Rethinking Backdoor Attacks on Dataset Distillation: A Kernel Method Perspective
Authors: Ming-Yu Chung
Sheng-Yen Chou
Chia-Mu Yu
Pin-Yu Chen
Sy-Yen Kuo
Tsung-Yi Ho
Venue: ICLR 2024 poster (2024)
Keywords: Backdoor
Trigger
Dataset Condensation
Dataset Distillation
Primary area: societal considerations including fairness, safety, privacy
TL;DR: We theoretically analyze the backdoor attack using dataset condensation and then propose a trigger pattern generation algorithm.

Abstract: Dataset distillation offers a potential means to enhance data efficiency in deep learning. Recent studies have shown its ability to counteract backdoor risks present in original training samples. In this study, we delve into the theoretical aspects of backdoor attacks and dataset distillation based on kernel methods. We introduce two new theory-driven trigger pattern generation methods specialized for dataset distillation. Following a comprehensive set of analyses and experiments, we show that our optimization-based trigger design framework informs effective backdoor attacks on dataset distillation. Notably, datasets poisoned by our designed trigger prove resilient against conventional backdoor attack detection and mitigation methods.  Our empirical results validate that the triggers developed using our approaches are proficient at executing resilient backdoor attacks.

Published as a conference paper at ICLR 2024
RETHINKING BACKDOOR ATTACKS ON DATASET DIS- TILLATION: A KERNEL METHOD PERSPECTIVE
Ming-Yu Chung National Taiwan University
Sheng- Yen Chou
The Chinese University of Hong Kong
Chia-Mu Yu National Yang Ming Chiao Tung University
Pin-Yu Yu Chen IBM Research
Sy-Yen Kuo
National Taiwan University
Tsung-Y Yi Ho
The Chinese University of Hong Kong
ABSTRACT
Dataset distillation offers a potential means to enhance data efficiency in deep learning. Recent studies have shown its ability counteract backdoor risks present in original training samples. In this study, we delve into the theoretical aspects of backdoor attacks and dataset distillation based on kernel methods. We introduce two new theory-driven trigger pattern generation methods specialized for dataset distillation. Following a comprehensive set of analyses and experi- ments, we show that our optimization-base trigger design framework informs effective backdoor attacks on dataset distillation. Notably, datasets poisoned by our designed trigger prove resilient against conventional backdoor attack detection and mitigation methods. Our empirical results validate that the triggers developed using our approaches are proficient at executing resilient backdoor attacks.
INTRODUCTION
In recent years, deep neural networks have achieved significant success in many fields, such as natural language modeling, computer vision, medical diagnosis, etc. These successes are usually built on large-scale datasets consisting of millions or even billions of samples. Under this scale of datasets, training a model becomes troublesome because of the need for sufficiently large memory to store the datasets or the need for special infrastructure to train model. To deal with this problem, dataset distillation (Wang et al., 2018)) or dataset condensation (Zhao et al.) (02T) is designed to compress the information of large datasets into small synthetic dataset. These small datasets generated by dataset distillation, called distilled datasets, still retain a certain degree of utility. Under the same model (neural network) structure, the performance of the model trained the distilled dataset is only slightly lower than that the model trained on the original large-scale dataset.
However, with the development of dataset distillation techniques, the related security and privacy issues started to emerge (Liu et al. 2023a Dong et al. 2022). In this paper, we focus on backdoor attacks dataset distillation. In particular, each distilled sample does not have clear connection to the original samples, a straightforward stealthy backdoor attack is to poison a benign dataset first and then derive the corresponding distilled poisoned dataset. One can expect that the triggers can hardly be detected visually in the distilled poisoned dataset. However, these triggers, if not designed properly, can be diluted during dataset distillation, making backdoor attacks ineffective.
Liu et al. (2023c) empirically demonstrate the feasibility of generating a poisoned dataset surviving dataset distillation. In particular. [Liu et al. (2023c) propose DOORPING as distillation-resllle backdoor. However, DOORPING suffers from two major weaknesses. First, the resiliency and opti- mality of backdoor against dataset distillation remain unclear, mainly due the lack of a theoret-
Cooee available ottpaaaa....aaaee......ooooooeee www.eedd-bcoooo-----oo htt.ooorrrtttck......

---

Published as a conference paper at ICLR 2024
ical foundation for the distillation resiliency. Second, DOORPING relies a bi-level optimization and, as a consequence, consumes a significant amount of time to generate backdoor triggers.
To bridge this gap, this paper makes step toward dataset distillation-resileent backdoors with theoretical foundation. Our contributions can be summarized as follows:
To the best of our knowledge, we establish the first theoretical framework to characterize backdoor effects on dataset distillation, which explains why certain backdoors survive dataset distillation.
We propose two theory-induced backdoors, simple-trigger and relax-triggen In particular, relax- trigger and DOORPING share the same clean test accuracy (CTA) and attack success rate (ASR). However, relax-trigger relies only on ordinary (single-level) optimization procedures and can be computationally efficient.
We experimentally show both simple-trigger and relax-trigger signify the advanced threat vector to either completely break or weaken eight existing defenses. In particular, relax-trigger can evade all eight existing backdoor detection and cleansing methods considered in this paper.
BACKGROUND AND RELATED WORKS
Dataset Distillation. Dataset distillation is a technique for compressing the information of target
dataset into a small synthetic dataset. The explicit definition can be described as follows. Consider the input space X C. RR the label space C. RC,, and the distribution (I. y) D, where x X and y E V. Suppose we are given a dataset denoted by T = {(E,, 8e)] DD where It E X, Ye E V, and N is the number of samples, and synthetic dataset denoted as S {(I ya)) Ns where ds E X. y/ E V, Ns is the number of samples in S, and Ns & N. The synthetic dataset S* generated by dataset distillation method can be formulated as
S = arg min C(S,
(1)
5
where C is some function to measure the information loss between and T. There are several types of C. One of the most straightforward ways to define L is to measure the model's performance. In this sense, the dataset distillation can be reformulated as
1 s N
S = arg min E(fs T) subject to fs = arg min ((f 5) + AlffI fEH Ns
(2)
where the model (a classifier) is denoted f X' > V, H is some collection of models (hypothesis class), is the loss function measuring the loss of model evaluated on the dataset, À > 0 is the weight for the regularization term, and ||| is some norm defined on H. Eq. 2 forms bi-level op- timization problem. This type of dataset distillation is categorized as performance- dataser distillation in (Yu al. (202).. For example, all of the methods from (Wang et al.) 2018 Nguyen et al. 2021 Loo et al. 2022; Zhou et al. 2022: Loo et al. 2023) are performance-matee Lee et al. [202a Wang et al. 2022] /Zao
dataset
distillate lation while the methods from (Zhao & Bilen 2023
et al., [021 Lee et al. 20226 Liu et al. 2022] Wang et al.] 20033 belong to either parameter- dataset distillation, with a particular example on kernel inducing points (KIP) from Nguyen et al. (202T).
preserving or distributionnpreserviin
In this paper, we focus only on performance-matchnn
Reproducing Kernel Hilbert Space and KIP. In general, the inner optimization problem in Eq. (2) does not have closed-form solution, which not only increases the computational cost, but also increases the difficulty of analyzing this problem. To alleviate this problem, we assume our model lies in the reproducing kernel Hilbert space (RKHS) (Aronszajn 1950 Berlinet & Thomas-
Agnan 2011: Ghojogh et al., (021)..
Definition (Kernel). k: X x X - + is a kerenl if the following two points hold. (a) Vz, x' E X, the kernel k is symmetric; i.e., k(x,x²)) k(a', k(x',z). x). (b) Vn E V(11, X2,1,22,....551 where each x;
are sampled from X, the kernel matrix K defined as K.j == (;) is postive semi-definite
Definition 2 (Reproducing Kernel Hilbert Space). Given an kernel l : X x X + R. the collection of real-valued model H4 = {f X + R. is reproducing kernel Hilbert space corresponding to the kernel k. if (a) H2 is a Hilbert space corresponding to the inner product (:,),., (b) Vz E X, k(,,,) x) E Hi. (c) Vx E X and f E Hr. f(x) = (S, k(, H)H,, (Reproducing property).
2

