Backdoor Defenses Collapse When the Attacker Deliberately Lowers Attack Success Rate

arXiv 2608.27288·medium signalXBlueskyLinkedInCopy link

Existing backdoor attacks and defenses both assume a successful backdoor shows a high attack success rate, and this paper shows that assumption is a structural weakness rather than a fact. ASR is an attacker-controlled variable, and a reverse-training framework weakens the trigger-target association to produce low-ASR backdoor models that retain clean-input performance while keeping the backdoor behavior intact. Across multiple datasets, attack families and architectures, state-of-the-art defenses fail consistently under low-ASR conditions, exposing an attacker-defender asymmetry that anyone screening third-party model weights should account for.