SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation
Authors: He Yang
Dongyi Lv
Song Ma
Wei Xi
Jizhong Zhao
Venue: NeurIPS 2025 poster ()
Keywords: Dataset Distillation
Backdoor Attacks
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: Dataset condensation aims to synthesize compact yet informative datasets that retain the training efficacy of full-scale data, offering substantial gains in efficiency. Recent studies reveal that the condensation process can be vulnerable to backdoor attacks, where malicious triggers are injected into the condensation dataset, manipulating model behavior during inference. While prior approaches have made progress in balancing attack success rate and clean test accuracy, they often fall short in preserving stealthiness, especially in concealing the visual artifacts of condensed data or the perturbations introduced during inference. To address this challenge, we introduce \textsc{Sneakdoor}, which enhances stealthiness without compromising attack effectiveness. \textsc{Sneakdoor} exploits the inherent vulnerability of class decision boundaries and incorporates a generative module that constructs input-aware triggers aligned with local feature geometry, thereby minimizing detectability. This joint design enables the attack to remain imperceptible to both human inspection and statistical detection. Extensive experiments across multiple datasets demonstrate that \textsc{Sneakdoor} achieves a compelling balance among attack success rate, clean test accuracy, and stealthiness, substantially improving the invisibility of both the synthetic data and triggered samples while maintaining high attack efficacy. The code is available at \url{https://github.com/XJTU-AI-Lab/SneakDoor}.

SNEAKDOOR: Stealthy Backdoor Attacks against Distribution Matching-based Dataset Condensation
He Yangl.2., Dongyi Lvb", Song M2 Wei Xil Jizhong Zhao
School of Computer Science and Technology. Xi an Jiaotong University, Xi an, China
Hybrid Augmented Intelligence, Xi' an Jiaotong University 2 State Key Laboratory of Ivdongyi Sitonny@@stu.xuu.eell wtw.xj..eu.uuccn. song.ma stu.xjtu.edu.co yanghe73 xjtu.edu.cn, Xiwei xjtu.edu.c X77xxxu.edu.cn
Abstract
Dataset condensation aims to synthesize compact yet informative datasets that retain the training efficacy of full-scale data, offering substantial gains in efficiency. Recent studies reveal that condensation process can be vulnerable to backdoor attacks, where malicious triggers are injected into the condensation dataset, manipu- lating model behavior during inference. While prior approaches have made progress in balancing attack success rate and clean test accuracy, they often fall short in preserving stcalthiness, especially in concealing the visual artifacts of condensed data the perturbations introduced during inference. To address this challenge, we introduce SNEAKDOOR, which enhances stealthiness without compromising attack effectiveness. SNEAKDOOR exploits the inherent vulnerability of class deci- sion boundaries and incorporates a generative module that constructs input-aware triggers aligned with local feature geometry, thereby minimizing detectability. This joint design enables the attack to remain imperceptible to both human inspection and statistical detection. Extensive experiments across multiple datasets demon- strate that SNEAKDOOR achieves a compelling balance among attack success rate, clean test accuracy. and stealthiness, substantially improving the invisibility of both the synthetic data and triggered samples while maintaining high attack efficacy. The code available at httttt:/// /tttps:/githhb... Com/XJJU-- AI-Lab/ /SneakDoor
3
5
7
11
12
13
15
16
17
18
Introduction
19
20
5 has recently emerged as powerful paradigm for synthesizing compact training datasets that retain the learning efficacy of their full-sized counterparts, offering substantial benefits in terms of computation, memory, and deployment efficiency. However,
Dataset Condensation (DC)
21
22
23 DC introduces inherent vulnerabilities to backdoor attacks 7 g 9 10 where malicious triggers can be injected into the distilled samples during the condensation process. Once compromised, the distilled dataset can disseminate malicious behaviors across downstream models, undermining model integrity and posing serious security threats.
24
25
27 growing body of work demonstrates that malicious triggers, once implanted into the distilled
28 set, can persist across downstream training and inference, leading to consistent and targeted mis- classification [I
29
One of the earliest approaches the Naive Attack [T]. which directly 30 adds a fixed visual pattern (typically a static patch) to instances from clean training samples before condensation. While conceptually simple, this method suffers from limited attack success rates, the uniform trigger tends to degrade through the condensation process. To enhance attack effectiveness, Doorping 11 introduces bilevel optimization framework that iteratively updates both the distilled
12 13
31
33
34 data and the backdoor trigger during training. Doorping better preserves the trigger semantics and
35 achieves stronger attack success rate. However, it incurs significant computational cost due to its
Equal contribution, =Corresponding author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Naive
Doorping
Simple
Relax
Sneakdoor
Condensed Image
Clean Image
Backdoored
Image
Figure I: Stealthiness Illustration
36
bilevel nature and lacks a theoretical foundation. A more recent work [12 adopts a kernel-theoretic lens reinterpret backdoor vulnerability in condensation. They propose two variants, simple-trigger and relax-trigger. The former attack focuses exclusively on minimizing the generalization gap, aiming ensure that the backdoor learned during condensation reliably transfers test-time behavior. The relax-trigger introduces a joint optimization objective that simultancously reduces projection loss (mismatch between synthetic and clean distributions), conflict loss (interference between clean and poisoned instances), and the generalization gap. Notably, relax-trigged maintains high attack success rate while avoiding the computational overhead of bilevel optimization.
37
38
39
40
41
42
43
44 However, existing approaches fall short of achieving a well-calibrated trade-off among attack success
45 rate (ASR), clean test accuracy (CTA), and stealthiness (STE). While some methods attain high ASR or maintain acceptable CTA, they frequently neglect STE, a critical dimension that reflects
46
47 the visual and statistical imperceptibility of both the distilled data and the triggered inputs (See Figure D. This oversight is particularly damaging, without sufficient stealthiness, even highly effective attacks become vulnerable detection, significantly limiting their practical viability. This persistent imbalance motivates our proposed method, SNEAKDOOR, which leverages input-aware
48
49
50
51 trigger generation and decision boundary sensitivity, achieving a more favorable balance among ASR, CTA, and STE.
52
Specifically, SNEAKDOOR consists of two stages, (1) Trigger Generation and (2) Backdoor Injection. In the first stage, a generative network is trained to produce input-aware triggers tailored to individual samples. By aligning each trigger with the local semantic content of its host image, the perturbations remain visually coherent and difficult to isolate. In the second stage, the backdoor injection is formulated
54
55
56
optimization problem. The generated triggers samples to form a poisoned subset. These triggered samples are then incorporated into the training set prior to condensation, allowing the distilled dataset to encode backdoor behavior alongside clean task representations. As a result, downstream models trained on the synthesized data exhibit the intended malicious behavior without sacrificing generalization to clean inputs.
embedded into subset of clean
58
59
80
61
62
Our contributions are summarized below:
We present the first investigation of backdoor attacks against distribution matching-based based dataset condensation, with focus on jointly optimizing ASR, CTA, and STE.
64
We provide thcoretical analysis of stealthiness concerning SNEAKDOOR, offering formal guarantees and insights into the conditions under which backdoor signals remain unde- tectable throughout the condensation and training process.
66
68
Extensive experiments across six datasets demonstrate that SNEAKDOOR consistently out- performs existing methods in achieving superior balance across ASR, CTA, and STE.
89
2
Related Work
70
71
Distribution Matching-based Dataset Condensation: Dataset condensation (DC) aims to syn-
thesize compact set of synthetic samples that can replace large-scale datasets while preserving

