PaperlayerView exact revision on arXiv

Source-linked AI summary

Hidden Backdoor Attack on Deep Contrastive Clustering

Zifeng Zhou, Shengda Zhuo, Jiahui Huang, Zeyan Li, Jinchun He, Peipeng Yu, Wangjie Qiu, Zhiming Zheng, Shuqiang Huang

arXiv:2610.33116v1cs.CR

TL;DR

Backdoor attacks on deep contrastive clustering remain underexplored, despite the distinct challenge of manipulating clusters without explicit labels. HBDCC poisons a small fraction of unlabeled samples and exploits persistent triggers aligned across augmented views. Across representative models, triggered inputs substantially degrade clustering while clean-data utility is generally preserved, with effects varying by dataset.

  • Problem

    Backdoor feasibility and impact in deep contrastive clustering remain poorly understood, although clustering lacks the explicit labels that define conventional classification attacks.

    Source: §I · p. 1, E. Summary and Our Contributions · p. 4

  • Method

    HBDCC poisons a small fraction of unlabeled training samples so augmentation-persistent triggers form dormant associations that activate on triggered inputs.

    Source: §I · p. 2

  • Results

    Across representative contrastive clustering models, triggered inputs substantially degrade clustering while clean-data utility is generally preserved, with effects varying by dataset.

    Source: §I · p. 13, §VI · p. 14

  • Takeaways & Limitations

    The findings identify a backdoor vulnerability specific to clustering behavior and semantic grouping, beyond downstream label prediction.

    Source: E. Summary and Our Contributions · p. 4

    The study covers representative image benchmarks and contrastive clustering architectures; larger datasets, non-visual domains, and foundation-model-based clustering remain uninvestigated.

    Source: §VI · p. 14

Abstract

from arXiv · show

Deep contrastive clustering has become a representative paradigm for unsupervised image clustering, yet its security under training-time poisoning remains largely unexplored. This paper investigates a hidden backdoor threat against deep contrastive clustering and proposes HBDCC, a Hidden Backdoor attack for Deep Contrastive Clustering. Here, hidden does not indicate that the trigger is visually imperceptible, but rather that the malicious trigger-cluster association remains behaviorally dormant on clean inputs and is activated only when the trigger appears at inference time. HBDCC poisons only a small fraction of unlabeled training samples and exploits an inherent structural weakness of contrastive clustering: augmentation-persistent triggers can be repeatedly aligned across different views at the instance level and further reinforced by cluster-level consistency objectives. As a result, the poisoned model preserves normal clustering behavior on clean data, while producing severely distorted cluster assignments for triggered inputs. We provide a dual-level analysis of the backdoor implantation mechanism and evaluate HBDCC on ImageNet-10, ImageNet-Dogs, and STL-10 with representative contrastive clustering frameworks. Extensive experiments demonstrate that HBDCC can substantially degrade triggered clustering performance in a dataset-dependent manner while maintaining sufficient clean-data utility to evade standard evaluation protocols. We further conduct comprehensive studies on poisoning ratio, attack scope, trigger type, trigger size, and a lightweight knowledge-distillation-based mitigation strategy.

I. INTRODUCTION

The introduction identifies a largely unexplored backdoor risk in deep contrastive clustering, where augmentation-persistent triggers may become stable semantic cues and distort cluster assignments. It presents HBDCC as a small-budget poisoning attack that preserves clean-data behavior, evaluates its scope, and considers distillation as a mitigation.

A. Deep Clustering and Contrastive Clustering

  • Contrastive clustering combines augmentation-based instance discrimination with cluster-level consistency to learn cluster-friendly representations.The introduction notes that security implications of absorbing persistent shortcut patterns as semantic invariants have received little examination.Source: §I · p. 1, A. Deep Clustering and Contrastive… · p. 3

I. INTRODUCTION

  • The paper frames deep contrastive clustering security as underexplored, despite its use of unlabeled data from sources whose integrity may be uncertain.Prior backdoor work has focused mainly on supervised tasks, while clustering-specific attack goals and consequences remain less understood.Source: §I · p. 1
  • Persistent triggers can become stable semantic cues under augmentation, reshaping the embedding space and cluster assignments without label supervision.The trigger-related features are aligned across augmented views at the instance level, supporting subsequent cluster-level distortion.Source: Figure 1 · p. 1, §I · p. 2
  • Experiments cover ImageNet-10, ImageNet-Dogs, and STL-10 with representative frameworks, analyzing poisoning ratio, trigger type, trigger size, and attack scope.A knowledge-distillation defense using a small amount of clean unlabeled data reduces the backdoor effect and recovers much, but not all, clustering capability.Source: §I · p. 2
  • HBDCC poisons a small fraction of unlabeled samples to manipulate clustering while largely preserving clean-data performance.The paper defines “hidden” as an association dormant on clean inputs and activated by the trigger, not as visual imperceptibility.Source: §I · p. 2

B. Backdoor Attacks in Deep Learning

Prior backdoor research largely centers on supervised classification, while unlabeled representation-learning studies often evaluate downstream tasks rather than clustering behavior. The paper positions HBDCC as a direct study of how poisoning can alter clustering geometry and semantic grouping.

