Checkerboard: A Simple, Effective, Efficient and Learning-free Clean Label Backdoor Attack with Low Poisoning Budget

2026-05-02

AI Summary

This work addresses the stealthy and label-consistent security threat posed by clean-label backdoor attacks by proposing a novel attack method that requires neither learning nor a proxy model. Leveraging linear separability theory, the authors derive a closed-form checkerboard trigger and design a complexity-driven sample selection strategy that relies solely on data from the target class, enabling highly effective attacks under extremely low poisoning budgets. This approach represents the first theoretically grounded, learning-free backdoor attack, eliminating dependence on optimization procedures or surrogate models. Experiments demonstrate that poisoning only 20 samples on CIFAR-10 achieves a 99.99% attack success rate, while on ImageNet-100, a poisoning rate of just 0.46% yields over 94% success, all without compromising clean accuracy and exhibiting strong robustness against both existing and adaptive defenses.

Abstract

Backdoor attacks threaten the deep learning supply chain by poisoning a small fraction of the training data so that a model behaves normally on clean inputs but misclassifies trigger-carrying inputs to an attacker-chosen target class. Clean-label backdoor attacks are especially dangerous because poisoned samples remain label-consistent and are therefore harder to detect. Yet existing clean-label attacks typically rely on expensive optimization, surrogate-model training, or nontrivial data access. We present Checkerboard, a theoretically grounded, learning-free clean-label backdoor attack that is effective, efficient, and simple to implement. From a linear separability formulation, we derive a checkerboard trigger in closed form, removing the need for surrogate-model training and trigger optimization. For texture-rich datasets, we introduce Complexity-driven Sample Selection, which uses only target-class data to improve trigger-to-background contrast by selecting low-complexity images for poisoning. Across four benchmark datasets, Checkerboard outperforms 8 baseline attacks and achieves state-of-the-art performance under low poisoning budgets. For example, on CIFAR-10, under a trigger perturbation budget of $10/255$, poisoning 20 training samples achieves $99.99\%$ Attack Success Rate (ASR). On ImageNet-100, a poisoning rate of only $0.46\%$ yields over $94\%$ ASR without degrading clean accuracy. The proposed attack also remains effective against state-of-the-art backdoor defenses and shows strong resistance to adaptive defenses.

Problem

• clean-label backdoor attack
• low poisoning budget
• trigger design
• data poisoning
• adversarial machine learning

Innovation

• clean-label backdoor attack
• learning-free
• checkerboard trigger
• low poisoning budget
• complexity-driven sample selection