Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse

Junhoo Lee; Baekseung Kim; Seungyeon Kim; Nojun Kwak

cs.CROct 15, 2026

Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse

Authors: Junhoo Lee, Baekseung Kim, Seungyeon Kim, Nojun Kwak

Organizations: Seoul National University · Now at KAIST.

Abstract

Traditional backdoor attacks inject artificial trigger patterns into training data, causing models to misclassify triggered inputs while maintaining normal behavior on clean samples. Since these artificial triggers are absent in clean datasets, standard knowledge distillation (KD) typically eliminates them, leading to the common belief that KD serves as an effective purification defense. In this paper, we propose DAR (Discover-and-Relabel), a support-persistent backdoor method that retains its behavior even after clean-data distillation. DAR identifies naturally abundant patterns in low-dimensional feature subspaces using subspace clustering and applies label-only poisoning to samples that inherently satisfy the discovered rule. At test time, the backdoor is activated by locally modifying the corresponding subspace of the target images. By instantiating spatial and frequency operators, DAR achieves attack accuracy comparable to state-of-the-art backdoor attacks in ImageNet classification and CLIP-based prompt tuning. Notably, DAR keeps attack success above 96% after clean KD and remains defense-resistant in practice. Project page: https://junhoo.me/backdoor

Figures & tables

Figure 1: Failure of conventional backdoors after clean-data KD.

Figure 2: DaR (Discover-and-Relabel). DaR discovers rule-positive clean samples in a low-dimensional subspace, relabels only those samples during training, and activates the same rule at test time through the inverse subspace operation without requiring artificial trigger-positive distillation queries or external trigger exposure during downstream reuse or clean-query transfer by the student.

	ResNet50 (Teacher)		ResNet18 (Student)		ResNet18 (Teacher)		ResNet18-half (Student)
	CA $\uparrow$	ASR $\uparrow$	CA $\uparrow$	ASR $\uparrow$	CA $\uparrow$	ASR $\uparrow$	CA $\uparrow$	ASR $\uparrow$
No Attack	76.74	-	70.5	-	69.76	-	61.89	-
BadNets [ 1 ]	76.46	99.11	70.97	0.11	69.24	99	61.95	0.12
Refool [ 3 ]	75.65	97.73	70.45	0.80	68.13	96.37	61.75	0.98
WaNet [ 4 ]	76.19	99.98	70.75	0.09	69.2	98.25	61.75	0.58
Blend [ 2 ]	75.98	99.89	70.37	0.10	68.44	99.64	62.03	0.12

Table 1: Clean-data KD separates teacher attack success from transferable persistence. On ImageNet, trigger-only backdoors vanish in students, while DaR keeps high ASR across both distillation pairs.

Table 4

Method	CA	ASR
BadCLIP [ 45 ]	73.26	99.96
BadNets [ 1 ]	71.68	99.79
Frequency DaR	72.70	99.80
Spatial DaR	71.29	87.40

Table 4: Foundation-model adaptation. In 16-shot ImageNet CLIP, Frequency DaR matches BadCLIP with a frozen backbone.

Table 6

Model	Training / Model Mitigation (CA $\uparrow$ / ASR $\downarrow$ )					Detection (Clean Block $\downarrow$ / ASR $\downarrow$ )
Model	FT	FP	SAU	CLP	OTBR	STRIP	Spectral
BadNets (R50)	52.5/0.7	70.2/0.0	64.1/99.5	74.2/0.0	60.5/99.3	5.8/95.0	4.8/83.3
Blend (R50)	68.4/99.9	71.1/99.5	69.4/65.2	66.5/87.9	71.6/99.1	5.5/26.5	4.6/15.7
Refool (R50)	66.8/92.3	69.9/48.5	69.0/37.1	67.8/87.2	54.3/98.4	8.2/19.7	5.8/14.4
WaNet (R50)	68.1/0.0	71.3/0.0	70.6/0.2	77.3/13.7	69.4/90.8	5.7/79.9	4.2/92.3
Frequency DaR (R50)	69.1/99.8	68.3/100.0	68.4/100.0	73.9/99.9	60.5/100.0	6.2/38.4	3.7/100.0

Table 7: Mitigation and detection comparison. On ImageNet, defenses reduce some attacks but do not uniformly remove DaR ; columns report repaired CA/ASR or clean-block/effective ASR.

