MM-Backdoor: Evasion-Aware Multi-Class Mapping Backdoor Attacks

Backdoor attacks exploit training data poisoning to embed hidden malicious behaviors into deep neural networks, with most existing research focusing on the all-to-one attack setting, where triggered inputs are misclassified into a single attacker-defined class. While alternative strategies, such as all-to-all and sub-class attacks, have been proposed, these often suffer from mapping collapse, where triggered samples from non-designated classes are misclassified into the same target class. This work introduces MM-Backdoor, the first systematic framework for multi-mapping backdoor attacks, which supports four mapping types: all-to-one, all-to-multi, sub-to-one, and sub-to-multi, allowing flexible and fine-grained control over attack design. The key innovation is the inclusion of an auxiliary evasion class to decouple the trigger presence from the class mapping, preventing trigger overfitting and enhancing mapping stability. Through three specialized training modes, MM-Backdoor effectively mitigates trigger dependency and enables reliable multi-mapping behaviors. Extensive experiments show that MM-Backdoor achieves superior flexibility and stability in mapping control compared to prior attacks, which often collapse into all-to-one mapping. Additionally, we demonstrate that existing defense mechanisms are highly sensitive to mapping complexity, with their performance deteriorating as the number of target or evasion classes increases, revealing a previously overlooked vulnerability.