B. Backdoor Attacks in Deep Learning

C. Data Poisoning in Unsupervised and Self-Supervised Learning

  • Prior self-supervised poisoning studies mostly target generic encoders or downstream tasks, leaving end-to-end clustering structure and assignments less examined.Their evaluations commonly use downstream classification or detection rather than intrinsic clustering behavior.Source: C. Data Poisoning in Unsupervised and… · p. 4

D. Backdoor Attacks in Contrastive Learning

  • Contrastive-learning backdoors exploit augmentation-invariant alignment, but prior work focuses mainly on encoders, downstream transfer, or multimodal alignment rather than clustering systems.Clustering-specific components such as prototype learning and assignment consistency remain outside that focus.Source: D. Backdoor Attacks in Contrastive… · p. 4

E. Summary and Our Contributions

  • The paper addresses this gap with an attack that targets clustering behavior and semantic grouping in embedding space while preserving clean-data behavior.It identifies contrastive alignment as a route to representation-level backdoor implantation.Source: E. Summary and Our Contributions · p. 4

III. THREAT MODEL

The threat model places HBDCC in unlabeled, training-time data poisoning: the attacker seeks a trigger association that stays dormant on clean inputs but distorts clustering when triggered. The attacker is limited to a small poisoning budget and constrained triggers, with no label access or changes to the victim’s training pipeline.

A. Attacker’s Capabilities

B. Attacker’s Objective

  • HBDCC targets representation geometry and cluster formation, aiming to manipulate triggered assignments while preserving clean-data clustering utility.Source: B. Attacker’s Objective · p. 5

C. Attacker’s Constraints

  • The trigger must be localized and avoid significantly degrading sample semantics; its hidden property is dormant clean-input behavior, not imperceptibility.Source: C. Attacker’s Constraints · p. 5
  • The attack is training-time only: the attacker cannot intervene in inference, post-processing, or deployment.Source: C. Attacker’s Constraints · p. 5

D. Defender’s Assumptions

The defender is assumed to train on unlabeled data without knowing the poisoned subset or trigger. HBDCC instead relies on poisoning the data and exploiting the instance- and cluster-level objectives of contrastive clustering.

D. Defender’s Assumptions

  • The defender is unaware of poisoned samples and the trigger, and lacks labeled validation data; the described mitigation setting permits post hoc measures or a small amount of clean unlabeled data.Source: D. Defender’s Assumptions · p. 5

IV. METHOD

  • HBDCC attacks representation learning and cluster formation without explicit target-label manipulation.Source: §IV · p. 5
  • Persistent triggers can be aligned across augmented views at the instance level, then reinforced by cluster-level consistency into a broader structural bias.Source: §IV · p. 5
  • The attacker poisons a small number of samples, leaves the victim’s original training objective unchanged, and activates the association by adding a trigger at test time.Source: §IV · p. 5

A. Preliminaries: Dual-Level Contrastive Clustering

1) Instance-Level Contrastive Objective:

The victim objective couples instance-level view invariance with cluster-level consistency. HBDCC exploits both: trigger-biased representations can be reinforced as stable cluster assignments.

1) Instance-Level Contrastive Objective:

2) Cluster-Level Contrastive Objective:

  • At the cluster level, assignments from the two views form positive cluster pairs while other cluster columns act as negatives; consistency can consolidate trigger bias.Source: 2) Cluster-Level Contrastive Objective · p. 6
  • The trigger bank allows different poisoned subsets to use different patterns, supporting single-trigger and multi-trigger poisoning settings.Source: Figure 3 · p. 7

3) Overall Objective of the Victim Model:

The paper identifies the victim model’s dual-level objective as central to HBDCC: persistent triggers can bias instance invariance and cluster assignment consistency.

3) Overall Objective of the Victim Model:

B. Trigger-Based Poisoning Strategy

HBDCC uses a small, augmentation-stable trigger bank to poison unlabeled samples, then exploits instance- and cluster-level objectives to implant trigger-associated clustering bias.

