Pith. sign in

REVIEW 6 major objections 3 minor 27 references

Poison in the Well: Feature Embedding Disruption in Backdoor Attacks

T0 review · 6 major / 3 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ShadowPrint shows that a trigger optimized only to cluster poisoned-sample embeddings achieves near-perfect attack success at 0.01% poison rates while evading three defenses.

desk verdict A promising feature-clustering backdoor idea undermined by a sign error in the core loss and a missing target-attraction term. read the letter →

arxiv 2505.19821 v1 pith:KYDF2IQE submitted 2025-05-26 cs.CR cs.LG

Zhou Feng , Jiahao Chen , Chunyi Zhou , Yuwen Pu , Qingming Li , Shouling Ji This is my paper · ORCID
classification cs.CRcs.LG
keywords backdoorattackdatapoisoningfeatureembeddingtriggeroptimizationclean-labeldirty-labeldefenseevasionlowpoisonrate
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ShadowPrint is a backdoor attack that moves the hard part of poisoning from model training to trigger design. The paper claims that a universal trigger optimized to make poisoned images look alike in the last-layer feature space lets an attacker succeed with poison rates as low as 0.01%—around five images in CIFAR-10—instead of the 0.1% or more typical of prior work. In the reported experiments the attack reaches up to 100% success, keeps clean accuracy within about one point of baseline in most cases, and evades three state-of-the-art defenses with average detection rates below 5%. If the claim is right, backdoor threats are cheaper and harder to spot than the field has assumed, and defenses need to look at feature-space geometry, not just trigger visibility.

What carries the argument

The load-bearing object is the universal trigger $t$ produced by Algorithm 1, optimized against the pairwise cosine-similarity loss $L_{\mathrm{cluster}}$ using Adam over the embeddings of poisoned samples. The optimization runs on the attacker's own model $f_{\mathrm{adv}}$ and dataset $D_{\mathrm{adv}}$, so it can happen before the victim's model exists. The trigger is then inserted through the blended transformation $T(x_i,t)=x_i(1-w)+tw$ from the Blended attack, where $w$ is a tunable weight. What the machinery does is shift the burden of forming the backdoor association from many poison examples during training to a precomputed pattern that already aligns poisoned examples in feature space; the paper claims this is why poison rates of $0.01\%$–$0.05\%$ suffice.

What would settle it

Train a ShadowPrint backdoored model at a 0.01% poison rate and compare the mean embedding of triggered poisoned images with the mean embeddings of each class in that trained model; if the triggered cluster is not closest to the target class, or if attack success stays high while the cluster sits far from the target class, the clustering-transfer mechanism is falsified.

Watch

Extended reading notes

Core claim

The central discovery, stated on the paper's own terms, is that the backdoor objective can be pushed before training begins. For a set of poisoned samples $x'_i = T(x_i,t)$ produced by blending a trigger $t$ into images, ShadowPrint minimizes $L_{\mathrm{cluster}} = \frac{1}{N^2}\sum_{i\neq j}\frac{Z_i\cdot Z_j^T}{\|Z_i\|\|Z_j\|}$, where $Z_i$ is the embedding of $x'_i$ in the last fully connected layer of the attacker's model. This collapses the triggered embeddings into a tight cluster. The paper argues that once the victim trains on a dataset containing a very small number of such clustered samples, the model absorbs the trigger-to-target mapping almost for free, producing high attack success without degrading clean accuracy. ShadowPrint instantiates this idea in three modes—dirty-label, clean-label, and data-free—and reports that it sustains its performance across CIFAR-10, CIFAR-100, and TinyImageNet with ResNet and VGG backbones.

Load-bearing premise

The method rests on the assumption that a trigger that makes poisoned images look alike inside the attacker's model will, after the victim trains on a few such images, make any triggered image land in the target class—even though the trigger optimization never steers the cluster toward that class.