---

Published as a conference paper at ICLR 2024
There are several advantages to considering RKHS for solving optimization problems. One of the most beneficial properties is that there Representer Theorem (Kimeldorf' & Wahba 1971; Ghojogh et al. 202I induced by the reproducing property. In particular, consider the optimization problem:
N
f arg min fEHr N
Σ ((f(z)). + AII
(3)
where f: X - RR, yi R, À 2 0 the weight for the regularization term. The solution of the optimization problem f can be expressed as the linear combination of {k(,, z.)); Furthermore, we set (I, = (x) - vll.. there a closed-form expression for f*:
( k(r, (XX,, X) + NAI
where k(r,X) = [k(a, x1), k(r, x2)
IN]] 1(X, X) is an N X N matrix with [K(X,, x)1 Iz), and Y [/1, U2 UN Now, we return to Eq.
By rewriting
the model f X + + R as [f', f². .2...... fT.T where each f": X' + E is a real-valued function and f is bounded in the RKHS He. the inner optimization problem for fs in Eq. (2) can be consid-
ered as independent optimization problems and each problem has closed-form solution as shown in Eq. (4). Thus, the solution of the inner optimization problem can be expressed as
fs(x)² = k(r, X (Xs, Xs) + NgAT Yss
(5)
where k(2, Xs) = [k(,, k(I, Iez).... ..... k(æ, LaNg }}, k(Ks Xs) is Ns x Ns matrix with [k(Xx, Xs)lis k=,,,, D,,), and YsS is Ns matrix with Ys [y,, Uszs- MoNg!
Then, the dataset distillation problem can be expressed as
N Σ
S = arg min S
[[s(()))
-vell
(6)
N
where fs(x)) optimization problem one-level optimization problem using RKHS. Essentially, KIP (Nguyen let al. 2021) can be formulated as Eq. (6).
= k(r, (s) Xs) N as shown in Eq. (5) We reduce a two-level
An important problem for Eq. (6) is how to construct select kernel k..,)). Nevertheless, do
not discuss this problem in this paper. We directly consider the neural tangent kernel (NTK) (Jacol
2018 [e al., 2020 Lee al. 2019) induced by three-layer neural network the kernel al.
k(
to do the experiment in Section
Backdoor Attack. Backdoor attack introduces some malicious behavior into the model without degrading the model's performance on the original task by poisoning the dataset (Gu et al.
2019
Chen al. 2017 Liu al.] 2018b) Turner et al. 2019 Nguyen & Tran 2020 Barni et al.
2019
Li et al.] [2021c] Nguyen & Tran 2021] Liu et al. 2020; Tang et al.) 20.1 Qi et al.) 2022
Souri
al. 2022). To be more specific, consider the following scenario. Suppose there are two types of distributions, (Ia, Ma) ~ DA and (Io, yb) DB. DA corresponds to the original normal behavior, while DB corresponds to the malicious behavior. The goal of the backdoor attack is to construct a poisoned dataset such that the model trained on it learns well for both the original normal distribution DA and the malicious distribution DB. In other words, an attacker wants to construct a dataset Í such that the model trained on D. denoted fp. has sufficiently low risk E(g.,h)> ((fD. (Na, ya)) and E(z,.,)>>,, {fpp (Ia, yb)) at the same time.
One approach to constructing such a dataset ò is to directly mix the benign dataset DA ~ DNA and the trigger dataset DB DN An attacker usually wants to make the attack stealthy, and so it sets NB < NA- We define DB according to the original normal behavior DA. the trigger T E IR.. and the trigger label yr E y:
(ob, yb) = ((1 - m) 3 x. + m 3 T,yr),
(7)
where Fa DA, E Rdd is the real-valued mask and is the Hadamard product.
3

