Benign on Label, Malicious by Design: Clean-Label Dormant-to-Activated Backdoor via Machine Unlearning with Removable Camouflage Dongdong Zhao1 , Can Li1 , Xiang Yao1 , Fan He1 , Qihang Ge1 , and Baogang Song1,* 1
Wuhan University of Technology
Email: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
arXiv:2607.27936v1 [cs.CR] 30 Jul 2026
Abstract Existing backdoor attacks often become effective immediately after backdoor implantation and may therefore be exposed before exploitation. Machine unlearning activated dormant backdoors mitigate such behavioral exposure by remaining inactive after training and becoming effective only after selected training records are unlearned. However, existing methods struggle to simultaneously achieve a low pre-unlearning attack success rate and strong post-unlearning activation under clean-label constraints and realistic unlearning requests. Achieving this transition requires jointly establishing a persistent latent association and a removable suppressive influence. To address this challenge, we propose a clean-label unlearning-activated backdoor framework based on dual-generator learning and formulate it as a bilevel optimization problem: By simulating latent backdoor establishment and machine unlearning, the framework alternately learns sample-specific triggers that establish a latent trigger-to-target association and label-consistent camouflage samples that provide removable suppression. Once a small subset of camouflage samples is unlearned, the suppression is lifted and the dormant backdoor is activated. Experiments on CIFAR-10 and ImageNet-10 show that our method maintains lower pre-unlearning attack success rates while achieving stronger post-unlearning activation across multiple unlearning algorithms than representative backdoor baselines. These results demonstrate that reliable dormancy-to-activation transitions can be achieved by coordinating a persistent latent association with removable suppression under clean-label and realistic deletion constraints.
Introduction Backdoor attacks threaten DNNs deployed in safety-sensitive applications by preserving benign performance while inducing attacker-specified predictions on triggered inputs. Existing studies improve stealthiness through invisible, warpingbased, input-adaptive, and clean-label designs (Li et al. 2021; Nguyen and Tran 2021, 2020; Nguyen et al. 2025), mainly reducing visual or label-level anomalies in poisoned samples. However, these improvements usually do not change a critical fact: the learned backdoor often becomes active immediately after training. Thus, malicious trigger-to-target behavior may be exposed by post-training inspection or backdoor defenses before the attacker exploits it, as shown in Fig. 1 (Wang et al. 2019; Gao et al. 2019). This reveals a behavioral exposure risk that cannot be fully addressed by merely making poisoned samples less perceptible.
Clean Samples
Attacker
Poisoned Samples
...
Backdoor Injection
...
Clean input
Bird
Triggered input
Dog
Inspection / Defense / Unlearning
Backdoor Removed
(a) Traditional Backdoor Attack Clean Samples
...
Poisoned Samples
...
Attacker Camouflage Samples
Inspection / Defense
Dormant Formation
...
Unlearning Request Backdoor Activated
Dormant Backdoor
Before Unlearning (Dormant)
After Unlearning (Activated)
Clean input
Bird
Clean input
Triggered input
Cat
Triggered input
Dog
Camouflage input
Truck
Camouflage input
Truck
Bird
(b) Unlearning-Activated Backdoor Attack
Figure 1: Research motivation. To reduce such post-training exposure, recent studies have explored dormant or delayed-activation backdoors that remain inactive after training and are activated only by a specific subsequent event. Machine unlearning provides a natural post-training activation mechanism by removing the influence of specified training samples in response to deletion requests, thereby inducing model-state changes that attackers can exploit to activate a dormant backdoor. Existing studies have demonstrated the feasibility of unlearning-activated backdoors, but important limitations remain in realistic datasubmission and deletion-request scenarios. Some rely on dirty-label poisoning, violating label consistency (Zhang et al. 2023; Alam, Lamri, and Maniatakos 2025). Some construct influence-driven suppression for a given off-the-shelf backdoor construction, rather than jointly constructing a latent association and its suppression mechanism under cleanlabel constraints (Huang, Mao, and Zhong 2024). Moreover, the limited work under clean-label constraints activates the backdoor by unlearning samples outside the attackersubmitted training records (Arazzi, Nocera, and Vinod P 2025). This deviates from practical machine-unlearning semantics, where a valid request should be record-matched and restricted to data submitted by the requester for target-model training. Therefore, although existing unlearning-activated backdoors mitigate the immediate post-training exposure of backdoor behavior, they do not fully satisfy the dual considerations of clean-label data submission and realistic user deletion requests.
Motivated by these limitations, we study a stricter cleanlabel data-removal workflow in which all attacker-crafted samples retain their original labels and the forget set is restricted to attacker-submitted samples that actually participated in training. This workflow jointly enforces label consistency at data submission and sample provenance at deletion, better reflecting realistic machine-unlearning services. Under this workflow, the core challenge is to simultaneously achieve label consistency, pre-unlearning dormancy, and post-unlearning activation. Specifically, the trigger-target association must be implanted implicitly under original-label supervision, remain unexposed after training, and emerge only after a subset of attacker-submitted samples is forgotten. To satisfy these requirements, the attack framework needs to coordinate two types of training signals: one that establishes a latent trigger-target association that persists through unlearning, and another that suppresses this association before unlearning through attacker-submitted samples that can later be deleted. Coordinating these two effects under cleanlabel constraints is the key challenge for realizing cleanlabel unlearning-activated backdoors across pre- and postunlearning model states. To address this challenge, we propose a dual-generator framework that separately models latent backdoor implantation and camouflage suppression and coordinates them through bilevel optimization. This separation is necessary because establishing a persistent trigger-target association and suppressing its observable behavior impose competing objectives that may interfere when optimized through a single generator. Accordingly, the trigger generator produces sample-specific triggers that establish a latent association under original-label supervision and preserve it through unlearning, while the camouflage generator produces label-consistent samples that impose removable suppression on the trigger-induced target tendency during training. Since unlearning-activated backdoors depend on both the latent state after training and the activated state after machine unlearning, we use a bilevel formulation to characterize the coupling between generator optimization and the training–unlearning process. After generator optimization, both trigger-bearing samples and camouflage samples are incorporated into target-model training with their original labels. When the attacker subsequently requests unlearning of a small subset of camouflage samples, the removable suppression is lifted, allowing the retained latent trigger-target association to emerge as an activated backdoor. Our main contributions are summarized as follows: • We systematically study unlearning-activated backdoor attacks under a clean-label data-removal workflow, extending dormant backdoors to a more practical scenario that simultaneously enforces label consistency and realistic user-deletion constraints. • We design a bilevel optimization-based dual-generator framework that jointly optimizes latent trigger persistence and removable camouflage suppression by simulating dormant backdoor formation and unlearning-induced activation. • We design removable camouflage objectives that com-
bine gradient opposition and target-tendency suppression, enabling label-consistent suppression of trigger-induced behavior that can be lifted through unlearning. • We evaluate the effectiveness of our method on CIFAR10 and ImageNet-10. Results show that our method effectively realizes clean-label unlearning-activated backdoor attacks, achieving stealthier pre-unlearning dormancy and more effective post-unlearning activation than mainstream backdoor attacks.