Table 8

Figure 3: Poisoning-rate controls support. Poisoning rate vs. performance on ImageNet100 with ResNet18

\rightarrow

ResNet18-half. Frequency DaR reaches high ASR at lower rates.

Table 10

Figure 4: Trigger strength is not a knife edge. Trigger strength vs. backdoor performance on ImageNet100 using ResNet18. DaR remains effective.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Rule support is class-structured. On ImageNet, Frequency DaR concentrates rule-positive samples more strongly than Spatial DaR .

Corruption	Spatial	Freq.	Corruption	Spatial	Freq.
brightness	2.16	0.48	jpeg compression	6.69	2.48
contrast	11.49	25.82	motion blur	10.95	3.88
defocus blur	11.77	3.68	pixelate	7.98	2.86
elastic transform	7.30	2.74	saturate	3.86	1.97
fog	13.90	32.37	shot noise	2.60	2.98
frost	0.46	1.66	snow	1.46	0.23

Appendix

Table 12: Rule support survives common corruptions. On ImageNet-C, weighted trigger ratios remain close to the source poisoning rates.

Table 13: The rule is not tied to one distance or color cue. On ImageNet/ResNet18, DaR remains effective with L1 distance and grayscale evaluation.

Panel of Table 14 — Table 14: Selected clean positives define the test-time rule. ImageNet examples pair mined Spatial/Frequency positives with their triggered variants.

Backdoor Attacks

Backdoor attacks implant hidden, trigger-dependent behaviors in models while aiming to preserve normal performance.

See all 135 papers

How to Backdoor Image Knowledge Distillation
Apr 30, 2025Qian Ma, Chen Wu, Prasenjit Mitra +1Adversarial Attacks Data Poisoning Attacks
The Pennsylvania State University, State College, USA · Carnegie Mellon University Africa, Kigali, Rwanda
Checkerboard: A Simple, Effective, Efficient and Learning-free Clean Label Backdoor Attack with Low Poisoning Budget
May 2, 2026Yi Yang, Jinyang Huang, Binbin Liu +5Backdoor Attacks Data Poisoning Attacks
School of Computer Science and Information Engineering Hefei University of Technology Hefei, Anhui, China · School of Information Science and Technology University of Science and Technology of China Hefei, Anhui, China · Faculty of Business Data Science Kansai University Japan +3
Density-aware Sample-specific Attack
May 27, 2026Qiyuan Wang, Yao Li, Raymond K. W. WongBackdoor Attacks Adversarial Robustness
Texas A&M University · University of North Carolina at Chapel Hill

Apr 30, 2025J/K move · Enter open · S save

How to Backdoor Image Knowledge Distillation

Qian Ma, Chen Wu, Prasenjit Mitra, Sencun Zhu

The Pennsylvania State University, State College, USA · Carnegie Mellon University Africa, Kigali, Rwanda

Adversarial Attacks Data Poisoning Attacks Knowledge Distillation

Open paper AskPDF arXiv

Knowledge distillation is widely used to transfer behavior from a large teacher model to a smaller student. It is often assumed to be safe when the teacher is clean, because classic backdoor attacks rely on poisoned labels and triggers in supervised training, whereas distillation trains the student to match a teacher's outputs. We show that this assumption can fail when the distillation dataset itself is poisoned. Our attack injects triggered and manipulated images that a clean teacher already predicts as an attacker chosen target label, which causes the student to learn a backdoor even though the teacher remains unaffected. We evaluate this threat across multiple manipulation strategies, including targeted adversarial perturbations and targeted GAN based class transitions, and study how distillation settings influence both accuracy and attack success. We show that the attack remains effective even at a 10% poisoning rates. The results demonstrate that a clean teacher alone is not a sufficient safeguard: poisoned distillation data can produce a strongly backdoored student while maintaining competitive performance on clean images. These findings show that the integrity and provenance of distillation data are part of the security boundary of data intensive KD pipelines, even when the teacher itself is trusted.

Abstract

Backdoor Attacks

Explore similar work

How to Backdoor Image Knowledge Distillation

Checkerboard: A Simple, Effective, Efficient and Learning-free Clean Label Backdoor Attack with Low Poisoning Budget

Density-aware Sample-specific Attack