Benign on Label, Malicious by Design: Clean-Label Dormant-to-Activated Backdoor via Machine Unlearning with Removable Camouflage

Dongdong Zhao¹, Can Li¹, Xiang Yao¹, Fan He¹, Qihang Ge¹, and Baogang Song^1,*

Abstract

Existing backdoor attacks often become effective immediately after backdoor implantation and may therefore be exposed before exploitation. Machine unlearning activated dormant backdoors mitigate such behavioral exposure by remaining inactive after training and becoming effective only after selected training records are unlearned. However, existing methods struggle to simultaneously achieve a low pre-unlearning attack success rate and strong post-unlearning activation under clean-label constraints and realistic unlearning requests. Achieving this transition requires jointly establishing a persistent latent association and a removable suppressive influence. To address this challenge, we propose a clean-label unlearning-activated backdoor framework based on dual-generator learning and formulate it as a bilevel optimization problem: By simulating latent backdoor establishment and machine unlearning, the framework alternately learns sample-specific triggers that establish a latent trigger-to-target association and label-consistent camouflage samples that provide removable suppression. Once a small subset of camouflage samples is unlearned, the suppression is lifted and the dormant backdoor is activated. Experiments on CIFAR-10 and ImageNet-10 show that our method maintains lower pre-unlearning attack success rates while achieving stronger post-unlearning activation across multiple unlearning algorithms than representative backdoor baselines. These results demonstrate that reliable dormancy-to-activation transitions can be achieved by coordinating a persistent latent association with removable suppression under clean-label and realistic deletion constraints.

Introduction

Backdoor attacks threaten DNNs deployed in safety-sensitive applications by preserving benign performance while inducing attacker-specified predictions on triggered inputs. Existing studies improve stealthiness through invisible, warping-based, input-adaptive, and clean-label designs (Li et al. 2021; Nguyen and Tran 2021, 2020; Nguyen et al. 2025), mainly reducing visual or label-level anomalies in poisoned samples. However, these improvements usually do not change a critical fact: the learned backdoor often becomes active immediately after training. Thus, malicious trigger-to-target behavior may be exposed by post-training inspection or backdoor defenses before the attacker exploits it, as shown in Fig. 1 (Wang et al. 2019; Gao et al. 2019). This reveals a behavioral exposure risk that cannot be fully addressed by merely making poisoned samples less perceptible.

Refer to caption — Figure 1: Research motivation.

To reduce such post-training exposure, recent studies have explored dormant or delayed-activation backdoors that remain inactive after training and are activated only by a specific subsequent event. Machine unlearning provides a natural post-training activation mechanism by removing the influence of specified training samples in response to deletion requests, thereby inducing model-state changes that attackers can exploit to activate a dormant backdoor. Existing studies have demonstrated the feasibility of unlearning-activated backdoors, but important limitations remain in realistic data-submission and deletion-request scenarios. Some rely on dirty-label poisoning, violating label consistency (Zhang et al. 2023; Alam et al. 2025). Some construct influence-driven suppression for a given off-the-shelf backdoor construction, rather than jointly constructing a latent association and its suppression mechanism under clean-label constraints (Huang et al. 2024). Moreover, the limited work under clean-label constraints activates the backdoor by unlearning samples outside the attacker-submitted training records (Arazzi et al. 2025). This deviates from practical machine-unlearning semantics, where a valid request should be record-matched and restricted to data submitted by the requester for target-model training. Therefore, although existing unlearning-activated backdoors mitigate the immediate post-training exposure of backdoor behavior, they do not fully satisfy the dual considerations of clean-label data submission and realistic user deletion requests.

Motivated by these limitations, we study a stricter clean-label data-removal workflow in which all attacker-crafted samples retain their original labels and the forget set is restricted to attacker-submitted samples that actually participated in training. This workflow jointly enforces label consistency at data submission and sample provenance at deletion, better reflecting realistic machine-unlearning services. Under this workflow, the core challenge is to simultaneously achieve label consistency, pre-unlearning dormancy, and post-unlearning activation. Specifically, the trigger-target association must be implanted implicitly under original-label supervision, remain unexposed after training, and emerge only after a subset of attacker-submitted samples is forgotten. To satisfy these requirements, the attack framework needs to coordinate two types of training signals: one that establishes a latent trigger-target association that persists through unlearning, and another that suppresses this association before unlearning through attacker-submitted samples that can later be deleted. Coordinating these two effects under clean-label constraints is the key challenge for realizing clean-label unlearning-activated backdoors across pre- and post-unlearning model states.

To address this challenge, we propose a dual-generator framework that separately models latent backdoor implantation and camouflage suppression and coordinates them through bilevel optimization. This separation is necessary because establishing a persistent trigger-target association and suppressing its observable behavior impose competing objectives that may interfere when optimized through a single generator. Accordingly, the trigger generator produces sample-specific triggers that establish a latent association under original-label supervision and preserve it through unlearning, while the camouflage generator produces label-consistent samples that impose removable suppression on the trigger-induced target tendency during training. Since unlearning-activated backdoors depend on both the latent state after training and the activated state after machine unlearning, we use a bilevel formulation to characterize the coupling between generator optimization and the training–unlearning process. After generator optimization, both trigger-bearing samples and camouflage samples are incorporated into target-model training with their original labels. When the attacker subsequently requests unlearning of a small subset of camouflage samples, the removable suppression is lifted, allowing the retained latent trigger-target association to emerge as an activated backdoor.

Our main contributions are summarized as follows:

•

We systematically study unlearning-activated backdoor attacks under a clean-label data-removal workflow, extending dormant backdoors to a more practical scenario that simultaneously enforces label consistency and realistic user-deletion constraints.
•

We design a bilevel optimization-based dual-generator framework that jointly optimizes latent trigger persistence and removable camouflage suppression by simulating dormant backdoor formation and unlearning-induced activation.
•

We design removable camouflage objectives that combine gradient opposition and target-tendency suppression, enabling label-consistent suppression of trigger-induced behavior that can be lifted through unlearning.
•

We evaluate the effectiveness of our method on CIFAR-10 and ImageNet-10. Results show that our method effectively realizes clean-label unlearning-activated backdoor attacks, achieving stealthier pre-unlearning dormancy and more effective post-unlearning activation than mainstream backdoor attacks.

