Low-ASR Backdoors Slip Past Popular Defences

Problem

This paper studies how backdoor detection fails when attackers deliberately reduce the observable Attack Success Rate (ASR) while preserving a model’s clean-input performance. Existing attacks and defences are typically evaluated assuming high ASR, so a low-ASR regime could hide malicious behaviour from standard checks. The work highlights an attacker–defender asymmetry: defenders need aggregate, statistically consistent evidence to flag a model, whereas an attacker who retains a local copy can search until they find a single input that activates the backdoor.

Approach

The authors introduce a reverse-training framework that starts from a conventional high-ASR backdoored model and retrains it by applying the same trigger transformation but restoring triggered samples to their original labels. This progressively weakens the trigger–target association without changing trigger, target label, model architecture or clean accuracy. Experiments use MNIST, CIFAR-10 and GTSRB, multiple architectures (SimpleCNN, LeNet, ResNet18, VGG16, ResNet50) and four representative attacks across trigger families: Patch-Based (BadNets), Blended, WaNet and LIRA. Four representative defences are evaluated: Neural Cleanse, STRIP, FreeEagle and DeBackdoor. The study also measures gradient-based optimisation effort to quantify residual target-class bias.

Key Findings

• Reverse training reliably reduces ASR while preserving clean accuracy: ASR drops rapidly during early epochs and stabilises in a low-ASR regime without degrading the primary task.
• State-of-the-art defences fail under low-ASR: Neural Cleanse loses its trigger-norm outlier, STRIP’s low-entropy signature collapses and poison/clean entropy distributions overlap, FreeEagle’s anomaly score can fall from 2.511 to 0.219 (CIFAR-10 example) and DeBackdoor recovers much smaller cASR values indistinguishable from clean models.
• Residual attacker-useful bias remains: triggered inputs on low-ASR models require far fewer gradient-based optimisation steps to reach the attacker target (about 2 steps) compared with clean models (about 30 steps), showing the backdoor is still easier to activate locally.
• Trigger representations are weakened but not eliminated: saliency maps and spatial heatmaps show reduced and more diffuse trigger influence, yet a residual spatial footprint persists across datasets and trigger types, including dynamic triggers like WaNet and LIRA.
• Low-ASR failure modes generalise across datasets, architectures and static or dynamic trigger families, indicating a broad limitation of detection methods that rely on strong, consistent trigger-induced signals.

Limitations

Evaluation is limited to image classification benchmarks and a reverse-training generation method; results may not directly generalise to other modalities or to alternative low-observability backdoor construction techniques. Only four representative defences were tested, so some other approaches might behave differently.

Implications

Offensively, a malicious model supplier can implant a low-ASR backdoor that passes routine model-level and input-level checks, retain a white-box local copy to search for or craft successful inputs, and then submit those inputs at inference time. Such low-ASR backdoors are easier to activate locally via brief gradient-based optimisation and are comparatively robust to simple input-cleaning filters, making supply-chain insertion and stealthy post-deployment exploitation more practical while evading many current detection procedures.