---

73
comparable model performance. Among various condensation paradigms, distribution matching (DM)-based methods have emerged as a leading approach due to their scalability, generality, and empirical effectiveness. Unlike earlier techniques based on gradient matching or training trajectory alignment, DM- methods directly align statistical or feature-level distributions between real and synthetic data. A seminal example is DM [3], which matches the second-order moments (co- variance) of feature embeddings extracted by random encoders. A core formulation in distribution matching-bad -baiin dataset condensation leverages the maximum mean discrepancy (MMD) to quantity
74
75
76
77
78
80 the distance between the feature distributions of real and synthetic samples in a high-dimensional embedding space. The objective is to minimize this discrepancy over the synthetic set S, ensuring statistical alignment with the original dataset T. Specifically, the optimization problem is defined
81
82
1 (S |s] Σド= ( w))ll? where the is a randomly initialized and fixed embedding function, and A(..w) denotes a differentiable Siamese augmenta- tion operator applied to both real and synthetic samples, parameterized by w. This formulation encourages the synthetic set to preserve the statistical structure of the real dataset under randomized transformations, thereby promoting generalization across model initializations drawn from Po-
as: ming Ee-ra ll [m7 Σ ())()(
83
84
85
86
87
Subsequent extensions, such as IDM and DAM, enhance caasiconniiional alignment through kemnel- based moment matching, adaptive feature regularization, and encoder updates, yielding improved performance. IDM introduces practical enhancements to the original distribution matching framework, incorporating progressive feature extractor updates, stronger data augmentations, and dynamic class balancing to improve generalization. In parallel, DataDAM leverages attention map alignment to better preserve spatial semantics, guiding synthetic samples to activate similar regions as real data while maintaining computational efficiency. These methods advance the state of dataset condensation by demonstrating that richer supervision and adaptive training dynamics are critical for generating synthetic datasets.
89
90
81
92
93
94
95
96
97
Backdoor attacks aim to manipulate model behavior inference time by injecting carefully crafted triggers into a subset of training data. When effective, the model performs normally on clean inputs but consistently misclassifies inputs containing the trigger. While extensively studied in standard supervised learning, backdoor attacks in the context of dataset condensation have only recently received attention. A pioncering study by Liu et al. [ introduces backdoors by poisoning real data before dataset condensation. Their Naive Attack appends a fixed trigger to target-class samples before condensation, but suffers from trigger degradation and reduced attack efficacy due to the synthesis process. To address this, Doorping employs a bilevel optimization scheme that jointly refines the trigger and the synthetic data. Although more effective, it incurs substantial computational overhead. More recently, Chung et al. [12] provide a kernel-theorete perspective on backdoor persistence in condensation. They propose simle--riggen which minimizes the generalization gap of the backdoor effect, and relax-trigger, which further reduces projection and conflict losses for improved robustness.
Backdoor Attacks against Dataset Condensation:
98
89
100
101
102
103
104
105
106
107
108
110
Importantly, existing approaches focus predominantly on maximizing ASR or preserving CTA. often overlooking STE, which is a critical factor for realistic attacks. In contrast, we propose SNEAKDOOR, novel framework that explicitly addresses the ASR-CTA-STE trade-off through input-aware trigger generation and sccatt--wware integration into distribution matching-bas -baeed condensation.
111
112
113
3
Methodology
114
115
3.1 Threat Model
116
Attack Scenario. We consider a collaborative setting where one entity possesses a high-quality dataset and shares a compact version with another party via dataset condensation, due to privacy or bandwidth constraints. The condensed dataset is typically regarded as a trustworthy proxy for training. However, this trust can be exploited. A malicious provider, with full access to the original data and sole control over the condensation process, can embed backdoor triggers into the synthetic data. These triggers, while preserving high utility for clean tasks, can cause targeted misclassification in downstream models.
118
120
122
123
Moreover, our threat model does not assume that the attacker knows the downstream (victim) model 124
architecttre. This upstream threat underscores a critical vulnerability: even limited data sharing can serve potent attack vector when the condensation process is adversarially controlled.
3

