PaperlayerView exact revision on arXiv

Source-linked AI summary

Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse

Junhoo Lee, Baekseung Kim, Seungyeon Kim, Nojun Kwak

arXiv:2610.21208v1cs.CRcs.LG

TL;DR

Conventional trigger-based backdoors can collapse when a student learns from clean-data distillation queries that omit trigger-positive inputs. DAR discovers rules already supported by clean data and relabels samples that satisfy them; it preserves high attack success after clean-data KD and across other evaluated reuse settings.

  • Problem

    Conventional trigger-based backdoors may be washed out by clean-data KD because the student does not observe trigger-positive inputs, making persistence depend on whether the malicious relation has clean-query support.

    Source: §1 · p. 2, §2 · p. 3

  • Method

    DAR discovers naturally abundant subspace rules and relabels clean samples that already satisfy them, so the malicious relation is observable during training and clean-query reuse.

    Source: §1 · p. 2, §3.2 · p. 4, §5 · p. 10

  • Results

    DAR preserves over 96% student ASR in both teacher–student pairs after clean-data KD, while artificial-trigger baselines’ student ASR drops to almost zero; it also maintains high attack success across other evaluated reuse settings.

    Source: §1 · p. 3, §4.2 · p. 6

  • Takeaways & Limitations

    Persistence after reuse depends on whether the malicious input-label relation is visible under clean distillation queries, not merely on teacher-side attack success.

    Source: §4.2 · p. 6, §5 · p. 10

    The empirical scope is limited to vision models and evaluated spatial and frequency subspaces, digital activation, clean-data KD, prompt tuning, input perturbations, and standard defenses.

    Source: §5 · p. 10

Abstract

from arXiv · show

Traditional backdoor attacks inject artificial trigger patterns into training data, causing models to misclassify triggered inputs while maintaining normal behavior on clean samples. Since these artificial triggers are absent in clean datasets, standard knowledge distillation (KD) typically eliminates them, leading to the common belief that KD serves as an effective purification defense. In this paper, we propose DAR (Discover-and-Relabel), a support-persistent backdoor method that retains its behavior even after clean-data distillation. DAR identifies naturally abundant patterns in low-dimensional feature subspaces using subspace clustering and applies label-only poisoning to samples that inherently satisfy the discovered rule. At test time, the backdoor is activated by locally modifying the corresponding subspace of the target images. By instantiating spatial and frequency operators, DAR achieves attack accuracy comparable to state-of-the-art backdoor attacks in ImageNet classification and CLIP-based prompt tuning. Notably, DAR keeps attack success above 96% after clean KD and remains defense-resistant in practice. Project page: https://junhoo.me/backdoor

1 Introduction

Clean-query model reuse challenges backdoor persistence because students may never observe the hidden input condition. DAR discovers rules supported by clean data and relabels only samples that satisfy them, enabling the malicious relation to remain observable during reuse.

1 Introduction

  • Clean-query reuse challenges persistence because the student may never observe the hidden input condition associated with the target output.A persistent relation must remain observable after model reuse or adaptation.Source: §1 · p. 1
  • DAR discovers naturally supported rule-positive relations in clean data and relabels only matching samples, so downstream clean queries can repeatedly expose the relation.This avoids requiring artificial trigger-positive samples during downstream reuse.Source: §1 · p. 2
  • The paper frames persistence as rule injection over the clean query distribution, with support mismatch identified as the key failure mode of conventional triggers.DAR is presented as an automated alternative to manually defining a trigger and forcing training images into its positive region.Source: §1 · p. 2
  • DAR preserves high attack success under clean-data KD, OOD distillation, cross-architecture transfer, CLIP prompt tuning, input perturbations, and standard defenses, while conventional trigger-based backdoors collapse.The framework instantiates automatically discovered rules in spatial and frequency subspaces.Source: §1 · pp. 2–3

2 Related Work

Prior backdoor approaches often depend on externally enforced triggers or clean-image relations that are not designed for persistence under clean-query reuse. The paper distinguishes that goal from teacher-side stealth and emphasizes whether a malicious relation is supported by downstream queries and controllable at inference.

