Space Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only Backdoors

Arnab Dey, Mohammad Mahfuzul Islam

Some backdoor attacks never touch an image. FLIP only changes labels: on CIFAR-10, flipping 3% of them makes a ResNet-32 send 99.7% of triggered source-class images to the attacker…