---

128
Attacker's Goal. The attacker's objective in backdooring condensed datasets is inherently multi- faceted, requiring a delicate balance among three goals: stealthiness (STE), attack success rate (ASR), and clean test accuracy (CTA). Due to space constraints, detailed definitions of these metrics are provided in Appendix A.
127
129
130
3.2
Stealthy Backdoor Attack against Dataset Condensation
131
(1) Trigger Generation
Trigger generation starts by identifying the source-target class pair (i,j) with the highest inter-class misclassification rate:
133
N Σ (Fo, = 1), Th E Ti, Oz-oj N
1
134
where T. represents the subset of the original dataset T with ground label i, fo, and go. denote the feature extractor and classifier, respectively, I(-) is the indicator funetion that equals if the classifier assigns the sample Iy to class j. and O otherwise. In practice, we estimate O;-; by sampling N examples from class mapping them the latent space with for- and computing the fraction that go, assigns to class j.
136
137
138
We evaluate O,++ for all ordered class pairs and select the pair with the maximal value. The chosen pair indicates the most error-prone direction for label confusion; a trigger is then designed to exploit this specific weakness. By targeting the pair with highest misclassification rate, the attack achieves consistent source -target misclassification while limiting collateral impact on overall model accuracy.
140
142
143
The computation of O:--j depends on the model parameters 0 = {0,, 6z), which correspond to the feature extractor fa, and the classifier fe., respectively. To obtain these parameters, we first construct a condensed dataset = {(r{. ,()),N1 from the original dataset T {(x,, y:) where N < M. The synthetic dataset S is generated by minimizing distribution-mate mattiinngnnanii objective over randomly initialized models, ensuring that training on S approximates the behavior of models trained on the full dataset T:
144
145
147
S arg min R x'mps, Orp ((Pr(x;)), +s(
where (x; 0) and Ps(z';0) denote the feature distributions induced by the original and condensed datasets, respectively. The distance measure D(. such as Maximum Mean Discrepancy (MMD), quantifies the discrepancy between these distributions. R(S) is a regularization term, and À balances the trade-off between distribution alignment and regularization.
150
152
153
After generating the condensed dataset S, we train a surrogate model parameterized by 0 = (0,, using only S. This surrogate serves as an efficient approximation of the downstream model's decision behavior. Once trained, it is evaluated on the original dataset T, and normalized confusion matrix computed to analyze inter-class prediction tendencies.
154
155
156
CF
C
Σ Cip
C2y= = Σ
(Jo =
(..N)T
157 where o, is the total number of classes in the original dataset T. Cj represents the empirical proba-
158 bility that a sample from class is misclassified as class j. The maximum inter-class misclassificatiin
159 rate O u, by. is then calculated as follows:
Oy, -y- arg max Ciy.
(4)
180
This measure identifies the class pair (t,j) with the highest misclassification probability, revealing the most vulnerable decision boundary in the model.
182 We then proceed to the trigger generation phase, where the objective is to create a trigger that, when added to an input sample, causes the model to misclassify the input from the source class ye to the