Related Work

Machine Unlearning

Machine unlearning aims to remove the influence of requested training samples from a trained model, motivated by privacy regulations and data deletion demands (Otto 2018). Prior work has developed a range of unlearning methods, such as SISA (Bourtoule et al. 2021), First-Order unlearning (Warnecke et al. 2023), and PUMA unlearning (Wu et al. 2022). These studies mainly focus on improving unlearning efficiency or preserving model utility. In contrast, we examine unlearning from an adversarial perspective, exploiting the induced model transition as an attacker-controlled mechanism to remove camouflage suppression and activate a dormant clean-label backdoor.

Backdoor Attacks

Backdoor attacks poison model training to implant trigger-specific malicious behavior while preserving benign performance (Gu et al. 2019). Although subsequent invisible, adaptive, warping-based, and clean-label designs improve visual or label-level stealthiness, their backdoors are typically active immediately after training and may be exposed before exploitation. Dormant and delayed-activation attacks instead postpone malicious behavior until a subsequent model-state change, with prior studies showing that deletion-induced updates can activate hidden backdoors (Zhang et al. 2023; Liu et al. 2024). However, these approaches generally rely on dirty-label poisoning or label manipulation. More recent methods improve activation controllability under machine unlearning. UBA-Inf strengthens the pre-unlearning suppression of an off-the-shelf backdoor using influence functions (Huang et al. 2024), but does not jointly construct the latent association and its suppression under clean-label constraints. UNCLEAN studies a clean unlearning attack by amplifying a weak malicious signal through forgetting the clean counterparts of poisoned samples (Arazzi et al. 2025), while its forget set is not restricted to attacker-submitted training records. In contrast, we jointly optimize label-consistent trigger samples and removable camouflage samples under a clean-label data-removal workflow, enabling the camouflage samples to suppress the latent association before unlearning and release it after a valid attacker-controlled deletion request.

Problem Statement

Problem Formulation. We formally define the Clean-Label Unlearning-Activated Backdoor Attack as follows. Let $f_{\theta}$ denote a classification model trained on $\mathcal{D}=\{(x_{i},y_{i})\}_{i=1}^{N}$ , with $x_{i}\in\mathcal{X}$ and $y_{i}\in\mathcal{Y}$ . Here, $\mathcal{X}$ and $\mathcal{Y}$ denote the input and label spaces, respectively. The attacker aims to implant a clean-label latent backdoor that remains inactive after normal training and becomes activated once camouflage samples are unlearned. Specifically, the attacker first selects a target label $y_{t}\in\mathcal{Y}$ and controls a limited subset $\mathcal{D}_{a}\subset\mathcal{D}$ of the training data. From $\mathcal{D}_{a}$ , the attacker selects a backdoor source subset $\mathcal{P}\subset\{(x,y)\in\mathcal{D}_{a}\mid y=y_{t}\}$ with poisoning rate $\rho_{p}$ , and a camouflage source subset $\mathcal{C}\subset\{(x,y)\in\mathcal{D}_{a}\mid y\neq y_{t}\}$ with rate $\rho_{c}$ . Based on the trigger generator $G_{\phi}$ and the camouflage generator $M_{\psi}$ , the attacker constructs the backdoor sample set $\mathcal{P}^{\prime}=\{(B_{\phi}(x),y)\mid(x,y)\in\mathcal{P}\}$ and camouflage sample set $\mathcal{C}^{\prime}=\{(C_{\phi,\psi}(x),y)\mid(x,y)\in\mathcal{C}\}$ , respectively, where the detailed formulations of $B_{\phi}(\cdot)$ and $C_{\phi,\psi}(\cdot)$ are provided in the Method section. All crafted samples preserve their original labels. The crafted samples are submitted through the normal data collection pipeline and their incorporation results in the mixed training set $\mathcal{D}^{*}=(\mathcal{D}\setminus\mathcal{D}_{a})\cup(\mathcal{D}_{a}\setminus(\mathcal{P}\cup\mathcal{C}))\cup\mathcal{P}^{\prime}\cup\mathcal{C}^{\prime}$ , which is subsequently used by the model owner for training. After training on $\mathcal{D}^{*}$ , the parameters of the model are updated to $\theta_{l}$ , resulting in a latent backdoor model $f_{\theta_{l}}$ that behaves normally on clean input and remains inactive on triggered inputs before unlearning:

f_{\theta_{l}}(x_{i})=y_{i},\qquad f_{\theta_{l}}(B_{\phi}(x_{i}))=y_{i}

(1)

At the intended attack time, the attacker requests unlearning of $\mathcal{U}\subseteq\mathcal{C}^{\prime}$ . The model owner then invokes an unlearning algorithm to update the model parameters from $\theta_{l}$ to $\theta_{u}$ , obtaining the unlearned model $f_{\theta_{u}}$ . After unlearning, the attack aims to activate the backdoor and induce the target behavior:

f_{\theta_{u}}(x_{i})=y_{i},\qquad f_{\theta_{u}}(B_{\phi}(x_{i}))=y_{t}

(2)

Threat Model.

We assume that the attacker participates in data collection and can contribute a limited number of crafted backdoor and camouflage samples to the model owner’s training set. During offline optimization, the attacker trains surrogate models to approximate the victim training and unlearning processes. The attacker can later access the unlearning interface of the data provided by the model service provider and request the removal of a small subset of training samples. However, the attacker cannot interfere with victim training, directly modify model parameters, or control final model deployment. All crafted samples retain their original labels, reflecting realistic settings where attackers have limited label-control ability and mislabeled records are more readily detected during data inspection or deletion verification.

Method

In this section, we first present the overall attack workflow and then elaborate on the optimization of the two generators.

Overview

As illustrated in Fig. 2, our proposed unlearning-activated backdoor attack proceeds in three stages.

1.

Dual-Generator Optimization. The attacker optimizes the trigger generator and the camouflage generator under a bilevel formulation in an offline manner. The former learns a latent trigger association, while the latter learns a removable suppressive influence.
2.

Latent Backdoor Establishment. After offline optimization, the generated backdoor and camouflage samples are injected into the training set, causing the victim model to learn a dormant backdoor whose malicious behavior remains suppressed after deployment.
3.

Backdoor Activation. At the intended attack time, the attacker requests the unlearning of the camouflage samples, removing their suppressive influence and activating the latent backdoor.

To realize the above three-stage workflow and the controlled dormant-to-activated transition, we next introduce the construction and optimization objectives of $G_{\phi}$ and $M_{\psi}$ , followed by their bilevel optimization.

Trigger Generation and Optimization

Backdoor Sample Construction.