Related Work Machine Unlearning Machine unlearning aims to remove the influence of requested training samples from a trained model, motivated by privacy regulations and data deletion demands (Otto 2018). Prior work has developed a range of unlearning methods, such as SISA (Bourtoule et al. 2021), First-Order unlearning (Warnecke et al. 2023), and PUMA unlearning (Wu, Hashemi, and Srinivasa 2022). These studies mainly focus on improving unlearning efficiency or preserving model utility. In contrast, we examine unlearning from an adversarial perspective, exploiting the induced model transition as an attacker-controlled mechanism to remove camouflage suppression and activate a dormant clean-label backdoor.
Backdoor Attacks Backdoor attacks poison model training to implant triggerspecific malicious behavior while preserving benign performance (Gu et al. 2019). Although subsequent invisible, adaptive, warping-based, and clean-label designs improve visual or label-level stealthiness, their backdoors are typically active immediately after training and may be exposed before exploitation. Dormant and delayed-activation attacks instead postpone malicious behavior until a subsequent model-state change, with prior studies showing that deletion-induced updates can activate hidden backdoors (Zhang et al. 2023; Liu et al. 2024). However, these approaches generally rely on dirty-label poisoning or label manipulation. More recent methods improve activation controllability under machine unlearning. UBA-Inf strengthens the pre-unlearning suppression of an off-the-shelf backdoor using influence functions (Huang, Mao, and Zhong 2024), but does not jointly construct the latent association and its suppression under clean-label constraints. UNCLEAN studies a clean unlearning attack by amplifying a weak malicious signal through forgetting the clean counterparts of poisoned samples (Arazzi, Nocera, and Vinod P 2025), while its forget set is not restricted to attacker-submitted training records. In contrast, we jointly optimize label-consistent trigger samples and removable camouflage samples under a clean-label data-removal workflow, enabling the camouflage samples to suppress the latent association before unlearning and release it after a valid attacker-controlled deletion request.
Problem Statement Problem Formulation. We formally define the Clean-Label Unlearning-Activated Backdoor Attack as follows. Let fθ
denote a classification model trained on D = {(xi , yi )}N i=1 , with xi ∈ X and yi ∈ Y. Here, X and Y denote the input and label spaces, respectively. The attacker aims to implant a clean-label latent backdoor that remains inactive after normal training and becomes activated once camouflage samples are unlearned. Specifically, the attacker first selects a target label yt ∈ Y and controls a limited subset Da ⊂ D of the training data. From Da , the attacker selects a backdoor source subset P ⊂ {(x, y) ∈ Da | y = yt } with poisoning rate ρp , and a camouflage source subset C ⊂ {(x, y) ∈ Da | y ̸= yt } with rate ρc . Based on the trigger generator Gϕ and the camouflage generator Mψ , the attacker constructs the backdoor sample set P ′ = {(Bϕ (x), y) | (x, y) ∈ P} and camouflage sample set C ′ = {(Cϕ,ψ (x), y) | (x, y) ∈ C}, respectively, where the detailed formulations of Bϕ (·) and Cϕ,ψ (·) are provided in the Method section. All crafted samples preserve their original labels. The crafted samples are submitted through the normal data collection pipeline and their incorporation results in the mixed training set D∗ = (D \ Da ) ∪ (Da \ (P ∪ C)) ∪ P ′ ∪ C ′ , which is subsequently used by the model owner for training. After training on D∗ , the parameters of the model are updated to θl , resulting in a latent backdoor model fθl that behaves normally on clean input and remains inactive on triggered inputs before unlearning: fθl (xi ) = yi ,
fθl (Bϕ (xi )) = yi
(1)
At the intended attack time, the attacker requests unlearning of U ⊆ C ′ . The model owner then invokes an unlearning algorithm to update the model parameters from θl to θu , obtaining the unlearned model fθu . After unlearning, the attack aims to activate the backdoor and induce the target behavior: fθu (xi ) = yi ,
fθu (Bϕ (xi )) = yt
(2)
Threat Model. We assume that the attacker participates in data collection and can contribute a limited number of crafted backdoor and camouflage samples to the model owner’s training set. During offline optimization, the attacker trains surrogate models to approximate the victim training and unlearning processes. The attacker can later access the unlearning interface of the data provided by the model service provider and request the removal of a small subset of training samples. However, the attacker cannot interfere with victim training, directly modify model parameters, or control final model deployment. All crafted samples retain their original labels, reflecting realistic settings where attackers have limited labelcontrol ability and mislabeled records are more readily detected during data inspection or deletion verification.
Method In this section, we first present the overall attack workflow and then elaborate on the optimization of the two generators.
Overview As illustrated in Fig. 2, our proposed unlearning-activated backdoor attack proceeds in three stages. 1. Dual-Generator Optimization. The attacker optimizes the trigger generator and the camouflage generator under
a bilevel formulation in an offline manner. The former learns a latent trigger association, while the latter learns a removable suppressive influence. 2. Latent Backdoor Establishment. After offline optimization, the generated backdoor and camouflage samples are injected into the training set, causing the victim model to learn a dormant backdoor whose malicious behavior remains suppressed after deployment. 3. Backdoor Activation. At the intended attack time, the attacker requests the unlearning of the camouflage samples, removing their suppressive influence and activating the latent backdoor. To realize the above three-stage workflow and the controlled dormant-to-activated transition, we next introduce the construction and optimization objectives of Gϕ and Mψ , followed by their bilevel optimization.