Editorial extensions

If this is right

  • At 0.01% poison, an attacker controls roughly five images in CIFAR-10's 50,000-image training set; the reported near-perfect ASR at that rate implies that defenses assuming attackers need large poison budgets are missing the relevant threat.
  • Clean-label, dirty-label, and data-free attacks all use the same trigger-generation procedure, so the method covers scenarios where the attacker lacks model architecture and training data, including ML-as-a-service pipelines.
  • Clean accuracy stays within about one percentage point of baseline and detection rates average below 5% against IBD-PSC, SCALE UP, and Beatrix, meaning standard accuracy checks and these three defenses would not flag the poisoned model.
  • The trigger transfers across ResNet18, ResNet34, and VGG13BN and across CIFAR-10, CIFAR-100, and TinyImageNet, indicating the clustering alignment generalizes across architectures and datasets within the evaluated range.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: Because the optimization in Eq. (3) contains no term pulling the poisoned cluster toward the target class, the paper's transfer story implicitly depends on the labels of the poisoned samples anchoring the cluster to the target; a direct measurement of the cluster's distance to class centroids in the trained victim model would test this.
  • Editorial inference: The trigger-weight ablation shows a sharp ASR jump between weight 0.1 and 0.2, implying a minimal perturbation magnitude below which clustering no longer transfers; an adaptive defender could search for that threshold with scaled perturbations and flag models that exhibit such a cliff.
  • Editorial inference: The data-free experiments use CIFAR-100 as the surrogate domain for other target datasets, so a natural follow-up is to measure how ASR degrades as the surrogate domain moves further from the target domain, which would quantify how much cluster transfer depends on domain similarity.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

6 major / 3 minor

Summary. The manuscript proposes ShadowPrint, a backdoor attack that optimizes a blended trigger so that triggered samples have clustered feature embeddings at the last fully connected layer, claiming attack success at poison rates as low as 0.01%. It defines three attacker scenarios (white-box, black-box, and data-free), reports CA/ASR tables on CIFAR-10, CIFAR-100, and TinyImageNet, and includes an ablation study plus a defense evaluation against IBD-PSC, SCALE UP, and Beatrix. The central claim is that clustering triggered embeddings in this way yields superior ASR and stealth at poison rates orders of magnitude below standard settings.

Significance. If the mechanism worked as stated and the empirical claims held with proper comparison, ShadowPrint would be a meaningful contribution: it addresses low poison rates and limited attacker knowledge, and it shifts trigger design from input-space appearance to feature-space geometry. The threat-model taxonomy is a strength, and the defense evaluation is a useful piece of evidence. The paper, however, ships no code or data, and the central optimization contains an internal contradiction, so the significance cannot be assessed as presented.

major comments (6)
  1. [§III-C, Eq. (3), Algorithm 1] Eq. (3) defines Lcluster as the mean pairwise cosine similarity of triggered embeddings, and Algorithm 1 minimizes it. Since cosine similarity is bounded above by 1, minimizing this quantity drives normalized embeddings apart (toward cosine -1); the text's statement that "minimizing (3) encourages higher cosine similarity" is the opposite of what the loss does. This is load-bearing: if the implementation literally minimizes Eq. (3), the reported clustering and the resulting ASR cannot be explained by the stated mechanism. Please correct the objective (e.g., minimize 1 - cosine, or maximize Eq. (3)), state which one was actually used, and show the resulting embedding geometry to remove ambiguity.
  2. [§IV-B, Tables I-II] The abstract and Section IV.C claim that ShadowPrint achieves "superior" ASR and "outperforms comparable methods," but no comparison against any existing backdoor attack under identical models, datasets, and poison rates is provided. Tables I and II contain only ShadowPrint's own CA/ASR values, so the comparison claims cannot be verified. Please add baseline runs of at least BadNets, Blended, Narcissus, and one recent low-poison-rate attack in the same experimental harness.
  3. [§III-A, §III-C, Table III] The data-free scenario (A3) is defined as the attacker having no knowledge of the training dataset, yet Table III uses a surrogate ResNet34 and the CIFAR-100 auxiliary dataset. This is a reasonable "no target data" scenario, but it is not data-free in the sense of requiring no data at all. The naming in Scenario A3 and Section III.C should be reconciled with the actual requirement of auxiliary data from another domain; otherwise the abstract's claim of operating in a data-free setting overstates the evaluation.
  4. [§IV-C, Table VI] The defense evaluation is reported twice in two consecutive paragraphs, with conflicting summary values ("as low as 0.05" versus "lower than 0.12%"). Table VI reports DDR values as decimals, but no text explains the threshold or detector configuration used for each defense, and no other attack is run through the same defenses. Since evading SOTA defenses is central to the "stealth" conclusion, this needs a consistent, detailed description and a comparative run.
  5. [§IV-B, Tables I-V] All reported CA, ASR, and DDR numbers are single point estimates with no seeds, standard deviations, or repetitions. Given that many ASR values saturate at 0.999-1.000 and some clean-label cells are around 0.89 (e.g., Table II, ResNet18 target, CIFAR-10, VGG13BN trigger, poison rate 0.0001), it is impossible to assess the claimed stability ("CA decay no more than 1% in most cases") or the significance of differences across target models and poison rates. Please report at least 3-5 seeds with variance.
  6. [§III-C, Eq. (2) vs Algorithm 1] Even after the sign in Eq. (3) is corrected, the optimization in Algorithm 1 contains only the pairwise clustering term and no term that attracts the poisoned cluster toward the target label or target-class centroid. Eq. (2) includes such a term, but it is absent from the algorithm. The transfer from "poisoned samples are clustered" to "triggered inputs are classified as the target class" is therefore an unmeasured assumption, especially for clean-label attacks. Please add a direct measurement of the distance between the poisoned cluster and the target-class embeddings, or add a target-anchoring term to the loss.
minor comments (3)
  1. [§II-A] The citation "We et al. [18]" should be "Wu et al. [18]", matching the reference list.
  2. [§IV-C] The paragraph beginning "We evaluate the effectiveness of ShadowPrint against several SOTA defense mechanisms" duplicates the preceding paragraph and should be removed.
  3. [§IV-C] The two DDR summary statements in this section use inconsistent scales (a fraction versus a percentage); choose one consistent scale and apply it throughout.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ShadowPrint's trigger optimization and ASR evaluation are empirically independent; the noted Eq. (3) sign issue is a correctness concern, not a circular derivation.