We formulate backdoor sample construction as a learnable injection process, where $G_{\phi}$ produces a sample-specific perturbation $G_{\phi}(x)$ for each input $x$ . To reduce high-frequency artifacts and spatial discontinuities, we project the generated perturbation onto the low-frequency domain. We define the low-frequency projection operator as (Ahmed et al. 1974)

\mathcal{P}_{lf}(z)=\mathrm{IDCT}\left(\mathcal{M}_{lf}\odot\mathrm{DCT}(z)\right)

(3)

where $\mathcal{M}_{lf}$ denotes the low-frequency mask and $\odot$ denotes the Hadamard product. The filtered trigger perturbation is then obtained as $\delta_{G}(x)=\mathcal{P}_{lf}(G_{\phi}(x))$ . To ensure valid pixel values and further improve the spatial continuity and visual stealthiness of the trigger, we inject the low-frequency perturbation into the original image, followed by clipping and Gaussian smoothing (Huynh et al. 2024):

B_{\phi}(x)=\mathcal{K}\left(\mathrm{Clip}\left(x+\eta_{G}\cdot\delta_{G}(x)\right)\right)

(4)

where $\eta_{G}$ controls the trigger strength, $\mathrm{Clip}(\cdot)$ ensures valid pixel values, and $\mathcal{K}(\cdot)$ denotes Gaussian smoothing.

Trigger Generator Optimization.

In the unlearning-activated backdoor attacks, the core challenge of trigger optimization lies in the fact that the trigger should exhibit different behaviors before and after unlearning. Unlike conventional backdoor attacks, which only require the trigger to be effective after model training, our trigger should remain dormant in the normally deployed model and become effective after camouflage samples are unlearned. Therefore, when optimizing the trigger generator, we explicitly consider both the latent model $f_{\theta_{l}}$ and the unlearned model $f_{\theta_{u}}$ . In the trigger generator optimization, we consider the following loss terms:

•

Latent loss. Before unlearning, the latent loss requires triggered samples to be classified into their ground-truth labels:

$\mathcal{L}_{latent}^{G}=\mathbb{E}_{(x,y)\in\mathcal{D}}\mathcal{L}(f_{\theta_{l}}(B_{\phi}(x)),y)$ (5)
This loss constrains the generated triggers to remain dormant in the latent model by preventing premature target behavior before unlearning.
•

Activation loss. For activation, we apply the trigger to samples in the dataset and require the unlearned model to classify the triggered samples into the target label $y_{t}$ :

$\mathcal{L}_{act}^{G}=\mathbb{E}_{(x,y)\in\mathcal{D}}\mathcal{L}(f_{\theta_{u}}(B_{\phi}(x)),y_{t})$ (6)
This objective makes the trigger effective after unlearning, enabling the attacker to achieve the intended attack.

•

Visibility loss. We constrain the perturbation magnitude to improve the visual stealthiness of the trigger:

$\mathcal{L}_{vis}^{G}=\mathbb{E}_{x\in\mathcal{D}}\|B_{\phi}(x)-x\|_{2}^{2}$ (7)
•

Non-adversarial loss. We require the clean model $f_{\theta_{c}}$ to correctly classify the generated backdoor samples, preventing the trigger from degenerating into a standard adversarial perturbation:

$\mathcal{L}_{clean}^{G}=\mathbb{E}_{(x,y)\in\mathcal{D}}\mathcal{L}(f_{\theta_{c}}(B_{\phi}(x)),y)$ (8)

Combining the above objectives, the trigger generator is trained to solve the following optimization problem:

$\displaystyle G_{\phi}^{*}$	$\displaystyle=\arg\min_{G_{\phi}}\left\{\begin{aligned} &\lambda_{l}\mathcal{L}_{latent}^{G}+\lambda_{a}\mathcal{L}_{act}^{G}\\ &+\lambda_{v}\mathcal{L}_{vis}^{G}+\lambda_{c}\mathcal{L}_{clean}^{G}\end{aligned}\right.$	(9)
$\displaystyle\text{s.t.}\quad\theta_{l}$	$\displaystyle=\arg\min_{\theta}\mathbb{E}_{\mathcal{D}^{*}}\mathcal{L}(f_{\theta}(x),y),$
$\displaystyle\theta_{u}$	$\displaystyle=\mathcal{F}_{\mathrm{unlearn}}(\theta_{l},\mathcal{U})$

where $\lambda_{l}$ , $\lambda_{a}$ , $\lambda_{v}$ , and $\lambda_{c}$ are balancing coefficients, $\mathcal{F}_{\mathrm{unlearn}}$ denotes the machine unlearning algorithm, and $\mathcal{U}$ is the requested forget set.

Camouflage Generation and Optimization

Camouflage Sample Construction.

Given an input image $x$ from the camouflage set, the current trigger generator $G_{\phi}$ first produces a raw trigger perturbation, which is projected onto the low-frequency components using Eq. (3): $\delta_{G}(x)=\mathcal{P}_{lf}(G_{\phi}(x))$ . We then construct a trigger-conditioned intermediate sample as

x^{d}=\mathrm{Clip}\left(x+\eta_{G}\cdot\delta_{G}(x)\right)

(10)

Conditioned on $x^{d}$ , the camouflage generator $M_{\psi}$ produces a camouflage perturbation, whose low-frequency form is $\delta_{C}(x^{d})=\mathcal{P}_{lf}(M_{\psi}(x^{d}))$ . The final camouflage sample is constructed as

C_{\phi,\psi}(x)=\mathcal{K}\left(\mathrm{Clip}\left(x^{d}+\eta_{C}\cdot\delta_{C}(x^{d})\right)\right)

(11)

where $\eta_{C}$ controls the camouflage perturbation strength.

Camouflage Generator Optimization.

