Mask-Guided Hybrid Triggers for Robust Clean-Label Backdoor Attacks

1 Introduction

The remarkable success of deep neural networks (DNNs) relies heavily on large-scale, high-quality datasets. In practice, model developers often collect data from open-source platforms or third-party providers. However, this lack of transparency in the data collection stage exposes DNNs to severe security threats, including adversarial attacks [Madry et al., 2018; Goodfellow et al., 2015] and backdoor attacks [Li et al., 2024]. Backdoor attacks are especially dangerous because an attacker can inject a hidden trigger into only a small fraction of the training set, causing the trained model to behave normally on benign inputs while consistently misclassifying any input containing the trigger as the target class.

∗Corresponding author.

Early studies primarily focused on dirty-label backdoor attacks, where the attacker modifies both the image and its label. Although effective, dirty-label attacks are vulnerable to manual inspection [Turner et al., 2019] due to the label inconsistencies of poisoned samples. To overcome this limitation, recent research has focused on more stealthy and practical clean-label backdoor attacks. In a clean-label setting, the attacker injects triggers without altering the ground-truth labels. This means the victimmodel is required to learn the association between the trigger and the target class in the presence of strong target-class features, making trigger injection significantly more challenging.

Existing clean-label attacks mainly follow two strategies for trigger construction: sample-agnostic (static) triggers and sample-specific (dynamic) triggers. However, both approaches face intrinsic limitations under the strict cleanlabel constraint. Sample-agnostic triggers, typically implemented as fixed patches or global patterns [Saha et al., 2020; Souri et al., 2022; Zeng et al., 2023], provide a stable, consistent feature that is easy for the model to memorize, resulting in high attack success rates. While these trigger patterns are imperceptible during the training phase, they often become visually obvious in the test phase or require amplification to be more effective. In contrast, sample-specific triggers generate dynamic perturbations based on the input image, offering superior stealthiness in both the training and testing stages. However, establishing a strong backdoor correlation with dynamic triggers is difficult in clean-label settings. Since the target-class labels are correct, the model tends to learn the robust semantic features of the original object rather than the weak, dispersed dynamic noise. This is known as feature suppression [Zhu et al., 2025]. Therefore, injecting samplespecific backdoors in a clean-label setting is challenging.

This reveals a fundamental dilemma in clean-label backdoor learning: sample-agnostic triggers are easy to learn but easy to detect, while sample-specific triggers are stealthy but difficult to learn. Existing methods typically commit to one of these two extremes, lacking a mechanism to combine their complementary strengths. We argue that a robust clean-label attack should not rely solely on one type of pattern but exploit the strengths of both. We propose a novel perspective: utilizing the static pattern as a robust anchor to ensure injectability, while leveraging dynamic perturbations as camouflage to adapt to local image semantics.

Based on this insight, we introduce the Mask-Guided Hybrid Trigger (MGHT), which employs a learnable mask to adaptively partition the image into regions dominated by the sample-agnostic anchor and regions occupied by the samplespecific camouflage. This mask-guided fusion method allows the hybrid trigger to remain both learnable and robust across different images. However, preliminary experiments show that naively combining two triggers yields marginal gains over individual components and can even underperform single triggers on complex datasets. We attribute this degradation to unconstrained optimization, which causes the model to collapse onto a single trigger component. To address this, we design a Synergy-driven Co-optimization Strategy that comprehensively coordinates both trigger components via a margin-based constraint. We generate the sample-specific trigger based on the input that already contains the sampleagnostic trigger and introduce a Synergy Loss during the joint training process. This mechanism prevents the optimization from collapsing into trivial solutions, ensuring both components make complementary contributions to the backdoor injection. To the best of our knowledge, we are among the first to utilize a mask mechanism to combine these two types of triggers. Our code is available on GitHub 1 .

