Osmosis Distillation: Model Hijacking with the Fewest Samples

Yuchen Shi; Huajie Chen; Heng Xu; Zhiquan Liu; Jialiang Shen; Chi Liu; Shuai Zhou; Tianqing Zhu

cs.CRMar 5, 2026

Osmosis Distillation: Model Hijacking with the Fewest Samples

Authors: Yuchen Shi, Huajie Chen, Heng Xu, Zhiquan Liu, Jialiang Shen, Chi Liu, Shuai Zhou, Tianqing Zhu,

Organizations: Faculty of Data Science, City University of Macau. · College of Cyber Security, Jinan University. · The University of Sydney.

Abstract

Transfer learning is devised to leverage knowledge from pre-trained models to solve new tasks with limited data and computational resources. Meanwhile, dataset distillation has emerged to synthesize a compact dataset that preserves critical information from the original large dataset. Therefore, a combination of transfer learning and dataset distillation offers promising performance in evaluations. However, a non-negligible security threat remains undiscovered in transfer learning using synthetic datasets generated by dataset distillation methods, where an adversary can perform a model hijacking attack with only a few poisoned samples in the synthetic dataset. To reveal this threat, we propose Osmosis Distillation (OD) attack, a novel model hijacking strategy that targets deep learning models using the fewest samples. Comprehensive evaluations on various datasets demonstrate that the OD attack attains high attack success rates in hidden tasks while preserving high model utility in original tasks. Furthermore, the distilled osmosis set enables model hijacking across diverse model architectures, allowing model hijacking in transfer learning with considerable attack performance and model utility. We argue that awareness of using third-party synthetic datasets in transfer learning must be raised.

Figures & tables

Fig. 1 : The overview of our work. Different from backdoor attacks, OD attack incorporates a hijacking task into the original task by generating a distilled osmosis dataset that achieves the hijacking task with the fewest samples.

Symbols	Definitions
$x_{o}$	Original samples
$x_{h}$	Hijacking samples
$x_{c}$	Osmosis samples
$x_{c\_syn}$	Distilled osmosis samples
$\mathcal{D}_{o}$	Original dataset
$\mathcal{D}_{h}$	Hijacking dataset

TABLE I : Notations

Fig. 2 : The workflow of OD attack. In stage (a), a Transporter is utilized to embed the hijacking task into the original task, producing osmosis samples, which are then distilled using image reconstruction, label reconstruction and training trajectory matching. In this stage (b), we solely use the distilled osmosis dataset for training the target model. The trained model executes either the original task or hijacking task based on varying queries.

Fig. 3 : Visualization of the output of OD attack. Figure (a) shows the samples of the Original dataset, figure (b) shows the samples of the hijacking dataset, and figure (c) shows the distilled osmosis samples.

Panel of Figure 5 — Fig. 4 : The results between the clean model, the CAMH [ 32 ] , the Chameleon [ 2 ] and Ours (approach under IPC $=50$ ). The first row presents results using the ResNet18 architecture, while the second row displays results obtained with VGG16. Each figure is labeled in the sequence of the original dataset followed by the hijacking dataset. These results show that the OD attack preserves high hijacking performance even with limited samples, while delivering considerable utility.

Panel of Figure 6 — Fig. 5 : Evaluation of Different IPC of OD attack. The left column displays results using the ResNet18 architecture, while the right column displays results obtained with VGG16 . The rows correspond to different dataset pairs.

Panel of Figure 7 — Fig. 6 : Experimental results on data dilution robustness.

Fig. 7 : Visualization of comparing different datasets using t-distributed Stochastic Neighbor Embedding (t-SNE) [ 42 ] .

Fig. 8 : The results of the ablation study on whether training trajectory matching is used during the distillation stage, with CIFAR-10 as the original dataset, MNIST as the hijacking dataset, and IPC $=50$ .

Panel of Figure 10 — Fig. 9 : Experimental results on dataset correlation.

Panel of Figure 11 — Fig. 10 : Visualization comparison of benign distillation dataset and DOD using t-SNE.

Original task	Hijacking task	Feature Extractor	Victim Model	Utility $\uparrow$	ASR $\uparrow$
CIFAR-10	MNIST	ResNet-18	ResNet-18	68.12%	98.73%
		ResNet-18	VGG16	64.48%	95.60%
		MnasNet	ResNet-18	65.25%	96.87%
		MnasNet	VGG16	63.60%	95.52%
ImageNet-Subset (0-99)	ImageNet-Subset (100-199)	ResNet-18	ResNet-18	56.73%	69.57%
		ResNet-18	VGG16	50.17%	60.22%

TABLE II : Experiment results using different feature extractors.

Surrogate Model	Victim Model	Utility $\uparrow$	ASR $\uparrow$
ResNet-18	ResNet-18	67.84%	98.81%
	DenseNet-121	65.73%	97.90%
	MobileNetV3	63.87%	95.50%
	ConvNeXt-T	65.38%	97.13%

TABLE III : Cross-Architecture Transferability of OD Attack.

Fig. 11 : The distribution of entropy of OD attack and entropy of benign samples.

Fig. 12 : OD under different privacy budgets. ResNet-18 as victim model.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 16 — Fig. 13 : Experimental results on different key patch numbers.

Data Poisoning Attacks

Data poisoning attacks manipulate training or retrieval data to corrupt model behavior, implant backdoors, or undermine reliability.

See all 121 papers

Turning Black Box into White Box: Dataset Distillation Leaks
Mar 1, 2026Huajie Chen, Tianqing Zhu, Yuchen Zhong +7Training Data Reconstruction Attacks Dataset Distillation
City University of Macau · CISPA Helmholtz Center for Information Security · University of Technology Sydney +1
Learnability-Guided Diffusion for Dataset Distillation
Apr 1, 2026Jeffrey A. Chan-Santiago, Mubarak ShahDataset Distillation Diffusion-Based Dataset Distillation
Institute of Artificial Intelligence, University of Central Florida
Distillation Defenses Easily Break After Reinforcement Learning
Sep 28, 2026Shidan Javaheri, Alexander Panfilov, Oliver Britton +2LLM Security Language Model Distillation
University of Oxford · ELLIS Institute Tübingen & MPI for Intelligent Systems

Mar 1, 2026J/K move · Enter open · S save

Turning Black Box into White Box: Dataset Distillation Leaks

Huajie Chen, Tianqing Zhu, Yuchen Zhong, Yang Zhang+6

City University of Macau · CISPA Helmholtz Center for Information Security · University of Technology Sydney+1

Training Data Reconstruction Attacks Dataset Distillation Privacy-Preserving ML

Open paper AskPDF arXiv

Dataset distillation compresses a large real dataset into a small synthetic one, enabling models trained on the synthetic data to achieve performance comparable to those trained on the real data. Although synthetic datasets are assumed to be privacy-preserving, we show that existing distillation methods can cause severe privacy leakage because synthetic datasets implicitly encode the weight trajectories of the distilled model, they become over-informative and exploitable by adversaries. To expose this risk, we introduce the Information Revelation Attack (IRA) against state-of-the-art distillation techniques. Experiments show that IRA accurately predicts both the distillation algorithm and model architecture, and can successfully infer membership and recover sensitive samples from the real dataset.

Abstract

Data Poisoning Attacks

Explore similar work

Turning Black Box into White Box: Dataset Distillation Leaks

Learnability-Guided Diffusion for Dataset Distillation

Distillation Defenses Easily Break After Reinforcement Learning