Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks

Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks

Summary

This paper introduces Distributional Feature Coverage Sample Selection (DFCS), a method for selecting poisoned samples in low-budget dirty-label backdoor attacks. The authors state: "We propose Distributional Feature Coverage Sample Selection (DFCS), a training-free, trigger-agnostic method that clusters fixed pretrained features into one region per poisoning slot and selects the centroid-nearest sample from each region."

The paper addresses the problem that Existing methods typically rank candidates using per-sample scores, which can select redundant samples from similar semantic regions, and many require task-specific surrogate training. The authors argue that The problem is therefore not only which candidates have large individual scores, but how the entire budget is allocated.

DFCS works as follows: "DFCS uses a frozen external encoder, k-means with B regions, and centroid-nearest projection to real candidates. The budget thus determines both the number of represented regions and the number of selected samples, while each region contributes one actual training example. The method is described as trigger-independent, training-free and uses a frozen external encoder, k-means with B regions, and centroid-nearest projection to real candidates."

The paper provides a theoretical motivation: "We further provide a local first-order motivation tailored to dirty-label replacement. Under the equal weighting used by the implemented attack, the discrepancy between the candidate-average and selected-set replacement signals is bounded in terms of feature-space quantization and representative-mass imbalance. This leads to Proposition 1, which states: Assume that Ax is LA(x)-Lipschitz on the candidate pool with respect to the normalized pretrained features and that Ax(s) ≤ MA(x) for every s ∈ S. Then Δ̃C(x) − Δ̃uS(x) ≤ ηLA(x)√Δ2(S) + ηMA(x)Γ(S). The paper explains: Proposition 1 separates the approximation error into two components. The first depends on Δ2(S) and therefore directly reflects the distributional-coverage objective in Eq. (1). The second captures the discrepancy between the candidate mass represented by each selected sample and the uniform weight imposed by the poison-set construction."

The experimental results show: "Across BadNets and Blended attacks on CIFAR-10, Tiny-ImageNet, and Imagenette, DFCS achieves the highest mean attack success rate among seven selectors in all six dataset–attack settings, averaging 96.30% and exceeding the strongest comparator in each setting by 4.60 percentage points on average while preserving clean accuracy."

Specifically, the paper reports: "DFCS achieves the highest mean ASR in all six dataset–attack settings, ranging from 93.81% to 98.32%, and is the only selector whose mean ASR exceeds 90% in every setting. Its margin over the best competing baseline in each setting ranges from 2.38% to 8.71%. Averaged across the three datasets, this margin is 6.24% for BadNets and 2.97% for Blended. The difference between DFCS's mean ACC and that of the corresponding no-attack model ranges from −0.07% to +0.74% across the six settings."

The paper also reports on selection efficiency: Averaging across the six dataset–attack settings, DFCS achieves 96.30% mean ASR, compared with 87.84% for HFE. DFCS is faster than FUS, RD, PFS, and IFS in every case across the three datasets.

The ablation studies show robustness across multiple dimensions. Regarding poisoning rate, DFCS maintains a higher mean ASR than both references throughout this very-low-budget range. For victim-training strategy, Across all configurations, DFCS maintains a mean ASR of at least 86.3%, indicating that its effectiveness does not depend on a single victim-training strategy. For target class, DFCS achieves the highest mean ASR for every target, attaining approximately 95%–99% for nine classes and about 89% for class 6. For victim architecture, DFCS achieves approximately 98.3%, 97.4%, 99.2%, and 89.7% ASR on these architectures, respectively, exceeding RD in every case. For pretrained encoder, DFCS therefore retains at least 95.5% mean ASR across the five evaluated representation spaces, with DINOv3 providing the highest mean and the smallest dispersion.

The paper concludes: "In this paper we introduce DFCS, which clusters frozen candidate features into B clusters and selects the sample nearest each centroid, allocating equal-weight dirty-label poisoning slots without task-specific selector training. Across three datasets and two attacks, DFCS achieves the highest mean ASR in all settings while preserving clean accuracy, with efficient sample selection. It remains effective across the evaluated budgets, victim-training strategies, targets, victim architectures, and encoders, while the local analysis and matched controls supported global, centroid-nearest allocation."

Improvements to AI Systems:

1. Trigger-Agnostic Poisoned Sample Selection for Robustness Testing: Integrate DFCS into red-team/security evaluation pipelines for vision models. The system can now generate highly effective dirty-label backdoor attacks with as few as 10–50 poisoned samples (93.81–98.32% ASR) without needing to know the trigger type or train a surrogate model. This allows security auditors to stress-test defenses across diverse trigger patterns and low-budget scenarios, identifying model vulnerabilities that per-sample ranking methods miss.

2. Training-Free Data Subset Selection for General Learning: Apply the DFCS principle (k-means clustering of frozen features + centroid-nearest selection) to any task requiring diverse, representative subset selection—e.g., active learning, dataset distillation, or few-shot fine-tuning. The improved system can select a maximally diverse training subset from a large unlabeled pool in a single forward pass (no gradient updates), ensuring each selected sample represents a distinct semantic region, which reduces redundancy and improves generalization under tight data budgets.

3. Distributional Coverage for Class-Imbalanced or Long-Tail Learning: Use DFCS’s coverage objective to allocate training samples across under-represented classes. The system can cluster features per class and select centroid-nearest samples to ensure uniform representation of each semantic sub-region, mitigating the “representative-mass imbalance” error bound from Proposition 1. This improves minority-class accuracy without oversampling or synthetic data, by explicitly controlling the feature-space quantization error.

4. Efficient Multi-Architecture Backdoor Defense Evaluation: Leverage DFCS’s encoder-agnostic property (works with DINOv2, CLIP, etc.) to build a universal attack-generation module that works across victim architectures (ResNet, VGG, DenseNet, ViT). The improved system can automatically generate high-ASR poisoned datasets for any target architecture without retraining the selector, enabling fast, fair comparison of defense mechanisms across model families.

5. Local Error-Bounded Sample Selection for Robust Optimization: Incorporate the theoretical bound (Δ̃C(x) − Δ̃uS(x) ≤ ηLA(x)√Δ2(S) + ηMA(x)Γ(S)) into a general sample-selection framework. The improved system can explicitly minimize the two error terms—feature-space quantization (Δ2) and mass imbalance (Γ)—by adjusting cluster count B and selecting samples that balance both. This yields a principled, provably near-optimal selection strategy for any poisoning or data-weighting task, with guarantees on the discrepancy between full-set and selected-set gradients.

6. Real-Time Data Curation for Continual Learning: Deploy DFCS as a streaming filter that clusters incoming data into B regions and retains only centroid-nearest exemplars per region. The improved system can maintain a diverse, compact memory buffer for rehearsal-based continual learning, preventing catastrophic forgetting while keeping memory usage constant—since each region contributes exactly one sample, regardless of data stream size.