Trigger Generation and Optimization Backdoor Sample Construction. We formulate backdoor sample construction as a learnable injection process, where Gϕ produces a sample-specific perturbation Gϕ (x) for each input x. To reduce high-frequency artifacts and spatial discontinuities, we project the generated perturbation onto the low-frequency domain. We define the low-frequency projection operator as (Ahmed, Natarajan, and Rao 1974) Plf (z) = IDCT (Mlf ⊙ DCT(z))
(3)
where Mlf denotes the low-frequency mask and ⊙ denotes the Hadamard product. The filtered trigger perturbation is then obtained as δG (x) = Plf (Gϕ (x)). To ensure valid pixel values and further improve the spatial continuity and visual stealthiness of the trigger, we inject the low-frequency perturbation into the original image, followed by clipping and Gaussian smoothing (Huynh et al. 2024): Bϕ (x) = K (Clip (x + ηG · δG (x)))
(4)
where ηG controls the trigger strength, Clip(·) ensures valid pixel values, and K(·) denotes Gaussian smoothing. Trigger Generator Optimization. In the unlearningactivated backdoor attacks, the core challenge of trigger optimization lies in the fact that the trigger should exhibit different behaviors before and after unlearning. Unlike conventional backdoor attacks, which only require the trigger to be effective after model training, our trigger should remain dormant in the normally deployed model and become effective after camouflage samples are unlearned. Therefore, when optimizing the trigger generator, we explicitly consider both the latent model fθl and the unlearned model fθu . In the trigger generator optimization, we consider the following loss terms: • Latent loss. Before unlearning, the latent loss requires triggered samples to be classified into their ground-truth labels: LG latent = E(x,y)∈D L(fθl (Bϕ (x)), y)
(5)
This loss constrains the generated triggers to remain dormant in the latent model by preventing premature target behavior before unlearning.
Stage I · Alternating Optimization
Stage II · Backdoor Injection
Stage III · Backdoor Activation Arrow legend
𝓛𝒄𝒐𝒑𝒑 𝓛𝑪𝒗𝒊𝒔 𝓛𝒄𝒄𝒍𝒆𝒂𝒏 𝓛𝒄𝒎𝒂𝒓𝒈𝒊𝒏
workflow loss feedback alternating loop
④ Optimize 𝑴𝝍 Poisoned Reference Model 𝒇𝜽𝒑 Camouflage Generator 𝑴𝝍
Camouflage Samples 𝑪𝒓
① Generate
Trigger Generator 𝑮𝝓
... ② Injection
Clean Samples
...
Backdoor Samples 𝑷𝒓
...
③ Unlearning
Latent Model 𝒇𝜽𝒍𝒓 (Dormant Backdoor)
Unlearned Model 𝒇𝜽𝒖𝒓 (Activated Backdoor)
④ Optimize 𝑮𝝓 Clean Reference Model 𝒇𝜽𝒄
𝓛𝑮𝒄𝒍𝒆𝒂𝒏 𝓛𝑮𝒗𝒊𝒔
𝓛𝑮𝒍𝒂𝒕𝒆𝒏𝒕 𝓛𝑮𝒂𝒄𝒕
Repeat for each alternating round r = 1 , 2 , ... , R
Figure 2: Overview of the proposed framework. • Activation loss. For activation, we apply the trigger to samples in the dataset and require the unlearned model to classify the triggered samples into the target label yt : LG act = E(x,y)∈D L(fθu (Bϕ (x)), yt )
(6)
This objective makes the trigger effective after unlearning, enabling the attacker to achieve the intended attack. • Visibility loss. We constrain the perturbation magnitude to improve the visual stealthiness of the trigger: 2 LG vis = Ex∈D ∥Bϕ (x) − x∥2
(7)
• Non-adversarial loss. We require the clean model fθc to correctly classify the generated backdoor samples, preventing the trigger from degenerating into a standard adversarial perturbation: LG clean = E(x,y)∈D L(fθc (Bϕ (x)), y)
(8)
Combining the above objectives, the trigger generator is trained to solve the following optimization problem: ( G λl LG latent + λa Lact ∗ Gϕ = arg min (9) G Gϕ + λ v LG vis + λc Lclean s.t.
θl = arg min ED∗ L(fθ (x), y), θ
θu = Funlearn (θl , U) where λl , λa , λv , and λc are balancing coefficients, Funlearn denotes the machine unlearning algorithm, and U is the requested forget set.
