arXiv cs.AI· Andrew Draganov, Tolga H. Dur, Anandmayi Bhongade, Mary Phuong·· 9 天前AI 评分62
Phantom Transfer：数据投毒可绕过数据层防御
Phantom Transfer: Data Poisoning can Survive Data-Level Defences
AI 导读
论文提出一种名为 Phantom Transfer 的数据投毒攻击，即使已知毒样本如何被放入原本干净的数据集，也无法将其过滤掉。该攻击通过改造 subliminal learning 使其适用于真实场景，无论数据由哪个模型生成、哪个模型在数据上训练、攻击目标是什么都能生效，并绕过了 11 种已测试的数据层防御，其中包括用另一个模型对每个样本进行改写。
正文 · 原文
Abstract:We present a data poisoning attack -- Phantom Transfer -- with the property that, even if you know precisely how the poison was placed into an otherwise benign dataset, you cannot filter it out. We achieve this by modifying subliminal learning to work in real-world contexts and demonstrate that the attack works regardless of which model produced the data, which model is trained on the data or what the attack target is. Furthermore, the attack survives 11 tested data-level defences, including one where every sample is paraphrased by another model. We characterise when this attack works best and show that it can be used to plant password-triggered behaviours into models while still beating defences. We suggest that future defences should be supplemented with white-box methods and post-training model audits.
| Comments: | Camera-ready version accepted at NeurIPS 2026; expanded experiments and model audits |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2602.04899 [cs.CR] |
| (or arXiv:2602.04899v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2602.04899 arXiv-issued DOI via DataCite |
Submission history
From: Tolga Dur [view email]
[v1]
Tue, 3 Feb 2026 14:38:07 UTC (325 KB)
[v2]
Tue, 2 Jun 2026 15:48:30 UTC (498 KB)
[v3]
Wed, 7 Oct 2026 21:35:49 UTC (512 KB)
来源：arXiv cs.AI · arxiv.org