Our main contributions can be summarized as follows:

• We propose Mask-Guided Hybrid Trigger (MGHT), a novel clean-label backdoor attack framework that unifies sample-agnostic and sample-specific triggers through adaptive semantic masks. By dynamically balancing the spatial contribution of sample-agnostic and samplespecific patterns, MGHT effectively mitigates the tradeoff between effectiveness and perceptual stealthiness.
• We introduce a Synergy-driven Co-optimization Strategy to jointly optimize the semantic mask, samplespecific trigger, and sample-agnostic trigger. Specifically, the sample-specific trigger generation is directly conditioned on inputs embedded with the sampleagnostic trigger, and a Synergy Loss is employed to explicitly encourage complementary interactions between static and dynamic patterns.
• Extensive experimental results demonstrate that MGHT achieves competitive attack success rates compared to state-of-the-art clean-label backdoor attacks, while preserving high visual fidelity. Moreover, the proposed hybrid trigger exhibits enhanced robustness across diverse image contexts and against potential backdoor defense mechanisms.

2 RelatedWork

Backdoor Attack. BadNets [Gu et al., 2019] pioneered backdoor attacks by stamping patches and altering labels, and it is categorized as a dirty-label attack. To enhance stealthiness, Turner et al. [2019] introduced the clean-label setting, injecting triggers without label modification. Subsequent works such as HTBA [Saha et al., 2020] and Sleeper Agent [Souri et al., 2022] improved clean-label attacks by optimizing static triggers through feature space minimization and gradient alignment, respectively. The aforementioned methods rely on a static trigger pattern during either the training or testing phase to activate the backdoor. To improve trigger adaptivity, ISSBA [Li et al., 2021b] introduced samplespecific triggers in dirty-label settings. Specifically, a trigger is sample-specific if the trigger pattern varies depending on the input sample. Recent research extends sample-specific triggers to clean-label attacks using two main strategies: image-attribute-based and DNN-based methods. DABA [Xu et al., 2023] constructs image-attribute-based sample-specific triggers by applying fixed augmentation strategies to different channels of the images, while COMBAT [Huynh et al., 2024] trains a generator network using bilevel optimization. Recently, BAAT [Zhu et al., 2025] approaches this problem from a novel perspective by utilizing abstract triggers, such as image styles, to achieve label consistency and adaptivity.

1 https://github.com/MApllle/MGHT

Backdoor Defense. Backdoor defense can be broadly categorized into model-level and data-level approaches. Modellevel defenses modify the victim model to eliminate backdoors. Fine-Pruning [Liu et al., 2018] mitigates threats via retraining or pruning-then-fine-tuning on benign data. Others [Yoshida and Fujino, 2020; Li et al., 2021a] employ knowledge distillation [Hinton et al., 2015] for model purification. Neural Cleanse (NC) [Wang et al., 2019] adopts a two-stage strategy: reverse-engineering potential triggers for anomaly detection and suppressing their activation. Datalevel defenses filter or repair suspicious samples. During training, methods like DeepSweep [Qiu et al., 2021] use augmentation to disrupt triggers. Inference-time defenses often assume sample-agnostic triggers. For instance, STRIP [Gao et al., 2019] detects poisoned samples by superimposing various image patterns onto the input, while SentiNet [Chou et al., 2020] and Februus [Doan et al., 2020] analyze GradCAM [Selvaraju et al., 2017] saliency maps to locate suspicious triggered regions. However, these methods rely heavily on the sample-agnostic trigger assumption. To counter sample-specific attacks, SCALE-UP [Guo et al., 2023] was proposed to detect triggers based on scaled prediction consistency. Since this approach does not rely on trigger pattern assumptions, it is effective against sample-specific triggers.

3 Methodology

3.1 Threat Model

Following prior work on clean-label backdoor attacks [Huynh et al., 2024], we define the threat model based on a scenario where the attacker acts as a third-party data provider with full access to the dataset. In this setting, the attacker releases the dataset through commercial transactions or open-source platforms. We assume a scenario where the attacker can poison the training dataset before release but cannot access the victim model parameters, gradients, or training process. The attacker can train a local surrogate on the released data to optimize the backdoor injection. Specifically, to adhere to the clean-label constraint, the attacker modifies only a subset of samples belonging to a predefined target class without altering their original labels. The victim subsequently downloads this poisoned dataset to train an image classifier. The attacker's objective is to implant a backdoor such that the infected model behaves normally on benign inputs but misclassifies any input containing the specific trigger as the target label. During the inference phase, the attacker can exploit the trigger injection function to generate triggered samples from any class, thereby manipulating the model's predictions or verifying the dataset's usage.

3.2 Problem Statement

We focus on backdoor attacks against image classification neural networks under the clean-label setting.

