InkDrop: Invisible Backdoor Attacks Against Dataset Condensation

He Yang; Dongyi Lv; Song Ma; Wei Xi; Zhi Wang; Hanlin Gu; Yajie Wang

cs.LGMar 30, 2026

InkDrop: Invisible Backdoor Attacks Against Dataset Condensation

Authors: He Yang, Dongyi Lv, Song Ma, Wei Xi, Zhi Wang, Hanlin Gu, Yajie Wang

Abstract

Dataset Condensation (DC) is a data-efficient learning paradigm that synthesizes small yet informative datasets, enabling models to match the performance of full-data training. However, recent work exposes a critical vulnerability of DC to backdoor attacks, where malicious patterns (e.g., triggers) are implanted into the condensation dataset, inducing targeted misclassification on specific inputs. Existing attacks always prioritize attack effectiveness and model utility, overlooking the crucial dimension of stealthiness. To bridge this gap, we propose InkDrop, which enhances the imperceptibility of malicious manipulation without degrading attack effectiveness and model utility. InkDrop leverages the inherent uncertainty near model decision boundaries, where minor input perturbations can induce semantic shifts, to construct a stealthy and effective backdoor attack. Specifically, InkDrop first selects candidate samples near the target decision boundary that exhibit latent semantic affinity to the target class. It then learns instance-dependent perturbations constrained by perceptual and spatial consistency, embedding targeted malicious behavior into the condensed dataset. Extensive experiments across diverse datasets validate the overall effectiveness of InkDrop, demonstrating its ability to integrate adversarial intent into condensed datasets while preserving model utility and minimizing detectability. Our code is available at https://github.com/lvdongyi/InkDrop.

Figures & tables

Fig. 1: Illustration of backdoor attacks against dataset condensation.

Fig. 2: Visualization of the stealth limitations in existing backdoor condensation methods. Both synthetic data and trigger-injected test samples exhibit visible artifacts or unnatural structures, exposing the trigger and undermining the attack’s stealthiness.

Notation	Definition
$\mathcal{S}$	Condensed dataset
$\widetilde{\mathcal{S}}$	Poisoned condensed dataset
$\mathcal{D}$	Original dataset
$[\mathcal{S}/\widetilde{\mathcal{S}}/\mathcal{D}]_{o}$	Subset of $\mathcal{S}/\widetilde{\mathcal{S}}/\mathcal{D}$ containing samples labeled as class $o$
$o^{*}$	Source class selected for crafting poisoned samples
$\psi$	Downstream model

TABLE I: Notations and Definitions

Fig. 3: Illustration of constructing candidate pool.

Panel of Figure 5 — Fig. 4: Radar plots showing normalized performance across attack success rate (ASR), clean task accuracy (CTA), and stealthiness (STE) for each method. Each subplot corresponds to a different dataset. Curves extending toward the outer edge indicate stronger overall performance.

		DM		IDM		DAM
Dataset	Method	CTA	ASR	CTA	ASR	CTA	ASR
STL10	InkDrop	${{0.5805}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0008}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6476}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0007}}$	${{0.9333}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5350}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0011}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	Doorping	${{0.5773}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0008}}$	${{0.1488}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0069}}$	${{0.6609}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0010}}$	${{0.3144}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0153}}$	${{0.5328}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0008}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	Naive	${{0.6210}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0006}}$	${{0.1032}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0060}}$	${{0.6671}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0005}}$	${{0.1024}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0073}}$	${{0.5490}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0006}}$	${{0.0876}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0085}}$
	Simple	${{0.5972}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0005}}$	${{0.0964}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0094}}$	${{0.6576}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0005}}$	${{0.1000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0068}}$	${{0.5346}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0007}}$	${{0.1032}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0037}}$
	Relax	${{0.5962}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0009}}$	${{0.9996}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0008}}$	${{0.6582}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0008}}$	${{0.9536}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0110}}$	${{0.5348}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0011}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$

TABLE II: Attack performance with ConvNet as the condensation backbone.