full rationale

ShadowPrint is an empirical backdoor-attack paper, not a derivation chain that reduces to its own inputs. The trigger is optimized by the attacker on a surrogate or partial dataset (Algorithm 1, Eq. (3)), and ASR is measured after the victim independently retrains a model on the poisoned dataset, so the reported attack success is not algebraically forced by the trigger loss. There are no load-bearing self-citations: the cited transformation in Eq. (1) is the standard Blended attack from external prior work, and the defense evaluations use external detectors. The paper's main theoretical weakness is that Eq. (3) is described as maximizing alignment while the expression is a sum of cosine similarities to be minimized, which would push embeddings apart, and the loss has no term pulling the cluster toward the target class; both are correctness/evidence problems, not circularity. The claim that clustering poisoned embeddings alone transfers to target-label misclassification is an empirical assumption that is tested, not assumed by construction. Accordingly, the appropriate circularity finding is no significant circularity.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The method itself is the only new object; no new particles, forces, or physical entities. The main free parameter is the trigger weight, which the paper tunes in ablation but never fixes for the headline numbers. The core mechanism is treated as an assumption rather than a derived result.

free parameters (2)
  • trigger weight w = not reported for main experiments (ablation shows 0.2-0.5 needed; 0.1 fails)
    Controls blend strength in Eq. (1); the paper does not state which weight produced Tables I and II, and Table V shows ASR collapses at w=0.1, so the main results depend on this hand-chosen value.
  • optimization steps K and optimizer settings = not reported
    Algorithm 1 depends on K and Adam hyperparameters; without them a re-implementation cannot reproduce the trigger.
assumptions (3)
  • domain assumption The last fully connected layer of the attacker's model is a sufficient and transferable space for aligning backdoor features.
    Invoked in Section III.C.1 where f^fc_adv embeddings are used; the data-free results assume surrogate-to-target transfer.
  • domain assumption The victim trains normally on the poisoned dataset without any defensive preprocessing.
    All CA/ASR tables and defense evals assume standard training; the paper does not evaluate against training-time defenses except inspection defenses at test time.
  • ad hoc to paper Clustering poisoned samples together is sufficient to make the model associate the trigger with the target label.
    This is the core mechanism introduced by the paper; it is asserted in Eq. (2)-(3) and Algorithm 1 but not proven or directly measured.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Poison in the Well: Feature Embedding Disruption in Backdoor Attacks." pith.science (2026). https://pith.science/paper/KYDF2IQE

