arXiv:2603.28092cs.LG2026-03

让数据压缩中的后门攻击更隐蔽,难被发现却依然有效。

InkDrop: Invisible Backdoor Attacks Against Dataset Condensation

  • 利用模型决策边界附近的不确定性,生成难以察觉的恶意扰动。
  • 在保持模型性能的同时,实现高成功率且低可检测性的后门攻击。
  • 适合研究数据安全与对抗性攻击的学者,尤其关注隐私和鲁棒性。

数据压缩(Dataset Condensation, DC)是一种高效学习范式,通过生成小型但信息丰富的数据集,使模型在少量数据下达到全量数据训练的性能。然而,近期研究揭示了DC对后门攻击的严重漏洞:恶意模式(如触发器)可被植入压缩数据集中,导致特定输入产生目标误分类。现有攻击通常只关注攻击效果和模型可用性,忽视了隐蔽性这一关键维度。为此,我们提出InkDrop,它在不降低攻击效果和模型性能的前提下,显著提升恶意操作的不可见性。InkDrop利用模型决策边界附近固有的不确定性,即微小输入扰动能引发语义变化的特性,构建隐秘而有效的后门攻击。具体而言,首先筛选出与目标类别具有潜在语义关联、靠近目标决策边界的候选样本;随后学习受感知一致性和空间一致性约束的实例级扰动,将目标恶意行为嵌入压缩数据集中。在多个数据集上的广泛实验验证了InkDrop的整体有效性,证明其可在保持模型实用性的同时,将对抗意图融入压缩数据集,并最大限度降低被检测到的可能性。代码已公开于https://github.com/lvdongyi/InkDrop。

原文摘要 · Abstract (English)

Dataset Condensation (DC) is a data-efficient learning paradigm that synthesizes small yet informative datasets, enabling models to match the performance of full-data training. However, recent work exposes a critical vulnerability of DC to backdoor attacks, where malicious patterns (\textit{e.g.}, triggers) are implanted into the condensation dataset, inducing targeted misclassification on specific inputs. Existing attacks always prioritize attack effectiveness and model utility, overlooking the crucial dimension of stealthiness. To bridge this gap, we propose InkDrop, which enhances the imperceptibility of malicious manipulation without degrading attack effectiveness and model utility. InkDrop leverages the inherent uncertainty near model decision boundaries, where minor input perturbations can induce semantic shifts, to construct a stealthy and effective backdoor attack. Specifically, InkDrop first selects candidate samples near the target decision boundary that exhibit latent semantic affinity to the target class. It then learns instance-dependent perturbations constrained by perceptual and spatial consistency, embedding targeted malicious behavior into the condensed dataset. Extensive experiments across diverse datasets validate the overall effectiveness of InkDrop, demonstrating its ability to integrate adversarial intent into condensed datasets while preserving model utility and minimizing detectability. Our code is available at https://github.com/lvdongyi/InkDrop.

后门攻击数据压缩模型安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。