Let fθ : X → [0, 1]K denote the classifier, where θ represents the model parameters, X ⊆ Rd is the input data space, and Y = {1, 2, . . . ,K} is the label space.

Given a benign training dataset D = {(xi, yi)}Ni=1 , the attacker first selects a target label yt ∈ Y and samples a subset Ds ⊂ D to be poisoned. The poisoning rate is defined as r = |Ds|/|D|. Specifically, we strictly adhere to the clean-label constraint, ensuring that the ground-truth labels of the poisoned samples belong to the target class, i.e., ∀(xk, yk) ∈ Ds, yk = yt.

Let G(·) denote the trigger injection function. Existing works generally fall into two categories regarding G(·). Some separate the process into two stages, while others employ a unified generator G(·) for both training and testing. We adopt the latter unified framework, where G(·) = G(·).

Following the definition in [Li et al., 2021b], we categorize the trigger generator G(·) based on its dependency on the input:

• Sample-Specific Trigger: A generator G(·) is samplespecific if and only if for distinct inputs xi, xj ∈ X (xi ̸= xj), the extracted triggers satisfy T(G(xi)) ̸=

T(G(xj)), where T(·) extracts the trigger pattern from the poisoned image.

• Sample-Agnostic Trigger: Conversely, G(·) is sampleagnostic if the trigger remains consistent regardless of the input, i.e., T(G(xi)) = T(G(xj)) for any xi, xj.

The victim model fθ′ is trained on the poisoned dataset Dp = Dr ∪ D′s , where D′s = {(G(x), y)|(x, y) ∈ Ds} and Dr = D\Ds. The parameters θ′ are optimized by minimizing the loss function L:

The attacker's goal is to ensure the model behaves normally on benign samples but misclassifies triggered samples as the target label yt:

While conventional views often treat sample-agnostic and sample-specific triggers as mutually exclusive, we posit that a robust clean-label attack can benefit from blending both characteristics. To bridge this gap, we formulate the trigger injection function G(·) as a hybrid generator.

Specifically, we define the hybrid trigger as a fusion of a sample-agnostic pattern and a sample-specific perturbation. Denoting the static pattern as δ and the parameterized generator for the sample-specific perturbation as gϕ(·), the final poisoned sample x′ is generated through a fusion function H:

where H(·) represents the fusion strategy that combines the sample-agnostic and sample-specific components. This formulation allows us to flexibly integrate the stability of sample-agnostic triggers with the diversity of sample-specific perturbations.

3.3 Our Approach

This section details the proposed Mask-Guided Hybrid Trigger (MGHT). As illustrated in Figure 1, we first propose a mask-guided fusion module that spatially integrates static and dynamic patterns using an adaptive semantic mask. Second, we introduce a Synergy-driven Co-optimization Strategy to jointly train these components in an alternating manner, yielding a hybrid trigger that achieves both high effectiveness and robustness.

Mask-Guided Hybrid Trigger Generation

The effectiveness of a hybrid trigger largely depends on the composition function H. A naive approach to fusing a sample-agnostic trigger δ and a sample-specific trigger gϕ(x) is via affine combination:

However, this scalar-based mixing applies a uniform weight α across all spatial locations and images, ignoring the local semantic context. To overcome this limitation, we propose using a spatially adaptive mask to guide the fusion.

We introduce an adaptive mask generator mψ(·) that produces a soft mask M ∈ [0, 1]H×W×1 , which is broadcast along the channel dimension. We employ a U-Net [Ronneberger et al., 2015] architecture for mψ(x) and modify the final layer with a sigmoid activation to ensure that the output values lie within [0, 1]. Our proposed mask-guided hybrid trigger generator can be formulated as:

where ⊙ denotes element-wise multiplication, Ω = {δ, ϕ, ψ} denotes the hybrid trigger parameters, and xagn represents the context-aware input (defined in Eq. 9). Regions where M≈ 0 are allocated for the static trigger, preserving robustness, while regions where M ≈ 1 are reserved for the samplespecific trigger to enhance stealthiness. This spatial allocation reduces interference and guides the dynamic branch using the anchor-occupied regions as context.

For the sample-agnostic trigger δ, we define it as a globally shared, learnable parameter with the same dimensions as the input. It provides a stable anchor feature that facilitates the victim model's memorization of the backdoor pattern.

