Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks
2026-08-10 • Cryptography and Security
Cryptography and SecurityComputer Vision and Pattern Recognition
AI summaryⓘ
The authors studied how to best pick which few samples to poison in a backdoor attack, where a model learns a hidden trigger while still working well normally. They introduced a new method called DFCS that doesn’t need extra training and picks diverse samples by grouping features and choosing central examples. Tested on several image datasets and attacks, their approach consistently gave higher success in causing the backdoor effect without hurting normal performance. This shows that covering different feature groups is useful when you have very few poisoned samples to insert.
Backdoor attacksTraining data poisoningTriggerFeature clusteringSample selectionPoisoning rateBadNetsBlended attacksClean accuracyFeature coverage
Authors
Yi Yang, Xiaoke Chen, Jinyang Huang, Feng-Qi Cui, Yu-Tong Guo, Jia-Cheng Zhao, Haiming Jin, Xiaokang Zhou, Meng Li
Abstract
Backdoor attacks compromise training data so that a model retains clean accuracy but predicts an attacker-chosen target on triggered inputs. At very low poisoning rates, only a few samples convey the trigger--target association, making poison-sample selection critical. Existing methods typically rank candidates using per-sample scores, which can select redundant samples from similar semantic regions, and many require task-specific surrogate training. We propose Distributional Feature Coverage Sample Selection (DFCS), a training-free, trigger-agnostic method that clusters fixed pretrained features into one region per poisoning slot and selects the centroid-nearest sample from each region. A local first-order analysis relates this allocation to feature-coverage and representative-mass terms. Across BadNets and Blended attacks on CIFAR-10, Tiny-ImageNet, and Imagenette, DFCS achieves the highest mean attack success rate among seven selectors in all six dataset--attack settings, averaging $96.30\%$ and exceeding the strongest comparator in each setting by 4.60 percentage points on average while preserving clean accuracy. These results support distributional feature coverage as an effective selection principle for low-budget dirty-label backdoor attacks.