Technical Summary: When Stronger Triggers Backfire: A High-Dimensional Theory of Backdoor Attacks

Problem Statement

Backdoor poisoning attacks involve an adversary injecting training samples containing a specific trigger pattern, labeled with a target class, to force the model to misclassify any test input containing that trigger. While empirical observations suggest that stronger training triggers might make poisoned samples easier to classify (potentially reducing their influence), a precise theoretical understanding of this trade-off in high-dimensional settings has been elusive. Existing theoretical work largely relies on empirical evidence or low-dimensional bounds that fail to capture the behavior of modern datasets where the dimension $p$ and sample size $n$ are of the same order (the proportional regime).

This paper investigates the counter-intuitive phenomenon where increasing the strength of the training trigger ($\alpha$) can actually improve clean test accuracy and eventually degrade the attack's success rate. The authors analyze this trade-off using regularized Generalized Linear Models (GLMs) trained on high-dimensional Gaussian mixture data.

Methodology

The study employs a rigorous high-dimensional statistical framework, specifically the proportional asymptotic regime where $p/n \to \kappa \in (0, \infty)$.

1. Data Model: The authors model the data as a binary Gaussian mixture. Clean samples follow $\mathcal{N}(y\mu, C)$, while poisoned samples (a fraction $\phi$ of the negative class) are modified by adding a trigger $\alpha v$ and flipping their label. The resulting poisoned data forms a two-component Gaussian mixture with means $\mu_1 = \mu$ and $\mu_2 = \alpha v - \mu$.
2. Model: The analysis focuses on regularized GLMs minimizing empirical risk (ERM) with a convex loss function $L$ and $\ell_2$ regularization $\lambda$.
3. Analytical Tools:
   • Gaussian Proxy: The authors utilize the Gaussian proxy theorem (based on Loureiro et al. [25]) to characterize the high-dimensional minimizer $\hat{\theta}$. This allows the complex stochastic optimization problem to be reduced to a deterministic fixed-point system involving scalars $(\tau, \gamma, \delta, \eta_1, \eta_2)$.
   • Key Metrics: The analysis centers on two alignment quantities:
     • Benign Alignment ($h_\mu$): $E[\mu^\top \tilde{\theta}]$, governing clean test accuracy.
     • Trigger Alignment ($h_v$): $E[v^\top \tilde{\theta}]$, governing the attack success rate (ASR).
   • Assumptions: The trigger direction $v$ is assumed to be asymptotically orthogonal to the Krylov subspace generated by the class mean $\mu$ and covariance $C$ (Assumption 2), reflecting standard trigger constructions like localized patches.

Key Contributions

The paper provides the first high-dimensional theoretical characterization of trigger impact, proving three distinct phenomena observed in deep learning experiments:

1. Clean Accuracy Increases with Trigger Strength: Contrary to intuition, increasing the training trigger strength $\alpha$ monotonically improves clean test accuracy.

   • Mechanism: As $\alpha$ grows, poisoned samples are pushed further into the target class region, becoming easier to classify. The model "wastes" less capacity on these samples and concentrates on the clean distribution.
   • Theoretical Insight: This effect is driven by a finite-sample noise floor ($\zeta \propto \kappa$) inherent in the proportional regime. In the information limit ($n \gg p$), this noise floor vanishes, and the improvement in clean accuracy becomes invisible, explaining why classical asymptotic analyses miss this phenomenon.

2. Attack Success Rate Peaks at Finite Trigger Strength: The trigger alignment $h_v(\alpha)$, and consequently the attack success rate, does not grow indefinitely. Instead, it reaches a unique maximum at a finite $\alpha^*$ and then decays.

   • Mechanism: For very large $\alpha$, the poisoned class becomes so well-separated that the loss function's gradient in the trigger direction vanishes (as $L'(x) \to 0$ for large $x$). The model effectively ignores the trigger direction because the loss provides no signal to adjust weights along it.
   • Rates: The decay rate is derived explicitly: $O(\alpha^{-\epsilon/(2+\epsilon)})$ for polynomial-tail losses and $O(\log \alpha / \alpha)$ for exponential-tail losses (e.g., logistic loss).

3. Optimal Trigger Direction is the Minimum Eigenvector: For a fixed trigger budget, the attack is most effective when the trigger aligns with the eigenvector of the data covariance $C$ corresponding to the smallest eigenvalue.

   • Mechanism: In low-variance directions, the classifier has less inherent signal to resist the perturbation, making the decision boundary easier to shift. The trigger alignment is strictly increasing with respect to the resolvent quadratic form $v^\top R(\lambda, \tau)v$, which is maximized by the minimum eigenvector.

Results and Validation

The theoretical results are validated across multiple settings:

• Squared Loss (ERM): Closed-form expressions are derived for the alignments, explicitly showing the rational function form that leads to the finite peak in trigger alignment and monotonic growth in benign alignment.
• General Convex Losses: The results are extended to general convex losses (e.g., logistic loss) via the Gaussian proxy fixed-point system, proving the existence of a finite peak and the convergence of the poisoned minimizer to the benign minimizer as $\alpha \to \infty$ in the population limit.
• Empirical Validation:
  • Gaussian Surrogates: Experiments on synthetic Gaussian data matching CIFAR-10 statistics closely match the theoretical predictions.
  • Real Data: Logistic regression on CIFAR-10 (classes 0 and 1) exhibits the predicted monotonic increase in clean accuracy and the peak-and-decay behavior in attack success.
  • Deep Networks: ResNet-18 experiments on CIFAR-10 confirm that these qualitative phenomena persist beyond the convex setting, suggesting universality.
  • Eigenvector Analysis: Experiments varying the trigger direction across eigenvectors of the empirical covariance confirm that attacks are most effective along low-variance directions.

Significance and Claims

The paper claims to offer a rigorous, quantitative analysis of backdoor poisoning that moves beyond empirical observation and low-dimensional bounds. Its primary significance lies in:

1. Revealing High-Dimensional Nuance: It demonstrates that the proportional regime ($p/n \to \kappa$) captures finite-sample effects (specifically the noise floor $\zeta$) that are invisible in the classical information limit ($n \gg p$). This explains why stronger triggers can paradoxically improve model robustness on clean data.
2. Defensive Implications: By identifying regimes where stronger attacks fail (i.e., when $\alpha > \alpha^*$), the analysis provides insights for defenders and auditors. It suggests that the relationship between trigger strength and attack efficacy is non-monotonic.
3. Theoretical Foundation: It establishes a tractable adversarial data model that exhibits qualitatively new behaviors not captured by classical asymptotics, bridging the gap between theoretical high-dimensional statistics and practical deep learning security.

The authors maintain modesty regarding the scope, noting that their analysis relies on Gaussian mixture models and linear/generalized linear classifiers. While experiments suggest the phenomena persist in deep networks, extending the theory to non-convex feature maps is identified as a direction for future work. The paper characterizes the attack mechanics but does not propose specific defense mechanisms, focusing instead on understanding the underlying failure modes of current training pipelines.