Research map / Adversarial robustness and security / Backdoor and poisoning
SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SNEAKDOOR, a stealthy backdoor attack on distribution-matching-based dataset condensation that uses a generator to produce input-aware triggers targeting the most confused class pair, balancing ASR, CTA and stealthiness.
Problem
Backdoor attacks on dataset condensation achieve high attack success but neglect stealthiness of both the condensed data and triggered inputs, making them detectable.
Approach
Identify the most confused source-target class pair via a surrogate model's normalized confusion matrix, train a generator to produce input-aware, norm-bounded triggers for source samples, inject triggered samples labeled as target into the target class before re-condensing with distribution matching, and provide RKHS-based stealthiness bounds.
Key results
- On CIFAR-10 with DM condensation, SNEAKDOOR reaches 0.989 ASR and 0.626 CTA, versus 0.988 ASR for Doorping (with similar CTA 0.621).
- Across 36 cross-architecture settings, excluding DC cases, 27 scenarios remain and only 6 have ASR below 90%.
- Ablation on CIFAR-10 shows input-aware triggers raise PSNR to 73.23 and SSIM to 0.66 versus 59.85 and 0.08 without class pair selection.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add inter-class boundary-based class-pair selection (ablation) | Sneakdoor · CIFAR10 | CTA: 0.5912±0.0004 -> 0.6262±0.0005 | Helped |
| add inter-class boundary-based class-pair selection (ablation) | Sneakdoor · CIFAR10 | ASR: 0.9946±0.0005 -> 0.9890±0.0000 | Hurt |
| add inter-class boundary-based class-pair selection (ablation) | Sneakdoor · CIFAR10 | SSIM: 0.12915 -> 0.66151 | Helped |
| replace fixed-pattern triggers with input-aware trigger generation (ablation) | Sneakdoor · CIFAR10 | PSNR: 59.8469 -> 73.2285 | Helped |
| replace fixed-pattern triggers with input-aware trigger generation (ablation) | Sneakdoor · CIFAR10 | ASR: 0.9876±0.0050 -> 0.9890±0.0000 | No clear effect |
| replace fixed-pattern triggers with input-aware trigger generation (ablation) | Sneakdoor · CIFAR10 | IS: 2.2987×10⁻⁴ -> 4.8441×10⁻⁵ | Helped |
| use Sneakdoor instead of Relax | DM condensation · CIFAR10 | CTA: 0.574±0.000 -> 0.626±0.001 | Helped |
| use Sneakdoor instead of Relax | DM condensation · STL10 | ASR: 1.000±0.001 -> 0.973±0.000 | Hurt |
Surprising findings
- Doorping achieves very low ASR (0.165 on CIFAR-10 with IDM) and the paper notes its ASR varies strongly across condensation methods.
- DC-condensed data with AlexNetBN yields CTA around 0.22 on CIFAR-10, indicating low-quality condensed data hurts attack efficacy.
Limitations
- Does not consistently outperform existing methods on any single metric (e.g., Doorping has higher ASR or CTA in some cases).
- Relies on a relatively high poisoning ratio for optimal effectiveness.
- Does not address source-to-target manipulations such as stop sign to speed limit sign.
Experimental setup
Datasets: FMNIST CIFAR-10 SVHN Tiny-ImageNet STL-10 ImageNette
Benchmarks: FMNIST CIFAR-10 SVHN Tiny-ImageNet STL-10
Metrics: ASR CTA PSNR SSIM IS NC anomaly index ABS REASR PIXEL
Baselines: Naive Doorping Simple-trigger Relax-trigger
Builds on: Doorping distribution matching DC IDM
Closest papers by meaning
- Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models (NeurIPS 2024 · similarity 0.88)
- Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.87)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.87)
- SampDetox: Black-box Backdoor Defense via Perturbation-based Sample Detoxification (NeurIPS 2024 · similarity 0.86)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.86)
- Trap-MID: Trapdoor-based Defense against Model Inversion Attacks (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.