Trigger-Centric Backdoors

  • Trigger-centric attacks define a trigger, modify samples to contain it, and train a target-label mapping; high teacher attack success does not ensure persistence after downstream reuse.The same controllable input-output relation can also serve watermarking and model ownership verification [11] [12].Source: §2 · p. 3

Persistence under Model Reuse

  • Clean-data KD exposes the transfer-time gap: trigger-positive inputs are negligible in clean queries, so students may observe normal behavior and lose the trigger-target relation.The paper characterizes this as support mismatch rather than merely a weakness of a particular trigger shape [21–26].Source: §2 · p. 3
  • Universal adversarial perturbations can be applied across images, but universality alone does not establish clean-query support and may be fragile to preprocessing or frequency filtering.Other representation and prompt-failure studies do not establish persistence of an implanted backdoor under distillation.Source: §2 · p. 3

Clean-Image and Label-Only Backdoors

  • Clean-image and label-only attacks keep poisoned images visually unchanged, but their objectives generally emphasize training-time stealth rather than persistence under clean-query reuse.Prior approaches may rely on manually specified cues, dataset correlations, or trigger optimization [6] [8] [32] [9] [10].Source: §2 · p. 3

3 Method

DAR frames clean-data persistence as a support-matching problem: a backdoor rule must be observable in clean distillation queries. It discovers and relabels naturally rule-positive samples, then activates the same subspace rule at inference.

3.1 Problem Formulation

  • The threat model gives the attacker control of teacher training and labels, while the victim distills the teacher on clean data without attacker intervention.Transfer requires the trigger to lie within the support of the distillation data.Source: §3.1 · p. 4
  • Conventional attacks define artificial triggers, but clean-data KD rarely queries trigger-positive inputs, leaving the student without the trigger-target relation.Physical-trigger approaches instead rely on multi-object annotations or known dataset correlations.Source: §3.1 · p. 4, §3.2 · p. 4

3.2 Pattern Discovery Framework

  • DAR discovers a naturally abundant rule and relabels only clean samples that already satisfy it, exposing the target association during training and clean-data KD.The poisoned samples remain on the clean data support.Source: §3.2 · p. 4
  • DAR projects clean samples into a feature subspace and searches for a compact region containing the specified fraction ρ of projected samples.The rule-positive region is defined by proximity to the selected prototype.Source: §3.2 · pp. 4–5
  • Trigger-only backdoors vanish after clean-data KD, while DAR retains high ASR across both ImageNet distillation pairs.Table 1 contrasts teacher attack success with transfer to the student.Source: Table 1 · p. 5

3.3 Rule Activation and Subspace Choices

  • At inference, DAR moves an input into the mined prototype’s subspace region while preserving its remaining content, using spatial or frequency operators.Spatial activation replaces a selected image region; frequency activation substitutes central FFT coefficients and applies the inverse FFT.Source: §3.3 · p. 5

4 Experiments

The experiments test DAR across clean-data distillation settings, defenses, model families, and design choices. They evaluate whether support in the student’s clean queries is associated with backdoor transfer.

4.2 Results

  • Over 96% student ASR persists for DAR in both teacher–student pairs after clean-data KD, while artificial-trigger baselines fall to almost zero.DAR relabels clean rule-positive samples; the passage links transfer to whether the malicious relation is visible in the student’s clean queries.Source: §4.2 · p. 6

4.3 Robustness against Defense

  • Under blur and JPEG compression, UAP rapidly collapses while both DAR variants retain near-perfect ASR; Frequency DAR also preserves high ASR after many standard defenses.The defense comparison reports that DAR often matches or exceeds conventional trigger-injection backdoors.Source: Table 6 · p. 7, §4.3 · p. 8, Table 7 · p. 8