In this framework, the key challenge of camouflage generator optimization is to make camouflage samples exert a removable suppressive influence. During training, camouflage samples retain their original labels while suppressing backdoor behavior, thereby keeping the implanted backdoor inactive before unlearning. Once these samples are unlearned, their suppressive influence is removed, allowing the latent association to emerge as an activated backdoor. We optimize the camouflage generator using the following loss terms:

•

Gradient-opposing loss. This loss requires the training gradient of camouflage samples to be anti-aligned with a trigger-induced target direction. For each camouflage source sample $x\in\mathcal{C}$ , we first construct its trigger-contaminated intermediate sample $x^{d}$ . Rather than deriving this direction from the backdoor sample set $\mathcal{P}^{\prime}$ , which may introduce class-semantic and visual-content mismatch with the current camouflage sample, we use $x^{d}$ to characterize the trigger-induced target tendency under the same source image:

$g_{bd}=\nabla_{\theta_{l}}\mathcal{L}(f_{\theta_{l}}(x^{d}),y_{t})$ (12)
For the corresponding camouflage sample $C_{\phi,\psi}(x)$ , we compute its training gradient:

$g_{c}=\nabla_{\theta_{l}}\mathcal{L}(f_{\theta_{l}}(C_{\phi,\psi}(x)),y)$ (13)
We define their cosine similarity as

$\operatorname{cos}_{sim}(g_{c},g_{bd})=\frac{\langle g_{c},g_{bd}\rangle}{\|g_{c}\|_{2}\|g_{bd}\|_{2}}$ (14)
The gradient-opposing loss is then formulated as

$\mathcal{L}_{opp}^{C}=1+\operatorname{cos}_{sim}(g_{c},g_{bd})$ (15)
Minimizing $\mathcal{L}_{opp}^{C}$ drives $\operatorname{cos}_{sim}(g_{c},g_{bd})$ toward $-1$ , causing camouflage gradients to oppose the trigger-induced target direction defined by $x^{d}$ . This creates a removable suppressive influence before unlearning; once the camouflage samples are unlearned, the gradient cancellation is removed and latent association is released.
•

Target-suppressive margin loss. Since camouflage samples are generated from trigger-conditioned inputs, they may retain residual target-class tendency under a model that has learned the trigger-target association. To provide a stable reference for suppressing this residual tendency, we offline construct a trigger-only reference model $f_{\theta_{p}}$ before optimization. Specifically, we first train an initial trigger generator and use the resulting trigger-bearing clean-label samples, without introducing camouflage samples, to train $f_{\theta_{p}}$ . We then fix $f_{\theta_{p}}$ and use it only for the target-suppressive margin constraint. Let $z_{k}^{p}(\cdot)$ denote the pre-softmax logit of class $k$ predicted by $f_{\theta_{p}}$ and define

$s_{t}(x)=z_{y_{t}}^{p}(C_{\phi,\psi}(x)),\quad s_{y}(x)=z_{y}^{p}(C_{\phi,\psi}(x))$ (16)
The margin loss is defined as

$\mathcal{L}_{margin}^{C}=\mathbb{E}_{(x,y)\in\mathcal{C}}\max(0,s_{t}(x)-s_{y}(x)+\gamma)$ (17)

where $\gamma$ is the margin hyperparameter. Minimizing this loss enforces the original-class logit to exceed the target-class logit by at least $\gamma$ , thereby suppressing the target-class tendency of camouflage samples.

•

Label-preserving loss. We require the latent model to classify camouflage samples as their original labels, preventing suppression through misclassification:

$\mathcal{L}_{clean}^{C}=\mathbb{E}_{(x,y)\in\mathcal{C}}\mathcal{L}\left(f_{\theta_{l}}(C_{\phi,\psi}(x)),y\right)$ (18)
•

Visibility loss. We constrain camouflage perturbations with an $\ell_{1}$ penalty to improve visual stealthiness:

$\mathcal{L}_{vis}^{C}=\mathbb{E}_{x\in\mathcal{C}}\|M_{\psi}(x^{d})\|_{1}$ (19)

Combining the above objectives, we formulate the camouflage generator optimization as follows:

	$\displaystyle M_{\psi}^{*}$	$\displaystyle=\arg\min_{M_{\psi}}\left\{\begin{aligned} &\lambda_{o}\mathcal{L}_{opp}^{C}+\lambda_{m}\mathcal{L}_{margin}^{C}\\ &+\lambda_{cl}\mathcal{L}_{clean}^{C}+\lambda_{r}\mathcal{L}_{vis}^{C}\end{aligned}\right.$		(20)
	$\displaystyle\text{s.t.}\quad\theta_{l}$	$\displaystyle=\arg\min_{\theta}\mathbb{E}_{\mathcal{D}^{*}}\mathcal{L}(f_{\theta}(x),y)$

where $\lambda_{o}$ , $\lambda_{m}$ , $\lambda_{cl}$ , and $\lambda_{r}$ are balancing coefficients.

Bilevel Optimization for Dual-Generator Learning

In clean-label unlearning-activated backdoor attacks, trigger effectiveness depends on both the latent model after training and the post-unlearning model. Unlike conventional attacks optimized only for the trained model, the backdoor must remain dormant before unlearning and activate after camouflage samples are unlearned. We therefore simulate both latent-model training and subsequent unlearning during generator optimization. Accordingly, we formulate dual-generator learning as a bilevel optimization problem. The outer level optimizes the trigger generator $G_{\phi}$ and camouflage generator $M_{\psi}$ , while the inner level constructs the current training set, trains a surrogate latent model, and performs unlearning. The resulting latent and post-unlearning models provide feedback for updating both generators. It is worth noting that, in real-world attack settings, attackers cannot access the deployed victim model or its training process. We therefore adopt a surrogate training strategy that uses a locally constructed shadow model closely approximating the victim architecture and attacker-accessible auxiliary data to simulate the training and unlearning processes. The complete dual-generator optimization algorithm is provided in Appendix A, Sec. D.

Experiments

Experimental Settings

Datasets and Models. Following prior backdoor studies, we evaluate our method on two benchmark image classification datasets, CIFAR-10 (Krizhevsky and Hinton 2009) and ImageNet-10 that is constructed by randomly selecting 10 classes from the standard ImageNet dataset (Deng et al. 2009). For the default evaluation, we use Pre-activation ResNet-18 (He et al. 2016b) on CIFAR-10 and ResNet-18 (He et al. 2016a) on ImageNet-10. We further evaluate cross-architecture transfer with VGG-16 (Simonyan and Zisserman 2015) and MobileNetV2 (Sandler et al. 2018). Both the trigger generator $G_{\phi}$ and camouflage generator $M_{\psi}$ use a U-Net (Ronneberger et al. 2015) backbone throughout all experiments.