---

Published as a conference paper at ICLR 2024
3 PROPOSED METHODS AND THEORETICAL ANALYSIS
In this paper, we aim to use dataset distillation (KIP as a representative) to perform the backdoor at- tack. In the simplest form of KIP-based backdoor attacks (as shown in Algorithm[]of the Appendix), first construct the poisoned dataset D D A U D from D and D Then, perform KIP on D and compress the information D into the distilled poisoned dataser S* {(r,, Ms)) where Ns < NA + NB. Namely, we solve the following optimization problem
S = arg min S
1
Σ
llfs(z)) vll2.
NA + NB
(x.Y))
where /s(x)² - k(x, {s))k(Xss N -Y. Essentially, the above KIP-based backdoor attack is the same as Naive attack in (Liu et al. 2023c) except that the other distillation, instead of KIP, is used in Naive attack. The experimental results in (Liu et al. 2023c) show that ASR grows but CTA drops significantly when the trigger size increases. Liu et al. (202cc) claims tradc-off' between CTA and the trigger size. Nonetheless, we find that our KIP-based backdoor attack does not have such trade-off. This motivates us to develop theoretical framework for backdoor attacks on dataset distillation.
followed by two theory-induced back- Below, we introduce the theoretical framework in Section 3.1
door attacks, simple-trigger and relax-trigger in Section 3.2 and Section 3.3 respectively.
3.1 THEORETICAL FRAMEWORK
We first introduce the structure of our analysis, which divides the risk of KIP-based backdoor attacks into three parts: projection loss, conflict loss, and generalization gap. Then, we provide an upper bound for each part of the risk.
Structure of Analysis. Recall that the goal of a KIP-based backdoor attack is to construct the synthetic dataset S* such that the risk (( (a., y)) is sufficiently low, where DD is the normal distribution DA or the malicious distribution DB. The classical framework for analyzing this problem divide the risk into two parts, the empirical risk and generalization gap. Namely,
((r ((fs. (z, = B(a.)) Elfs-, (x,
Empirical risk
+ [(aa))> ((Ss, (z, v)) BLayYD C(Ss (z, v))
Generalization gap
where D (1,, W is the dataset sampled from the distribution DN and N is the number of samples of D. Here, we consider that D is DA NA or DB DN, In framework, continue to divide the empirical risk into two parts as
E(ag)~D (x. NA + NB
min B (ax) Dlfs, (z,fn()))) B B (z. v))l S
N
Projection Loss
Conflict Loss
(10)
where D DAUDB, , is the model trained on Đ with the weight of the regularization term and fs is the model trained S with the weight of the regularization term Äs > 0. Intuitively, given dataset 1) constructed from D and D. J is regarded the best model derived from the information of i). The conflict loss reflects the internal information conflict between the information about A in D and the information about DD in D. For example, we consider a dog/cat picture classification problem. In the dataset DA, we label the dog pictures with 0 and label the cat pictures with 1. However, in the dataset DB, we label the dog pictures with 1 and label the cat pictures with 0. It is clear that the model trained on D must perform terribly on the dataset either DA or DB. In this case, the information between D and Dg have strong conflict and the conflict loss would be large. On the other hand, projection loss reflects the loss of information caused by projecting fö
into {Ss|S (( vi) X Ns. We also consider the projection loss the increase in
4

---

Published as a conference paper at ICLR 2024
information induced by compressing the information of D into the synthetic dataset S. Take writing an abstract for example. we want to write a 100 words abstract to describe a 10000 words article, the abstract may suffer some lack of semantics to some degree. Such phenomena also happens for dataset distillation. When the information of a large dataset is complex enough, the information loss for dataset distillation will be significant; When the information of large dataset is very simple, it is possible that there is only very limited information loss. We introduce the projection loss defined above to measure this phenomenon. More details can be found below.
Conflict Loss. In KIP-based backdoor attack, the dataset ò defined as δ -= DA DB. where DA D and DB ~ D By Eq. (5) we know that the model trained on D with the weight of the regularization term 2 has a closed-form solution we constrain the model in the RKHS Hi and suppose that ((f, (z, y)) == [z v1l2:
fx(x)² k(x, XAB) [xx XAB) + (NA + NB)AT "YAB,
(11)
where (NA NN) x d matrix XAB is the matrix corresponding to the features of D, (N +NB) xe matrix YAB is the matrix corresponding to the labels of D, k(z, XAB) is a x (Na NB) matrix, k(XAR AB; XAB) is (Na + NB) x (NA + NB) matrix with [k{ (e(An, X XAB)lij = k(mr, (y)) and
YAB is a (NA* + NB) x e matrix with YAB = [y1, 1//,3/2,... BNN. Hence, we can express the
conflict loss Lcunflict as
Lcontlict
YAB - A(XAB. XAB) XAB) + (NA + AB) YYAll (12)
NA + NB
We obtain the upper bound of Lconltia as Theorem Theorem (Upper bound of conflict loss). The conflict loss Luonflier can be bounded as
1
Lcauticr NA NB THII k(X XAB) (K XAa) (NA Na)Ar 1
(13)
where Tr the trace operator, ls [X AB XAB) is (Na + NB) x (NA + NB) matrix, and YBB a (N - NB) x matrix.
The proof of Theorem can he found in Appendix loss can be characterized by Tr( [ k( X AB, X AB) k AB, X AB) + +(N A NB { However, in the latter sections, we do not utilize Tr(I k (A(AAB. X [kB)[K(X AAB X AB + (N + NB - construct trigger pattern generalization algorithm; instead, we use Eq. 12 directly. is because
A.3 From Theorem
we know that the conflict
Eq. (12) can be computed more precisely although Tr(I- - k( (AB,, XAB XAB, XAB) + (N +
NB -!) and Eq. (12) have similar computational cost.
Projection Loss. To derive the upper bound of the projection loss, we first derive Lemma
Lemma 1 (Projection lemma). Given a synthetic dataset = {(x.. No, and a dataset D {(x,, ye W NN+NN where (N + NB) ) is the number of the samples of D. Suppose the kernel matrix k(Xs, Xs) is invertible, then we have
k(,,)) k(,, Xs)k Xs) " k(Xs. [k( k(, Xs)k(Xs. Xs) k(Xs, -s))xxssssxxxxaa
V(r.)) D
ENg
where Hs = s-ann (pan((k((,,a x..) ) Hul(
Ws) E 8}) and H is the collection functions orthogonal
H. corresponding the inner product ( Hz.- Thus, k(, Xx)k(xss,,, "kXss is the solution of the optimization problem:
arg min JEHS
Σ
[1((x)) - k.
(15)
The proof of Lemma can be found in Appendix A.2 Now, we turn to the scenario of the KIP-based backdoor attack. Given mixed dataset D = DA U DB where Da DN and DB ~ No We also constrained models in the RKHS HS and suppose E(f, (z, g)) == llf(z) - y112. With the help of Lemma I we obtain the following theorem:
B
5

