Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks

2026-08-09

AI Summary

This work addresses the challenge of low-poisoning-rate backdoor attacks, where existing methods struggle to efficiently associate triggers with target labels due to sample redundancy or reliance on task-specific training. To overcome this limitation, the authors propose DFCS—a training-free, trigger-agnostic sample selection strategy that introduces distributional feature coverage as a core principle for low-budget dirty-label backdoor attacks. DFCS leverages fixed features extracted from a pretrained model, partitions the feature space via clustering, and selects samples closest to each cluster centroid to maximize coverage. Evaluated on CIFAR-10, Tiny-ImageNet, and Imagenette under BadNets and Blended attack settings, DFCS achieves an average attack success rate of 96.30%, outperforming the strongest baseline by 4.60 percentage points while preserving clean accuracy.

Abstract

Backdoor attacks compromise training data so that a model retains clean accuracy but predicts an attacker-chosen target on triggered inputs. At very low poisoning rates, only a few samples convey the trigger--target association, making poison-sample selection critical. Existing methods typically rank candidates using per-sample scores, which can select redundant samples from similar semantic regions, and many require task-specific surrogate training. We propose Distributional Feature Coverage Sample Selection (DFCS), a training-free, trigger-agnostic method that clusters fixed pretrained features into one region per poisoning slot and selects the centroid-nearest sample from each region. A local first-order analysis relates this allocation to feature-coverage and representative-mass terms. Across BadNets and Blended attacks on CIFAR-10, Tiny-ImageNet, and Imagenette, DFCS achieves the highest mean attack success rate among seven selectors in all six dataset--attack settings, averaging $96.30\%$ and exceeding the strongest comparator in each setting by 4.60 percentage points on average while preserving clean accuracy. These results support distributional feature coverage as an effective selection principle for low-budget dirty-label backdoor attacks.

Problem

• backdoor attacks
• sample selection
• data efficiency
• poisoning rate
• attack success rate

Innovation

• backdoor attack
• sample selection
• feature coverage
• data-efficient poisoning
• training-free