Attack Method	Unlearning Algorithm	CIFAR-10				ImageNet-10
		Before Unlearn		After Unlearn		Before Unlearn		After Unlearn
		ASR	BA	ASR-U( $\Delta$ )	BA-U	ASR	BA	ASR-U( $\Delta$ )	BA-U
Ours	SISA	8.91	91.39	89.01(+80.10)	90.82	10.67	80.34	80.30(+69.63)	80.08
UBA-Inf		14.69	92.24	89.32(+74.63)	91.04	17.22	81.50	84.81(+67.59)	79.08
UNCLEAN-Origin		14.28	90.01	83.49(+69.21)	89.84	30.25	78.42	65.67(+35.42)	76.92
UNCLEAN-Align		15.78	88.57	76.73(+60.95)	88.69	31.17	78.83	66.92(+35.75)	77.75
Sleeper Agent		37.63	92.65	99.40(+61.77)	91.47	36.23	81.07	85.83(+49.60)	80.21
Ours	PUMA	13.74	93.38	86.99(+73.25)	80.77	13.80	83.58	80.74(+66.94)	70.08
UBA-Inf		17.36	90.39	84.16(+66.80)	82.94	26.57	80.67	84.53(+57.96)	66.17
UNCLEAN-Origin		22.84	87.95	47.43(+24.59)	81.59	24.83	85.50	66.17(+41.34)	68.75
UNCLEAN-Align		21.28	88.84	52.29(+31.01)	79.39	23.75	84.83	62.00(+38.25)	70.75
Sleeper Agent		42.81	93.96	67.63(+24.82)	80.15	40.17	82.96	75.83(+35.66)	72.87
Ours	First-Order	12.67	93.35	87.87(+75.20)	83.24	14.35	83.21	82.13(+67.78)	76.50
UBA-Inf		17.36	90.39	54.09(+36.73)	84.59	26.57	80.67	52.04(+25.47)	73.58
UNCLEAN-Origin		22.84	87.95	41.65(+18.81)	70.66	24.83	85.50	50.25(+25.42)	71.92
UNCLEAN-Align		21.28	88.84	39.45(+18.17)	72.18	23.75	84.83	55.42(+31.67)	73.08
Sleeper Agent		42.81	93.96	62.46(+19.65)	81.54	40.17	82.96	72.50(+32.33)	75.33

Table 1: Main results and comparison with existing attacks across unlearning algorithms on CIFAR-10 and ImageNet-10.

Parameter and Attack Settings. Victim classifiers are trained for 250 epochs using SGD with momentum 0.9 and weight decay $5\times 10^{-4}$ . For CIFAR-10 and ImageNet-10, the batch sizes are 128 and 32, and the initial learning rates are 0.01 and 0.001, respectively. Class 0 is used as the target label. Before alternating optimization, an initial trigger generator is trained to construct the trigger-only reference model $f_{\theta_{p}}$ and initialize $G_{\phi}$ . Both $G_{\phi}$ and $M_{\psi}$ are then optimized with an initial learning rate of 0.01. We set the poisoning and camouflage sample rates to $\rho_{p}=1\%$ and $\rho_{c}=3\%$ , with perturbation strengths $\eta_{G}=\eta_{C}=0.15$ . The loss coefficients are $\lambda_{l}=1$ , $\lambda_{a}=2$ , $\lambda_{v}=0.02$ , and $\lambda_{c}=0.8$ for $G_{\phi}$ , and $\lambda_{o}=2.5$ , $\lambda_{m}=0.5$ , $\lambda_{cl}=1.0$ , and $\lambda_{r}=0.05$ for $M_{\psi}$ . The margin hyperparameter is set to $\gamma=5$ . The unlearning set $\mathcal{U}\subset\mathcal{C}^{\prime}$ contains 250 samples for CIFAR-10 and 150 for ImageNet-10. We use $\tau=0.025$ for First-Order and PUMA and two shards for SISA. Unless otherwise specified, experiments are conducted on CIFAR-10 using First-Order unlearning for evaluation and all reported results are averaged over three independent runs with different random seeds. To further assess the visual consistency of the crafted samples, we provide visual examples in Appendix A, Sec. F.

Unlearning Algorithms. To account for practical unlearning scenarios, we evaluate our attack under three representative unlearning algorithms that cover different design principles: SISA, First-Order, and PUMA, with further details provided in Appendix A, Sec. B.

Evaluation Metrics. To evaluate attack performance, we report four metrics: Attack Success Rate (ASR), ASR after Unlearning (ASR-U), Benign Accuracy (BA), and Benign Accuracy after Unlearning (BA-U). ASR and ASR-U measure the proportion of non-target triggered inputs classified as the target class before and after unlearning respectively. BA and BA-U measure the clean classification accuracy before and after unlearning. An effective unlearning-activated backdoor should maintain low ASR before unlearning, high ASR-U after unlearning, and acceptable BA-U.

Main Results and Comparisons

Table 1 reports the results on CIFAR-10 and ImageNet-10 under different machine unlearning algorithms. Our method consistently exhibits the intended dormant-to-activated behavior, maintaining low ASR before unlearning and substantially increasing ASR-U after the requested camouflage samples are unlearned. Although BA-U decreases in some settings, the controlled experiments in Appendix A, Sec. E show that comparable degradation also occurs under equal-budget clean-sample removal, indicating that the observed activation is not merely caused by general model degradation. We further compare our method with UBA-Inf (Huang et al. 2024), UNCLEAN (Arazzi et al. 2025), and Sleeper Agent (Souri et al. 2022). Specifically, UNCLEAN-Origin follows its original clean-counterpart forgetting setting, while UNCLEAN-Align uses the same forgetting budget on samples that actually participate in training. For Sleeper Agent, we construct naive removable camouflage samples by applying its trigger construction to selected samples and adding uniform random noise. As shown in Table 1, our method consistently achieves the lowest pre-unlearning ASR and the largest $\Delta$ ASR across datasets and unlearning algorithms. Although UBA-Inf and Sleeper Agent sometimes achieve higher absolute ASR-U, their higher pre-unlearning ASR indicates premature backdoor exposure. UNCLEAN generally produces a weaker ASR increase after unlearning. These results demonstrate that the proposed removable camouflage design more effectively coordinates pre-unlearning dormancy and unlearning-triggered activation.

$\|\mathcal{P}\|:\|\mathcal{C}\|$	ASR	ASR-U	BA	BA-U
1:0.5	35.08	79.64	93.44	86.23
1:1	30.77	83.07	93.16	84.66
1:2	21.84	85.62	93.28	83.91
1:3	12.67	87.87	93.35	83.24

Table 2: Effect of backdoor-to-camouflage sample allocation on CIFAR-10.

Robustness and Sensitivity Analysis

We analyze the robustness of the proposed attack under different attack configurations and deployment conditions.

Effect of poisoning and camouflage sample rates. We fix the backdoor sample rate at $\rho_{p}=1\%$ and vary the ratio between backdoor and camouflage samples. As shown in Table 2, increasing camouflage proportion gradually lowers ASR before unlearning and raises ASR-U after unlearning. This suggests that more camouflage samples provide stronger removable suppression, while BA remains relatively stable and BA-U decreases moderately after unlearning.