---

Published as a conference paper at ICLR 2024
Theorem 2 (Upper bound of projection loss). Suppose the kernel matrix of the synthetic dataset s(Xs, Xs) is invertible, Is is the model trained the synthetic dataset S with the regularization term As, where the projection loss pprojctt ming (aaa)-B&(ss (z, (p())) can be bounded as
lassl NA No
Cproject S
Σ
[K(XAB, - - K(XAB, (s)K(s Xs) M(Xs (16)
Xs
Yablas which is the weight of k(, Hz) corre- sponding to S.. XAB is the (Na+ + NN) x matrix corresponding to the features of D, X the Ng x d matrix corresponding to the features of S, YAB is the (NA+Ng x c matrix corresponding to the labels of D. Ys is the Ns x matrix corresponding to the labels S.
where os. [[I(XAB XAB) + (Na+
The proof of Theorem 2 can be found in Appendix A.4 In Theorem 2 we first characterize the natural information loss when compressing the information of D into an arbitrary dataset S, and then bound the information loss for the synthetic dataset S generated by dataset compression by taking the minimum. This formulation gives some insight into the construction of our trigger generation algorithm, which is discussed in the later section.
Generalization Gap. Finally, for the generalization gap, we follow the existing theoretical results
(Theorem 3.3 in (Mohri et al., ).12)), but modify them bit. Let G = {g (x. y) + (z) y1βi E H..- Assume that the distribution 'D is distributed in a bounded region, and that G C C and the norm of the gradient of y G have common non-trivial upper bound. Namely, [| y) - (x',8") y0)| S I'D for any sample which is picked from D and V S Lp. Then we can obtain Theorem
Theorem 3 (Upper bound of generalization gap). Given N N-sample dataset D. sampled from the distribution D, the following generalization gap holds for all g E 9 with probability at least 1 ò:
(()))))) N
log 2N
Σ
25t 2
(17)
(D.DN)DD
where X is the matrix of the features of D and RD (G) is the empirical Rademacher's complexity.
The proof of Theorem 3 can be found in Appendix A.5 We know from Theorem 3 that the upper bound of the generalization gap is characterized by two factors, RD) and Pp. The lower D and I'D imply the lower generalization gap. We usually assume k(x, xx) S r2 and (f S A (as in Theorem 6.12 of (Mohri al. 2012)). Under this setting, we can ignore (g) for the upper bound of the generalization gap and only focus on l'D. ASR relates to the risk for DD and hence corresponds to the generalization gap evaluated on DB- This theoretical consequence can be used to explain the phenomenon that ASR of the backdoor attack increases
enlarge the trigger size.
3.2 THEORY-INDUCED BACKDOOR: SIMPLE-TRIGGER
Consider 'D Theorem 3 as Dn and the corresponding dataset as DB- Conventionally, a cell of the mask in Eq. ( is corresponds to trigger, and is O otherwise. Recall that the definition of DD in Eq. (7). it is clear that the I'P, will monotonely decrease from I'D, to 0 as we enlarge the trigger size. If we enlarge the trigger size, the I' I'Da drops to zero, which implies that the correspond- ing generalization gap will be considerably small. Thus, the success of the large trigger pattern can be attributed its relatively small generalization gap.
So, given an image of size m x (m < n). simple-trigger generates a trigger of size m X n. The default pattern for the trigger generated by simple-trigge whole-white. fact, since the generalization gap is irrelevant to the trigger pattern, we do not impost any pattern restrictions.
3.3 THEORY-INDUCET BACKDOOR: RELAX-TRIGGER
In simple-trigger. we optimize the trigger through only the generalization gap. However, we know that ASR can be determined by conflict loss, projection loss, and generalization gap because of

---

Published as a conference paper at ICLR 2024
Theorems 3 (i.e., all are related to Dz). On the other hand, CTA is related to conflict loss and projection loss, because the generalization gap is irrelevant to CTA. That is, Eq. [7] evaluated on Da is constant generalization gap imply a backdoor attack with greater ASR and CTA. Therefore, relax-trigger aims construct trigger whose corresponding DB make Eq. (22) Eq. (16). and DD, sufficiently low. The computation procedures of relax- trix-trigger can be found in Algorithm 2 of Appendix A.7
modify the trigger. As result, the lower conflict loss, projection loss, and
Suppose D.. NA and NB are fixed. To reduce the bound in Eq. (2), one considers D3 function depending the trigger T and then the optimizer find the optimal trigger T". In this sense, solve the following optimization problem
arg min
YAR k(X X AB) [M AA, XAR) + (Na + - YAall..
(18)
On the other hand, a low Pp,, can be realized by enlarging the trigger as mentioned in Section 3.2
Finally, to make Eq. [6 directly optimize
sufficiently low, consider Dn as a function of the trigger T, and then
arg min
Σ
min Ja. (IK(AA()) k(X Xs) "s)
(19)
(DD
is bi-level optimization problem that is difficult to solve. Instead, we set the synthetic dataset S in Eq. (19 to SA, which the distilled dataset from DA. Then, the two-level optimization problem can be converted into one-level optimization problem below.
However, Eq. 19
arg min T
Σ (maN)EDiiiI
ais (IA, k(XAB. Xs. S Xs.) xsx))'((X,) kKXS. 12)
(20)
Eq. (20 can be easily solved by directly applying optimizers like Adam (P. Kingma & Bal 2015).
Eq. 20) aims to find a trigger T such that D generated from DA and DB will be compressed into
neighborhood of SA C (X' Ns, which guarantees that CTA of the model trained on the
distilled D is similar to CTA of the model trained on the distilled DA Overall, relax-trigger solves the following optimization,
arg mint T
ΣΣ
Σ
Σ aas
Pllk(X An, k(XAn XsS )k( (K( S. Xs.) k( (Xx S. 2:)1
(FAN)EDDE=L
+ P| - - R(XAB AB. XAB) I(X XAB) + (NA + NB)AT YABI12).
(21)
where p > 0 is the penalty parameter, is the previously chosen mask, the malicious dataset is defined as Dg = [1bb, 3b0) = ((1 m) 3 Ha + m @ T, T.yr) va) E DA We particularly note that Eq. 19 is converted into Eq. 20 because use SA replace the minimization over S.
relax-trigger is different from DOORPING @Liu et al. 2023c). DOORPING generates the trigger during the process of sample compression. In other words, DOORPING is induced by solving bi- level optimization problem. However, relax-trigger is induced by one-level optimization problem (Eq. (21)). The design rationale of relax-trigger different from DOORPING. DOORPING aims to find the globally best trigger but consumes a significant amount of computation time. On the other hand, through our theoretical framework, trigger aims to find the trigger that reliably compresses the corresponding Ó into the neighborhood of our SA with the benefit of time efficiency.
4 EVALUATION
4.1 EXPERIMENTAL SETTING
Dataset. Two datasets are chosen for measuring the backdoor performance.
CIFAR-10 is a 10-class dataset with 6000 32 x 32 color images per class. CIFAR-10 is split into 50000 training images and 10000 testing images.
GTSRB contains 43 classes of traffic signs with 39270 images, which are split into 26640 training images and 12630 testing images. We resize all images to 32 32 color images.
7

