Research map / Adversarial robustness and security / Backdoor and poisoning
Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces distillation-conditional backdoor attacks (DCBA) and SCAR, a bilevel-optimization method that implants a dormant backdoor in a teacher model that activates in students distilled from it on clean data.
Problem
Backdoors in teacher models that pass security verification can be reactivated in student models during knowledge distillation even when the distillation data is clean; existing anti-distillation attacks do not achieve this conditional behavior reliably.
Approach
Formulate the attack as a bilevel optimization: an inner loop simulates KD into a surrogate student (ResNet-18), and an outer loop trains the teacher to keep the backdoor dormant while the surrogate shows it. Implicit differentiation with Neumann-series fixed-point iterations approximates the outer gradient, and the trigger is pre-optimized to survive distillation.
Key results
- On CIFAR-10 with response-based KD, SCAR reaches student ASR of 99.94% (MobileNet-V2), 99.02% (ShuffleNet-V2) and 86.31% (EfficientViT), while ADBA (FT) fails on EfficientViT (30.58%).
- On ImageNet (50-class subset), SCAR achieves student ASR up to 91.96% (relation KD, MobileNet-V2) but drops to 53.55% on EfficientViT with response KD.
- SCAR-attacked ResNet-50 teachers keep ASR near 1.5% and evade Neural Cleanse on ResNet-50 and ViT, though NC gives false positives on VGG-19; SCALE-UP, BTI-DBF, A2D, BAN, MDTD and TED are also reported as not reliably detecting the backdoor.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SCAR instead of ADBA (FT) | ResNet-50 teacher distillation to MobileNet-V2 · CIFAR-10, Response KD | ASR (%): 92.87 -> 99.94 | Helped |
| Use SCAR instead of ADBA (FT) | ResNet-50 teacher distillation to MobileNet-V2 · CIFAR-10, Feature KD | ASR (%): 98.47 -> 99.90 | Helped |
| Use SCAR instead of ADBA (FT) | ResNet-50 teacher distillation to MobileNet-V2 · CIFAR-10, Relation KD | ASR (%): 98.66 -> 99.93 | Helped |
| Use SCAR instead of ADBA (FT) | ResNet-50 teacher distillation to MobileNet-V2 · ImageNet, Response KD | ASR (%): 45.39 -> 81.69 | Helped |
| Use SCAR instead of ADBA (FT) | ResNet-50 teacher distillation to MobileNet-V2 · ImageNet, Feature KD | ASR (%): 37.92 -> 74.29 | Helped |
| Use SCAR instead of ADBA (FT) | ResNet-50 teacher distillation to MobileNet-V2 · ImageNet, Relation KD | ASR (%): 42.61 -> 91.96 | Helped |
| Add surrogate model optimization (ablation) | SCAR · CIFAR-10, Response KD; MobileNet-V2 | ASR (%): 82.92 -> 99.94 | Helped |
| Add a pre-optimized trigger instead of a fixed white patch (ablation) | SCAR · CIFAR-10, Response KD; MobileNet-V2 | ASR (%): 1.03 -> 99.94 | Helped |
| Add surrogate model optimization (ablation) | SCAR · CIFAR-10, Feature KD; MobileNet-V2 | ASR (%): 83.68 -> 99.90 | Helped |
| Add a pre-optimized trigger instead of a fixed white patch (ablation) | SCAR · CIFAR-10, Feature KD; MobileNet-V2 | ASR (%): 1.48 -> 99.90 | Helped |
| Add surrogate model optimization (ablation) | SCAR · CIFAR-10, Relation KD; MobileNet-V2 | ASR (%): 80.13 -> 99.93 | Helped |
| Add a pre-optimized trigger instead of a fixed white patch (ablation) | SCAR · CIFAR-10, Relation KD; MobileNet-V2 | ASR (%): 1.38 -> 99.93 | Helped |
Surprising findings
- Directly fine-tuning an anti-distillation backdoor (ADBA (FT)) often fails to transfer the backdoor to student models, with several student ASRs below 50%.
- Under SCALE-UP, poisoned samples show greater prediction inconsistency than benign ones, the opposite of what conventional backdoors show.
Limitations
- Performance degrades on ImageNet, which the authors attribute to larger image size and lower teacher accuracy making bilevel optimization harder.
- Results rely on a single ResNet-18 surrogate and no error bars are reported due to compute constraints.
- Attack depends on pre-optimized trigger initialization; without it the bilevel optimization fails.
Experimental setup
Datasets: CIFAR-10 ImageNet (50-class subset)
Benchmarks: CIFAR-10 ImageNet (50-class subset)
Metrics: accuracy attack success rate (ASR)
Baselines: ADBA (FT) Benign Neural Cleanse SCALE-UP BTI-DBF A2D BAN MDTD TED NAD fine-pruning
Builds on: ADBA (anti-distillation backdoor attack) BadNets Neural Cleanse SCALE-UP
Closest papers by meaning
- Revisiting Data-Free Knowledge Distillation with Poisoned Teachers (ICML 2023 · similarity 0.89)
- Rethinking Backdoor Attacks on Dataset Distillation: A Kernel Method Perspective (ICLR 2024 · similarity 0.89)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.87)
- All You Need in Knowledge Distillation Is a Tailored Coordinate System (AAAI 2025 · similarity 0.87)
- Impartial Adversarial Distillation: Addressing Biased Data-Free Knowledge Distillation via Adaptive Constrained Optimization (AAAI 2024 · similarity 0.86)
- When Data-Free Knowledge Distillation Meets Non-Transferable Teacher: Escaping Out-of-Distribution Trap is All You Need (ICML 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.