B. Trigger-Based Poisoning Strategy

  • The trigger bank should contain localized, augmentation-stable, learnable, and diverse patterns that do not dominate image semantics.Diversity allows poisoned subsets to form different trigger-associated regions rather than collapsing into one trigger type.Source: B. Trigger-Based Poisoning Strategy · p. 7
  • The attacker samples a poisoned subset and may divide it into disjoint subsets, each associated with a distinct trigger pattern.For each selected clean image, the trigger is injected at a randomized position, with α controlling strength or blending.Source: B. Trigger-Based Poisoning Strategy · p. 7
  • A small poisoning budget, randomized trigger placement, and limited trigger size and strength help preserve clean behavior while allowing triggers to survive common augmentations.The trigger bank follows a common trigger-based backdoor formulation,,.Source: B. Trigger-Based Poisoning Strategy · p. 7

C. Backdoor Implantation under Dual-Level Objectives

  • Persistent triggers align poisoned views at the instance level, while similar soft cluster assignments reinforce the bias into a stable trigger-associated cluster region.The coupled process turns a local persistent cue into a malicious clustering prior.Source: C. Backdoor Implantation under… · p. 7

D. Inference-Time Activation and Cluster Distortion

At inference, a trigger draws a sample toward its learned representation region and can distort cluster structure; clean-data knowledge distillation is proposed to mitigate this effect.

D. Inference-Time Activation and Cluster Distortion

  • Triggered representations are drawn toward the learned trigger-associated region, enabling manipulation of cluster assignments regardless of original semantic identity.Typical structural corruption includes cross-class confusion and splitting one semantic class across clusters; accumulated poisoned samples can shift cluster centroids toward trigger-dominated regions.Source: D. Inference-Time Activation and… · pp. 7–8

E. Knowledge-Distillation-Based Mitigation

  • A clean teacher transfers clustering knowledge to a student initialized from the poisoned model using a small clean unlabeled subset.The student matches the teacher’s clean clustering behavior through a distillation term based on their soft cluster distributions; the objective uses balancing coefficients.Source: E. Knowledge-Distillation-Based… · p. 8
  • Clean-only distillation stops reinforcing trigger correlations and is intended to restore benign semantic structure without requiring labels.The proposed defense suppresses backdoor-dependent behavior while inheriting the clean teacher’s clustering structure.Source: E. Knowledge-Distillation-Based… · p. 8

F. Overall Attack Algorithm

HBDCC poisons unlabeled training data and trains the victim with its original objective, exploiting the interaction of instance-level invariance and cluster-level consistency. The experiments evaluate the attack on three benchmark image datasets.

F. Overall Attack Algorithm

  • HBDCC is a pure data-poisoning attack that requires neither label access nor modifications to the victim training pipeline.Its mechanism exploits the structural vulnerability created by coupled instance-level invariance and cluster-level consistency.Source: F. Overall Attack Algorithm · p. 8
  • The algorithm samples poisoned subsets, randomizes trigger locations, constructs a poisoned dataset, and trains on augmented views to obtain a poisoned model.The listed pipeline computes features, instance embeddings, cluster assignments, and the original objective before updating model parameters.Source: F. Overall Attack Algorithm · p. 8

V. EXPERIMENTS

  • Experiments evaluate HBDCC on ImageNet-10, ImageNet-Dogs, and STL-10, examining attack behavior across ratios, poisoning scope, architectures, trigger settings, and mitigation.The paper identifies the datasets as benchmark image-clustering datasets and describes representative examples in Fig. 4.Source: §V · p. 8, Figure 4 · p. 9

A. Experimental Setup

The experiments use three image-clustering datasets and evaluate clean and triggered performance under varied poisoning ratios and scopes. Poisoning generally preserves clean utility while triggered inputs expose substantial clustering degradation, especially under multi-class poisoning.

A. Experimental Setup

  • The evaluation uses ImageNet-10, ImageNet-Dogs, and STL-10, with Contrastive Clustering as the primary victim model and NMI, ARI, and ACC as clustering metrics.ImageNet-10 and STL-10 each contain 13,000 images from 10 categories; ImageNet-Dogs contains 19,500 images from 15 dog breeds.Source: A. Experimental Setup · p. 9

B. Attack Performance under Different Poisoning Ratios

  • Applying triggers to a clean model causes only minor changes, including an ImageNet-10 ACC decrease from 89.5 to 89.0.The authors attribute later degradation to the model learning a trigger-dependent association during poisoned training, rather than to input-level corruption alone.Source: B. Attack Performance under Different… · p. 9
  • At 10% poisoning, ImageNet-10 ACC falls from 88.4 on clean inputs to 73.3 on triggered inputs, while ImageNet-Dogs and STL-10 triggered ACC are 10.1 and 10.4.Across poisoning ratios, clean ACC stays between 88.4 and 90.2 on ImageNet-10 and between 74.5 and 78.7 on STL-10; ImageNet-Dogs is less stable.Source: B. Attack Performance under Different… · p. 10
  • Triggered NMI can remain comparatively higher than ACC and ARI when some coarse grouping persists despite damaged label-to-cluster alignment.The authors report non-monotonic NMI on STL-10 at 10% poisoning and interpret Fig. 5 as showing disrupted embedding geometry.Source: B. Attack Performance under Different… · p. 10