Camouflage Generation and Optimization Camouflage Sample Construction. Given an input image x from the camouflage set, the current trigger generator Gϕ first produces a raw trigger perturbation, which is projected onto the low-frequency components using Eq. (3): δG (x) = Plf (Gϕ (x)). We then construct a trigger-conditioned intermediate sample as xd = Clip (x + ηG · δG (x))
(10)
Conditioned on xd , the camouflage generator Mψ produces a camouflage perturbation, whose low-frequency form is δC (xd ) = Plf (Mψ (xd )). The final camouflage sample is constructed as Cϕ,ψ (x) = K Clip xd + ηC · δC (xd ) (11) where ηC controls the camouflage perturbation strength. Camouflage Generator Optimization. In this framework, the key challenge of camouflage generator optimization is to make camouflage samples exert a removable suppressive influence. During training, camouflage samples retain their original labels while suppressing backdoor behavior, thereby keeping the implanted backdoor inactive before unlearning. Once these samples are unlearned, their suppressive influence is removed, allowing the latent association to emerge as an activated backdoor. We optimize the camouflage generator using the following loss terms: • Gradient-opposing loss. This loss requires the training gradient of camouflage samples to be anti-aligned with a trigger-induced target direction. For each camouflage source sample x ∈ C, we first construct its triggercontaminated intermediate sample xd . Rather than deriving this direction from the backdoor sample set P ′ , which may introduce class-semantic and visual-content mismatch with the current camouflage sample, we use xd to characterize the trigger-induced target tendency under the same source image: gbd = ∇θl L(fθl (xd ), yt )
(12)
For the corresponding camouflage sample Cϕ,ψ (x), we compute its training gradient: gc = ∇θl L(fθl (Cϕ,ψ (x)), y) We define their cosine similarity as ⟨gc , gbd ⟩ cossim (gc , gbd ) = ∥gc ∥2 ∥gbd ∥2 The gradient-opposing loss is then formulated as LC opp = 1 + cossim (gc , gbd )
(13)
(14)
(15)
Minimizing LC opp drives cossim (gc , gbd ) toward −1, causing camouflage gradients to oppose the trigger-induced target direction defined by xd . This creates a removable suppressive influence before unlearning; once the camouflage samples are unlearned, the gradient cancellation is removed and latent association is released. • Target-suppressive margin loss. Since camouflage samples are generated from trigger-conditioned inputs, they may retain residual target-class tendency under a model that has learned the trigger-target association. To provide a stable reference for suppressing this residual tendency, we offline construct a trigger-only reference model fθp before optimization. Specifically, we first train an initial trigger generator and use the resulting trigger-bearing cleanlabel samples, without introducing camouflage samples, to train fθp . We then fix fθp and use it only for the targetsuppressive margin constraint. Let zkp (·) denote the presoftmax logit of class k predicted by fθp and define st (x) = zypt (Cϕ,ψ (x)),
sy (x) = zyp (Cϕ,ψ (x)) (16)
The margin loss is defined as LC margin = E(x,y)∈C max(0, st (x) − sy (x) + γ) (17) where γ is the margin hyperparameter. Minimizing this loss enforces the original-class logit to exceed the targetclass logit by at least γ, thereby suppressing the targetclass tendency of camouflage samples. • Label-preserving loss. We require the latent model to classify camouflage samples as their original labels, preventing suppression through misclassification: LC clean = E(x,y)∈C L (fθl (Cϕ,ψ (x)), y)
(18)
• Visibility loss. We constrain camouflage perturbations with an ℓ1 penalty to improve visual stealthiness: d LC vis = Ex∈C ∥Mψ (x )∥1
(19)
Combining the above objectives, we formulate the camouflage generator optimization as follows: ( C λo LC opp + λm Lmargin ∗ Mψ = arg min (20) C Mψ + λcl LC clean + λr Lvis s.t.
θl = arg min ED∗ L(fθ (x), y) θ
where λo , λm , λcl , and λr are balancing coefficients.
Bilevel Optimization for Dual-Generator Learning In clean-label unlearning-activated backdoor attacks, trigger effectiveness depends on both the latent model after training and the post-unlearning model. Unlike conventional attacks optimized only for the trained model, the backdoor must remain dormant before unlearning and activate after camouflage samples are unlearned. We therefore simulate both latent-model training and subsequent unlearning during generator optimization. Accordingly, we formulate dualgenerator learning as a bilevel optimization problem. The
outer level optimizes the trigger generator Gϕ and camouflage generator Mψ , while the inner level constructs the current training set, trains a surrogate latent model, and performs unlearning. The resulting latent and post-unlearning models provide feedback for updating both generators. It is worth noting that, in real-world attack settings, attackers cannot access the deployed victim model or its training process. We therefore adopt a surrogate training strategy that uses a locally constructed shadow model closely approximating the victim architecture and attacker-accessible auxiliary data to simulate the training and unlearning processes. The complete dual-generator optimization algorithm is provided in Appendix A, Sec. D.
Experiments Experimental Settings Datasets and Models. Following prior backdoor studies, we evaluate our method on two benchmark image classification datasets, CIFAR-10 (Krizhevsky and Hinton 2009) and ImageNet-10 that is constructed by randomly selecting 10 classes from the standard ImageNet dataset (Deng et al. 2009). For the default evaluation, we use Pre-activation ResNet-18 (He et al. 2016b) on CIFAR-10 and ResNet18 (He et al. 2016a) on ImageNet-10. We further evaluate cross-architecture transfer with VGG-16 (Simonyan and Zisserman 2015) and MobileNetV2 (Sandler et al. 2018). Both the trigger generator Gϕ and camouflage generator Mψ use a U-Net (Ronneberger, Fischer, and Brox 2015) backbone throughout all experiments. Parameter and Attack Settings. Victim classifiers are trained for 250 epochs using SGD with momentum 0.9 and weight decay 5 × 10−4 . For CIFAR-10 and ImageNet-10, the batch sizes are 128 and 32, and the initial learning rates are 0.01 and 0.001, respectively. Class 0 is used as the target label. Before alternating optimization, an initial trigger generator is trained to construct the trigger-only reference model fθp and initialize Gϕ . Both Gϕ and Mψ are then optimized with an initial learning rate of 0.01. We set the poisoning and camouflage sample rates to ρp = 1% and ρc = 3%, with