Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors
Label-only backdoor audit shows feature space, not the detector score, decides whether retraining removes the attack.
The paper audits label-only backdoors such as FLIP, which flips 3 percent of CIFAR-10 labels and makes a ResNet-32 send 99.7 percent of triggered source-class images to the attacker class. Keeping the test and metric fixed, the same nearest-neighbor check scores AUROC 0.546 on poisoned-model features, 0.967 on frozen DINOv2 features, and 0.995 on a clean-label oracle. A reproduced SPECTRE defense matches published numbers but deletes 20 percent of every class on truck-to-deer, while a frozen-feature prototype audit deletes 6 percent with higher clean accuracy. Higher detection AUROC did not always yield a safer retrained model, and adaptive attackers can slip past the best static prototype audit.
- FLIP flipping 3% of CIFAR-10 labels yields 99.7% attack success.
- Frozen DINOv2 features far outperform poisoned-model features.
- SPECTRE deletes 20% of each class; prototype audit deletes 6%.
- Higher AUROC did not always mean lower attack success.
- Adaptive attackers evade the best static prototype audit.
From the original article
1 min read at arxiv.orgSome backdoor attacks never touch an image. FLIP only changes labels: on CIFAR-10, flipping 3% of them makes a ResNet-32 send 99. 7% of triggered source-class images to the attacker's class.
By Arnab Dey · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.