---

Published as a conference paper at ICLR 2024
Dataset Distillation and Backdoor Attack. We use KIP (N Ngguyen al. 2021 to implement backdoor attacks with the neural tangent kernel (NTK) induced by a 3-layer neural network, which has the same structure in the Colab notebook of (Nguyen et al. 202T). We also set the optimizer to Adam (P. Kingma & Ba, 2015), the learning rate to 0.01, and the batch size to 10 x number of class for each dataset. We run KTP with 1000 training steps to generate distilled dataset. We perform independent runs for each KIP-based backdoor attack to examine the performance.
Evaluation Metries. We consider two metrics, clean test accuracy (CTA) and attack success rate (ASR). Consider S as a distilled dataset from the KIP-based backdoor attack. CTA is defined as the test accuracy of the model trained on S and evaluated on the normal (clean) test dataset, while ASR is defined as the test accuracy of the model trained on S and evaluated on the trigger test dataset.
Defense for Backdoor Attack. In this paper we consider eight existing defenses, SCAn (Tang et al., (021)) AC (Chen et al.] 2018). SS (Tran et al. 2018), Strip (modified
poison cleaner) (Gao et al., 2019). ABL (Li et al., 2021a), NAD (Li et al. 2021b), STRIP (backdoor input filter) (Gao et al. 2019), FP (Liu et al., 2018a), to investigate the ability to defend against KIP-based backdoor attack. The implementation of the above defenses is from the backdoor-toolbog
4.2 EXPERIMENTAL RESULTS
Performance of simple-trigger. We performed a series of experiments demonstrate the ef- fectiveness of simple-trigger. In our setting, Ns is set to 10 x number of classes and 50 x number of classes for each dataset. We also configurated the trigger 32 x 32 white square patterns. The corresponding results are shown in Table I The experiment results suggest that CTA and ASR of simple-trigger increase as we enlarge the trigger size, which is consistent with our theoretical analysis (Theorem 3). One can see that for the 32 x 32 white square trigger, ASR can achieve 100% without sacrificing CTA.
x 2, 4 x 4. 8, 16 16,
Nive
PTATO CTAIS)
ASR T5)
CIA151
ASK
ASETES
UST
CIA
CIFN 1005
21
41.3
98.29 (013)
41.5
77560000
GISKU
120000200
23370200)
16.9171))
5190
100001000 7127002
Table I: Performance of simple-trigger on CIFAR-IO and GTSRB (mean and standard deviation).
Performance of relax-trigger. Here, we relax the setting of the mask m; i.e., each component of m is defined to be 0.3, instead of This can be regarded as an increase in the trigger's 's transparency (the level of invisibility) for mixing an image and the trigger. Recall the definition of DB in (Eq. 77. From theory point of view, under such a mask m, I'D2 will drop to 0.3 * L' > 0, as we enlarge the trigger. Hence, we cannot reduce the generalization gap considerably as in the experiments of simple-trigger. It turns out that to derive better CTA and ASR, we resort to consider relax-trigger.
The result presented in Table 2 We compare the performance (CTA and ASR) between simple- trigger (32 x 32 white square). DOORPING and relax-trigger. For CIFAR- 10, relax-trigger in- creases the ASR about 24% from simple-trigger without losing CTA. For GTSRB, relax-trigger not only increases the ASR about 30,, but also slightly increases the CTA. On the other hand, relax-trigger possesses higher CTA and ASR compared to DOORPING. These results confirm the effectiveness of relax-triggen The trigger patterns of relax-trigger are visualized in Figure]
Trig.
simple-trigger
(bascline)
relsx-trigger
ASK
CTA
ASK
CTA (%)
ASRT%)
CITAR-10
100
41.40 (0.06
41.660.44)
10000000000
(0.922
30.00
(40.0)
0IPAR-10
100
43.0%
(31
75 14790005 (1.88)
23.440044
10010000000
GTSRB
430
67.02
(0.07)
(0.33)
(016))
05.2610:345
68.05
"XXI (30.00)
GTSRB
2150
70.28
(0007)
62.68 (1:12)
71.54 (0.33)
95.08
Table 2: Performance of relax-trigger on CIFAR-IO 10 and GTSRB (mean and standard deviation).
Off-the-shelf Backdoor Defenses. We examine whether simple-trigeer and relax-trigger can survive backdoor detection and cleansing. Here, utilize backdoor-toolbe and retrain the dis- tilled dataset on ResNet (default setting in backdoor-toolbon to compute CTA and ASR. In our experimental results, the term "None" denotes defense.
Available https: / //g thub. com/vtu8// wwwpkaooo-taoooooooooooooooooo.. boobboox
8