For the sample-specific trigger generator gϕ(·), instead of generating the perturbation in isolation, we employ a contextaware strategy. First, we construct a sample-agnostic triggered input xagn by applying the static trigger to the benign image via the complementary mask:

Then, the sample-specific generator gϕ takes this context as input:

By conditioning on xagn , the generator considers the regions already occupied by the static trigger. This enables it to synthesize perturbations that transition smoothly from the static pattern and fill the masked regions in a manner that is semantically consistent with both the original image content and the static anchor.

Generator Optimization

We jointly optimize the trigger parameters Ω = {δ, ϕ, ψ} of the hybrid trigger generator GΩ(x). This end-to-end optimization paradigm promotes stronger synergy between the two trigger types.

Formally, given an input sample xi and a learnable sampleagnostic trigger, the generation of the final poisoned sample x′i proceeds in four sequential steps. We define the intermediate variables and the final output as follows:

where Mi denotes the adaptive mask, xagn i represents the anchor-embedded intermediate state used to condition the generator, δspec i is the generated sample-specific perturbation, and x′i is the final hybrid-triggered sample.

Since the victim's specific training details are unknown during the dataset poisoning phase, we introduce a surrogate model sξ to approximate the victim's behavior. The attack objective is to minimize the classification loss of the generated poisoned samples toward the target label yt:

To enforce complementarity, we require the hybrid sample x′i to induce a lower target-class loss than two singlecomponent counterparts: the static-anchor-only sample xagn i and the sample-specific-only sample xspec i . We utilize the predefined xagn i (Eq. 9) and construct xspec i = xi +Mi ⊙ δspec i . The Synergy Loss is formulated as:

Specifically, µsyn is a predefined margin, and the ReLU function [Nair and Hinton, 2010] prevents optimization instability by zeroing the loss once the synergy constraint is satisfied.

To ensure perceptual similarity, we constrain the distortion using LPIPS [Zhang et al., 2018], GMSD [Xue et al., 2014], and PSNR [Hore and Ziou, 2010], with distinct thresholds µ1, µ2, µ3:

Beyond perceptual constraints, we further constrain the perturbation magnitude. For the sample-agnostic trigger, we project δ onto the L∞-ball of radius ϵ. For the samplespecific trigger, we apply a scaling operation to the output of gϕ(·) to ensure the sample-specific perturbations remain within [-ϵ, ϵ]. Additionally, we introduce an L2 regularization term to bound the energy of the dynamic trigger:

Following [Huynh et al., 2024], we incorporate a clean consistency loss using a frozen clean model sclean ξ pre-trained on benign data. This term encourages triggered samples to preserve their original predictions under the clean model, preventing the generated trigger from degenerating into ordinary adversarial perturbations:

The training of the hybrid trigger is formulated as a bilevel optimization problem. We aim to find the optimal trigger parameters Ω that minimize the combined trigger objective in Eq. 17, while the surrogate model sξ is trained to minimize the classification loss Lcls on the poisoned dataset:

where λsyn, λc, λl2 are weighting hyperparameters.

To solve Eq. 17, we adopt an alternated training strategy [Huynh et al., 2024] as an approximation. First, we pretrain the clean surrogate model sclean ξ on the benign dataset D. Then, in each iteration, we alternately fix Ω to update ξ, and fix ξ to update Ω.

4 Experiments

4.1 Experimental Setup

Datasets and Models. We evaluate our method on three image classification datasets: CIFAR-10 [Krizhevsky and Hinton, 2009], ImageNet-10, and CelebA [Liu et al., 2015]. For ImageNet-10, we use a fixed subset consisting of 10 randomly selected classes from ImageNet-1K 2 [Deng et al., 2009]. For CelebA, following the setting in [Salem et al., 2022], we consider three attributes (Heavy Makeup, Mouth Slightly Open, and Smiling) to construct an 8-class classification task. We use ResNet18 [He et al., 2016] as the default surrogate model for generating MGHT triggers. Both the mask generator and the sample-specific trigger generator employ a U-Net [Ronneberger et al., 2015] backbone.

