如何对图像知识蒸馏实施后门攻击

View PDF HTML (experimental)

Abstract:Knowledge distillation is widely used to transfer behavior from a large teacher model to a smaller student. It is often assumed to be safe when the teacher is clean, because classic backdoor attacks rely on poisoned labels and triggers in supervised training, whereas distillation trains the student to match a teacher's outputs. We show that this assumption can fail when the distillation dataset itself is poisoned. Our attack injects triggered and manipulated images that a clean teacher already predicts as an attacker chosen target label, which causes the student to learn a backdoor even though the teacher remains unaffected. We evaluate this threat across multiple manipulation strategies, including targeted adversarial perturbations and targeted GAN based class transitions, and study how distillation settings influence both accuracy and attack success. We show that the attack remains effective even at a 10% poisoning rates. The results demonstrate that a clean teacher alone is not a sufficient safeguard: poisoned distillation data can produce a strongly backdoored student while maintaining competitive performance on clean images. These findings show that the integrity and provenance of distillation data are part of the security boundary of data intensive KD pipelines, even when the teacher itself is trusted.

Comments:	Accepted as a regular paper for the 2026 IEEE International Conference on Big Data
Subjects:	Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Machine Learning (cs.LG)
Cite as:	arXiv:2504.21323 [cs.CR]
	(or arXiv:2504.21323v5 [cs.CR] for this version)
	https://doi.org/10.48550/arXiv.2504.21323 arXiv-issued DOI via DataCite

Submission history

From: Qian Ma [view email]
[v1] Wed, 30 Apr 2025 05:19:23 UTC (3,614 KB)
[v2] Mon, 12 Jan 2026 01:10:07 UTC (2,471 KB)
[v3] Tue, 8 Sep 2026 01:27:50 UTC (2,526 KB)
[v4] Thu, 22 Oct 2026 01:32:21 UTC (2,526 KB)
[v5] Thu, 5 Nov 2026 00:57:56 UTC (2,398 KB)