---

Published as a conference paper at ICLR 2024
CIFARIO
(b) CIe
(c) CITRR 430)
GTSRR 2150)
Figure 1: Triggers generated by relax- detax-ttriger for GTSRB and CIFAR.
Tag.tee
Now
SCAB
Stap
CTA
ASRrG)
CTA
CTA
ASK (5)
CTA
ASICSS
CTA
ASE (5)
2x2
21
(8,36
(2.34(225)
(2.17
(3.84(1.12)
10,57 (3.52)
22,00:1623
(L.4
2508 (0.48)
12.79 (5.25)
174
25.99 40
23.2519.87)
266700971
29.2711299
(400015.441
2198
29
17,85 (5.47)
5x
13.35 (5.33
14.05
15.2411560
9.1915333
11194401
15.13
16x 16
25 (5.76)
$1.29 (2.96)
(2.66
(9.66.9966)
(1.5
58 (8.26110:94)
2408-(1666
(2.02
26.22 (0.50
(40.18)
289511330
100000
(87.14)
25.3512000
(6.07433333
25
Ing..ee Dee..
NAD
STRIP
CIACO
CIA
ASKORS
CIATOO
ASK
232
1531
(.14
31.741300
(1005
174
151222004
13:85
(13.00
2037 (323
7.8514.36
20.55 (1.15
19.05
73.25 (12.25)
8x
14
24.22 (34.3))
3505 (1.04)
05.211
25007 (1.00)
(4,44
152771
2.11 (OU65)
16x 16
(.07)
(3680
32.7711.0 06)
24.2514.11
23.35 (0.30)
16.33100351
21.94 (37.37
52 92
(6.254422)
(4,35
(3.22
100.00 (0.000
26.08(1.335
(.0010000)
18152138
(0.00
Table 3: Defenses for simple-trigger CIFAR-10 with distilled dataset size 100.
For simple-trigger, find that both CTA and ASR of None increase as enlarge the trigger size. Moreover, both CTA and ASR of None increase as we enlarge the size of the distilled dataset. The above implies that simple-trigge is more suitable for large-size distilled datasets. Since the CTA and ASR increase as we enlarge the trigger, we focus on 32 x 32 trigger images in the following discussion. In the case of CIFAR-10, for size 100 (see Table B) can find that ASR of NAD is still 1. That is, NAD fails to remove the backdoor. For the other defenses, the CTA drops over 7%, though they can reduce the ASR. Hence, conclude that these defenses size 500 (see Table 5 in Appendix A.S). the ASR of SCAn is still 1, implying that SCAn fails to remove the backdoor. The other defenses, SS, Strip, ABL, STRIP, and FP considerably compromise the CTA. Overall, the above results also suggest that the defenses may be more successful when we increase the size of the distilled dataset. On the other hand, for GTSRB (see Tabel a Table in Appendix[A.8] A.8). we also reach similar conclusion.
effective. For
For relax-trigger (see Table g in Appendix (A.8), all defenses considered in this paper cannot effec- tively remove the backdoor. In particular, in the case of CIFAR-10, for size 100, SCAn, AC, Strip, and ABI. do not reduce the ASR. They even increase ASR to some degree. On the other hand, SS, STRIP, and FP also compromise the CTA too much. Lastly, though NAD reaches better defense result; however, the corresponding ASR still remains about 50% of None's ' ASR. Essentially, this suggests that NAD cannot completely defend against relax-trigger, For the other defenses, the ASR still remains over 30% of None's ' ASR. These defenses are ineffective against relax-trigger.
In the of GTSRB, for size 430. fully remove the backdoor. The ASR still remains over 70% of None's ASR. Besides, we can find that AC, SS, Stip, ABI,, and FP still compromise the CTA Strip, NAD, and STRIP still remain ASR over 50% of None's s ASR. Furthermore, SCAn, ABL, and FP even increase the ASR. addition, SS decreases the CTA by about 45% of None's CTA. To sum up, relax-trigger shows strong backdoor resiliency against all the tested defenses.
also find that SCAn, NAD, and STRIP cannot success-
much. Finally, for size 2150, AC,
5 CONCLUSION
In this paper, present novel theoretical framework based the kernel inducing points (KIP) method to study the interplay between backdoor attacks and dataset distillation. The backdoor ef- fect is characterized by three key components: conflict loss, projection loss, and generalization gap, along with two theory-induced attacks, simple-trigger and relax-trigged Our simple-tiggee proves that enlarged trigger size leads to improved ASR without sacrificing CTA. Our relax- presents a new and resilient backdoor attack scheme that either completely breaks or significantly weakens eight existing backdoor defense methods. Our study provides novel theoretical insights, unveils new risks of dataset distillation-ban backdoor attacks, and calls for better defenses.

---

Published as a conference paper at ICLR 2024
REFERENCES
Nachman Aronszajn. Theory of reproducing kernels. Transactions of the American mathematical society, 68(3):337-404, 1950.
Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in enns by training set corruption without label poisoning. In 2019 IEEE International Conference on Image Processing (ICIP), pp. 101-105. IEEE, 2019.
Alain Berlinet and Christine Thomas-Agnan. Reproducing kernel Hilbert spaces in probability and statistics. Springer Science & Business Media, 2011.
Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. In AAAI Artificial Intelligence Safery Workshop (SafeAl), 2018.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprini arXiv:/712.05526. 2017.
Tian Dong, Bo Zhao, and Lingjuan Lyu. Privacy for free: How does dataset condensation help privacy? In International Conference on Machine Learning (ICML), 2022.
Yansong Gao, Change Xu, Derui Wang. Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, pp.
2019.
Benyamin Ghojogh, Ali Ghodsi, Fakhri Karray, and Mark Crowley. Reproducing kernel hilbert space, mercer's 's theorem, eigenfunctions, nyström method, and use of kernels in machine learning: Tutorial and survey. arXiv preprint arXiv:2 004404433 2021.
Tianyu Gu, Kang Liu, Brendan Dolan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 0477330-72444 2019.
Bobby He, Balaji Lakshminarayanan, and Yee Whye Teh. Bayesian deep ensembles via the neural tangent kernel. Advances in neural information processing systems, 33:1010-1022, 2020.
Arthur Jacot, Franck Gabriel, and Clément Hongler. Neural tangent kemel: Convergence and gen- eralization in neural networks. Advances in neural information processing systems, 31, 2018.
George Kimeldorf and Grace Wahba. Some results on tchebycheftian spline functions. Journal of mathematical analysis and applications, 33(1):22-95, 1971.
Hae Beom Lee, Dong Bok Lee, and Sung Ju Hwang. Dataset condensation with latent space knowl- edge factorization and sharing. arXiv preprint arXiv:2208. 10494, 2022a.
Jachoon Lee, Lechao Xiao, Samuel Schoenholz, Yasaman Bahri, Roman Novak, Jascha Sohl- Dickstein, and Jeffrey Pennington. Wide neural networks of any depth evolve as linear models under gradient descent. Advances in neural information processing systems, 32, 2019.
Sachyung Lee, Sanghyuk Chun, Sangwon Jung, Sangdoo Yun, and Sungroh Yoon. Dataset con- densation with contrastive signals. In International Conference on Machine Learning (ICML), 2022b.
Yige Li. Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learn- ing: Training clean models poisoned data. Advances in Neural Information Processing Sys- tems, 34: 14:114900-4492, 2021a.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In International Conference on Learning Representations (ICLR), 2021b.
Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEEE/CVF international conference computer vision, pp. 16463-16472, 2021c.
10