Transferability across Unlearning Algorithms. We further evaluate transferability across unlearning algorithms. As shown in Fig. 3, matched settings generally achieve the highest ASR-U, while most mismatched settings retain effective activation and consistently low pre-unlearning ASR. These results show that the learned suppression–release relation transfers across unlearning procedures, preserving dormancy before unlearning and activation afterward.

Transferability across Model Architectures. We further examine whether the learned attack remains effective when the surrogate and victim architectures differ. As shown in Fig. 4, the attack maintains low pre-unlearning ASR and high post-unlearning ASR-U under both matched and mismatched settings. This indicates that the learned latent association and removable suppression are not specific to a particular architecture, supporting transfer to unseen victim models.

Defense Evaluation

We evaluate the proposed backdoor attack against fine-pruning (Liu et al. 2018), a representative defense that prunes neurons with low activation on clean samples. Experiments are conducted on CIFAR-10 and ImageNet-10 under First-Order unlearning. We further evaluate STRIP (Gao et al. 2019) as a mainstream defense on both datasets, with detailed results provided in Appendix A, Sec. G. As shown in Fig. 5, for latent models before unlearning, ASR remains low as neurons are gradually pruned, while BA stays high until aggressive pruning is applied. For activated models after unlearning, ASR remains high across a wide range of pruning and drops clearly only when a large number of neurons are pruned. However, this reduction is accompanied by a substantial decrease in BA, indicating that fine-pruning cannot remove the activated backdoor without significantly damaging benign model performance.

Setting	Before Unlearning		After Unlearning
Setting	ASR	BA	ASR-U ( $\Delta$ )	BA-U
Full Method	12.67	93.35	87.87 (+75.20)	83.24
w/o $M_{\psi}$	61.74	93.20	69.41 (+7.67)	92.50
w/o $\mathcal{L}_{act}^{G}$	23.48	93.30	73.76 (+50.28)	86.98
w/o $\mathcal{L}_{opp}^{C}$ & $\mathcal{L}_{margin}^{C}$	25.48	93.26	63.76 (+38.28)	84.34

Table 3: Ablation of key components on CIFAR-10.

Ablation Study

To assess the contribution of each component, we conduct ablation studies on CIFAR-10. As shown in Table 3, removing the camouflage generator $M_{\psi}$ leads to a higher pre-unlearning ASR and a much smaller $\Delta$ , indicating that removable camouflage samples are critical for maintaining the dormant state. Removing the activation loss $\mathcal{L}_{act}^{G}$ results in a lower post-unlearning ASR-U, indicating that this objective is important for strengthening backdoor activation after unlearning. Jointly removing $\mathcal{L}^{C}_{opp}$ and $\mathcal{L}^{C}_{margin}$ increases the pre-unlearning ASR and decreases ASR-U, substantially weakening the intended dormant-to-activated transition. Overall, these results confirm that the coordinated design of trigger learning and removable camouflage suppression is essential for dormancy before unlearning and enabling activation after unlearning.

Conclusion

In this paper, we propose a clean-label unlearning-activated backdoor framework that jointly learns persistent trigger associations and removable camouflage suppression through dual-generator bilevel optimization. Experiments on CIFAR-10 and ImageNet-10 demonstrate consistent dormancy before unlearning and strong activation afterward across different unlearning algorithms. These results expose the security risk of adversarially crafted forgetting requests and motivate more robust unlearning defenses.

References

N. Ahmed, T. Natarajan, and K. R. Rao (1974) Discrete cosine transform. IEEE Transactions on Computers C-23 (1), pp. 90–93. Cited by: Backdoor Sample Construction..
M. Alam, H. Lamri, and M. Maniatakos (2025) ReVeil: unconstrained concealed backdoor attack on deep neural networks using machine unlearning. In 2025 62nd ACM/IEEE Design Automation Conference (DAC), pp. 1–7. Cited by: Introduction.
M. Arazzi, A. Nocera, and Vinod P (2025) When forgetting triggers backdoors: a clean unlearning attack. arXiv preprint arXiv:2506.12522. Cited by: Introduction, Backdoor Attacks, Main Results and Comparisons.
L. Bourtoule, V. Chandrasekaran, C. A. Choquette-Choo, H. Jia, A. Travers, B. Zhang, D. Lie, and N. Papernot (2021) Machine unlearning. In 2021 IEEE Symposium on Security and Privacy, pp. 141–159. Cited by: Machine Unlearning.
J. Deng, W. Dong, R. Socher, L. Li, K. Li, and L. Fei-Fei (2009) ImageNet: a large-scale hierarchical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248–255. Cited by: Experimental Settings.
Y. Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal (2019) STRIP: a defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, pp. 113–125. Cited by: Introduction, Defense Evaluation.
T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg (2019) BadNets: evaluating backdooring attacks on deep neural networks. IEEE Access 7, pp. 47230–47244. Cited by: Backdoor Attacks.
K. He, X. Zhang, S. Ren, and J. Sun (2016a) Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770–778. Cited by: Experimental Settings.
K. He, X. Zhang, S. Ren, and J. Sun (2016b) Identity mappings in deep residual networks. In European Conference on Computer Vision, pp. 630–645. Cited by: Experimental Settings.
Z. Huang, Y. Mao, and S. Zhong (2024) UBA-Inf: unlearning activated backdoor attack with influence-driven camouflage. In 33rd USENIX Security Symposium (USENIX Security 24), pp. 4211–4228. Cited by: Introduction, Backdoor Attacks, Main Results and Comparisons.
T. Huynh, D. Nguyen, T. Pham, and A. Tran (2024) COMBAT: alternated training for effective clean-label backdoor attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38, pp. 2436–2444. Cited by: Backdoor Sample Construction..
A. Krizhevsky and G. Hinton (2009) Learning multiple layers of features from tiny images. Technical report University of Toronto. Cited by: Experimental Settings.
Y. Li, Y. Li, B. Wu, L. Li, R. He, and S. Lyu (2021) Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 16463–16472. Cited by: Introduction.
K. Liu, B. Dolan-Gavitt, and S. Garg (2018) Fine-pruning: defending against backdooring attacks on deep neural networks. In International Symposium on Research in Attacks, Intrusions, and Defenses, pp. 273–294. Cited by: Defense Evaluation.
Z. Liu, T. Wang, M. Huai, and C. Miao (2024) Backdoor attacks via machine unlearning. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38, pp. 14115–14123. Cited by: Backdoor Attacks.
Q. H. Nguyen, N. Nguyen, T. Ta, T. Nguyen-Tang, K. Wong, T. Hoang, and K. D. Doan (2025) Wicked oddities: selectively poisoning for effective clean-label backdoor attacks. In International Conference on Learning Representations, Cited by: Introduction.
T. A. Nguyen and A. T. Tran (2020) Input-aware dynamic backdoor attack. In Advances in Neural Information Processing Systems, Vol. 33, pp. 3454–3464. Cited by: Introduction.
T. A. Nguyen and A. T. Tran (2021) WaNet - imperceptible warping-based backdoor attack. In International Conference on Learning Representations, Cited by: Introduction.
M. Otto (2018) Regulation (eu) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (general data protection regulation–gdpr). In International and European Labour Law, pp. 958–981. Cited by: Machine Unlearning.
O. Ronneberger, P. Fischer, and T. Brox (2015) U-net: convolutional networks for biomedical image segmentation. In International Conference on Medical Image Computing and Computer-Assisted Intervention, pp. 234–241. Cited by: Experimental Settings.
M. Sandler, A. Howard, M. Zhu, A. Zhmoginov, and L. Chen (2018) MobileNetV2: inverted residuals and linear bottlenecks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4510–4520. Cited by: Experimental Settings.
K. Simonyan and A. Zisserman (2015) Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations, Cited by: Experimental Settings.
H. Souri, L. Fowl, R. Chellappa, M. Goldblum, and T. Goldstein (2022) Sleeper agent: scalable hidden trigger backdoors for neural networks trained from scratch. In Advances in Neural Information Processing Systems, Vol. 35, pp. 19165–19178. Cited by: Main Results and Comparisons.
B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao (2019) Neural cleanse: identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy, pp. 707–723. Cited by: Introduction.
A. Warnecke, L. Pirch, C. Wressnegger, and K. Rieck (2023) Machine unlearning of features and labels. In Proceedings 2023 Network and Distributed System Security Symposium, Cited by: Machine Unlearning.
G. Wu, M. Hashemi, and C. Srinivasa (2022) PUMA: performance unchanged model augmentation for training data removal. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 36, pp. 8675–8682. Cited by: Machine Unlearning.
P. Zhang, J. Sun, M. Tan, and X. Wang (2023) Exploiting machine unlearning for backdoor attacks in deep learning system. arXiv preprint arXiv:2310.10659. Cited by: Introduction, Backdoor Attacks.

