Checkerboard: Closed-Form and Data-Independent Trigger Design for Clean-Label Backdoor Attacks

Abstract

Backdoor attacks threaten the deep-learning supply chain by poisoning a small fraction of the training data so that a model behaves normally on clean inputs but maps triggered inputs to an attacker-chosen class. Clean-label backdoor attacks are especially difficult to audit because poisoned examples preserve their semantic labels. Yet existing clean-label attacks often require surrogate model training, auxiliary data access, or iterative optimization. In this paper, we present \emph{Checkerboard}, a clean-label backdoor attack with closed-form, data-independent trigger design. We formulate trigger design through an input-space Fisher-separability objective and, under a ridge four-neighbor local-smoothness prior for natural images, obtain the pixel-wise checkerboard as a closed-form maximizer of the resulting design proxy without data access, model training, or optimization. Across four benchmark datasets, Checkerboard outperforms the evaluated norm-bounded clean-label attacks and achieves state-of-the-art performance under low global poisoning rates. For example, on CIFAR-10, under a trigger perturbation of $10/255$, poisoning 20 training samples achieves $95.72\%$ Attack Success Rate (ASR). On IN-100, a global poisoning rate of only $0.4\%$ yields over $83\%$ ASR without degrading clean accuracy. The proposed attack also remains effective against state-of-the-art backdoor defenses and shows resistance to adaptive defenses under simple modification.