---

Published as a conference paper at ICLR 2024
Kang Liu, Brendan Gavat,, and Siddharth Garg. Fine-pruning Defending against back- dooring attacks on deep neural networks. In International Symposium on Research in Attacks, Intrusions and Defenses (RAID), 2018a.
Songhua Liu, Kai Wang, Xingyi Yang, Jingwen Ye, and Xinchao Wang. Dataset distillation via factorization. In Advances in Neural Information Processing Systems (NeurIPS), 2022.
Tengjun Liu, Ying Chen, and Wanxuan Gu. Copyright-certffeed distillation dataset: Distilling one million coins into one bitcoin with your private key, In Proceedings of the AAAI Conference on Artificial Intelligence, 2023a.
Yanqing Liu, Jianyang Gu, Kai Wang, Zheng Zhu, Wei Jiang, and Yang You. Dream: Efficient dataset distillation by representative matching. In International Conference on Computer Vision (ICCV), 2023b.
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In 25th Annual Network And Distributed System Security Symposium (NDSS 2018). Internet Soc, 2018b.
Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Backdoor attacks against dataset distillation. Network and Distributed System Security (NDSS) Symposium, 2023c.
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. In Computer RssionEECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part 16, pp. 182-199. Springer, 2020.
Noel Loo, Ramin Hasani, Alexander Amini, and Daniela Rus. Efficient dataset distillation using random feature approximation. Anmual Conference Neural Information Processing Systems (NeurIPS), 2022.
Noel Loo, Ramin Hasani, Mathias Lechner, and Daniela Rus. Dataset distillation with convexified implicit gradients. International Conference on Machine Learning (ICML), 2023.
Mehryar Mohri, Afshin Rostamizadeh, and Ameet Talwalkar. Foundations of Machine Learning. The MIT Press, 2012. ISBN 0262018222 825X.
Timothy Nguyen, Zhourong Chen, and Jaehoon Lee. Dataset meta-learning from kernel ridge- regression. International Conference on Learning Representations (ICLR), 2021.
Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems, 33:3454-3464, 2020.
Tuan Anh Nguyen and Anh Tuan Tran. Wanet imperceptible warping-based backdoor attack. In International Conference Learning Representations (ICLR), 2021.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. International
Conference on Learning Representations (ICLR), 2015.
Xiangyu Qi, Tinghao Xie, Yiming Li, Saeed Mahloujifar, and Prateek Mittal. Revisiting the as- sumption of latent separability for backdoor defenses. In The eleventh international conference on learning representations, 2022.
Hossein Souri, Liam Fowl, Rama Chellappa, Micah Goldblum, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. Advances in Neural 2022.
Information Processing Systems,
Di Tang, XiaoFeng Wang, Haixu Tang, and Kehuan Zhang. Demon in the variant: Statistical analysis of dnns for robust backdoor contamination detection. In USENIX Security Symposium, 2021.
Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. Advances in Neural Information Processing Systems (NeurIPS), 31, 2018.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv: 1xXxv:9112.02777 2019.
11

---

Published as a conference paper at ICLR 2024
Kai Wang. Bo Zhao, Xiangyu Peng, Zheng Zhu, Shuo Yang, Shuo Wang, Guan Huang, Hakan Learning to condense dataset by aligning features.
Bilen, Xinchao Wang, and Yang You. Cafe: In JEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
Kai Wang, Jianyang Gu, Daquan Zhou, Zheng Zhu, Wei Jiang, and Yang You. Dim: Distilling
dataset into generative model. arXiv preprint arXiv:2303.04700 2023.
Tongzhou Wang, Jun- Yan Zhu, Antonio Torralba, and Alexei A Efros. Dataset distillation. arXiv
preprint arXiv: 10959, 2018.
Ruonan Yu, Songhua Liu, and Xinchao Wang. Dataset distillation: A comprehensive review. arXiv preprint arXiv:2301.07014 2023.
Bo Zhao and Hakan Bilen. Dataset condensation with distribution matching. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp. 6514-6523, 2023.
Zhao, Konda Reddy Mopuri, and Hakan Bilen. Dataset condensation with gradient matching. International Conference Learning Representations (ICIR), 2021.
Yongchao Zhou, Ehsan Nezhadarya, and Jimmy Ba. Dataset distillation using neural feature regres- sion. Advances in Neural Information Processing Systems (NeurIPS), 2022.
12


