{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/clean-label-backdoor-attacks-on-video","title":"Clean-Label Backdoor Attacks on Video Recognition Models","arxiv_id":"2003.03030","date":"2020-03-06","proceeding":"CVPR 2020 6","authors":["Shihao Zhao","Xingjun Ma","Xiang Zheng","James Bailey","Jingjing Chen","Yu-Gang Jiang"],"abstract":"Deep neural networks (DNNs) are vulnerable to backdoor attacks which can hide backdoor triggers in DNNs by poisoning training data. A backdoored model behaves normally on clean test images, yet consistently predicts a particular target class for any test examples that contain the trigger pattern. As such, backdoor attacks are hard to detect, and have raised severe security concerns in real-world applications. Thus far, backdoor research has mostly been conducted in the image domain with image classification models. In this paper, we show that existing image backdoor attacks are far less effective on videos, and outline 4 strict conditions where existing attacks are likely to fail: 1) scenarios with more input dimensions (eg. videos), 2) scenarios with high resolution, 3) scenarios with a large number of classes and few examples per class (a \"sparse dataset\"), and 4) attacks with access to correct labels (eg. clean-label attacks). We propose the use of a universal adversarial trigger as the backdoor trigger to attack video recognition models, a situation where backdoor attacks are likely to be challenged by the above 4 strict conditions. We show on benchmark video datasets that our proposed backdoor attack can manipulate state-of-the-art video models with high success rates by poisoning only a small proportion of training data (without changing the labels). We also show that our proposed backdoor attack is resistant to state-of-the-art backdoor defense/detection methods, and can even be applied to improve image backdoor attacks. Our proposed video backdoor attack not only serves as a strong baseline for improving the robustness of video models, but also provides a new perspective for more understanding more powerful backdoor attacks.","url_abs":"https://arxiv.org/abs/2003.03030v2","url_pdf":"https://arxiv.org/pdf/2003.03030v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"clean-label-backdoor-attacks-on-video","repo_url":"https://github.com/ShihaoZhaoZSH/Video-Backdoor-Attack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"image-classification","task_name":"Image Classification"},{"task_slug":"video-recognition","task_name":"Video Recognition"},{"task_slug":"backdoor-defense","task_name":"backdoor defense"},{"task_slug":"image-classification","task_name":"image-classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2003.03030","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2003.03030"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ShihaoZhaoZSH/Video-Backdoor-Attack","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"unverified":7},"by_repo_kind":{"official":{"samples":7,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"afde2fce23e904be","entry":"addTrigger","repo":"ShihaoZhaoZSH/Video-Backdoor-Attack","repo_kind":"official","path":"experiments/enhance_trigger.py","file_url":"https://github.com/ShihaoZhaoZSH/Video-Backdoor-Attack/blob/HEAD/experiments/enhance_trigger.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"afde2fce23e904be"}},{"code_sha256_prefix":"8553e59eb6f6feab","entry":"average_gradients","repo":"ShihaoZhaoZSH/Video-Backdoor-Attack","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ShihaoZhaoZSH/Video-Backdoor-Attack/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"8553e59eb6f6feab"}},{"code_sha256_prefix":"2fba3fef686b0192","entry":"get_data","repo":"ShihaoZhaoZSH/Video-Backdoor-Attack","repo_kind":"official","path":"input_data.py","file_url":"https://github.com/ShihaoZhaoZSH/Video-Backdoor-Attack/blob/HEAD/input_data.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"2fba3fef686b0192"}},{"code_sha256_prefix":"8a9994123dd07cf9","entry":"get_frames_data","repo":"ShihaoZhaoZSH/Video-Backdoor-Attack","repo_kind":"official","path":"input_data.py","file_url":"https://github.com/ShihaoZhaoZSH/Video-Backdoor-Attack/blob/HEAD/input_data.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"8a9994123dd07cf9"}},{"code_sha256_prefix":"3a790fcc84f46286","entry":"placeholder_inputs","repo":"ShihaoZhaoZSH/Video-Backdoor-Attack","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ShihaoZhaoZSH/Video-Backdoor-Attack/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3a790fcc84f46286"}},{"code_sha256_prefix":"19178582a4611840","entry":"sample_data","repo":"ShihaoZhaoZSH/Video-Backdoor-Attack","repo_kind":"official","path":"input_data.py","file_url":"https://github.com/ShihaoZhaoZSH/Video-Backdoor-Attack/blob/HEAD/input_data.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"19178582a4611840"}},{"code_sha256_prefix":"0be7f8fa62988f87","entry":"tower_loss","repo":"ShihaoZhaoZSH/Video-Backdoor-Attack","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ShihaoZhaoZSH/Video-Backdoor-Attack/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"0be7f8fa62988f87"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}