@misc{pith2026250519821,
  author       = {Pith},
  title        = {Pith review of: Poison in the Well: Feature Embedding Disruption in Backdoor Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KYDF2IQE}},
  note         = {Machine review of arXiv:2505.19821}
}
read the original abstract

Backdoor attacks embed malicious triggers into training data, enabling attackers to manipulate neural network behavior during inference while maintaining high accuracy on benign inputs. However, existing backdoor attacks face limitations manifesting in excessive reliance on training data, poor stealth, and instability, which hinder their effectiveness in real-world applications. Therefore, this paper introduces ShadowPrint, a versatile backdoor attack that targets feature embeddings within neural networks to achieve high ASRs and stealthiness. Unlike traditional approaches, ShadowPrint reduces reliance on training data access and operates effectively with exceedingly low poison rates (as low as 0.01%). It leverages a clustering-based optimization strategy to align feature embeddings, ensuring robust performance across diverse scenarios while maintaining stability and stealth. Extensive evaluations demonstrate that ShadowPrint achieves superior ASR (up to 100%), steady CA (with decay no more than 1% in most cases), and low DDR (averaging below 5%) across both clean-label and dirty-label settings, and with poison rates ranging from as low as 0.01% to 0.05%, setting a new standard for backdoor attack capabilities and emphasizing the need for advanced defense strategies focused on feature space manipulations.

Figures

Figures reproduced from arXiv: 2505.19821 by the authors.

Figure 1
Figure 1. Scheme of ShadowPrint framework. In Stage 1, the attacker optimizes the trigger based on his knowledge and resources. In Stage 2, the victim, unaware of the malicious intent, uses the poisoned dataset provided via the Internet to unintentionally train a backdoored model. ShadowPrint introduces a novel backdoor attack framework that leverages feature space manipulation for enhanced stealth and effectiveness. By optim… view at source ↗
Figure 2
Figure 2. Illustration of feature space alignment using [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Visualization of the poisoning process. The visualization depicts [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

27 extracted references · 10 canonical work pages

  1. [1]

    Deep learning in medical image analysis,

    D. Shen, G. Wu, and H.-I. Suk, “Deep learning in medical image analysis,” Annual review of biomedical engineering, vol. 19, no. 1, pp. 221–248, 2017

    2017

  2. [2]

    Deep learning for finance: deep portfolios,

    J. B. Heaton, N. G. Polson, and J. H. Witte, “Deep learning for finance: deep portfolios,” Applied Stochastic Models in Business and Industry, vol. 33, no. 1, pp. 3–12, 2017

    work page 2017

  3. [3]

    Badnets: Evaluating backdooring attacks on deep neural networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” IEEE Access, vol. 7, pp. 47 230–47 244, 2019

    2019

  4. [4]

    Narcissus: A practical clean-label backdoor attack with limited information,

    Y . Zeng, M. Pan, H. A. Just, L. Lyu, M. Qiu, and R. Jia, “Narcissus: A practical clean-label backdoor attack with limited information,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, pp. 771–785

    2023

  5. [5]

    Not all samples are born equal: Towards effective clean-label backdoor attacks,

    Y . Gao, Y . Li, L. Zhu, D. Wu, Y . Jiang, and S.-T. Xia, “Not all samples are born equal: Towards effective clean-label backdoor attacks,” Pattern Recognition, vol. 139, p. 109512, 2023

    work page 2023

  6. [6]

    Nsml: Meet the mlaas platform with a real- world case study,

    H. Kim, M. Kim, D. Seo, J. Kim, H. Park, S. Park, H. Jo, K. Kim, Y . Yang, Y . Kimet al., “Nsml: Meet the mlaas platform with a real- world case study,” arXiv preprint arXiv:1810.09957, 2018

    arXiv 2018

  7. [7]

    Mlaas: Machine learning as a service,

    M. Ribeiro, K. Grolinger, and M. A. Capretz, “Mlaas: Machine learning as a service,” in 2015 IEEE 14th International Conference on Machine Learning and Applications (ICMLA), 2015, pp. 896–902

    work page 2015

  8. [8]

    Ibd-psc: Input-level backdoor detection via parameter-oriented scaling consis- tency,