Victim Model Training. Victim models are trained for 200 epochs via SGD with momentum 0.9 and weight decay 5 × 10-4 . The dataset-wide poisoning rates are set to 4% for CIFAR-10 and ImageNet-10, and 1.25% for CelebA (approx. 40% and 10% of target-class samples, respectively). The target classes are set to Class 2 for CIFAR-10 and Class 1 for ImageNet-10 and CelebA.

MGHT Optimization. We employ alternating training for 150 epochs using the Adam optimizer [Kingma and Ba, 2015] for generators and the SGD optimizer for the surrogate model. The learning rates for the generators match those of the victim models on their respective datasets. The learning rate for the sample-agnostic trigger is set to 0.025 for CIFAR-10 and CelebA, and 0.005 for ImageNet-10. Key hyperparameters are λsyn = 0.5, λc = 0.8, λl2 = 0.02, with the Synergy Loss margin µsyn = 0.5, perceptual thresholds µ1 = 0.05, µ2 = 0.03, µ3 = 30.0, and a perturbation budget of ϵ = 16/255.

2 WordNet IDs: n01440764, n02107312, n02346627, n02979186, n03394916, n03417042, n03425413, n03445777, n03888257, n07753592.

EvaluationMetrics. We employ two standard metrics: benign accuracy (BA) and attack success rate (ASR). BA measures the classification accuracy of the backdoored model on the clean test set. ASR measures the proportion of non-target samples in the triggered test set that are successfully misclassified as the target label yt.

4.2 Effectiveness Analysis

White-box Settings

We first evaluate the attack performance under a standard backdoor attack scenario where the attacker possesses sufficient prior knowledge to align the surrogate model's architecture with the victim model. In this setting, we compare our method against two categories of clean-label attacks: (1) Sample-agnostic methods, including LC [Turner et al., 2019], Sleeper Agent [Souri et al., 2022], and Narcissus [Zeng et al., 2023]; and (2) Sample-specific methods, including DABA [Xu et al., 2023], COMBAT [Huynh et al., 2024], and BAAT [Zhu et al., 2025]. We also include a naive hybrid baseline, Affine, which independently trains a sample-agnostic trigger and a sample-specific generator and combines them using Eq. 4 with α = 0.5. This baseline helps verify whether the performance gain of MGHT comes from the proposed mask-guided hybrid design rather than merely from using two trigger sources. For a fair comparison, we standardize the settings for certain baselines: for BAAT, we consistently utilize the style-transfer trigger mode across all datasets; for Narcissus, we remove the trigger amplification during the validation phase.

As shown in Table 1, MGHT demonstrates competitive performance across all benchmarks. It obtains the best ASR on CIFAR-10 (99.69%) and near-saturated ASR on CelebA (99.97%), while maintaining benign accuracy comparable to the clean models. On ImageNet-10, although BAAT achieves the highest ASR, MGHT preserves a higher BA. Compared with the naive Affine baseline, MGHT consistently improves ASR across all datasets, including a 25.80% relative gain on ImageNet-10, showing that the improvement mainly comes from mask-guided allocation rather than simply combining two trigger sources.

Black-box Settings

While the preceding analysis confirms the effectiveness of MGHT under the assumption of architectural alignment, we further evaluate MGHT's robustness in a black-box setting where the victim architecture is unknown. We conduct this black-box evaluation on the CIFAR-10 dataset. Specifically, we generate poisoned datasets using three surrogate models (ResNet18, MobileNetV2 [Sandler et al., 2018], and VGG13 [Simonyan and Zisserman, 2015]) and four distinct target models, including ViT [Dosovitskiy et al., 2021].

As summarized in Table 2, MGHT demonstrates remarkable transferability across all surrogate-target pairs. ASR values consistently exceed 97% across CNN architectures and reach up to 99.86% on ViT. This indicates that MGHT creates semantically strong patterns rather than overfitting to local convolutional artifacts. The strong transferability mainly stems from the hybrid design: the static anchor provides an architecture-invariant signal, while the dynamic branch improves semantic adaptation. This reduces overfitting to the surrogate architecture and enables MGHT to remain effective across unseen targets.

4.3 Stealthiness Analysis

We employ four standard metrics to measure the visual quality of the poisoned samples: PSNR [Hore and Ziou, 2010], LPIPS [Zhang et al., 2018], GMSD [Xue et al., 2014], and SSIM [Wang et al., 2004].