---

164 target class y,. Speicifically, we utilize a generator model Gg. which generates perturbations, or triggers, which are added the original input data. The perturbation designed to be imperceptible. ensuring the trigger remains stealthy while causing misclassification. The trigger generation process can be represented as follows:
185
166
167
T = x=I+aGole
Vx E T s.t. [G)(2)]loo <s, Vr
(5)
168
where Gz(z) represents the generated adversarial noise, while is a constraint that controls the maximum permissible perturbation, ensuring that the perturbation remains subtle and undetectable.
169
170
The perturbed input is denoted as Σ. The subset Ty. refers to the portion of the original dataset for which the label is ye. a is a small constant, further controlling the size of the perturbation.
171
172
In practice, the maximum permissible perturbation constraint in (5. is enforced by applying clamping operation to the generator output (z(x)) before adding to the original input. Specifically, the adversarial noise is clamped such that its fo -nomm lies within the range E.. ensuring the perturbation remains imperceptible. This clamped noise is then added to the clean image, followed by another clamping step to maintain the pixel values within the valid image range. The loss in (6) is computed on these clamped, perturbed images, allowing the generator to be implicitly optimized under the perturbation constraint without the need for an explicit penalty term in the objective.
173
174
175
177
179
The generator model Ge is trained alongside @ = 0e), with the objective of minimizing the classification loss associated with the target class yr. Specifically. the generator is updated based on the following objective function:
180
181
Nl
Σ T
L ( (xr + GG(z))),
(6)
182
where L is the loss function, which measures the error in predicting the target class yr after applying the trigger to the input x, and 7/ is the learning rate for the generator.
183
184 By iteratively updating the generator, the generator G is refined to produce more effective backdoor triggers. The process continues until the trigger causes consistent misclassifications of the source class ys as the target class yr, while keeping the perturbation within the imperceptibility threshold E. This upproach enables the adversary to design highly effective backdoor triggers, leveraging the generator to produce stealthy perturbations that successfully compromise the performance of the downstream model.
185
186
187
188
189
190
2) Backdoor Injection
Once the generator G has been trained to generate perturbations that cause misclassifications of the source class y/s to the target class yr. we proceed with the backdoor injection process. This step involves adding the learned perturbations to the source class samples in the original dataset T. Specifically, we add the perturbations generated by G& to each sample x E Ty.:
192
194
H z (G)(
Vz E TT,
(7)
195
where 3. represents the perturbed sample, and (x) the perturbation generated by the adversarial generator. These perturbed samples are then relabeled to the target class yr-
197
This process ensures that adversarial perturbations are applied the samples from the source class, resulting in a set of triggered samples, Triggered = (ž, yr) ) where the perturbed inputs are labeled as the target class y/- In the subsequent step, the triggered samples are incorporated with the clean samples from the target class yr- The primary objective of this combination is to introduce a fraction of the triggered samples into the target class, thereby facilitating the model to misclassify source class samples as the target class when subjected to the adversarial trigger. This process ensures that the model's decision boundary is subtly manipulated
198
199
200
202
203
favor misclassification under specific conditions. Let Miriggered be the total number of triggered samples generated in the previous step, each labeled with the target class yr- The number of clean samples in the target class y, in the original
204
205
208
dataset Tyr is denoted by NT Based on the poison ratio p. we will add p .NT,,, triggered samples
207
into Ty.. Specifically, we first randomly select p NN,,, samples from Tuiggened and add them into T
208
The resulting poisoned dataset Tiixed consists of both the clean target class samples and the triggered
209
samples:
Tmixod Typ U (( NTo-
(8)
5

---

210
The next step is to recondense the target class T... The objective of recondensation is to generate a new subset Sy. within the synthetic dataset, which preserves the key characteristics of the target class while amplifying the influence of the triggered samples. This process seeks to strike a balance
211
212
213
between maintaining the intrinsic features of the target class and maximizing the impact of the adversarial samples. Specifically, the objective is to generate synthetic dataset Sy, that closely
214
215
approximates the target class distribution in the poisoned data Tyr The optimization objective is defined as:
Sy arg minE PT 2t -pSy Drupo D (Prrnu (o; Psy. (z): + XR.S).)
217
where Paam (2; 0) is the probability distribution of the target class incorporating triggered samples. Ps.. (x'; ;0) is the probability distribution of the recondensed target class.
218
4
Stealthiness Analysis
219
220
critical challenge in designing effective backdoor attacks on dataset condensation is achieving stealthiness, ensuring that poisoned samples and the resulting synthetic data are indistinguishable from their clean counterparts. Our goal formalize stealthiness through a geometric and distributional lens, grounded in the feature space induced by deep neural architectures.
221
222
To this end, our analysis is guided by the following question: How does input-aware backdoor injection perturb the structure of data manifolds in feature space, and can this deviation be rigorously bounded guarantee stealth? Since distribution matching-based condensation aligns global feature statistics (e.g., moments of embedded data), it is essential to understand whether triggers introduce detectable geometric or statistical anomalies in the condensed representation. We conduct our
225
228
227
228
229
analysis in a Reproducing Kernel Hilbert Space (RKHS), where class-specific data, both clean and triggered, are assumed lie on smooth, locally compact manifolds. By modeling the trigger as a bounded, input- aware perturbation and invoking assumptions on manifold regularity and inter-class proximity, we show that triggered samples remain tightly coupled to the clean data manifold under mild conditions. This theoretical framework enables us to quantify the effect of poisoning both at the feature level (Theorem 3) and at the level of the condensed dataset (Theorem 2). These results provide principled justification for SNEAKDOOR'S 's empirical stealth: the perturbations introduced by the trigger remain autent-space-aligne and distributionally consistent, limiting their detectability after condensation.
230
231
232
233
234
236
238
Formal statements of assumptions, intermediate lemmas, and proofs supporting our theoretical analysis are deferved to Appendix B for clarity and completeness.
239
240
Definition (Kernel). k: x X + R on a non-empty set X' is a kernel if it satisfies the following
two conditions: (I) symmetry: k(2,2' = 1s(x'' .z). Vx, x' E X. (2) Positive Semi-Definiteness:
242
for any finite subset {21, {21, "", , C X, the Gram matrix K = [k((,,, I1, )) is positive definiiie
244
Definition 2 (Reproducing Kernel Hilbert Space, RKHS). Given a kernel k : X X X + R. the Reproducing Kernel Hilbert Space H4 a Hilbert space of functions f X' + I. satisfying: (1) For every x E X, the function k(rr, :) E Hr. (2) Vx E X and I E Ha. f(xx) = k(z,((z))))) .)) H).
245
247
Theorem 1 (Upper Bound on Manifolld Deviation under Poisoning). Let T denote the clean target-class dataset and Teriggered the triggered (poisoned) dataset, with corresponding feature- space distributions PMacan and P Macisgsoaa respectively. Define the mixed distribution as: Passsca
249
250
(1 - P + pP Messeesess where p E [0, 1] denotes the poisoning ratio. Under Assumptions 1 (Lipschitz Continuity), 2 (Local Compactness of Feature Manifold), and 3 (Inter- Class Hausdorff
252
Distance), the expected deviation of samples the mixed distribution to the target feature manifold
253
satisfies:
E Egg. Munixeed
inf
||=- = S p(77 +6),
(10)
3.E.Maeenn
254
where H is the RKHS associated with the feature encoder.
Theorem 2 (Upper Bound on the Discrepancy Between Poisoned and Clean Condensation Datasets).
256
Let Ty, denote the clean target-class dataset and Tmixed = =Ty, U Trriggereds where Trriggered consists
of source-class samples Ty, perturbed by a trigger generator G and relabeled as the target class.

