this answer

6. 06Summarize the main content of the paper

   NARCISSUS can carry out a low-poisoning-rate clean-label backdoor attack using only target-class data, and the authors report that none of the existing defenses can robustly mitigate it.

   An attack paper on training data poisoning security that proposes a clean-label backdoor attack, NARCISSUS: the attacker only needs representative samples of the target class and public out-of-distribution (POOD) samples, without knowledge of the entire training set.

   • Problem to solve: existing clean-label attacks (LC, HTBA, SAA) rely on training data from all classes, whereas in reality data is often aggregated from independent sources, making it difficult for attackers to obtain; the authors study whether an attack remains feasible when only target-class data is known.
   • Method highlights: pretrain a surrogate model with POOD data, fine-tune it for 5 rounds with target-class samples, then synthesize a trigger "pointing into the target class" via 1000 rounds of projected gradient descent; poison only a small number of target-class samples (keeping their original labels), and amplify the trigger at query time during testing; the physical-world version adds random position, hue variation, and EOT.
   • Main results: at a 0.05% poisoning rate, ASR is 97.36% on CIFAR-10 and 85.81% on Tiny-ImageNet; on PubFig, 0.024% (3 images) achieves 99.89% (Table III); at the same poisoning rate, existing clean-label attacks achieve an ASR of at most 6.00% (CIFAR-10, SAA, one-to-one).
   • Defense evaluation: the authors report that Neural Cleanse and TABOR detect no anomaly, that Fine-pruning leaves ASR above 90.8% under each setting, that the attack remains effective after one hundred rounds of I-BAU and performs unstably, and that ASR remains 98.47%–100% after ABL; the original trigger with an l∞ constraint can be identified by a frequency detector at a 100% detection rate, but the adaptive version with an added low-pass constraint drops to a 58.96% detection rate while ASR is still 90.30% (0.8% poisoning rate).
   • The authors' conclusion: the authors argue that the trigger is difficult to remove because it contains features as persistent as the target class's semantic features, and removing it would first harm model accuracy; the authors state that popular machine learning pipelines using public data sources are easily exposed to such practical attacks, and call for research on the theory of clean-label attacks and more robust defenses.

   Collapse this answer

Related papers