{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/lotus-evasive-and-resilient-backdoor-attacks","title":"LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioning","arxiv_id":"2403.17188","date":"2024-03-25","proceeding":"CVPR 2024 1","authors":["Siyuan Cheng","Guanhong Tao","Yingqi Liu","Guangyu Shen","Shengwei An","Shiwei Feng","Xiangzhe Xu","Kaiyuan Zhang","Shiqing Ma","Xiangyu Zhang"],"abstract":"Backdoor attack poses a significant security threat to Deep Learning applications. Existing attacks are often not evasive to established backdoor detection techniques. This susceptibility primarily stems from the fact that these attacks typically leverage a universal trigger pattern or transformation function, such that the trigger can cause misclassification for any input. In response to this, recent papers have introduced attacks using sample-specific invisible triggers crafted through special transformation functions. While these approaches manage to evade detection to some extent, they reveal vulnerability to existing backdoor mitigation techniques. To address and enhance both evasiveness and resilience, we introduce a novel backdoor attack LOTUS. Specifically, it leverages a secret function to separate samples in the victim class into a set of partitions and applies unique triggers to different partitions. Furthermore, LOTUS incorporates an effective trigger focusing mechanism, ensuring only the trigger corresponding to the partition can induce the backdoor behavior. Extensive experimental results show that LOTUS can achieve high attack success rate across 4 datasets and 7 model structures, and effectively evading 13 backdoor detection and mitigation techniques. The code is available at https://github.com/Megum1/LOTUS.","url_abs":"https://arxiv.org/abs/2403.17188v1","url_pdf":"https://arxiv.org/pdf/2403.17188v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"lotus-evasive-and-resilient-backdoor-attacks","repo_url":"https://github.com/megum1/lotus","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"}],"methods":[{"method_slug":"set","method_name":"SET"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2403.17188","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2403.17188"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/megum1/lotus","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"deterministic:regex_extraction","url":"https://github.com/Megum1/LOTUS","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":9,"ran_fixture":1,"unverified":3},"by_repo_kind":{"official":{"samples":13,"ran":10,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"f89ebdeac2cd34a2","entry":"adjust_learning_rate","repo":"megum1/lotus","repo_kind":"official","path":"misc/mitigation.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/misc/mitigation.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f89ebdeac2cd34a2"}},{"code_sha256_prefix":"51385a626b151d0d","entry":"get_config","repo":"megum1/lotus","repo_kind":"official","path":"utils.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"51385a626b151d0d"}},{"code_sha256_prefix":"1959b01afae33059","entry":"get_norm","repo":"megum1/lotus","repo_kind":"official","path":"utils.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/utils.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1959b01afae33059"}},{"code_sha256_prefix":"b428a29b59766a36","entry":"get_transform","repo":"megum1/lotus","repo_kind":"official","path":"utils.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b428a29b59766a36"}},{"code_sha256_prefix":"d782d39883a9a91b","entry":"mask_patn_process","repo":"megum1/lotus","repo_kind":"official","path":"misc/nc.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/misc/nc.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d782d39883a9a91b"}},{"code_sha256_prefix":"2701f96dac3e6c3c","entry":"nc","repo":"megum1/lotus","repo_kind":"official","path":"misc/nc.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/misc/nc.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2701f96dac3e6c3c"}},{"code_sha256_prefix":"466658548dab64be","entry":"outlier_detection","repo":"megum1/lotus","repo_kind":"official","path":"misc/nc.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/misc/nc.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"466658548dab64be"}},{"code_sha256_prefix":"8066d21bcfb5d677","entry":"split_victim_other","repo":"megum1/lotus","repo_kind":"official","path":"dataset.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/dataset.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8066d21bcfb5d677"}},{"code_sha256_prefix":"a11551fbad4f2769","entry":"stamp_trigger","repo":"Megum1/LOTUS","repo_kind":"official","path":"trigger.py","file_url":"https://github.com/Megum1/LOTUS/blob/HEAD/trigger.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a11551fbad4f2769"}},{"code_sha256_prefix":"04ebef6dc8a3202f","entry":"trigger_focus","repo":"megum1/lotus","repo_kind":"official","path":"trigger.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/trigger.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"04ebef6dc8a3202f"}},{"code_sha256_prefix":"c1d26ac82fd5897b","entry":"extract_feat","repo":"megum1/lotus","repo_kind":"official","path":"partition.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/partition.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c1d26ac82fd5897b"}},{"code_sha256_prefix":"aadf4aa4135f2e09","entry":"fineprune","repo":"megum1/lotus","repo_kind":"official","path":"misc/mitigation.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/misc/mitigation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"aadf4aa4135f2e09"}},{"code_sha256_prefix":"87497271d48656a3","entry":"finetune","repo":"megum1/lotus","repo_kind":"official","path":"misc/mitigation.py","file_url":"https://github.com/megum1/lotus/blob/HEAD/misc/mitigation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"87497271d48656a3"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}