{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/sleeper-agent-scalable-hidden-trigger","title":"Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch","arxiv_id":"2106.08970","date":"2021-06-16","proceeding":null,"authors":["Hossein Souri","Liam Fowl","Rama Chellappa","Micah Goldblum","Tom Goldstein"],"abstract":"As the curation of data for machine learning becomes increasingly automated, dataset tampering is a mounting threat. Backdoor attackers tamper with training data to embed a vulnerability in models that are trained on that data. This vulnerability is then activated at inference time by placing a \"trigger\" into the model's input. Typical backdoor attacks insert the trigger directly into the training data, although the presence of such an attack may be visible upon inspection. In contrast, the Hidden Trigger Backdoor Attack achieves poisoning without placing a trigger into the training data at all. However, this hidden trigger attack is ineffective at poisoning neural networks trained from scratch. We develop a new hidden trigger attack, Sleeper Agent, which employs gradient matching, data selection, and target model re-training during the crafting process. Sleeper Agent is the first hidden trigger backdoor attack to be effective against neural networks trained from scratch. We demonstrate its effectiveness on ImageNet and in black-box settings. Our implementation code can be found at https://github.com/hsouri/Sleeper-Agent.","url_abs":"https://arxiv.org/abs/2106.08970v3","url_pdf":"https://arxiv.org/pdf/2106.08970v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"sleeper-agent-scalable-hidden-trigger","repo_url":"https://github.com/hsouri/Sleeper-Agent","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2106.08970","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2106.08970"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/hsouri/Sleeper-Agent","reach":null}],"summary":{"ran_draft_wrong":1,"unverified":2},"by_repo_kind":{"official":{"samples":3,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":3,"samples":[{"code_sha256_prefix":"4f1b22f771a50e6d","entry":"bypass_last_layer","repo":"hsouri/Sleeper-Agent","repo_kind":"official","path":"forest/victims/batched_attacks.py","file_url":"https://github.com/hsouri/Sleeper-Agent/blob/HEAD/forest/victims/batched_attacks.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4f1b22f771a50e6d"}},{"code_sha256_prefix":"34911817e88e224a","entry":"BaseAttack","repo":"hsouri/Sleeper-Agent","repo_kind":"official","path":"forest/victims/batched_attacks.py","file_url":"https://github.com/hsouri/Sleeper-Agent/blob/HEAD/forest/victims/batched_attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"34911817e88e224a"}},{"code_sha256_prefix":"5d42b7b133f5db30","entry":"HTBD","repo":"hsouri/Sleeper-Agent","repo_kind":"official","path":"forest/victims/batched_attacks.py","file_url":"https://github.com/hsouri/Sleeper-Agent/blob/HEAD/forest/victims/batched_attacks.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5d42b7b133f5db30"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}