perturbation strengths ηG = ηC = 0.15. The loss coefficients are λl = 1, λa = 2, λv = 0.02, and λc = 0.8 for Gϕ , and λo = 2.5, λm = 0.5, λcl = 1.0, and λr = 0.05 for Mψ . The margin hyperparameter is set to γ = 5. The unlearning set U ⊂ C ′ contains 250 samples for CIFAR-10 and 150 for ImageNet-10. We use τ = 0.025 for First-Order and PUMA and two shards for SISA. Unless otherwise specified, experiments are conducted on CIFAR-10 using First-Order unlearning for evaluation and all reported results are averaged over three independent runs with different random seeds. To further assess the visual consistency of the crafted samples, we provide visual examples in Appendix A, Sec. F. Unlearning Algorithms. To account for practical unlearning scenarios, we evaluate our attack under three representative unlearning algorithms that cover different design principles: SISA, First-Order, and PUMA, with further details provided in Appendix A, Sec. B. Evaluation Metrics. To evaluate attack performance, we report four metrics: Attack Success Rate (ASR), ASR after
CIFAR-10 Attack Method
Ours UBA-Inf UNCLEAN-Origin UNCLEAN-Align Sleeper Agent Ours UBA-Inf UNCLEAN-Origin UNCLEAN-Align Sleeper Agent Ours UBA-Inf UNCLEAN-Origin UNCLEAN-Align Sleeper Agent
Unlearning Algorithm
Before Unlearn
ImageNet-10
After Unlearn
Before Unlearn
After Unlearn
ASR
BA
ASR-U(∆)
BA-U ASR
BA
ASR-U(∆)
BA-U
SISA
8.91 14.69 14.28 15.78 37.63
91.39 92.24 90.01 88.57 92.65
89.01(+80.10) 89.32(+74.63) 83.49(+69.21) 76.73(+60.95) 99.40(+61.77)
90.82 91.04 89.84 88.69 91.47
10.67 17.22 30.25 31.17 36.23
80.34 81.50 78.42 78.83 81.07
80.30(+69.63) 84.81(+67.59) 65.67(+35.42) 66.92(+35.75) 85.83(+49.60)
80.08 79.08 76.92 77.75 80.21
PUMA
13.74 17.36 22.84 21.28 42.81
93.38 90.39 87.95 88.84 93.96
86.99(+73.25) 84.16(+66.80) 47.43(+24.59) 52.29(+31.01) 67.63(+24.82)
80.77 82.94 81.59 79.39 80.15
13.80 26.57 24.83 23.75 40.17
83.58 80.67 85.50 84.83 82.96
80.74(+66.94) 84.53(+57.96) 66.17(+41.34) 62.00(+38.25) 75.83(+35.66)
70.08 66.17 68.75 70.75 72.87
First-Order
12.67 17.36 22.84 21.28 42.81
93.35 90.39 87.95 88.84 93.96
87.87(+75.20) 54.09(+36.73) 41.65(+18.81) 39.45(+18.17) 62.46(+19.65)
83.24 84.59 70.66 72.18 81.54
14.35 26.57 24.83 23.75 40.17
83.21 80.67 85.50 84.83 82.96
82.13(+67.78) 52.04(+25.47) 50.25(+25.42) 55.42(+31.67) 72.50(+32.33)
76.50 73.58 71.92 73.08 75.33
Table 1: Main results and comparison with existing attacks across unlearning algorithms on CIFAR-10 and ImageNet-10. Unlearning (ASR-U), Benign Accuracy (BA), and Benign Accuracy after Unlearning (BA-U). ASR and ASR-U measure the proportion of non-target triggered inputs classified as the target class before and after unlearning respectively. BA and BA-U measure the clean classification accuracy before and after unlearning. An effective unlearning-activated backdoor should maintain low ASR before unlearning, high ASR-U after unlearning, and acceptable BA-U.
|P| : |C|
ASR
ASR-U
BA
BA-U
1:0.5 1:1 1:2 1:3
35.08 30.77 21.84 12.67
79.64 83.07 85.62 87.87
93.44 93.16 93.28 93.35
86.23 84.66 83.91 83.24
Table 2: Effect of backdoor-to-camouflage sample allocation on CIFAR-10.
Main Results and Comparisons Table 1 reports the results on CIFAR-10 and ImageNet-10 under different machine unlearning algorithms. Our method consistently exhibits the intended dormant-to-activated behavior, maintaining low ASR before unlearning and substantially increasing ASR-U after the requested camouflage samples are unlearned. Although BA-U decreases in some settings, the controlled experiments in Appendix A, Sec. E show that comparable degradation also occurs under equalbudget clean-sample removal, indicating that the observed activation is not merely caused by general model degradation. We further compare our method with UBA-Inf (Huang, Mao, and Zhong 2024), UNCLEAN (Arazzi, Nocera, and Vinod P 2025), and Sleeper Agent (Souri et al. 2022). Specifically, UNCLEAN-Origin follows its original clean-counterpart forgetting setting, while UNCLEAN-Align uses the same forgetting budget on samples that actually participate in training. For Sleeper Agent, we construct naive removable camouflage samples by applying its trigger construction to selected samples and adding uniform random noise. As shown in Table 1, our method consistently achieves the lowest pre-unlearning ASR and the largest ∆ASR across datasets and unlearning algorithms. Although UBA-Inf and Sleeper Agent sometimes achieve higher absolute ASR-U, their higher pre-unlearning ASR indicates premature backdoor exposure. UNCLEAN generally produces a weaker ASR increase after unlearning.
These results demonstrate that the proposed removable camouflage design more effectively coordinates pre-unlearning dormancy and unlearning-triggered activation.
Robustness and Sensitivity Analysis We analyze the robustness of the proposed attack under different attack configurations and deployment conditions. Effect of poisoning and camouflage sample rates. We fix the backdoor sample rate at ρp = 1% and vary the ratio between backdoor and camouflage samples. As shown in Table 2, increasing camouflage proportion gradually lowers ASR before unlearning and raises ASR-U after unlearning. This suggests that more camouflage samples provide stronger removable suppression, while BA remains relatively stable and BA-U decreases moderately after unlearning. Transferability across Unlearning Algorithms. We further evaluate transferability across unlearning algorithms. As shown in Fig. 3, matched settings generally achieve the highest ASR-U, while most mismatched settings retain effective activation and consistently low pre-unlearning ASR. These results show that the learned suppression–release relation transfers across unlearning procedures, preserving dormancy before unlearning and activation afterward. Transferability across Model Architectures. We further examine whether the learned attack remains effective when
40 SA
81.45
SI
90
er
76.35
87.87
80.03
75.96
82.69
86.99
Fi M A
13.74
PU
70
M A
rd
PU
SI
M A
SA
er
60
Fi rs
Fi rs
t-O
SI
rd
SA
er
10
t-O
13.74
PU
M A
13.74
80
PU
Fi
77.93
rd
t-O
20
Surrogate
12.67
rs
89.01
t-O
12.67
rd
er
Surrogate
30 12.67
100
8.91
rs
8.91
SI
SA
8.91
Victim
Victim
(a)
(b)
(c)
(d)
Figure 3: ASR before unlearning (left) and ASR-U after unlearning (right) across surrogate and victim algorithms. 40
100 80.26
81.69
es N Pr eR -1 6
72.50
79.31
78.72
80
G
G
20
G
18.75
Surrogate
10.86
G
-1 6
13.61
90
V
es N Pr eR
30
V
Surrogate
87.87
8
14.42
et -1
16.61
et -1
8
12.67
70 78.69
2
13.08
76.98
80.14
et N
2 V et N
G
ile
G
Figure 5: Fine-pruning under First-Order unlearning: (a, c) latent models and (b, d) activated models.