Reviews:
[{"review_id": "ExOJlKXGa0", "reviewer": "Reviewer_hKa2", "summary": "The paper studies the problem of backdoor attacks to evade data distillation, which introduces subtle changes or \"triggers\" to data to manipulate machine learning models.  It focuses on the theoretical underpinnings of dataset distillation and its implications on backdoor attacks. Based on the theoretical understandings, the authors propose two new theory-induced trigger generation methods: simple-trigger and relax-trigger. Experimental results demonstrate that these triggers, when used in an attack, can successfully evade common backdoor detection techniques.", "questions": "1. In Equation (9), why the second term is called the generalization gap?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. One of the primary strengths of this work is the establishment of the first theoretical framework to understand backdoor effects on dataset distillation. This fills a significant gap in the literature, especially when considering the practical implications of such attacks.\n2. The paper introduces two new backdoors - simple-trigger and relax-trigger - which are computationally efficient. The relax-trigger, in particular, is more efficient than DoorPing as it doesn't rely on bi-level optimization.\n3. Both the simple-trigger and relax-trigger have been demonstrated to challenge or evade eight existing defense mechanisms.", "weaknesses": "1. If we utilize the original dataset instead of the distilled data for model training, would the trigger remain effective? It would be better to include such experiments.\n2. Can the proposed attacks evade other data distillation techniques (e.g., gradient matching based methods and distribution matching based methods)? It would further strengthen the experimental evaluation by examining the transferability of the proposed attacks.\n3. In my understanding, individuals would majorly employ distilled data for training new models in scenarios such as neural architecture search and continual learning. Expanding on the implications of backdoor attacks in these applications would provide greater clarity.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KDcmtjMcrP", "reviewer": "Reviewer_npoK", "summary": "The paper aims to bridge a gap in the literature by providing a theoretical framework for understanding backdoor attacks on dataset distillation. It introduces two new theory-driven trigger pattern generation methods: simple trigger and relax trigger, specialized for dataset distillation. The paper presents analyses and experiments on two datasets, showing that these triggers are effective at launching resilient backdoor attacks that can significantly weaken conventional detection and mitigation methods.", "questions": "1. Are there some potential defense methods during the dataset distillation process to mitigate backdoor attacks?\n2. Given the variety of dataset distillation methods available, could the choice of distillation method potentially impact the conclusions drawn about the efficacy of the proposed attack method?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. The paper is among the first to provide a theoretical framework for understanding backdoor effects on dataset distillation, thus filling a significant gap in the field.\n2. The introduction of simple-trigger and relax-trigger is interesting. These triggers are also shown to be effective through empirical testing.", "weaknesses": "1. Some sections could benefit from more straightforward explanations to make the paper more accessible to readers not deeply familiar with the subject matter.\n2. The datasets evaluated in the paper appear to be limited in scope. Typically, researchers conduct experiments on more comprehensive datasets like ImageNet, or other comparable datasets, to convincingly demonstrate the effectiveness of a proposed attack method.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "vfXbULL3o8", "reviewer": "Reviewer_Z9NC", "summary": "The research provides a comprehensive exploration of the theoretical underpinnings of backdoor attacks and their interplay with dataset distillation, employing kernel methods as the foundational framework. This investigation leads to the introduction of two innovative trigger pattern generation techniques, intricately crafted to suit the specific requirements of dataset distillation. These methodologies are meticulously derived from a foundation of theoretical insights.", "questions": "Please refer to \"Weaknesses\" part.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The research significantly contributes to the theoretical understanding of backdoor attacks and their interaction with dataset distillation. By using kernel methods as the foundational framework, it provides a rigorous theoretical foundation for subsequent developments.\n\n2. The introduction of two novel trigger pattern generation methods tailored for dataset distillation is a notable contribution. These methods are based on theoretical insights and offer new avenues for designing backdoor attacks in this context.\n\n3.The study backs its theoretical findings with comprehensive empirical experiments. The results demonstrate the resilience of datasets poisoned by the designed triggers against conventional backdoor attack detection and mitigation methods, adding practical significance to the research.", "weaknesses": "The experimental results presented in the study may benefit from further substantiation to conclusively support the stated claims. A notable observation in Table 2 is that the performance of the 'simple-trigger' method is notably outperformed by 'DoorPing,' which prompts questions regarding the efficacy of the former.\n\nMoreover, enhancing the organization and writing style of the manuscript could enhance its overall readability and comprehension for a wider readership.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rVS5Wz86er", "reviewer": "Reviewer_bXcG", "summary": "This paper study the backdoor attack for the Kernel Inducing Points (KIP) based dataset distillation. Specifically, the paper introduces two theory-driven trigger patterns and provides empirical evidence that they can increase ASR of models (with the same architecture as the proxies for dataset distillation) trained on the distilled datasets without sacrificing CTA remarkably. Additionally, experimental results also indicate that the evaluated backdoor defense methods may not be fully effective against the proposed relax-trigger.", "questions": "Q1: Regarding Equation 9, why is the objective of the KIP-based backdoor attack to minimize the empirical loss of $f_{\\mathcal{S}^*}$ on either $\\mathcal{D}_A$ or $\\mathcal{D}_B$, rather than simultaneously reducing the empirical loss on both $\\mathcal{D}_A$ and $\\mathcal{D}_B\\$ as your statement about \"Backdoor Attack\" (The next to the last paragraph above Equation 7)?\n\nWhile you attempt to address this in Equation 10 by introducing $\\tilde{D}=D_A \\cup D_B$ to establish an upper bound on the loss of $f_{\\mathcal{S}^*}$ with respect to $D$, this formulation seems somewhat unreasonable to me.\n\nQ2: It appears that the introduced projection loss can be directly optimized with respect to the trigger $T$. What's the rationale behind setting an upper bound and optimizing the projection loss through this bound? Does this approach offer computational benefits?\n\nQ3: Based on my W3, could you share additional experimental evidence to validate the efficacy of your proposed triggers when applied to models with alternative architectures trained on the synthesized datasets?", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "S1: This paper proposes to investigate a theoretical framework for the KIP-based dataset distillation method about why certain backdoors can survive in distilled datasets. Then, two theory-driven backdoor trigger patterns are consequently introduced.\n\nS2: In the evaluated scenarios, the proposed triggers present adequate ability to raise ASR without sacrificing CTA remarkably. Moreover, experimental results also indicate that the 8 evaluated backdoor defence methods may not be fully effective against the proposed relax-trigger.", "weaknesses": "W1: Certain key aspects of the presented theory appear ambiguous from my vantage point. I will delve deeper into these ambiguities in the Questions section.\n\nW2: The established theoretical framework predominantly caters to kernel-based dataset distillation methods, and its application seems restricted primarily to the initially proposed KIP method. Given the complexities associated with computing the NTK, KIP's practicality has been empirically questioned. While subsequent kernel-based dataset distillation methods capable of distilling comprehensive datasets have emerged (e.g., [1]), this paper falls short of validating their compatibility with the introduced framework. This oversight not only raises concerns about the paper's soundness but also limits the practicability of the introduced attack method.\n\nW3: The experimental design in the paper appears insufficient, raising questions about the broader applicability of the proposed attack. First, it relies on a mere two benchmark datasets. Second, the distilled dataset's size variation is limited to IPC (abbreviation of Image Per Class) scenarios of 10 and 50. Third, while cross-architecture generalization is pivotal in dataset distillation, the paper's evaluations seem to be confined to a 3-layer ConvNet, which is consistent with the architecture of the proxy model designated for distillation.\n\n[1] Yongchao Zhou, Ehsan Nezhadarya, Jimmy Ba: Dataset Distillation using Neural Feature Regression. NeurIPS 2022", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)