Results show that security assessment of self-supervised distillation should include executable training logic in addition to model weights and visible data.
Abstract
Self-supervised knowledge distillation is widely used to compress reusable encoders, but an untrusted distillation implementation can itself become an attack surface. We study an algorithm-level threat in which the teacher encoder and user-visible distillation dataset remain unchanged, while malicious code internally generates trigger-bearing views and optimizes an additional backdoor objective. To instantiate this threat, we propose soft gradient collaboration (SGC), which combines distribution-alignment-based distillation, target-representation-based backdoor design, and conflict-avoidance gradient collaboration to reduce interference with benign representation transfer while embedding a trigger-to-target association in the student encoder. Experiments on CIFAR-10 and STL-10 show that SGC maintains competitive downstream accuracy and effective non-target attack success. Quantitative CKA, feature-distribution, and class-structure analyses further indicate that SGC retains clean representations closer to benign distillation than fixed scalarization or removal of distribution alignment. Its no-defense attack success is not the highest among the compared attacks; instead, its main empirical advantage is stronger residual attack persistence after MIMIC, MKD, and SSLDefender. Under SSLDefender, SGC retains 9.12% non-target ASR on CIFAR-10 and 9.06% on STL-10, the highest residual values among the compared attacks. Additional experiments with a compact ResNet-18 student, multiple target classes and trigger configurations, and a supplemental CIFAR-100 setting broaden the empirical evaluation across student capacity, target semantics, trigger configurations, and label-space complexity. These results show that security assessment of self-supervised distillation should include executable training logic in addition to model weights and visible data. The concealment considered here is limited to dataset-only inspection and clean-output validation; SGC is not claimed to evade source-code auditing, runtime data-flow monitoring, or training-log inspection.
DSPrompt is proposed, a Dynamic Soft Prompt defense framework that directly reshapes the retriever's embedding semantics, without modifying the retrieval pipeline, and is consistently outperforming existing defense baselines at a fraction of their computational cost.
Chang Liu, Y. Lai, Mingyue Cui et al.· 0 citations
Self-supervised learning (SSL) encoders are vulnerable to backdoor attacks, posing threats to both visual SSL encoders and vision-language encoders. Existing defenses are typically designed for only one of these paradigms and rely on restrictive assumptions such as access to uninfected in-distribution data or precomputed pseudo-labels, which are difficult to satisfy in practice. To address these limitations, we propose DEFUSE, a generalizable backdoor detection framework for SSL encoders. Inspired by Bayesian posterior inference, we reformulate backdoor detection as a representation-conditioned image likelihood estimation problem parameterized by a conditional diffusion generative model. Uninfected representations tend to yield semantically consistent reconstructions, whereas backdoored ones are more likely to be mapped to the attacker's target class or semantically meaningless images, deviating from the original semantics and thereby exposing the backdoor. However, we find that the exact likelihood is intractable, because highly abstracted representations discard the low-level information necessary for pixel-faithful reconstruction. We therefore relax the objective to semantic reconstruction and evaluate it in a well-separated representation space provided by a reference encoder. Rather than training from scratch, we fine-tune a pretrained diffusion model, leveraging its generative prior to map data onto the natural image manifold while preserving semantic content. Extensive experiments demonstrate that DEFUSE substantially outperforms existing detectors across diverse attack settings, generalizing to both visual SSL and vision-language encoders. Notably, our method greatly reduces the reliance on prior knowledge about the victim encoder or the attack strategy. The source code is available at https://github.com/jsrdcht/DEFUSE .
Tuo Chen, Jie Gui, Minjing Dong et al.· 0 citations
Cloud-based language model services routinely process prompts containing sensitive information. Obfuscation-based defenses---including ObfusLM, SentinelLMs, TextObfuscator, and DPNR---mitigate this risk by transforming prompt representations before transmission, offering a lightweight alternative to cryptographic solutions. We show these defenses provide far less protection than previously believed. We present DeepInvert, a semi-supervised embedding inversion attack that recovers original tokens from obfuscated representations with higher accuracy than prior methods. The key insight is that unlabeled obfuscated embeddings retain exploitable semantic structure despite perturbation. DeepInvert combines supervised training on labeled shadow data with a novel unsupervised consistency objective over unlabeled target embeddings, alternating between the two via a mixed training pipeline. Defense-aware adaptations further extend the attack to diverse obfuscation mechanisms across encoder-based and autoregressive architectures. Experiments on nine defenses, five tasks, and four model architectures show that DeepInvert outperforms prior attacks on most defenses. Against ObfusLM, DeepInvert achieves 73.5\% top-1 token recovery versus 26.2\% for the previous best. Our results reveal a task-dependent tension: obfuscation schemes preserving enough signal for utility also retain sufficient structure for inversion, while schemes resisting inversion collapse utility. On simpler classification tasks, some DP-based defenses can maintain both. We call for a re-evaluation of this defense class.
This work reveals that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network, and proposes Trapping and Removing (TR), a simple yet effective training-time defense that introduces a lightweight shortcut branch as a "honeypot" to trap backdoor knowledge.
Zixuan Zhu, Rui Wang, Lihua Jing et al.· 0 citations
This work comprehensively investigates computation-efficient strategies to speed up latent adversarial training from two complementary perspectives, and reduces per-step adversarial-training FLOPs by 48.1% while requiring only 0.0118% trainable parameters.
Weiyi He, Yuping Lin, Jiliang Tang et al.· 0 citations
Vertical Federated Learning (VFL) allows multiple organizations with disjoint feature spaces and overlapping sample identities to collaboratively train machine learning models while keeping local data. Despite its privacy-preserving design, recent studies have shown that VFL is vulnerable to backdoor attacks. In particular, a malicious passive party can inject a carefully crafted trigger into its local inputs or intermediate embeddings, causing the global model to produce targeted mispredictions at inference time. Existing backdoor attacks in VFL (e.g., BadVFL) rely on the assumption that the malicious client can obtain additional knowledge about task labels, which contradicts the core privacy assumptions of VFL. In this paper, we propose GOFA, a new backdoor attack method for VFL scenarios. GOFA uses the gradient feedback from the server to construct a poisoned dataset and employs an adversarial example attack (e.g., FGSM) for masking the original features of the data to enhance trigger learning. We use the CIFAR-10 and UCI-HAR datasets. Our experiments demonstrate the effectiveness of our method in various settings.
Ye Cheng, Naotoshi Adachi· 2026 6th International Confe...· 0 citations