    L. Hou, R. Feng, Z. Hua, W. Luo, L. Y . Zhang, and Y . Li, “Ibd-psc: Input-level backdoor detection via parameter-oriented scaling consis- tency,” arXiv preprint arXiv:2405.09786, 2024

    arXiv 2024

Show all 27 references
  1. [9]

    Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency,

    J. Guo, Y . Li, X. Chen, H. Guo, L. Sun, and C. Liu, “Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency,” arXiv preprint arXiv:2302.03251, 2023

    2023 arXiv

  2. [10]

    The" beatrix

    W. Ma, D. Wang, R. Sun, M. Xue, S. Wen, and Y . Xiang, “The" beatrix”resurrections: Robust backdoor detection via gram matrices,” arXiv preprint arXiv:2209.11715, 2022

    2022 arXiv

  3. [11]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,” arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  4. [12]

    Wanet–imperceptible warping-based backdoor attack,

    A. Nguyen and A. Tran, “Wanet–imperceptible warping-based backdoor attack,” arXiv preprint arXiv:2102.10369, 2021

    2021 arXiv

  5. [13]

    Trojaning attack on neural networks,

    Y . Liu, S. Ma, Y . Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” in 25th Annual Network And Distributed System Security Symposium (NDSS 2018). Internet Soc, 2018

    2018

  6. [14]

    Label-consistent backdoor at- tacks,

    A. Turner, D. Tsipras, and A. Madry, “Label-consistent backdoor at- tacks,” arXiv preprint arXiv:1912.02771, 2019

    1912 arXiv

  7. [15]

    Input-aware dynamic backdoor attack,

    T. A. Nguyen and A. Tran, “Input-aware dynamic backdoor attack,” Advances in Neural Information Processing Systems, vol. 33, pp. 3454– 3464, 2020

    2020

  8. [16]

    A new backdoor attack in cnns by training set corruption without label poisoning,

    M. Barni, K. Kallas, and B. Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” in 2019 IEEE International Conference on Image Processing (ICIP). IEEE, 2019, pp. 101–105

    2019

  9. [17]

    Efficient backdoor attacks for deep neural networks in real-world scenarios,

    Z. Li, H. Sun, P. Xia, H. Li, B. Xia, Y . Wu, and B. Li, “Efficient backdoor attacks for deep neural networks in real-world scenarios,” arXiv preprint arXiv:2306.08386, 2023

    2023 arXiv

  10. [18]

    Computation and data effi- cient backdoor attacks,

    Y . Wu, X. Han, H. Qiu, and T. Zhang, “Computation and data effi- cient backdoor attacks,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, 2023, pp. 4805–4814

    2023

  11. [19]

    Boosting backdoor attack with a learnable poisoning sample selection strategy,

    Z. Zhu, M. Zhang, S. Wei, L. Shen, Y . Fan, and B. Wu, “Boosting backdoor attack with a learnable poisoning sample selection strategy,” arXiv preprint arXiv:2307.07328, 2023

    2023 arXiv

  12. [20]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE symposium on security and privacy (SP). IEEE, 2019, pp. 707–723

    2019

  13. [21]

    Strip: A defence against trojan attacks on deep neural networks,

    Y . Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “Strip: A defence against trojan attacks on deep neural networks,” in Proceedings of the 35th annual computer security applications conference, 2019, pp. 113–125

    2019

  14. [22]

    Detecting backdoor attacks on deep neural networks by activation clustering,

    B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” arXiv preprint arXiv:1811.03728, 2018

    2018 arXiv

  15. [23]

    Fine-pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-pruning: Defending against backdooring attacks on deep neural networks,” in International symposium on research in attacks, intrusions, and defenses. Springer, 2018, pp. 273–294

    2018

  16. [24]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, 2016, pp. 770–778

    2016

  17. [25]

    Very deep convolutional networks for large-scale image recognition,

    K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” arXiv preprint arXiv:1409.1556, 2014

    2014 arXiv

  18. [26]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al., “Learning multiple layers of features from tiny images,” 2009

    2009

  19. [27]

    Tiny imagenet visual recognition challenge,

    Y . Le and X. Yang, “Tiny imagenet visual recognition challenge,” CS 231N, vol. 7, no. 7, p. 3, 2015

    2015

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.