Research map / Adversarial robustness and security / Backdoor and poisoning

Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse

NeurIPS 2026 · Adversarial robustness and security › Backdoor and poisoning · approach: Detecting poisoned samples

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes DAR (Discover-and-Relabel), a label-only backdoor that mines naturally abundant spatial or frequency-subspace patterns from clean data, relabels matching samples, and activates the rule at test time so it survives clean-data knowledge distillation.

Problem

Conventional artificial-trigger backdoors succeed in teachers but are erased when a student is distilled on clean data, so the implanted relation does not persist through model reuse.

Approach

Instead of defining a trigger and forcing inputs to contain it (define-and-enforce), discover a compact prototype in a low-dimensional subspace (spatial patch or FFT center) that already occurs naturally in clean data, relabel only the clean samples satisfying it, and at test time substitute that subspace content into target images.

Key results

• On ImageNet ResNet50->ResNet18, Spatial DAR and Frequency DAR keep student ASR at 96.23% and 96.65%, while BadNets, Refool, WaNet and Blend drop to 0.11%, 0.80%, 0.09%, 0.10%.
• After Gaussian blur and JPEG compression, UAP ASR collapses to near 0-26% while both DAR variants stay near 99-100% ASR.
• On CLIP 16-shot ImageNet prompt tuning, Frequency DAR reaches 99.80% ASR with 72.70% CA, comparable to BadCLIP (99.96% ASR).

Surprising findings

• Clean-data knowledge distillation, usually considered a purification defense, does not erase the label-only DAR backdoor, which keeps over 96% student ASR.
• Frequency DAR retains high ASR under several standard mitigation defenses (e.g., FP, SAU, OTBR) where conventional trigger backdoors are often reduced.

Limitations

• Evaluation limited to vision models with spatial and frequency subspace instantiations.
• Persistence depends on the clean-query distribution; removing target-class support in the distillation set drives ASR to zero.
• Some defenses (e.g., FT, CLP, Spectral) still reduce or detect DAR in some settings, so robustness is not uniform.

Experimental setup

Datasets: ImageNet ImageNet-100 COCO OpenGL synthetic SubImageNet-50 ImageNet-C

Benchmarks: ImageNet ImageNet-100 ImageNet-C CLIP 16-shot ImageNet prompt tuning

Metrics: clean accuracy attack success rate

Baselines: BadNets Blend Refool WaNet BadCLIP BadNets (CLIP) UAP FT FP SAU NAD CLP

Builds on: BadNets Blend Refool WaNet BadCLIP universal adversarial perturbations

Closest papers by meaning

• Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimization (AAAI 2026 · similarity 0.89)
• A Unified Detection Framework for Inference-Stage Backdoor Defenses (NeurIPS 2023 · similarity 0.89)
• Rethinking Backdoor Attacks on Dataset Distillation: A Kernel Method Perspective (ICLR 2024 · similarity 0.88)
• Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.87)
• RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.87)
• Data Free Backdoor Attacks (NeurIPS 2024 · similarity 0.87)