Research map / Label-efficient and robust learning / Domain adaptation and generalization

Protecting Model Adaptation from Trojans in the Unlabeled Data

AAAI 2025 · Label-efficient and robust learning › Domain adaptation and generalization · approach: Statistical alignment and hypothesis testing · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that unlabeled target data poisoned with Blended or adversarial-perturbation triggers can backdoor model adaptation (SHOT, NRC), and proposes DiffAdapt, a plug-and-play defense that reweights samples by noise sensitivity of a risky target model.

Problem

Model adaptation (source-free domain adaptation) adapts a pre-trained source model to unlabeled target data, but the security risk of poisoned unlabeled target samples (trojan/backdoor injection) has not been studied.

Approach

Backdoors are injected purely through poisoning unlabeled target data, using a Blended trigger or a surrogate-model universal perturbation trigger, with poison sample selection by ground truth or CLIP pseudo-labels. The defense, DiffAdapt, trains a risky target model, measures each sample's prediction change under Gaussian noise, averages sensitivity per pseudo-label, and uses these as weights in

Key results

• On Office with the perturbation trigger, DiffAdapt reduces SHOT's average ASR from 81.6% to 15.4% and NRC's from 57.6% to 6.0%, with clean accuracy drops of about 2.3% and 2.2%.
• On OfficeHome with the pseudo-label poisoning strategy, DiffAdapt reduces ASR from 90.7% to 7.1% on SHOT at a 2.1% accuracy cost.
• Blended-trigger poisoning reaches average ASR of 80.8% on SHOT and 86.9% on NRC on OfficeHome while keeping clean accuracy nearly unchanged.

Measured effects reported in the paper

Surprising findings

• Poisoning only unlabeled target data, with no labels or source access, still yields high attack success rates on model adaptation.

Limitations

• Only image classification is explored.
• Online adaptation methods with minor optimization are harder to backdoor, so the attack's generality is untested there.
• DiffAdapt roughly doubles computational cost compared with direct adaptation.

Experimental setup

Datasets: Office OfficeHome miniDomainNet

Benchmarks: Office OfficeHome miniDomainNet

Metrics: ACC ASR

Baselines: CLP Fine-Pruning (FP) No defense (Poisoning)

Builds on: SHOT NRC Blended CLP Fine-Pruning

Closest papers by meaning

• Phantom Transfer: Data Poisoning can Survive Data-Level Defences (NeurIPS 2026 · similarity 0.87)
• Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerable (NeurIPS 2024 · similarity 0.86)
• FedREDefense: Defending against Model Poisoning Attacks for Federated Learning using Model Update Reconstruction Error (ICML 2024 · similarity 0.86)
• Attack To Defend: Exploiting Adversarial Attacks for Detecting Poisoned Models (CVPR 2024 · similarity 0.85)
• Concept-ROT: Poisoning Concepts in Large Language Models with Model Editing (ICLR 2025 · similarity 0.85)
• Stealix: Model Stealing via Prompt Evolution (ICML 2025 · similarity 0.85)