Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation

He Yang, Dongyi Lv, Song Ma, Wei Xi, Jizhong Zhao

Abstract

Dataset condensation aims to synthesize compact yet informative datasets that retain the training efficacy of full-scale data, offering substantial gains in efficiency. Recent studies reveal that the condensation process can be vulnerable to backdoor attacks, where malicious triggers are injected into the condensation dataset, manipulating model behavior during inference. While prior approaches have made progress in balancing attack success rate and clean test accuracy, they often fall short in preserving stealthiness, especially in concealing the visual artifacts of condensed data or the perturbations introduced during inference. To address this challenge, we introduce Sneakdoor, which enhances stealthiness without compromising attack effectiveness. Sneakdoor exploits the inherent vulnerability of class decision boundaries and incorporates a generative module that constructs input-aware triggers aligned with local feature geometry, thereby minimizing detectability. This joint design enables the attack to remain imperceptible to both human inspection and statistical detection. Extensive experiments across multiple datasets demonstrate that Sneakdoor achieves a compelling balance among attack success rate, clean test accuracy, and stealthiness, substantially improving the invisibility of both the synthetic data and triggered samples while maintaining high attack efficacy. The code is available at https://github.com/XJTU-AI-Lab/SneakDoor.

SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation

Abstract

Dataset condensation aims to synthesize compact yet informative datasets that retain the training efficacy of full-scale data, offering substantial gains in efficiency. Recent studies reveal that the condensation process can be vulnerable to backdoor attacks, where malicious triggers are injected into the condensation dataset, manipulating model behavior during inference. While prior approaches have made progress in balancing attack success rate and clean test accuracy, they often fall short in preserving stealthiness, especially in concealing the visual artifacts of condensed data or the perturbations introduced during inference. To address this challenge, we introduce Sneakdoor, which enhances stealthiness without compromising attack effectiveness. Sneakdoor exploits the inherent vulnerability of class decision boundaries and incorporates a generative module that constructs input-aware triggers aligned with local feature geometry, thereby minimizing detectability. This joint design enables the attack to remain imperceptible to both human inspection and statistical detection. Extensive experiments across multiple datasets demonstrate that Sneakdoor achieves a compelling balance among attack success rate, clean test accuracy, and stealthiness, substantially improving the invisibility of both the synthetic data and triggered samples while maintaining high attack efficacy. The code is available at https://github.com/XJTU-AI-Lab/SneakDoor.

Paper Structure

This paper contains 25 sections, 6 theorems, 44 equations, 5 figures, 18 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Methodology
  4. Threat Model
  5. Stealthy Backdoor Attack against Dataset Condensation
  6. Stealthiness Analysis
  7. Experiments
  8. Datasets and Networks.
  9. Evaluation Metrics.
  10. Overall Attack Effectiveness.
  11. Effectiveness on Different Datasets
  12. Effectiveness on Cross Architectures
  13. Evaluation of Stealthiness
  14. Robust to Defense
  15. Ablation study
  16. ...and 10 more sections

Key Result

Theorem 1

Let $\mathcal{T}_{y_\tau}$ denote the clean target-class dataset and $\mathcal{T}_{\mathrm{triggered}}$ the triggered (poisoned) dataset, with corresponding feature-space distributions $P_{\mathcal{M}_{\mathrm{clean}}}$ and $P_{\mathcal{M}_{\mathrm{triggered}}}$, respectively. Define the mixed distr where $\mathcal{H}$ is the RKHS associated with the feature encoder.

Figures (5)

  • Figure 1: Stealthiness Illustration
  • Figure 2: Attack Performance on STL10. Larger area indicates better balance.
  • Figure 3: Attack Performance on Tiny-ImageNet. Larger area indicates better balance.
  • Figure 4: Stealthiness Performance on STL10
  • Figure 5: STL10 Stealthiness Illustration

Theorems & Definitions (12)

  • Definition 1: Kernel
  • Definition 2: Reproducing Kernel Hilbert Space, RKHS
  • Theorem 1: Upper Bound on Feature-Manifold Deviation under Poisoning
  • Theorem 2: Upper Bound on the Discrepancy Between Poisoned and Clean Condensation Datasets
  • Lemma 1: Boundedness of Latent Space Perturbation
  • proof
  • Lemma 2
  • proof
  • Theorem 3: Upper Bound on Feature-Manifold Deviation under Poisoning
  • proof
  • ...and 2 more