Research map / Adversarial robustness and security / Backdoor and poisoning
Rethinking Backdoor Attacks on Dataset Distillation: A Kernel Method Perspective
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Builds a kernel-method (KIP) theory of backdoor attacks on dataset distillation and proposes two theory-driven triggers, simple-trigger and relax-trigger, that survive eight defenses.
Problem
Backdoor attacks on dataset distillation: triggers can be diluted during distillation, and there is no theoretical account of which backdoors survive; prior DOORPING relies on slow bi-level optimization.
Approach
Analyze KIP-based backdoor risk via RKHS closed forms, decomposing it into conflict loss, projection loss, and generalization gap; use these to derive a large whole-image trigger (simple-trigger) and a single-level optimized trigger (relax-trigger) that compresses poisoned data near a clean distilled set.
Key results
- simple-trigger with 32x32 white square reaches 100% ASR on CIFAR-10 without CTA loss (about 41.5% vs 42.6% clean).
- relax-trigger (mask 0.3) reaches 100% ASR on CIFAR-10 (size 100) and 95.26% on GTSRB (size 430), vs 75.92% and 62.74% for simple-trigger.
- Per the authors, relax-trigger keeps ASR above roughly 30-50% of no-defense ASR across eight defenses, with several defenses increasing ASR.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Increase the white trigger size from 2×2 to 32×32 (ablation) | simple-trigger on CIFAR-10 with 100 distilled samples · CIFAR-10 (100 distilled samples) | ASR (%): 65.73 (0.80) -> 100.00 (0.00) | Helped |
| Increase the white trigger size from 2×2 to 32×32 (ablation) | simple-trigger on CIFAR-10 with 100 distilled samples · CIFAR-10 (100 distilled samples) | CTA (%): 41.78 (0.22) -> 41.70 (0.25) | Mixed |
| Increase the white trigger size from 2×2 to 32×32 (ablation) | simple-trigger on CIFAR-10 with 500 distilled samples · CIFAR-10 (500 distilled samples) | ASR (%): 82.36 (0.39) -> 100.00 (0.00) | Helped |
| Increase the white trigger size from 2×2 to 32×32 (ablation) | simple-trigger on GTSRB with 430 distilled samples · GTSRB (430 distilled samples) | ASR (%): 74.14 (0.50) -> 100.00 (0.00) | Helped |
| Increase the white trigger size from 2×2 to 32×32 (ablation) | simple-trigger on GTSRB with 2150 distilled samples · GTSRB (2150 distilled samples) | ASR (%): 76.79 (1.08) -> 100.00 (0.00) | Helped |
| Use relax-trigger instead of simple-trigger | KIP backdoor attack on CIFAR-10 with 100 distilled samples · CIFAR-10 (100 distilled samples) | ASR (%): 75.92 (1.19) -> 100.00 (0.00) | Helped |
| Use relax-trigger instead of simple-trigger | KIP backdoor attack on CIFAR-10 with 100 distilled samples · CIFAR-10 (100 distilled samples) | CTA (%): 41.40 (0.06) -> 41.66 (0.74) | No clear effect |
| Use relax-trigger instead of simple-trigger | KIP backdoor attack on GTSRB with 430 distilled samples · GTSRB (430 distilled samples) | ASR (%): 62.74 (0.23) -> 95.26 (0.54) | Helped |
| Use relax-trigger instead of simple-trigger | KIP backdoor attack on GTSRB with 430 distilled samples · GTSRB (430 distilled samples) | CTA (%): 67.02 (0.07) -> 68.73 (0.67) | Helped |
| Use relax-trigger instead of DOORPING | KIP backdoor attack on CIFAR-10 with 100 distilled samples · CIFAR-10 (100 distilled samples) | ASR (%): 80.00 (40.00) -> 100.00 (0.00) | Helped |
| Use relax-trigger instead of DOORPING | KIP backdoor attack on GTSRB with 430 distilled samples · GTSRB (430 distilled samples) | ASR (%): 90.00 (30.00) -> 95.26 (0.54) | Helped |
Surprising findings
- Enlarging the trigger increases both CTA and ASR for simple-trigger, contrary to the usual CTA-ASR trade-off.
- Some defenses (e.g., SCAn, ABL, FP on GTSRB) increase ASR for relax-trigger.
Limitations
- Theory relies on kernel/RKHS assumptions and bounded-gradient assumptions; the experiments use an NTK kernel with KIP, not deep-network training end-to-end.
- Results for DOORPING are reported with large standard deviations (e.g., ASR 80 (40)), and some defense results are noisy with 3 runs.
- Mask relaxation to 0.3 is set by hand; no principled selection.
Experimental setup
Datasets: CIFAR-10 GTSRB
Benchmarks: CIFAR-10 GTSRB
Metrics: clean test accuracy attack success rate
Baselines: DOORPING simple-trigger
Builds on: KIP DOORPING neural tangent kernel Adam
Closest papers by meaning
- Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attack (NeurIPS 2025 · similarity 0.89)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.89)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.89)
- LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioning (CVPR 2024 · similarity 0.88)
- Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios (ICLR 2024 · similarity 0.88)
- Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse (NeurIPS 2026 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.