M
ob
V
et -1 es N Pr eR
N ile ob
Victim
-1 6
8
ob
ile
60
et
V
2
-1 6 G G V
M
Pr eR
es N
et -1
M
8
ob
ile
10
M
N
et
V
18.96
V
2
20.54
Victim
Figure 4: ASR before unlearning (left) and ASR-U after unlearning (right) across surrogate and victim models. the surrogate and victim architectures differ. As shown in Fig. 4, the attack maintains low pre-unlearning ASR and high post-unlearning ASR-U under both matched and mismatched settings. This indicates that the learned latent association and removable suppression are not specific to a particular architecture, supporting transfer to unseen victim models.
Defense Evaluation We evaluate the proposed backdoor attack against finepruning (Liu, Dolan-Gavitt, and Garg 2018), a representative defense that prunes neurons with low activation on clean samples. Experiments are conducted on CIFAR-10 and ImageNet-10 under First-Order unlearning. We further evaluate STRIP (Gao et al. 2019) as a mainstream defense on both datasets, with detailed results provided in Appendix A, Sec. G. As shown in Fig. 5, for latent models before unlearning, ASR remains low as neurons are gradually pruned, while BA stays high until aggressive pruning is applied. For activated models after unlearning, ASR remains high across a wide range of pruning and drops clearly only when a large number of neurons are pruned. However, this reduction is accompanied by a substantial decrease in BA, indicating that fine-pruning cannot remove the activated backdoor without significantly damaging benign model performance.
Ablation Study To assess the contribution of each component, we conduct ablation studies on CIFAR-10. As shown in Table 3, removing the camouflage generator Mψ leads to a higher pre-unlearning ASR and a much smaller ∆, indicating that removable camouflage samples are critical for maintaining the dormant state. Removing the activation loss LG act results in a lower post-unlearning ASR-U, indicating that this objective is important for strengthening backdoor activation
Setting Full Method w/o Mψ w/o LG act C w/o LC opp & Lmargin
Before Unlearning
After Unlearning
ASR
BA
ASR-U (∆)
BA-U
12.67 61.74 23.48 25.48
93.35 93.20 93.30 93.26
87.87 (+75.20) 69.41 (+7.67) 73.76 (+50.28) 63.76 (+38.28)
83.24 92.50 86.98 84.34
Table 3: Ablation of key components on CIFAR-10. C after unlearning. Jointly removing LC opp and Lmargin increases the pre-unlearning ASR and decreases ASR-U, substantially weakening the intended dormant-to-activated transition. Overall, these results confirm that the coordinated design of trigger learning and removable camouflage suppression is essential for dormancy before unlearning and enabling activation after unlearning.
Conclusion In this paper, we propose a clean-label unlearning-activated backdoor framework that jointly learns persistent trigger associations and removable camouflage suppression through dual-generator bilevel optimization. Experiments on CIFAR10 and ImageNet-10 demonstrate consistent dormancy before unlearning and strong activation afterward across different unlearning algorithms. These results expose the security risk of adversarially crafted forgetting requests and motivate more robust unlearning defenses.
References Ahmed, N.; Natarajan, T.; and Rao, K. R. 1974. Discrete Cosine Transform. IEEE Transactions on Computers, C23(1): 90–93. Alam, M.; Lamri, H.; and Maniatakos, M. 2025. ReVeil: Unconstrained Concealed Backdoor Attack on Deep Neural Networks Using Machine Unlearning. In 2025 62nd ACM/IEEE Design Automation Conference (DAC), 1–7. IEEE.
Arazzi, M.; Nocera, A.; and Vinod P. 2025. When Forgetting Triggers Backdoors: A Clean Unlearning Attack. arXiv preprint arXiv:2506.12522. Bourtoule, L.; Chandrasekaran, V.; Choquette-Choo, C. A.; Jia, H.; Travers, A.; Zhang, B.; Lie, D.; and Papernot, N. 2021. Machine Unlearning. In 2021 IEEE Symposium on Security and Privacy, 141–159. IEEE. Deng, J.; Dong, W.; Socher, R.; Li, L.-J.; Li, K.; and FeiFei, L. 2009. ImageNet: A Large-Scale Hierarchical Image Database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, 248–255. IEEE. Gao, Y.; Xu, C.; Wang, D.; Chen, S.; Ranasinghe, D. C.; and Nepal, S. 2019. STRIP: A Defence Against Trojan Attacks on Deep Neural Networks. In Proceedings of the 35th Annual Computer Security Applications Conference, 113–125. Gu, T.; Liu, K.; Dolan-Gavitt, B.; and Garg, S. 2019. BadNets: Evaluating Backdooring Attacks on Deep Neural Networks. IEEE Access, 7: 47230–47244. He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016a. Deep Residual Learning for Image Recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 770–778. He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016b. Identity Mappings in Deep Residual Networks. In European Conference on Computer Vision, 630–645. Springer. Huang, Z.; Mao, Y.; and Zhong, S. 2024. UBA-Inf: Unlearning Activated Backdoor Attack with Influence-Driven Camouflage. In 33rd USENIX Security Symposium (USENIX Security 24), 4211–4228. Huynh, T.; Nguyen, D.; Pham, T.; and Tran, A. 2024. COMBAT: Alternated Training for Effective Clean-Label Backdoor Attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, 2436–2444. Krizhevsky, A.; and Hinton, G. 2009. Learning Multiple Layers of Features from Tiny Images. Technical report, University of Toronto. Li, Y.; Li, Y.; Wu, B.; Li, L.; He, R.; and Lyu, S. 2021. Invisible Backdoor Attack with Sample-Specific Triggers. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 16463–16472. Liu, K.; Dolan-Gavitt, B.; and Garg, S. 2018. Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. In International Symposium on Research in Attacks, Intrusions, and Defenses, 273–294. Springer. Liu, Z.; Wang, T.; Huai, M.; and Miao, C. 2024. Backdoor Attacks via Machine Unlearning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, 14115– 14123. Nguyen, Q. H.; Nguyen, N.-H.; Ta, T.-A.; Nguyen-Tang, T.; Wong, K.-S.; Hoang, T.-T.; and Doan, K. D. 2025. Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks. In International Conference on Learning Representations. Nguyen, T. A.; and Tran, A. T. 2020. Input-Aware Dynamic Backdoor Attack. In Advances in Neural Information Processing Systems, volume 33, 3454–3464.
