Lilith: Backdoor Generalization under Training-Inference Trigger Shift

2026-07-28

AI Summary

This work addresses a critical limitation in existing backdoor attacks, which typically assume identical triggers during training and inference and overlook whether a single training trigger can generalize to unseen trigger variants at test time. To bridge this gap, we propose Lilith, a black-box framework that employs a compact anchor trigger to induce model vulnerability and constructs a bounded trigger family that preserves the representation geometry shaped by the anchor during inference, thereby enabling cross-stage generalization. We formally define, for the first time, the problem of backdoor generalization under train–test trigger shift and introduce an “anchor-to-family” attack paradigm. Through theoretical analysis of anchor erasability and family reachability, we reveal that representation alignment is the key mechanism underlying successful family activation. Extensive experiments demonstrate that Lilith achieves high attack success rates across diverse datasets, architectures, poisoning ratios, and defenses, while maintaining low utility loss and minimal generalization gaps, thus offering both effectiveness and stealthiness.

Abstract

Machine-learning services increasingly rely on public data, third-party providers, and outsourced training, creating opportunities for data-poisoning attacks that implant persistent malicious behavior while preserving benign utility. However, existing backdoor studies largely evaluate exact trigger reuse, training-exposed trigger diversity, or variations along predefined transformation axes. They therefore leave a critical blind spot: whether a backdoor learned from one training-time trigger can generalize to an inference-time trigger family absent from victim training. We formulate this problem as backdoor generalization under training--inference trigger shift and introduce Lilith, a black-box anchor-to-family framework. Using only disjoint surrogate resources, Lilith first induces a compact target-side vulnerability with a single training anchor, then constructs a bounded inference-only family that preserves the anchor-induced representation geometry. We characterize this mechanism through anchor clearance and family reach, deriving sufficient conditions for family-wise target preservation under local regularity and bounded surrogate--victim discrepancy. Experiments across datasets, architectures, poisoning rates, and defenses show that Lilith achieves high family-wise attack success with limited utility degradation and a small trigger generalization gap. Additional analyses show that family activation depends on representation alignment rather than the proposal mechanism, exposing a broader threat overlooked by exact-trigger evaluation.

Problem

• backdoor generalization
• trigger shift
• training-inference discrepancy
• data poisoning
• adversarial machine learning

Innovation

• backdoor generalization
• trigger shift
• anchor-to-family
• representation geometry
• black-box attack