APPENDIX A
ADDITIONAL DETAILS AND EXPERIMENTAL EVALUATIONS

This appendix provides further technical details and supplementary analyses to facilitate reproducibility and a deeper understanding of our experimental methodology.

A. Datasets and Preprocessing

In all of our comparative experiments, we evaluated every method on the CIFAR-10 and ImageNet-10 datasets. For fairness, all methods use identical data splits and preprocessing pipelines. CIFAR-10 consists of 50,000 training images and 10,000 test images, covering 10 object categories. ImageNet-10 is constructed by randomly selecting 10 mutually exclusive classes from the standard ImageNet dataset. All images are resized to 32 × 32 for CIFAR-10 and 224 × 224 for ImageNet-10. For both datasets, we apply standard normalization using the per-channel mean and standard deviation. Data augmentation includes random horizontal flipping, random rotation and random cropping for CIFAR-10, and random resized cropping for ImageNet-10.

B. Unlearning Methods Adopted

In our experiments, we used three unlearning strategies: SISA, First-Order unlearning, and PUMA unlearning. These methods are designed to remove the influence of requested training samples while preserving the model’s utility on the remaining data.

•

SISA: An exact unlearning framework that organizes training data via sharding and slicing, generates final results through sub-model aggregation, and handles unlearning by retraining only the affected shard.
•

First-Order: A first-order approximate unlearning algorithm that applies gradient ascent to the requested forgetting samples to induce the forgetting effect.
•

PUMA: An approximate unlearning algorithm that estimates the influence of removed samples and compensates for their removal by optimally reweighting the remaining data.

C. Baseline Adaptation and Evaluation Settings

To ensure a fair comparison, all methods are evaluated under a unified clean-label protocol, where all crafted samples retain their original labels and share identical experimental and machine-unlearning settings. For UBA-Inf, we instantiate its influence-driven camouflage framework using the LC backdoor adopted in its original evaluation. For UNCLEAN, we report two variants. UNCLEAN-Origin follows the original clean-counterpart forgetting protocol, whereas UNCLEAN-Align restricts the removal set to records that participate in victim-model training and uses the same forgetting budget as our method. Sleeper Agent does not originally include a removable suppression mechanism for unlearning-triggered activation. We therefore preserve its original clean-label trigger construction and augment it with a naive mitigation-sample construction. All mitigation samples preserve their original labels, and their number and forgetting budget are matched to the camouflage setting of our method. This adaptation is used to evaluate whether a conventional clean-label backdoor combined with non-optimized removable mitigation samples can realize a comparable dormant-to-activated transition.

Algorithm 1 Bilevel Optimization for Dual-Generator Learning

1:Input: training set

\mathcal{D}

, backdoor subset

\mathcal{P}

, camouflage subset

\mathcal{C}

, target label

y_{t}

, generators

G_{\phi}

and

M_{\psi}

, reference models

f_{\theta_{c}}

and

f_{\theta_{p}}

, unlearning algorithm

\mathcal{F}_{\mathrm{unlearn}}

, optimization rounds

R

2:Output: Optimized generators

G_{\phi^{*}}

and

M_{\psi^{*}}

3:Initialize generator parameters

\phi

and

\psi

4:for each outer-level round

r\in[1,R]

5:// Outer-level sample construction induced by current generators

\mathcal{P}_{r}\leftarrow\{(B_{\phi}(x),y)\mid(x,y)\in\mathcal{P}\}

\mathcal{C}_{r}\leftarrow\{(C_{\phi,\psi}(x),y)\mid(x,y)\in\mathcal{C}\}

\mathcal{D}_{r}\leftarrow(\mathcal{D}\setminus(\mathcal{P}\cup\mathcal{C}))\cup\mathcal{P}_{r}\cup\mathcal{C}_{r}

9:// Inner-level training and unlearning simulation

10:

\theta_{l}^{r}\leftarrow\mathrm{Train}(\theta_{l}^{r-1},\mathcal{D}_{r})

11: Choose an unlearning set

\mathcal{U}_{r}\subseteq\mathcal{C}_{r}

12:

\theta_{u}^{r}\leftarrow\mathcal{F}_{\mathrm{unlearn}}(\theta_{l}^{r},\mathcal{U}_{r})