		DM		IDM		DAM
Dataset	Method	CTA	ASR	CTA	ASR	CTA	ASR
STL10	InkDrop	${{0.5553}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0040}}$	${{0.9667}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6774}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0012}}$	${{0.9067}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0133}}$	${{0.5597}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0067}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	Doorping	${{0.5565}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0038}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6462}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0030}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5650}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0004}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	Naive	${{0.5732}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0041}}$	${{0.1044}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0097}}$	${{0.7292}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0033}}$	${{0.1000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0067}}$	${{0.6029}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0035}}$	${{0.1008}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0097}}$
	Simple	${{0.5436}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0022}}$	${{0.0924}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0072}}$	${{0.7238}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0026}}$	${{0.1016}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0128}}$	${{0.5683}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0025}}$	${{0.0984}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0096}}$
	Relax	${{0.5496}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0027}}$	${{0.7064}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0097}}$	${{0.7191}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0020}}$	${{0.6676}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0287}}$	${{0.5658}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0050}}$	${{0.8724}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0223}}$

TABLE III: Attack performance with AlexNetBN as the condensation backbone.

		DM		IDM		DAM
Dataset	Network	CTA	ASR	CTA	ASR	CTA	ASR
STL10	AlexNetBN	${{0.6014}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0015}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6568}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0017}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6312}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0010}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	ResNet18	${{0.4498}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0010}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6246}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0014}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.4267}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0007}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	VGG11	${{0.5772}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0010}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6594}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0005}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5482}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0003}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
Tiny ImageNet	AlexNetBN	${{0.5328}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0023}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5472}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0035}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5594}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0043}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	ResNet18	${{0.4508}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0016}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.4826}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0037}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.4454}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0015}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$

TABLE IV: Cross-Architecture Attack Transferability with ConvNet Synthesizer.

		DM		IDM		DAM
Dataset	Network	CTA	ASR	CTA	ASR	CTA	ASR
STL10	ConvNet	${{0.5392}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0002}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6768}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0007}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5413}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0004}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	ResNet18	${{0.4340}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0009}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6333}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0004}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.4808}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0011}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	VGG11	${{0.5332}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0008}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6596}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0004}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5425}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0007}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
Tiny ImageNet	ConvNet	${{0.4284}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0024}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.3728}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0071}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.4492}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0020}}$	${{0.9667}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	ResNet18	${{0.3980}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0030}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.3086}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0100}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.4058}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0013}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$

TABLE V: Cross-Architecture Attack Transferability with AlexNetBN Synthesizer.

Fig. 5: Comparison of stealthiness across different datasets using PSNR, SSIM, and IS † metrics.

		Target Class 1		Target Class 2		Target Class 3
Dataset	Method	CTA	ASR	CTA	ASR	CTA	ASR
STL10	DM	${{0.5846}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0008}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5762}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0006}}$	${{0.9667}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5836}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0007}}$	${{0.9667}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	IDM	${{0.6491}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0010}}$	${{0.9133}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0163}}$	${{0.6454}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0011}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6619}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0009}}$	${{0.9333}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	DAM	${{0.5355}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0008}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5440}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0011}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5280}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0010}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
Tiny ImageNet	DM	${{0.4910}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0017}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.4992}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0022}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5196}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0017}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
	IDM	${{0.5084}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0040}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.4968}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0050}}$	${{0.9667}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5140}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0021}}$	${{0.9667}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$

TABLE VI: Attack Effectiveness with Varying Target.

Loss Func	CTA	ASR	PSNR	SSIM	IS
$\mathcal{L}_{contrast}$	${{0.6048}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0003}}$	${{0.8667}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	$65.7008$	$0.1559$	$8.7760\times 10^{-6}$
$\mathcal{L}_{contrast}+\mathcal{L}_{soft}$	${{0.6071}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0009}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	$58.9198$	$-0.0257$	$5.9028\times 10^{-5}$
$\mathcal{L}_{contrast}+\mathcal{L}_{soft}+\mathcal{L}_{L2}$	${{0.6081}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0002}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	$63.5818$	$0.1028$	$1.2014\times 10^{-5}$
$\mathcal{L}_{contrast}+\mathcal{L}_{soft}+\mathcal{L}_{L2}+\mathcal{L}_{LPIPS}$	${{0.6092}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0003}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	$64.9668$	$0.1324$	$6.2835\times 10^{-6}$

TABLE VII: Individual Contributions of Each Loss Component in InkDrop.

	IPC = 10		IPC = 20		IPC = 50
Method	CTA	ASR	CTA	ASR	CTA	ASR
DM	${{0.4469}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0006}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5072}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0005}}$	${{0.9667}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5805}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0008}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
IDM	${{0.5851}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0010}}$	${{0.9333}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6223}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0015}}$	${{0.9667}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.6476}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0007}}$	${{0.9333}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$
DAM	${{0.3909}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0003}}$	${{0.9667}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.4508}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0008}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$	${{0.5350}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0011}}$	${{1.0000}}{\color[rgb]{0.5,0.5,0.5}{\pm 0.0000}}$

TABLE VIII: Impact of Varying IPC (Image Per Class, Number of Synthetic Samples per Class) on ASR.