4.2 Results

  • DAR maintains high ASR on COCO and synthetic OpenGL queries when its rule remains observable, but removing the target class in SubImageNet drives ASR to zero.COCO and OpenGL lower clean accuracy; the results do not imply transfer under arbitrary proxy or subset distillation.Source: Table 2 · p. 6, §4.2 · p. 7
  • DAR backdoor-related channels contribute more on clean images than conventional backdoor channels, which remain at very low clean-input percentiles.The analysis compares channels contributing most to the target logit on attack inputs with their activity on 20K random clean ImageNet inputs.Source: Table 3 · p. 6, §4.2 · p. 7
  • In 16-shot CLIP prompt tuning with a frozen backbone, Frequency DAR achieves clean accuracy and ASR comparable to BadCLIP.Only the downstream prompt or adaptation module is trained with a small clean ImageNet set.Source: §4.2 · p. 7, Table 4 · p. 7

4.4 Ablation Studies

  • A ResNet50 teacher transfers high ASR to EfficientNetV2-B0 and, for Frequency DAR, DeiT-Tiny; Frequency DAR remains highly persistent at α = 0.5.The architecture transfer uses augmentation-heavy KD; reducing α weakens teacher imitation, and Spatial DAR recovers as the KD signal strengthens.Source: Table 8 · p. 8, §4.4 · pp. 8–10, Table 11 · p. 9
  • Small search pools generally recover representative rules, and both DAR variants maintain consistent teacher and student ASR across multiple ImageNet-100 target classes.Only extremely small search pools are an exception to the reported rule representativeness.Source: Table 9 · p. 8, §4.4 · p. 9, Table 10 · p. 9
  • Both DAR variants retain high ASR once poisoning rates provide adequate rule-positive support and remain effective with weaker test-time triggers than the main setting.Extremely small patches or weak frequency amplitudes can reduce ASR; smaller poisoning rates can also lower it.Source: §4.4 · p. 9, Figure 3 · p. 9, Figure 4 · p. 9

5 Conclusion

The conclusion presents DAR as support-preserving rule discovery for backdoors that can transfer through clean-data reuse. It limits the empirical claims to vision models and the evaluated activation and reuse settings.

5 Conclusion

  • DAR discovers naturally abundant subspace rules and relabels clean samples already satisfying them, making the malicious relation observable during teacher training and downstream clean-query reuse.The conclusion contrasts this with artificial triggers that disappear under clean-data KD.Source: §5 · p. 10
  • DAR consistently preserves high attack success after clean-data KD, whereas conventional artificial-trigger backdoors that succeed in the teacher largely collapse in the student.The conclusion states that persistence depends on whether the malicious input-label relation is supported by clean data and remains observable during distillation.Source: §5 · p. 10
  • The evidence is limited to vision models and tested spatial and frequency subspaces, digital activation, clean-data KD, prompt tuning, input perturbations, and standard defense pipelines.The authors caution against treating these results as an exhaustive characterization of other modalities, activation channels, or defender strategies.Source: §5 · p. 10

A Societal Impacts

The societal-impacts passage frames DAR as both a demonstration of vulnerability in clean-data reuse and a potential tool for watermarking and intellectual-property protection. It also calls attention to defenses against feature-based threats.

A Societal Impacts

  • The paper presents clean-data KD as a setting where malicious behavior may persist even when training and distillation data are clean.It describes the attack as hijacking naturally abundant, task-relevant features rather than relying on artificial trigger injection.Source: A Societal Impacts · p. 14
  • The passage identifies robust model watermarking and intellectual-property protection as potential uses of persistent backdoors.It describes this as a tool for model ownership protection.Source: A Societal Impacts · p. 14
  • The authors highlight the need for defenses against feature-based threats in clean-data reuse pipelines.Source: A Societal Impacts · p. 14

B Unlearning Dilemma

The unlearning-dilemma discussion connects Frequency DAR’s class-concentrated rules to clean-image statistics. It argues that removing those rules may conflict with retaining useful class-correlated structure.