As reported in Table 3, MGHT achieves excellent visual quality across all three datasets: PSNR values consistently exceed 30 dB, and SSIM scores remain high, while LPIPS and GMSD remain low. Since LPIPS aligns closely with human perception, these results quantitatively demonstrate that our hybrid triggers are highly imperceptible. This superior performance stems from our optimization strategy, which incorporates strict perceptual constraints (Linv) and enforces a predefined L∞ budget.

4.4 Robustness to Backdoor Defenses

Robustness Against STRIP. STRIP [Gao et al., 2019] detects triggers by superimposing patterns on inputs and monitoring prediction entropy. Figure 2 shows that the entropy distribution of MGHT-poisoned images substantially overlaps with that of clean images. Due to the sample-specific nature of the hybrid trigger, superimposing other image patterns disrupts its features and makes the entropy profile closer to that of clean inputs, allowing MGHT to bypass this defense.

Robustness Against SCALE-UP. SCALE-UP [Guo et al., 2023] detects poisoned samples based on scaled prediction consistency. As shown in Table 4, MGHT is difficult to detect across all datasets: SCALE-UP even performs worse than random guessing on ImageNet-10, and its low F1 scores on CIFAR-10 and CelebA indicate unreliable detection. These results suggest that MGHT does not exhibit a distinctive scaling-consistency pattern.

Robustness Against Grad-CAM. Grad-CAM [Selvaraju et al., 2017] visualizes regions critical to model predictions. As shown in Figure 3, MGHT heatmaps remain aligned with the main objects rather than shifting to localized trigger regions, weakening the localized-pattern assumption used by saliency-based defenses [Chou et al., 2020].

Robustness Against Neural Cleanse. Neural Cleanse (NC) [Wang et al., 2019] reverse-engineers triggers and detects abnormal target classes using an anomaly index. Table 5

shows that MGHT stays below the detection threshold of 2.0, suggesting that its spatially adaptive hybrid trigger is difficult to recover as a single consistent trigger.

Robustness Against Fine-Pruning. Fine-Pruning [Liu et al., 2018] removes backdoors by pruning neurons that are inactive on benign data. Figure 2 illustrates that the ASR and BA decline simultaneously on all datasets, indicating the absence of an optimal pruning threshold. This suggests that neurons activated by MGHT are coupled with those for normal classification, preventing backdoor removal without compromising model utility.

5 Ablation Study

Impact of Synergy Loss. We further investigate the impact of the proposed Synergy Loss (Lsyn). As shown in Table 6, removing this term leads to a notable ASR degradation, particularly on ImageNet-10 (dropping from 87.78% to 76.89%). This indicates that without explicit regularization, the optimization process tends to collapse onto a single component. The Synergy Loss mitigates this issue by enforcing complementary interaction between the two trigger components.

Impact of Synergy Loss Weight and Margin. Table 7 presents a sensitivity analysis of the Synergy Loss hyperparameters. On CIFAR-10 and CelebA, MGHT remains stable across different settings. On the more challenging ImageNet10 dataset, the hyperparameters have a moderate influence on ASR, but the performance remains robust across all tested configurations. This suggests that MGHT is not overly sensitive to the tested Synergy Loss settings, although tuning can further improve attack effectiveness on complex datasets.

6 Conclusion

In this paper, we propose Mask-Guided Hybrid Trigger (MGHT), a novel framework that integrates static anchors and dynamic camouflage via an adaptive semantic mask. Furthermore, we introduce a Synergy-driven Co-optimization Strategy to prevent optimization collapse and enforce complementary learning between the two trigger components. Experiments across three benchmark datasets demonstrate that MGHT achieves competitive attack success rates and exhibits strong robustness against various defenses. These findings highlight the limitations of existing defenses that rely on single-mode trigger assumptions and motivate the development of dynamic-aware inspection mechanisms.

Ethical Statement

This work studies clean-label backdoor attacks to expose potential risks in third-party training data and to support the development of more reliable defenses. We do not advocate malicious use of the proposed method. The released code and any poisoned-data generation scripts are intended only for controlled research evaluation, and we encourage researchers to use the results to improve dataset inspection, backdoor detection, and model robustness.

Acknowledgments

This work was supported by the National Natural Science Foundation of China under Grant Nos. 62272290 and 62572114.