DarkHash: A Data-Free Backdoor Attack Against Deep Hashing

2025-10-09

AI Summary

This work introduces the first data-free backdoor attack against deep hashing models—requiring no access to the original training data. To address the challenge of stealthily implanting backdoors while preserving retrieval performance in data-absent scenarios, we propose a bilingual semantic-guided shadow backdoor framework. It fine-tunes the target layer using a surrogate dataset and jointly optimizes individual samples and their neighbors toward a predefined target hash code via neighborhood relation modeling and topology alignment loss. Extensive experiments across four image datasets, five model architectures, and two hashing paradigms demonstrate that our method significantly outperforms existing state-of-the-art backdoor attacks. Crucially, it maintains the model’s original retrieval accuracy, exhibits strong stealthiness, and resists mainstream defensive techniques.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Learning to Search

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

Benefiting from its superior feature learning capabilities and efficiency, deep hashing has achieved remarkable success in large-scale image retrieval. Recent studies have demonstrated the vulnerability of deep hashing models to backdoor attacks. Although these studies have shown promising attack results, they rely on access to the training dataset to implant the backdoor. In the real world, obtaining such data (e.g., identity information) is often prohibited due to privacy protection and intellectual property concerns. Embedding backdoors into deep hashing models without access to the training data, while maintaining retrieval accuracy for the original task, presents a novel and challenging problem. In this paper, we propose DarkHash, the first data-free backdoor attack against deep hashing. Specifically, we design a novel shadow backdoor attack framework with dual-semantic guidance. It embeds backdoor functionality and maintains original retrieval accuracy by fine-tuning only specific layers of the victim model using a surrogate dataset. We consider leveraging the relationship between individual samples and their neighbors to enhance backdoor attacks during training. By designing a topological alignment loss, we optimize both individual and neighboring poisoned samples toward the target sample, further enhancing the attack capability. Experimental results on four image datasets, five model architectures, and two hashing methods demonstrate the high effectiveness of DarkHash, outperforming existing state-of-the-art backdoor attack methods. Defense experiments show that DarkHash can withstand existing mainstream backdoor defense methods.

Problem

• Attacks deep hashing models without training data access
• Embeds backdoors while preserving original retrieval accuracy
• Utilizes dual-semantic guidance and topological alignment loss

Innovation

• Data-free backdoor attack using surrogate dataset
• Dual-semantic guidance with shadow framework
• Topological alignment loss enhances attack capability