Flareon: Stealthy any2any Backdoor Injection via Poisoned Augmentation

Open software supply chain attacks, once successful, can exact heavy costs in mission-critical applications. As open-source ecosystems for deep learning ﬂourish and become increasingly universal, they present attackers previously unexplored avenues to code-inject malicious backdoors in deep neural network models. This paper proposes Flareon , a small, stealthy, seemingly harmless code modiﬁcation that speciﬁcally targets the data augmentation pipeline with motion-based triggers. Flareon neither alters ground-truth labels, nor modiﬁes the training loss objective, nor does it assume prior knowledge of the victim model architecture, training data