13:// Outer-level generator update with inner-level feedback

14: Compute the trigger-generator objective

15:

\mathcal{L}_{G}^{r}=\lambda_{l}\mathcal{L}_{latent}^{G}+\lambda_{a}\mathcal{L}_{act}^{G}+\lambda_{v}\mathcal{L}_{vis}^{G}+\lambda_{c}\mathcal{L}_{clean}^{G}

16: Update the trigger generator

17:

\phi\leftarrow\phi-\alpha_{G}\nabla_{\phi}\mathcal{L}_{G}^{r}

18: Compute the camouflage-generator objective

19:

\mathcal{L}_{C}^{r}=\lambda_{o}\mathcal{L}_{opp}^{C}+\lambda_{m}\mathcal{L}_{margin}^{C}+\lambda_{cl}\mathcal{L}_{clean}^{C}+\lambda_{r}\mathcal{L}_{vis}^{C}

20: Update the camouflage generator

21:

\psi\leftarrow\psi-\alpha_{C}\nabla_{\psi}\mathcal{L}_{C}^{r}

22:end for

23:return

G_{\phi^{*}}=G_{\phi}

and

M_{\psi^{*}}=M_{\psi}

D. Bilevel Optimization for Dual-Generator Learning

Algorithm 1 presents the complete optimization procedure of the proposed dual-generator framework. At each outer-level round, the current trigger and camouflage generators construct the corresponding backdoor and camouflage samples, which are combined with the remaining clean data to form the surrogate training set. The inner level then updates the latent surrogate model and simulates machine unlearning on a selected subset of camouflage samples, yielding dynamically refreshed latent and post-unlearning model states. These model states provide state-specific feedback for the outer-level optimization and are treated as fixed when updating the generators, with gradients propagated through the generated samples rather than through the surrogate training or unlearning procedures. Accordingly, the trigger generator is optimized to preserve dormancy in the latent model while inducing target behavior after unlearning, whereas the camouflage generator learns a label-consistent suppressive influence that can be removed by the subsequent unlearning request. Repeating this alternating process coordinates persistent latent trigger associations with removable camouflage suppression.

E. Verification of Camouflage-Removal-Induced Activation

To verify whether the post-unlearning activation is attributable to the specific removal of camouflage samples, rather than to general model-performance degradation caused by the unlearning operation itself, we conduct a series of verification experiments under the same experiment setting. We first apply the unlearning operation to randomly selected clean training samples from a clean model. This setting quantifies the general benign-accuracy degradation caused by equal-budget unlearning. We then evaluate a poisoned model trained with trigger-bearing samples generated by the same optimized trigger generator as the full method, but without any camouflage samples. The same number of randomly selected clean samples is unlearned from this model to examine whether camouflage samples are necessary for suppressing the trigger association and maintaining the dormant state before unlearning. Finally, for the same full latent model, we compare two removal settings. In the first setting, the same unlearning update is applied using the clean source counterparts of the selected camouflage samples. In the second setting, the actual camouflage samples $\mathcal{U}\subset\mathcal{C}^{\prime}$ are unlearned. This comparison examines whether the strong activation is specifically associated with removing the learned influence of the camouflage samples, rather than merely with the corresponding sample content or an equal-budget model update.

As shown in Table 4, unlearning random clean samples under the same configuration also causes a comparable decrease in benign accuracy, indicating that the observed BA-U reduction is not specific to camouflage removal. Without camouflage samples, the poisoned model already exhibits a high pre-unlearning ASR, confirming their role in maintaining backdoor dormancy. More importantly, for the same full latent model, removing the actual camouflage samples produces substantially stronger activation than the clean-source counterpart control. Although BA-U decreases further, the additional degradation remains modest relative to the substantial increase in ASR. Overall, these results demonstrate that the camouflage samples are essential for maintaining the dormant state and that the subsequent dormant-to-activated transition is primarily driven by removing their learned suppressive influence.

Training Configuration	Removal Set	ASR	BA	ASR-U ( $\Delta$ )	BA-U
Clean only	Random clean samples	3.93	93.68	7.29 (+3.36)	86.29
Backdoor only	Random clean samples	60.72	92.49	83.64 (+22.92)	85.65
Backdoor + camouflage	Clean source counterparts	12.67	93.35	36.78 (+24.11)	86.84
Backdoor + camouflage	Camouflage samples $\mathcal{U}$	12.67	93.35	87.87 (+75.20)	83.24

Table 4: Verification experiments for camouflage-removal-induced activation on CIFAR-10.

F. Visual Examples of Crafted Samples

To qualitatively assess the visual consistency of the crafted samples, we present poisoned and camouflage samples from CIFAR-10 and ImageNet-10 together with their corresponding clean source images. As shown in Fig. 6, for each dataset, the upper row contains the clean source images and the lower row contains their corresponding crafted samples. The first two columns show poisoned samples, while the last two columns show camouflage samples. The poisoned and camouflage samples preserve the primary object appearance and recognizable semantic content of their clean counterparts, without introducing conspicuous localized patterns or altering the semantics associated with their original labels. These examples illustrate that both types of crafted samples maintain visual and label consistency under the clean-label data-submission setting.

G. Additional Defense Evaluation

In this section, we further evaluate the resistance of the proposed attack to STRIP, complementing the fine-pruning evaluation reported in the main paper. Experiments are conducted on CIFAR-10 and ImageNet-10 under First-Order unlearning, considering both the latent model before unlearning and the activated model after unlearning. STRIP is implemented following its original evaluation protocol.

STRIP. STRIP detects potential backdoor inputs by repeatedly superimposing them with clean images and measuring the entropy of the resulting predictions. Conventional backdoor inputs tend to preserve the attacker-specified prediction under such perturbations and therefore exhibit abnormally low entropy. As shown in Fig. 7, the entropy distributions of clean and trigger-bearing inputs substantially overlap for the latent models on both CIFAR-10 and ImageNet-10. After unlearning, substantial overlap remains on CIFAR-10, while the trigger-bearing inputs on ImageNet-10 shift toward higher rather than lower entropy. Therefore, the proposed attack does not exhibit the characteristic low-entropy pattern assumed by STRIP, limiting its ability to reliably distinguish trigger-bearing inputs from clean inputs in either the latent or activated state.


(a)	(b)

(c)	(d)



(a) CIFAR-10 (Poisoned)		(b) CIFAR-10 (Camouflage)


(c) ImageNet-10 (Poisoned)		(d) ImageNet-10 (Camouflage)