Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attack
This reveals a critical vulnerability in deploying deep neural networks via knowledge distillation, posing a security threat for resource-constrained devices, and is a novel attack method rather than incremental.
The paper tackles the problem of backdoor attacks in knowledge distillation by introducing distillation-conditional backdoor attacks (DCBAs), which inject dormant backdoors into teacher models that activate in student models during distillation, achieving high attack success rates (e.g., over 90% in some cases) while evading detection.
Knowledge distillation (KD) is a vital technique for deploying deep neural networks (DNNs) on resource-constrained devices by transferring knowledge from large teacher models to lightweight student models. While teacher models from third-party platforms may undergo security verification (\eg, backdoor detection), we uncover a novel and critical threat: distillation-conditional backdoor attacks (DCBAs). DCBA injects dormant and undetectable backdoors into teacher models, which become activated in student models via the KD process, even with clean distillation datasets. While the direct extension of existing methods is ineffective for DCBA, we implement this attack by formulating it as a bilevel optimization problem and proposing a simple yet effective method (\ie, SCAR). Specifically, the inner optimization simulates the KD process by optimizing a surrogate student model, while the outer optimization leverages outputs from this surrogate to optimize the teacher model for implanting the conditional backdoor. Our SCAR addresses this complex optimization utilizing an implicit differentiation algorithm with a pre-optimized trigger injection function. Extensive experiments across diverse datasets, model architectures, and KD techniques validate the effectiveness of our SCAR and its resistance against existing backdoor detection, highlighting a significant yet previously overlooked vulnerability in the KD process. Our code is available at https://github.com/WhitolfChen/SCAR.