B Unlearning Dilemma

  • If the frequency rule is entangled with class-relevant clean features, ordinary clean queries repeatedly expose the relation supporting the backdoor during distillation.The passage says the student may inherit this relation as part of the teacher’s legitimate decision rule.Source: B Unlearning Dilemma · p. 14
  • Removing Frequency DAR can conflict with preserving useful class-correlated structure, and the cited defense results do not show uniform ASR reduction without clean-accuracy degradation or failure under other defenses.Source: B Unlearning Dilemma · p. 14
  • Frequency DAR produces a more class-concentrated rule-positive distribution than Spatial DAR, while spatial rules are spread more evenly across classes.The authors interpret frequency rules as aligned with image statistics unevenly tied to semantic classes, rather than as isolated artifacts.Source: Figure 5 · p. 14, B Unlearning Dilemma · p. 14

C Additional OOD Support Measurements

ImageNet-C measurements test whether discovered rules remain present under common corruptions and shifted image statistics. Weighted trigger ratios remain close to the source poisoning rates.

C Additional OOD Support Measurements

D Additional Design Checks

The additional checks find DAR effective with L1 distance and grayscale evaluation, while the attack taxonomy selects four representative methods spanning major backdoor types.

D Additional Design Checks

E Types of Attacks

  • The paper’s evaluation uses four representative backdoor attack methods—BadNets, Blend [2], Refool [3], and WaNet [4]—which cover the major backdoor attack types used in the evaluation.Source: E Types of Attacks · p. 15

F Qualitative Results

The qualitative examples illustrate selected clean positives and their triggered variants, alongside an appendix taxonomy distinguishing static from dynamic attacks and describing representative trigger forms.

F.1 Attack Taxonomy

  • The taxonomy separates attacks into static and dynamic types according to trigger type and its relationship to the input data.Static attacks use consistent triggers, while dynamic triggers depend on image content.Source: §F.1 · p. 15, §F.2 · p. 15, §F.3 · p. 16

F Qualitative Results

  • Table 14 pairs selected clean positives mined by Spatial/Frequency rules with their triggered variants to illustrate targeted poison selection.The left column shows selected targeted poison samples, and the right shows benign images after trigger injection.Source: F Qualitative Results · p. 15, Table 14 · p. 16

F.3 Dynamic Attacks

  • WaNet [4] exemplifies dynamic attacks with imperceptible, image-specific warping that avoids a fixed repeating pattern.The described input-dependent transformation is difficult for defenses that search for consistent poisoned-input patterns to identify.Source: §F.3 · pp. 16–17

G Defense Evaluation Details

The defense evaluation distinguishes methods that modify the model from detectors that reject inputs, with different metrics for each. Mitigation methods use clean data where applicable, and detector thresholds are calibrated on clean validation samples.

G Defense Evaluation Details

  • Table 7 separates model-level mitigation, evaluated by clean accuracy (CA) and attack success rate (ASR), from detection, evaluated by clean block rate and effective ASR.Detectors reject suspicious inputs rather than repairing the classifier during inference-time filtering.Source: G Defense Evaluation Details · p. 17
  • Unless data-free by design, mitigation methods receive 1% of ImageNet training data, and CLP reports the best valid pruning threshold under a clean-accuracy constraint.The listed methods include fine-tuning, pruning and fine-tuning, adversarial unlearning, attention distillation, channel removal, and optimal-transport fusion.Source: G Defense Evaluation Details · p. 17
  • Detection thresholds are calibrated on clean validation samples at a 5% target false positive rate, with clean block rate and effective ASR reported.An effective detector should keep clean block rate low while sharply reducing ASR.Source: G Defense Evaluation Details · p. 17

Related papers

Loading 2610.21208v1…