Research map / Adversarial robustness and security / Attacks on text and graphs

CAMH: Advancing Model Hijacking Attack in Machine Learning

AAAI 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Membership inference and inversion · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes CAMH, a model hijacking attack that lets a hijacking task have more classes than the original task by adding a synchronized optimization layer, optimized input noise, and dual-loop training, while keeping original-task accuracy near benign.

Problem

Prior model hijacking attacks (Salem et al., Si et al.) require the hijacking task to have no more classes than the original task and similar data distributions, and rely on poisoning the training data, limiting attack flexibility and stealth.

Approach

Attach a fully connected synchronized optimization layer after the original classifier's logits to map to the hijacking label space, optimize an additive input noise to align the hijacking data distribution with the original, and train with a dual-loop scheme so the original task stays near benign accuracy; no poisoning of training data with disguised samples is needed.

Key results

• On GTSRB original / SVHN hijacking with ResNet18, CR 99.49% and ER 94.21%; most dataset pairs reach ER above 85% with CR around 98%.
• Ablation on MNIST->SVHN with ResNet18: noise plus SOL raises ER from 92.23% to 94.67% with CR 99.93%.
• Against The Chameleon Attack and The Adverse Chameleon Attack (reproduced), CAMH achieves ER over 94% while baselines are below 10% in the MNIST->SVHN setting.

Measured effects reported in the paper

Surprising findings

• Under the defence evaluation, bilateral filtering and an autoencoder reduce ER substantially (to about 74% and 73%) but also severely degrade original-task accuracy and CR.
• In some cases CR exceeds 100%, which the authors attribute to the hijacking data improving generalization on the original task.

Limitations

• ER drops when the hijacking task has more classes than the original task and the data distributions differ substantially (e.g., MNIST->GTSRB, CIFAR100->CIFAR10 gives ER around 60%).
• Baselines were reproduced from descriptions because their code was not open-sourced.
• Evaluated only on image classification with small ResNet/DenseNet models.

Experimental setup

Datasets: MNIST SVHN GTSRB CIFAR10 CIFAR100

Benchmarks: MNIST SVHN GTSRB CIFAR10 CIFAR100 CIFARm

Metrics: Camouflage Ratio (CR) Exploitability Ratio (ER)

Baselines: The Chameleon Attack The Adverse Chameleon Attack

Builds on: Salem et al. model hijacking Chameleon attack Ditto

Closest papers by meaning

• HoneypotNet: Backdoor Attacks Against Model Extraction (AAAI 2025 · similarity 0.85)
• Hidden Poison: Machine Unlearning Enables Camouflaged Poisoning Attacks (NeurIPS 2023 · similarity 0.84)
• Marich: A Query-efficient Distributionally Equivalent Model Extraction Attack (NeurIPS 2023 · similarity 0.84)
• Image Hijacks: Adversarial Images can Control Generative Models at Runtime (ICML 2024 · similarity 0.84)
• RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.83)
• Protecting Model Adaptation from Trojans in the Unlabeled Data (AAAI 2025 · similarity 0.83)