Nguyen, T. A.; and Tran, A. T. 2021. WaNet - Imperceptible Warping-based Backdoor Attack. In International Conference on Learning Representations. Otto, M. 2018. Regulation (EU) 2016/679 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation–GDPR). In International and European Labour Law, 958–981. Nomos Verlagsgesellschaft mbH & Co. KG. Ronneberger, O.; Fischer, P.; and Brox, T. 2015. U-Net: Convolutional Networks for Biomedical Image Segmentation. In International Conference on Medical Image Computing and Computer-Assisted Intervention, 234–241. Springer. Sandler, M.; Howard, A.; Zhu, M.; Zhmoginov, A.; and Chen, L.-C. 2018. MobileNetV2: Inverted Residuals and Linear Bottlenecks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 4510–4520. Simonyan, K.; and Zisserman, A. 2015. Very Deep Convolutional Networks for Large-Scale Image Recognition. In International Conference on Learning Representations. Souri, H.; Fowl, L.; Chellappa, R.; Goldblum, M.; and Goldstein, T. 2022. Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch. In Advances in Neural Information Processing Systems, volume 35, 19165–19178. Wang, B.; Yao, Y.; Shan, S.; Li, H.; Viswanath, B.; Zheng, H.; and Zhao, B. Y. 2019. Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. In 2019 IEEE Symposium on Security and Privacy, 707–723. IEEE. Warnecke, A.; Pirch, L.; Wressnegger, C.; and Rieck, K. 2023. Machine Unlearning of Features and Labels. In Proceedings 2023 Network and Distributed System Security Symposium. Internet Society. Wu, G.; Hashemi, M.; and Srinivasa, C. 2022. PUMA: Performance Unchanged Model Augmentation for Training Data Removal. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, 8675–8682. Zhang, P.; Sun, J.; Tan, M.; and Wang, X. 2023. Exploiting Machine Unlearning for Backdoor Attacks in Deep Learning System. arXiv preprint arXiv:2310.10659.
APPENDIX A ADDITIONAL DETAILS AND EXPERIMENTAL EVALUATIONS This appendix provides further technical details and supplementary analyses to facilitate reproducibility and a deeper understanding of our experimental methodology. A. Datasets and Preprocessing In all of our comparative experiments, we evaluated every method on the CIFAR-10 and ImageNet-10 datasets. For fairness, all methods use identical data splits and preprocessing pipelines. CIFAR-10 consists of 50,000 training images and 10,000 test images, covering 10 object categories. ImageNet-10 is constructed by randomly selecting 10 mutually exclusive classes from the standard ImageNet dataset. All images are resized to 32 × 32 for CIFAR-10 and 224 × 224 for ImageNet-10. For both datasets, we apply standard normalization using the per-channel mean and standard deviation. Data augmentation includes random horizontal flipping, random rotation and random cropping for CIFAR-10, and random resized cropping for ImageNet-10. B. Unlearning Methods Adopted In our experiments, we used three unlearning strategies: SISA, First-Order unlearning, and PUMA unlearning. These methods are designed to remove the influence of requested training samples while preserving the model’s utility on the remaining data. • SISA: An exact unlearning framework that organizes training data via sharding and slicing, generates final results through sub-model aggregation, and handles unlearning by retraining only the affected shard. • First-Order: A first-order approximate unlearning algorithm that applies gradient ascent to the requested forgetting samples to induce the forgetting effect. • PUMA: An approximate unlearning algorithm that estimates the influence of removed samples and compensates for their removal by optimally reweighting the remaining data. C. Baseline Adaptation and Evaluation Settings To ensure a fair comparison, all methods are evaluated under a unified clean-label protocol, where all crafted samples retain their original labels and share identical experimental and machine-unlearning settings. For UBA-Inf, we instantiate its influence-driven camouflage framework using the LC backdoor adopted in its original evaluation. For UNCLEAN, we report two variants. UNCLEAN-Origin follows the original clean-counterpart forgetting protocol, whereas UNCLEAN-Align restricts the removal set to records that participate in victim-model training and uses the same forgetting budget as our method. Sleeper Agent does not originally include a removable suppression mechanism for unlearningtriggered activation. We therefore preserve its original cleanlabel trigger construction and augment it with a naive mitigation-sample construction. All mitigation samples preserve their original labels, and their number and forgetting budget are matched to the camouflage setting of our method.