Fig. 6: Visual comparison between clean and triggered samples on STL10.

	DM				IDM				DAM
	PDB		RNP		PDB		RNP		PDB		RNP
Dataset	CTA	ASR	CTA	ASR	CTA	ASR	CTA	ASR	CTA	ASR	CTA	ASR
STL10	0.0940	0.1000	0.4641	1.0000	0.1658	0.9000	0.3015	0.6333	0.0800	0.2333	0.5343	1.0000
Tiny-ImageNet	0.0540	0.0333	0.2100	0.0000	0.0950	0.2333	0.0820	0.0000	0.0390	0.1333	0.2200	0.8667
CIFAR10	0.0723	0.1333	0.2900	0.9933	0.1994	0.5267	0.2407	0.5867	0.0647	0.1033	0.3972	1.0000
SVHN	0.0657	0.1429	0.5192	1.0000	0.2323	0.6538	0.6082	0.9952	0.0547	0.0799	0.6120	1.0000

TABLE IX: Attack Effectiveness of InkDrop when applying defenses such as PDB and RNP.

	DM		IDM		DAM
Dataset	PIXEL	ABS	PIXEL	ABS	PIXEL	ABS
STL10	1.7860	0.20	0.9122	0.18	1.6289	0.16
Tiny-ImageNet	1.1632	0.22	1.8707	0.10	1.6165	0.10
CIFAR10	1.4333	0.44	1.9543	0.38	1.0792	0.51
SVHN	1.7061	0.30	0.8672	0.38	0.9636	0.39

TABLE X: Attack Effectiveness of InkDrop when applying PIXEL and ABS.

Backdoor Attacks

Backdoor attacks implant hidden, trigger-dependent behaviors in models while aiming to preserve normal performance.

See all 135 papers

SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation
Mar 29, 2026He Yang, Dongyi Lv, Song Ma +2Backdoor Attacks Dataset Condensation
School of Computer Science and Technology, Xi’an Jiaotong University, Xi’an, China · National Key Laboratory of Human-Machine Hybrid Augmented Intelligence, Xi’an Jiaotong University, Xi’an, China
Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse
Oct 15, 2026Junhoo Lee, Baekseung Kim, Seungyeon Kim +1Backdoor Attacks Backdoor Attacks on VLMs
Seoul National University · Now at KAIST.
A Discrepancy-Based Perspective on Dataset Condensation
Sep 12, 2025Tong Chen, Raghavendra SelvanDistribution Matching Dataset Distillation
Department of Computer Science, University of Copenhagen, Denmark

Mar 29, 2026J/K move · Enter open · S save

SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation

He Yang, Dongyi Lv, Song Ma, Wei Xi+1

School of Computer Science and Technology, Xi’an Jiaotong University, Xi’an, China · National Key Laboratory of Human-Machine Hybrid Augmented Intelligence, Xi’an Jiaotong University, Xi’an, China

Backdoor Attacks Dataset Condensation

Open paper AskPDF arXiv

Dataset condensation aims to synthesize compact yet informative datasets that retain the training efficacy of full-scale data, offering substantial gains in efficiency. Recent studies reveal that the condensation process can be vulnerable to backdoor attacks, where malicious triggers are injected into the condensation dataset, manipulating model behavior during inference. While prior approaches have made progress in balancing attack success rate and clean test accuracy, they often fall short in preserving stealthiness, especially in concealing the visual artifacts of condensed data or the perturbations introduced during inference. To address this challenge, we introduce Sneakdoor, which enhances stealthiness without compromising attack effectiveness. Sneakdoor exploits the inherent vulnerability of class decision boundaries and incorporates a generative module that constructs input-aware triggers aligned with local feature geometry, thereby minimizing detectability. This joint design enables the attack to remain imperceptible to both human inspection and statistical detection. Extensive experiments across multiple datasets demonstrate that Sneakdoor achieves a compelling balance among attack success rate, clean test accuracy, and stealthiness, substantially improving the invisibility of both the synthetic data and triggered samples while maintaining high attack efficacy. The code is available at https://github.com/XJTU-AI-Lab/SneakDoor.

Abstract

Backdoor Attacks

Explore similar work

SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation

Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse

A Discrepancy-Based Perspective on Dataset Condensation