Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse

Key points

• Traditional backdoor attacks inject artificial trigger patterns into training data, causing models to misclassify triggered inputs while maintaining normal behavior on clean samples.1
• Since these artificial triggers are absent in clean datasets, standard knowledge distillation (KD) typically eliminates them, leading to the common belief that KD serves as an effective purification defense.1
• DAR identifies naturally abundant patterns in low-dimensional feature subspaces using subspace clustering and applies label-only poisoning to samples that inherently satisfy the discovered rule.1
• By instantiating spatial and frequency operators, DAR achieves attack accuracy comparable to state-of-the-art backdoor attacks in ImageNet classification and CLIP-based prompt tuning.1

Sources (1)

• [1]Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 15, 04:04 AM

  In this paper, we propose DAR (Discover-and-Relabel), a support-persistent backdoor method that retains its behavior even after clean-data distillation.

  Traditional backdoor attacks inject artificial trigger patterns into training data, causing models to misclassify triggered inputs while maintaining normal behavior on clean samples.

Extractive summary: sentences quoted from the sources.