A few poisoned repair images could restore a CLIP backdoor after GARD purification

A detector can appear to remove an image encoder backdoor while depending on a reference dataset the attacker may influence. GARD uses adversarial representation changes to identify and suppress poisoned CLIP features without needing the original trigger. Its clean-data evaluations showed large attack-success reductions.

The paper then contaminated the supposedly clean repair corpus. In the reported BadCLIP configuration, two poisoned reference images raised the attack-success rate from 0.82% to 68.68%; additional images increased it further while ordinary clean accuracy looked stable. This is a laboratory attack against the defense input, not a compromised production image model. It makes repair-data provenance as important as model provenance.

A low backdoor score is fragile if the defense silently trusts an attacker-contaminated calibration set.

The repair corpus, not only the model checkpoint, is part of the supply-chain boundary. Low clean-task error cannot falsify the targeted backdoor because a tiny compromised target class barely moves an aggregate accuracy metric. This is distinct from LoRA repair reactivation, which follows subsequent fine-tuning; here the defense's own calibration data carries the poison.