---

258
Let Sclean and Spoison denote the condensation datasets distilled from Ty- and Tmised, respectively, by minimizing: S* arg ming MMD(T.S) XR(S), where T E (Ty- Tmixed J. X > 0, and R is unn strongly convex regularizer. Under Assumptions 1 (Lipschitz Continuity), 2 (Local Compactness of Feature Manifold), and 3 (Inter-Class Hausdorff Distance), the MMD between Seloan and Spoison satisfies:
259
261
262
13pp(7E + +6)
AMD(Setcam, Spoison)
where 7 L 8= sup=, MM inf Melaan 1|2 2211 is the poisoning rate, and bounds the input perturbation.
284
285
5
Experiments
266
Datasets and Networks. We evaluate SNEAKDOOR across five standard datasets: FMNIST (14).
257
CIFAR-I0 [TS]. SVHN [16]. Tiny-ImageNet [7]. STL-10 [18] and ImageNette [9]] These datasets
268
span a diverse range of visual complexity, semantic granularity, and image resolution, enabling a com- prehensive evaluation of attack generality. Each dataset is processed according to the standard dataset condensation protocol, with 50 images per class used for condensation. Specifically, we adopt two
269
270
common synthetic data backbones: ConvNet and AlexNetBN [20]. which represent lightweight and moderately expressive condensation encoders. For downstream training and evaluation, we consider four architectures: ConvNet, AlexNetBN, VGG11 [21], and ResNet18 [22. Moreover, we evaluate KEEARDOOR in comparison with four state-of-the-art attacks: NAIVE
272
274
DOORPING 11]
SIMPLE [1], and RELAX [12].
276
Evaluation Metrics. We evaluate attack performance across three key dimensions: ASR, CTA, and STE. Following prior work [23], STE is quantified using three complementary metrics: (1) PSNR (Peak Signal-to-Noise Ratio), measuring pixel-level similarity between triggered and clean samples, where higher values indicate lower perceptual distortion. (2) SSIM (Structural Similarity Index),
278
280
which measures structural similarity, with values closer to indicating stronger visual alignment; and (3) IS (Inception Score) quantifies the KL divergence between the predicted label distribution of a sample and the marginal distribution over all samples. Lower IS values suggest reduced recognizabilityy indicating higher stealth and improved resistance to detection. For convenience, define inverted score IS (10 IS)e where larger values correspond to improved stealth.
282
285
Overall Attack Effectiveness. We first evaluate the overall effectiveness of each backdoor attack in balaneing three key objectives: ASR, CTA, and STE. To illustrate this trade-off, visualize the normalized performance of each method using radar plots (Figure Figure (3) that jointly capture all three dimensions. SNEAKDOOR consistently achieves a superior balance across the three criteria. In contrast, while Doorping and Relax achieve high ASR, they suffer from significant degradation in
287
288
289
290
either CTA STE. Conversely, Naive and Simple maintain better CTA but fail to deliver competitive
ASR or STE. These results validate our central hypothesis: imput-aware trigger design combined with
292
Distribution-alignn injection enables the attack that is both effective and stealthy.
Sneakdoor
Doorping
Naive
Simple
Relax
PSNR
PSNR
PSNR
CTA
n4
SSIM
CTA
Q
56 SSIM
CTA
0.4
SSIM
CTA
0.3%
SSIM
1.00
0.00
922
..0
5,70
000
800
ASR
IS
ASR
1s
ASR
1S
ASR
IS²
DM
DC
IDM
DAM
Figure
Attack Performance on STL.10. Larger area indicates better balance.
293
Effectiveness on Different Datasets To rigorously assess the effectiveness of SNEAKDOOR, we
evaluate CTA and ASR across five datasets and four dataset condensation baselines: DM (3) DC 244,
294
IDM 25), and DAM (26). Results are summarized in Table D with each entry reporting the mean and standard deviation over five random seeds. SNFAKDOOR consistently achieves high ASR across all datasets and condensation methods, while maintaining competitive CTA. These results highlight
296
7

