Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization
Binyan Xu, Fan Yang, Di Tang, Xilin Dai, Kehuan Zhang
Abstract
Clean-image backdoor attacks, which use only label manipulation in training datasets to compromise deep neural networks, pose a significant threat to security-critical applications. A critical flaw in existing methods is that the poison rate required for a successful attack induces a proportional, and thus noticeable, drop in Clean Accuracy (CA), undermining their stealthiness. This paper presents a new paradigm for clean-image attacks that minimizes this accuracy degradation by optimizing the trigger itself. We introduce Generative Clean-Image Backdoors (GCB), a framework that uses a conditional InfoGAN to identify naturally occurring image features that can serve as potent and stealthy triggers. By ensuring these triggers are easily separable from benign task-related features, GCB enables a victim model to learn the backdoor from an extremely small set of poisoned examples, resulting in a CA drop of less than 1%. Our experiments demonstrate GCB
BibTeX
@inproceedings{aaai2026_breakingthesteal,
title = {Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization},
author = {Binyan Xu and Fan Yang and Di Tang and Xilin Dai and Kehuan Zhang},
booktitle = {AAAI 2026},
year = {2026}
}