{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/poisoned-classifiers-are-not-only-backdoored-1","title":"Poisoned classifiers are not only backdoored, they are fundamentally broken","arxiv_id":"2010.09080","date":"2020-10-18","proceeding":null,"authors":["MingJie Sun","Siddhant Agarwal","J. Zico Kolter"],"abstract":"Under a commonly-studied backdoor poisoning attack against classification models, an attacker adds a small trigger to a subset of the training data, such that the presence of this trigger at test time causes the classifier to always predict some target class. It is often implicitly assumed that the poisoned classifier is vulnerable exclusively to the adversary who possesses the trigger. In this paper, we show empirically that this view of backdoored classifiers is incorrect. We describe a new threat model for poisoned classifier, where one without knowledge of the original trigger, would want to control the poisoned classifier. Under this threat model, we propose a test-time, human-in-the-loop attack method to generate multiple effective alternative triggers without access to the initial backdoor and the training data. We construct these alternative triggers by first generating adversarial examples for a smoothed version of the classifier, created with a procedure called Denoised Smoothing, and then extracting colors or cropped portions of smoothed adversarial images with human interaction. We demonstrate the effectiveness of our attack through extensive experiments on high-resolution datasets: ImageNet and TrojAI. We also compare our approach to previous work on modeling trigger distributions and find that our method are more scalable and efficient in generating effective triggers. Last, we include a user study which demonstrates that our method allows users to easily determine the existence of such backdoors in existing poisoned classifiers. Thus, we argue that there is no such thing as a secret backdoor in poisoned classifiers: poisoning a classifier invites attacks not just by the party that possesses the trigger, but from anyone with access to the classifier.","url_abs":"https://arxiv.org/abs/2010.09080v2","url_pdf":"https://arxiv.org/pdf/2010.09080v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"poisoned-classifiers-are-not-only-backdoored-1","repo_url":"https://github.com/locuslab/breaking-poisoned-classifier","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[{"method_slug":"denoised-smoothing","method_name":"Denoised Smoothing"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2010.09080","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2010.09080"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/locuslab/breaking-poisoned-classifier","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_draft_wrong":1,"ran_violates":1,"unverified":4},"by_repo_kind":{"official":{"samples":6,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"160bb14bd76201b4","entry":"conv3x3","repo":"locuslab/breaking-poisoned-classifier","repo_kind":"official","path":"code/badnet/alexnet_fc7out.py","file_url":"https://github.com/locuslab/breaking-poisoned-classifier/blob/HEAD/code/badnet/alexnet_fc7out.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"160bb14bd76201b4"}},{"code_sha256_prefix":"8bc8b691d2e94f84","entry":"normalize_fn","repo":"locuslab/breaking-poisoned-classifier","repo_kind":"official","path":"code/badnet/alexnet_fc7out.py","file_url":"https://github.com/locuslab/breaking-poisoned-classifier/blob/HEAD/code/badnet/alexnet_fc7out.py","link_basis":"plan_row","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8bc8b691d2e94f84"}},{"code_sha256_prefix":"eedd280179e0f417","entry":"alexnet","repo":"locuslab/breaking-poisoned-classifier","repo_kind":"official","path":"code/badnet/alexnet_fc7out.py","file_url":"https://github.com/locuslab/breaking-poisoned-classifier/blob/HEAD/code/badnet/alexnet_fc7out.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"eedd280179e0f417"}},{"code_sha256_prefix":"b1feff1199933978","entry":"get_patch","repo":"locuslab/breaking-poisoned-classifier","repo_kind":"official","path":"code/badnet/utils.py","file_url":"https://github.com/locuslab/breaking-poisoned-classifier/blob/HEAD/code/badnet/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b1feff1199933978"}},{"code_sha256_prefix":"430095ea902452ea","entry":"initialize_model","repo":"locuslab/breaking-poisoned-classifier","repo_kind":"official","path":"code/badnet/utils.py","file_url":"https://github.com/locuslab/breaking-poisoned-classifier/blob/HEAD/code/badnet/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"430095ea902452ea"}},{"code_sha256_prefix":"3bfde3a501871df7","entry":"predict","repo":"locuslab/breaking-poisoned-classifier","repo_kind":"official","path":"code/badnet/utils.py","file_url":"https://github.com/locuslab/breaking-poisoned-classifier/blob/HEAD/code/badnet/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3bfde3a501871df7"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}