C. Single-Class versus Multi-Class Poisoning

  • Multi-class poisoning lowers triggered NMI/ARI/ACC to 55.7/51.7/73.3, compared with 74.8/64.3/80.5 under single-class poisoning.Clean performance remains strong in both settings: 85.9/82.1/88.4 for multi-class and 85.7/82.1/89.3 for single-class poisoning.Source: C. Single-Class versus Multi-Class… · p. 10
  • Single-class poisoning can affect samples beyond its source class, while multi-class poisoning introduces biases across more semantic regions and causes stronger global disruption.The authors describe multi-class poisoning as producing more severe cross-class confusion and degradation in overall clustering quality.Source: C. Single-Class versus Multi-Class… · p. 10

D. Transferability across Contrastive Clustering Architectures

HBDCC degrades triggered clustering across representative architectures, with attack strength varying by trigger design and size. Trigger-2 and a 50×50 trigger are strongest in their respective tests.

D. Transferability across Contrastive Clustering Architectures

  • After the attack, t-SNE visualizations show more cross-class mixing and degraded semantic consistency than the compact, separable clean-model clusters.The figure covers ImageNet-10, ImageNet-Dogs, and STL-10.Source: Figure 5 · p. 11

E. Effect of Trigger Type

  • Trigger-2 is most destructive, reducing NMI/ARI/ACC to 68.9/47.7/73.2, while Trigger-3 leaves scores at 76.5/69.7/83.1.Across the tested trigger designs, changing the pattern shifts ACC by nearly ten points and ARI by more than twenty points.Source: E. Effect of Trigger Type · pp. 11–12, Table VI · p. 12

F. Effect of Trigger Size

  • The 50×50 trigger produces the strongest attack, reducing NMI/ARI/ACC to 55.7/51.7/73.3, versus 85.6/81.8/89.0 for the clean model on the same triggered test protocol.The 40×40 trigger is less destructive, and the 60×60 trigger is also weaker; an oversized patch may interfere with image semantics.Source: F. Effect of Trigger Size · p. 12

D. Transferability across Contrastive Clustering Architectures

  • VTCC, SACC, and PCLC all degrade under HBDCC; VTCC falls from 85.0/81.7/89.4 to 23.0/5.2/28.8 in NMI/ARI/ACC, while PCLC remains most robust but still declines.SACC also drops from 87.7/84.3/90.5 to 45.9/40.5/65.6; the results suggest the vulnerability is not limited to one implementation.Source: D. Transferability across Contrastive… · pp. 10–11, Table V · p. 12

G. Generality across Different Trigger Carriers

Alternative trigger carriers retain clean-data utility while degrading clustering on triggered inputs, though the magnitude varies by carrier. Knowledge distillation substantially mitigates but does not eliminate the backdoor, and the study’s evidence remains bounded to representative image benchmarks and contrastive architectures.

I. Discussion

  • HBDCC’s effect varies with dataset separability, poisoning scope, and trigger design, and VTCC, SACC, and PCLC all show degradation under the same poisoning protocol.The discussion attributes trigger-pattern effects to how reliably cues survive augmentation and attack-scope effects to how broadly associations affect cluster geometry.Source: §I · p. 13

G. Generality across Different Trigger Carriers

  • The default trigger yields triggered NMI/ARI/ACC of 55.7/51.7/73.3, with decreases of 30.2, 30.4, and 15.1 points from clean-input performance; all four alternatives also degrade triggered-input scores.Across alternatives, SIG-style has the lowest triggered scores at 73.5/68.8/81.7, while clean scores remain close to the default-trigger results.Source: G. Generality across Different Trigger… · pp. 12–13, Table VIII · p. 14

H. Knowledge-Distillation Defense

  • Knowledge distillation raises triggered ImageNet-10 NMI/ARI/ACC from 55.7/51.7/73.3 to 78.6/74.8/85.8, mitigating the attack without fully removing it.The remaining ACC gap indicates that some triggered samples are still assigned to incorrect clusters.Source: H. Knowledge-Distillation Defense · p. 13, Table IX · p. 14

VI. CONCLUSION

  • Across representative contrastive clustering models, triggered inputs substantially degrade clustering while clean-data utility is generally preserved; knowledge distillation with clean unlabeled data mitigates but does not fully remove the backdoor.The conclusion notes that attack strength varies by dataset and is particularly strong in challenging fine-grained settings.Source: §VI · p. 14
  • The study covers representative image benchmarks and contrastive clustering architectures; larger datasets, non-visual domains, and foundation-model-based clustering remain to be investigated.Transferability and concealment of adaptive or learned triggers are also open questions because the attack uses manually designed trigger banks.Source: §VI · p. 14
Loading 2610.33116v1…