Algorithm 1 Bilevel Optimization for Dual-Generator Learning Input: training set D, backdoor subset P, camouflage subset C, target label yt , generators Gϕ and Mψ , reference models fθc and fθp , unlearning algorithm Funlearn , optimization rounds R Output: Optimized generators Gϕ∗ and Mψ∗ 1: Initialize generator parameters ϕ and ψ 2: for each outer-level round r ∈ [1, R] do // Outer-level sample construction induced by current generators 3: Pr ← {(Bϕ (x), y) | (x, y) ∈ P} 4: Cr ← {(Cϕ,ψ (x), y) | (x, y) ∈ C} 5: Dr ← (D \ (P ∪ C)) ∪ Pr ∪ Cr // Inner-level training and unlearning simulation 6: θlr ← Train(θlr−1 , Dr ) 7: Choose an unlearning set Ur ⊆ Cr 8: θur ← Funlearn (θlr , Ur ) // Outer-level generator update with inner-level feedback 9: Compute the trigger-generator objective G G G LrG = λl LG latent + λa Lact + λv Lvis + λc Lclean 10: Update the trigger generator ϕ ← ϕ − αG ∇ϕ LrG 11: 12:
Compute the camouflage-generator objective C C C LrC = λo LC opp + λm Lmargin + λcl Lclean + λr Lvis Update the camouflage generator ψ ← ψ − αC ∇ψ LrC
13: end for 14: return Gϕ∗ = Gϕ and Mψ∗ = Mψ
This adaptation is used to evaluate whether a conventional clean-label backdoor combined with non-optimized removable mitigation samples can realize a comparable dormantto-activated transition. D. Bilevel Optimization for Dual-Generator Learning Algorithm 1 presents the complete optimization procedure of the proposed dual-generator framework. At each outerlevel round, the current trigger and camouflage generators construct the corresponding backdoor and camouflage samples, which are combined with the remaining clean data to form the surrogate training set. The inner level then updates the latent surrogate model and simulates machine unlearning on a selected subset of camouflage samples, yielding dynamically refreshed latent and post-unlearning model states. These model states provide state-specific feedback for the outer-level optimization and are treated as fixed when updating the generators, with gradients propagated through the generated samples rather than through the surrogate training or unlearning procedures. Accordingly, the trigger generator is optimized to preserve dormancy in the latent model while inducing target behavior after unlearning, whereas the camouflage generator learns a label-consistent suppressive influence that can be removed by the subsequent unlearning request. Repeating this alternating process coordinates per-
sistent latent trigger associations with removable camouflage suppression. E. Verification of Camouflage-Removal-Induced Activation To verify whether the post-unlearning activation is attributable to the specific removal of camouflage samples, rather than to general model-performance degradation caused by the unlearning operation itself, we conduct a series of verification experiments under the same experiment setting. We first apply the unlearning operation to randomly selected clean training samples from a clean model. This setting quantifies the general benign-accuracy degradation caused by equal-budget unlearning. We then evaluate a poisoned model trained with trigger-bearing samples generated by the same optimized trigger generator as the full method, but without any camouflage samples. The same number of randomly selected clean samples is unlearned from this model to examine whether camouflage samples are necessary for suppressing the trigger association and maintaining the dormant state before unlearning. Finally, for the same full latent model, we compare two removal settings. In the first setting, the same unlearning update is applied using the clean source counterparts of the selected camouflage samples. In the second setting, the actual camouflage samples U ⊂ C ′ are unlearned. This comparison examines whether the strong activation is specifically associated with removing the learned influence of the camouflage samples, rather than merely with the corresponding sample content or an equal-budget model update. As shown in Table 4, unlearning random clean samples under the same configuration also causes a comparable decrease in benign accuracy, indicating that the observed BAU reduction is not specific to camouflage removal. Without camouflage samples, the poisoned model already exhibits a high pre-unlearning ASR, confirming their role in maintaining backdoor dormancy. More importantly, for the same full latent model, removing the actual camouflage samples produces substantially stronger activation than the clean-source counterpart control. Although BA-U decreases further, the additional degradation remains modest relative to the substantial increase in ASR. Overall, these results demonstrate that the camouflage samples are essential for maintaining the dormant state and that the subsequent dormant-to-activated transition is primarily driven by removing their learned suppressive influence. F. Visual Examples of Crafted Samples To qualitatively assess the visual consistency of the crafted samples, we present poisoned and camouflage samples from CIFAR-10 and ImageNet-10 together with their corresponding clean source images. As shown in Fig. 6, for each dataset, the upper row contains the clean source images and the lower row contains their corresponding crafted samples. The first two columns show poisoned samples, while the last two columns show camouflage samples. The poisoned and camouflage samples preserve the primary object appearance and recognizable semantic content of their clean counterparts, without introducing conspicuous localized patterns or altering the semantics associated with their original labels.
These examples illustrate that both types of crafted samples maintain visual and label consistency under the clean-label data-submission setting. G. Additional Defense Evaluation In this section, we further evaluate the resistance of the proposed attack to STRIP, complementing the fine-pruning evaluation reported in the main paper. Experiments are conducted on CIFAR-10 and ImageNet-10 under First-Order unlearning, considering both the latent model before unlearning and the activated model after unlearning. STRIP is implemented following its original evaluation protocol. STRIP. STRIP detects potential backdoor inputs by repeatedly superimposing them with clean images and measuring the entropy of the resulting predictions. Conventional backdoor inputs tend to preserve the attacker-specified prediction under such perturbations and therefore exhibit abnormally low entropy. As shown in Fig. 7, the entropy distributions of clean and trigger-bearing inputs substantially overlap for the latent models on both CIFAR-10 and ImageNet-10. After unlearning, substantial overlap remains on CIFAR-10, while the trigger-bearing inputs on ImageNet-10 shift toward higher rather than lower entropy. Therefore, the proposed attack does not exhibit the characteristic low-entropy pattern assumed by STRIP, limiting its ability to reliably distinguish trigger-bearing inputs from clean inputs in either the latent or activated state.
Training Configuration
Removal Set
ASR
BA
ASR-U (∆)
BA-U
Clean only Backdoor only Backdoor + camouflage Backdoor + camouflage
Random clean samples Random clean samples Clean source counterparts Camouflage samples U
3.93 60.72 12.67 12.67
93.68 92.49 93.35 93.35
7.29 (+3.36) 83.64 (+22.92) 36.78 (+24.11) 87.87 (+75.20)
86.29 85.65 86.84 83.24
Table 4: Verification experiments for camouflage-removal-induced activation on CIFAR-10.
(a) CIFAR-10 (Poisoned)
(b) CIFAR-10 (Camouflage)
(c) ImageNet-10 (Poisoned)
(d) ImageNet-10 (Camouflage)
Figure 6: Visual examples of crafted samples on CIFAR-10 and ImageNet-10.
(a)
(b)
(c)
(d)
Figure 7: Entropy distributions of clean and trigger-bearing inputs under STRIP with First-Order unlearning: (a) CIFAR-10 latent model before unlearning, (b) CIFAR-10 activated model after unlearning, (c) ImageNet-10 latent model before unlearning, and (d) ImageNet-10 activated model after unlearning.