CLASP: CLIP-Aligned Semantic Poisoning for Class-Dispersive Misclassification

The deep neural network constructed using third-party data sets and pre-trained models has a potential threat of a backdoor trigger that remains dormant when given clean data, but will trigger a certain action as soon as that trigger is activated. Most such attacks are targeted, binding one trigger to one label, and that one-to-one signature is exactly what defenses such as trigger reconstruction and mixing-based entropy tests are built around. Untargeted backdoors remove the fixed target, but two problems persist: an unconstrained objective quietly collapses onto whichever wrong class sits nearest in feature space [1], and even genuinely dispersed errors often land on classes with no semantic relation to the source [1,2], an implausibility a context-aware check can catch on sight. We propose CLASP (CLIP-Aligned Semantic Poisoning), an untargeted backdoor that keeps induced errors dispersed yet semantically coherent while poisoning only thirty images of a single source class. Rather than scattering predictions arbitrarily, CLASP confines them to a compact “cousin” set of three related classes chosen by proximity to CLIP text-embedding prototypes [3], so a vehicle is only ever pushed toward another vehicle. The trigger is restricted to the pixels a Grad-CAM saliency mask marks as decision-relevant and synthesized on the fly by a lightweight U-Net-style generator, keeping the perturbation imperceptible. Training proceeds through a clean warm-up followed by joint optimisation under a five-term objective: source-label suppression, cosine alignment to a dynamically reweighted CLIP prototype, flipped one-hot targeting over the cousin set, logit normalisation that blocks re-collapse onto one favourite cousin, and a spectral-decoupling penalty that keeps poisoned features from bunching into a single, isolable direction. On CIFAR-10 and CIFAR-100 with a ResNet-18 victim, and on GTSRB with a PreActResNet-18 victim, CLASP attains attack success rates above 99.9%, dispersibility above 0.92, clean-accuracy drops of at most 0.5 points (0.42, 0.50, and 0.24, respectively), and imperceptibility above 36 dB, confirming that the attack generalises across datasets and architectures. CLASP further evades three representative defenses, remaining below Neural Cleanse’s anomaly-index threshold, producing STRIP entropy close to that of clean inputs, and retaining an attack success rate above 79% even after 90% Fine-Pruning.