{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/narcissus-a-practical-clean-label-backdoor","title":"Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information","arxiv_id":"2204.05255","date":"2022-04-11","proceeding":null,"authors":["Yi Zeng","Minzhou Pan","Hoang Anh Just","Lingjuan Lyu","Meikang Qiu","Ruoxi Jia"],"abstract":"Backdoor attacks insert malicious data into a training set so that, during inference time, it misclassifies inputs that have been patched with a backdoor trigger as the malware specified label. For backdoor attacks to bypass human inspection, it is essential that the injected data appear to be correctly labeled. The attacks with such property are often referred to as \"clean-label attacks.\" Existing clean-label backdoor attacks require knowledge of the entire training set to be effective. Obtaining such knowledge is difficult or impossible because training data are often gathered from multiple sources (e.g., face images from different users). It remains a question whether backdoor attacks still present a real threat. This paper provides an affirmative answer to this question by designing an algorithm to mount clean-label backdoor attacks based only on the knowledge of representative examples from the target class. With poisoning equal to or less than 0.5% of the target-class data and 0.05% of the training set, we can train a model to classify test examples from arbitrary classes into the target class when the examples are patched with a backdoor trigger. Our attack works well across datasets and models, even when the trigger presents in the physical world. We explore the space of defenses and find that, surprisingly, our attack can evade the latest state-of-the-art defenses in their vanilla form, or after a simple twist, we can adapt to the downstream defenses. We study the cause of the intriguing effectiveness and find that because the trigger synthesized by our attack contains features as persistent as the original semantic features of the target class, any attempt to remove such triggers would inevitably hurt the model accuracy first.","url_abs":"https://arxiv.org/abs/2204.05255v2","url_pdf":"https://arxiv.org/pdf/2204.05255v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"narcissus-a-practical-clean-label-backdoor","repo_url":"https://github.com/ruoxi-jia-group/narcissus-backdoor-attack","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"narcissus-a-practical-clean-label-backdoor","repo_url":"https://github.com/reds-lab/narcissus","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"narcissus-a-practical-clean-label-backdoor","repo_url":"https://github.com/ruoxi-jia-group/narcissus","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"clean-label-backdoor-attack-0-024","task_name":"Clean-label Backdoor Attack (0.024%)"},{"task_slug":"clean-label-backdoor-attack-0-05","task_name":"Clean-label Backdoor Attack (0.05%)"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2204.05255","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2204.05255"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ruoxi-jia-group/narcissus-backdoor-attack","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/reds-lab/narcissus","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ruoxi-jia-group/narcissus","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":2,"unverified":1},"by_repo_kind":{"listed":{"samples":3,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"4304a326c593f8db","entry":"drop_connect","repo":"reds-lab/narcissus","repo_kind":"listed","path":"models/efficientnet.py","file_url":"https://github.com/reds-lab/narcissus/blob/HEAD/models/efficientnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4304a326c593f8db"}},{"code_sha256_prefix":"8737c82de631cffc","entry":"swish","repo":"reds-lab/narcissus","repo_kind":"listed","path":"models/efficientnet.py","file_url":"https://github.com/reds-lab/narcissus/blob/HEAD/models/efficientnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8737c82de631cffc"}},{"code_sha256_prefix":"4eff6a7b69bf9fe8","entry":"narcissus_gen","repo":"reds-lab/narcissus","repo_kind":"listed","path":"narcissus_function.py","file_url":"https://github.com/reds-lab/narcissus/blob/HEAD/narcissus_function.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4eff6a7b69bf9fe8"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}