---

Sneakdoor
Doorping
Naive
Simple
Relax
PSNR
PSNR
PSNR
PSNR
70.06
70:27
69:82
70.34
C
0.39
SSIM
CTA
SSIM
CTAI
0.39
SSIM
CTA6
SSSSMM
O.
0,95
IS
Is'
ASR
IDM
DAM
Figure 3: Attack Performance on
Larger area indicates better balance.
298
the robustness and generalizability of SNEAKDOOR, with improvements most evident in scenarios
299
where baseline methods overfit specific condensation schemes.
Table I: Effectiveness on Different Datasets
Dataset
Method
CTA
SNEAKDOOR
ASR
CTA
DOORPING
ASR
CTA
SIMPLE
ASR
CTN
RELAX
ASR
0.926
0.001
0.989
0.821 0,001
0.005
0.584
0,000
0,590
0.012
0.000
1.000
0.000
CIFARIO
DC
0.537
0.000
0.996 :: 0.000
0.506 1: 0.001
1.000 = 0.000
0/197
0.001
0.657 = 0.021
0.511
-0.001
1.000 = 0.000
IDM
0.643
4: 0.002
0.975
2 0.001
0.654
+ 0.002
0.165
+ 0.007
0.652
= 0.001
0.142
0.006
0.653
= 0.002
0.522 = 0.021
DAM
0.501
0.0001
0.979
0.001
0.531
0.000
1.000
0.000
0.507+00.00
0.674
0.059
0.508 0.001
0:973
0.000
0.577
0.001
0.149
0.007
0.507
0.001
00086
0.000
0.596
0.901
1.000
0.001
STL.00
IDM
DC
0. 565
0.658
1.000000 0.001
0.001
O. 0.998
0.979
1: 0.001
0.001
0.508
0.861 1: 0.001
:: 0.001
0.314
0.227
= 0.011
0.015
0.550
0.658
= 0.001
0.001
0.100
0.112
0.007
0.658
0.563
= 0.000
0.001
0.954
0.998
0.011
0.001
DAM
0.532
0.001
0.992
0.001
0.001
1.000
0.000
0.535
0.001
0.103
0.004
1.000
0.000
DM
0.976
0.001
0.908 + 0.000
0.876 + 0.000
0X093
0.006
0.968
0.000
0.178
= 0.005
0.828 - 0.000
1.000
0.000
FMNIST
DC
O. 0G1
0.001
D98
O. 000
0.872 + O. 0000
1 1.000
0.000
0.837
0.061
0.277
0.014
0.824 = 0.901
1,000
0.000
0.877
0.000
0.002
0.000
0.159
0.0007
0.876
0.000
DAM
0.577
0.000
0.99622
1 0.000
0.813 1 0.001
1.000 : O. 000
0,880
0.000
0.151
= 0.012
0.871 = 0.000
1.000
0.000
DM
O. 0.800
0.000
1.000 = 0.000
0.780 + 0.001
1:000 = 0.001
0.748
0.000
0.110
= 0.007
0.747 = 0.000
1.000
0.000
SVHN
DC
0.687
0,000
1.000
0.000
0.583 1: 0.001
0.703
0.017
0.626
0.001
0.100
0.009
0.689
0.001
1,000-
0.000
IDM
0.831
0.001
0:986
0.001
0.839 + 0.001
0.061
0.006
0.842
0.001
0.114--00
0.008
0.834
0.902
0.992
0.003
DAM
0.001 0.782
1.000
+ 0.000
0.721 + 0.000
1.000
+ 0.000
0.759
+ 0.001
0.114 = 0.005
0.745
= 0.001
1.000-
0.000
DM
0. 0.5033
0.001
1.000
0.000
0.296
:: 0. 0,002
1.000 :: 0.000
0.193
0.063
0.100 = 0.901
0.191
0. 0.003
0.996
0.000
TINY IMAGENET
0.432
0.002
0.000
0.492
0.001
0.005
0.391
0.002
0.192
0.418
0.063
0.001
IDM
0.517 0.001
1.000 1: 0.000
0.512
1: 0.005
0.089
:: 0.013
0,509
0.003
0.016 - 0.002
0.084
= 0.006
0.911
0.002
DAM
0.482 0.003
1.000 + 0.000
0.440
= 0.003
1.000
0.000
0.458 0.063
0.082 = 0.002 0.465
0.002
0.973 0.001
300
Effectiveness on Cross Architectures To evaluate SNEAKDOOR in cross-architecture settings, where the condensation model differs from the downstream model, we follow prior work [I] and consider four architectures: ConvNet, AlexNetBN, VGGII, and ResNet18. Specifically, we use ConvNet or AlexNetBN for data condensation and the remaining models for downstream training.
302
303
304 As shown in Table 2 we evaluate SNEAKDOOR, across 36 arohitcrchee scenarios spanning various datasets, condensation methods, and downstream models. SNEAKDOOR demonstrates consistent performance across most architecture pairs, indicating strong transferability. However, when using the DC algorithm, performance systematically degrades on specific architectures. Prior studies, as well as our own findings, suggest that DC often produces lower-quality distilled datasets,
305
306
308
reflected in its relatively low CTA. This implies that the reduced ASR in these cases is more likely due to DC's limited ability to retain both task rele-releant and reelevan--elevvnn information, rather than a shortcoming of the attack mechanism itself. When excluding DC-based cases, 27 scenarios remain, of which only exhibit ASR below 90%. This demonstrates that SNEAKDOOR consistently
310
312
achieves high ASR in most settings, provided the underlying condensed data is of sufficient quality.
Table 2: Cross- Cross-architecture CTA and ASR
Dataset
Network
CTA
DM
ASR
CTA
DC
ASR
CTA
IDM
ASR
CTA
DAM
ASR
VOGL
0.568
0.000
0.971
0:000
0.172
0.000
0.865
0.00
0.645 30
0.000
0.719
0.539
0.000
0.929
0.00]
CIBARIO
AlexNetBN
0.616
0.942
0.426
0.004
0/000
0.000
0.689
0.000
0.539
0.033
0.623
0.001
0.002
0.004
ResNer18
0.548
0.001
0.969
0.000
0.435
0.001
0.534
0.003
0.636
0.001
0.7766
0.033
0.510
0.00
0.857
0,002
VGG1
0.687 D.00
(0.00
+ 0.001
0.564 + 0.000
(177K] + 0.003
0.676
00.00
0.300+ 0:00
0.582
0.000
03324 + 0.001
STL.10
AlexNerBN
01580
0.002
0.905
+ 0.005
0.542
+ 0.001
0.796
+ 0.002
0.670
1::00-0.000
0.003
01708
0.005
(U636
+ 0.001
0.981 + 0.001
ResNet18
0.001 0.463
0.989
0.000
0.396
0.001
0.783
0.063
0.647
0.001
0.949
0.001
0.001 0.436
0.941
0.002
TINY IMAGENET
AlexNerRN
VGG11
0-488 0.000
0.617++D.000
0.7766 + 0.015
1.000
0.000
0.384
0.292
+ 0.007
0.001
1.0000
(1704
0.000
0.008
0.541
0.572
0.004
0.002
1,000
1,000
0.000
0.000
0.449
0.541
0.003
0.0012
1.000 0.000
1,000
ResNer18
0.456 + 0.002
1.000 + 0.000 0.358 0.001
0.524 0.008
0.483 0..05
01.88 0.010
0.438 0.002
1.000 0.000
314
Evaluation of Stealthiness As shown in Figure 4 SNEAKDOOR consistently achieves the highest
PSNR and SSIM across all condensation methods, highlighting its ability to produce visually and
8

