Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse
DAR plants support-persistent backdoors that stay above 96 percent success after clean-data distillation.
DAR, short for Discover-and-Relabel, identifies naturally abundant patterns in low-dimensional feature subspaces and applies label-only poisoning to samples that already match the discovered rule. At test time, the backdoor is activated by locally modifying the corresponding subspace rather than inserting an artificial trigger. Instantiated with spatial and frequency operators, it matches state-of-the-art backdoor accuracy on ImageNet classification and CLIP-based prompt tuning. The authors report attack success remains above 96 percent after clean-data knowledge distillation and that the backdoor resists practical defenses.
- DAR uses naturally occurring subspace patterns and label-only poisoning.
- Test-time activation locally edits the matching feature subspace.
- Evaluated on ImageNet classification and CLIP-based prompt tuning.
- Attack success stays above 96 percent after clean knowledge distillation.
From the original article
1 min read at arxiv.orgTraditional backdoor attacks inject artificial trigger patterns into training data, causing models to misclassify triggered inputs while maintaining normal behavior on clean samples. Since these artificial triggers are absent in clean datasets, standard knowledge distillation (KD) typically eliminates them, leading to the common belief that KD serves as an effective purification defense.
By Junhoo Lee · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.