---

318
structurally imperceptible triggers. In contrast, the other methods exhibit notable declines in both
317 metrics, suggesting visible artifacts or structural distortions the perturbed samples. Moreover,
while Simple and Naive achieve slightly lower IS values, they fail to maintain competitive ASR or CTA, limiting their overall effectiveness. SNEAKDOOR achieves similarly low IS while preserving
319
high ASR, indicating enhanced stealth without sacrificing attack strength.
Doorping
Naive
Simple
Relax
Sncakdoor
6c-4
60
0.4
4c-4
40
0.2
20
2c-4
0.0
DM
DC
IDM PSNR
DAM
DM
DC
IDM SSIM
DAM
DM
DC
IDM
DAM
IS
Figure 4: Stealthiness Performance STL10
Robust to Defense To evaluate the resilience of SNEAKDOOR against existing defense mechanisms, we conduct comprehensive experiments spanning model-level, input-level, and dataset-level defenses. Results in Table 3 show that SNEAKDOOR consistently evades state-of-the-art model-level defenses
322
323
324
such as NC [27 and PIXEL (28] with all anomaly scores remaining below detection thresholds.
Input-level defenses also fail recover effective triggers, indicated by uniformly low REASR
328
values across all settings [29]. While dataset-level methods such as RNP (30) and PDB [31] succeed suppressing ASR, they face significant drops CTA, reflecting a sharp trade-off. These findings
327
328
highlight SNEAKDOOR as robust attack that remains effective under diverse defense conditions.
Table 3: NC, ABS, and PIXEL across different datasets and condensation methods.
NC Anomaly Index
ABS REASR
PIXEL
Dataset
DM
DC
IDM
DAM
DM
DC
IDM
DAM
DC
IDM
DAM
STL.0
1.3180
1.0872
1.3648
0.9843
0.19
0.19
0.25
0.17
1.5525
1.0515
0.7688
1.5425
CIFAR1O
1.8762
0.9518
1.7640
1.3787
0.24
0.35
0.29
0.57
1.7705
1.2625
1.7750
0.9472
TINY-IMAGENET
1.4706
1.6199
1.2201
1.9065
0.17
0.14
0.15
0.16
1.7813
1.4252
1.9528
1.3447
Table 4: Effects of (1) Class Pair Selection and (2) Input-Aware Trigger Generation
(1)
(2)
CTA
ASR
PSNR
SSIM
IS
X
/
0.5912 + 0.0004
0.9946 1 0.0005
65.8677
0.12915
1.3058
10-5
X
0.6211 + 0.0005
0.9876 + 0.0050
59.8469
0.08217
2.2987
10-4
/
0.6262 + 0.0005
0.9890 + 0.0000
73.2285
0.66151
4.8441 x 10-5
Table 5: CTA/ARR Before and After Defense
Dataset
Method
DM
DC
DAM
IDM
W/O Defense
0.6262/0.9890
0.5372/0.9961
0.5906/0.9794
0.6431/0.9754
CIFAR10
RNP
0,2334/0,5499
0,3874/0. 1340
0.5748/0.988
0.4424/0.288 2870
PDB
0.1388/0.1368
0.1000/0.0000
0.0664/0.0300
0,3191/0.4190
W/O Defense
0.5979/0.99 9725
0.5653/0.9977
0.5324/0.99 9914/
0.6582/0.9799
STLIO
RNP
0.2791/0.0622
0.3955/0.8 8962
0.4961/0.84488
0.4889/0.5888
PDB
0.4719/0.0425
0.1150/0.0100
0.1293/0.0313
0.2644/0.0038
W/O Defense
0.5026/1. 15000//10000
0.4318/1. 00000
0.4822/1 ,0000
0,5174/1 .0000
TINY-MAGENET
RNP
0.2700/0.0600
0.2450/0.0200
0.3320/0.7600
0.3450/0.9200
PDB
0.1030/0.0000
0.0570/0.0000
0.0540/0.0000
0.0800/0.1 1600
329
Ablation study To assess the contribution of key components in SNEAKDOOR, we perform ablation
330
studies on (1) inter-class boundary- based class pair selection and (2) input-awarr trigger generation.
331
Removing (1) and using arbitrary class pairs slightly reduces ASR but significantly degrades CTA and stealth metrics (PSNR, SSIM). Replacing (2) with fixed patterns, as in Doorping, maintains ASR and CTA but severely compromises stealthiness, as shown by reduced similarity and elevated IS.
333
These results underscore the necessity of both components.

---

335
Due to space limitations, we report supplementary results in Appendix C, including comparisons with additional attack baselines. analysis of varying the number of condensed samples per class, and evaluations using AlexNet as the condensation model.
336
337
6 Limitations
338
339
While SNEAKDOOR achieves good balance across ASR, CTA, and STE, it does not consistently surpass all existing methods on any single metric. In certain cases, baseline approaches such as DOORPING attain higher ASR or CTA when considered in isolation. This trade-off reflects the inherent challenge of jointly optimizing multiple, often competing objectives. Future work could investigate methods that enhance a specific metric without sacrificing other metries. Further refinement may lead to more adaptable backdoor attacks tailored to specific deployment or threat
340
342
343
344
345
scenarios. Another limitation lies in the dependence on relatively high poisoning ratio to reach
346
optimal attack effectiveness. Reducing this requirement would make the approach more practical in real-world scenarios where the attacker's control over data limited. Finally, SNEAKDOOR does not fully capture more complex threat models that involve targeted source-to-target manipulations, such as altering "Stop Sign" to "Speed Limit: 60 mph", which poses serious safety risks. In such cases, the attack's is effectiveness may decrease. Extending SNEAKDOOO to handle diverse and task-specific attack objectives remains an important direction for future research.
347
349
351
Conclusion
352
353
This work introduces SNEAKDOOR, a novel attack paradigm that exposes critical vulnerabilities in eeatibutioo-matching-- based dataset condensation methods. By integrating input-aware trigger generation with inter-class misclassification analysis, SNEAKDOOR injects imperceptible yet highly effective backdoors into synthetic datasets. The theoretical analysis in reproducing kernel Hilbert
354
355
358
357
space (RKHS) formalizes the stealth properties of the attack, showing that the induced perturbations remain bounded in both geometric and distributional space. Extensive experiments across multiple datasets, condensation baselines, and defense strategies confirm that SNEAKDOOR achieves strong
358
359
360
ASR ASR-CTA-STE trade-offs and maintains high transferability under crost-architecture evaluation. Together, these results reveal that even condensed data, often regarded a crivacyprreeevvngg substitute for raw data, can serve as a potent vector for model compromise when the condensation process is adversarially controlled. This study lays the foundation for understanding the vulnerabilities and defense limitations of current condensation frameworks, emphasizing the need for proactive safeguards in synthetic data pipelines.
362
384
Broader Impact
367
Backdoor attacks against dataset condensation pose significant risks given the growing use of condensed datasets in privacy-sensitive or resource-constrained settings such as outsourced data compression, federated learning, machine unlearning, and continual learning. For instance, in continual learning systems deployed in edge AI applications, such as autonomous vehicles or medical diagnosis assistants, lightweight condensed datasets enable efficient model updates without full retraining. If an adversary injects imperceptible backdoor triggers into this data, the resulting models may misclassify critical inputs (e.g., road signs or tumor types), leading to serious safety and ethical consequences. Given these risks, the responsible disclosure of such attacks is essential. The goal of our work is to expose vulnerabilities in distribution caaaribution-macciinng. based condensation methods to inform the design of more effective defenses. To mitigate misuse, we recommend: (1) incorporating robust anomaly detection and certified defenses during condensation; (2) encouraging transparency and reproducibility in condensation pipelines; and (3) enforcing rigorous provenance tracking dataset generation processes. Our findings serve both as a cautionary signal and a foundation for developing secure and resilient dataset condensation techniques.
369
370
371
373
375
377
378
379
380
Acknowledgments
381
382
This work was supported by the National Key Research and Development Program of China (N0.2023YEFF9055300) NSFC Grant. N0.62176205 and 62472346.
10

---

References
384
[1] Songhua Liu, Jingwen Ye, Runpeng Yu, and Xinchao Wang. Slimmable dataset condensation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3759-3768, 2023.
386
387
388
[2] Yang He, Lingao Xiao, Joey Tianyi Zhou, and Ivor Tsang. Multisize dataset condensation. In The Twellth International Conference on Learning Representations. 2024.
389
[3] Bo Zhao and Hakan Bilen. Dataset condensation with distribution matching. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 6514-6523, 2023.
391
[4] Enneng Yang, Li Shen, Zhenyi Wang, Tongliang Liu, and Guibing Guo. An efficient dataset condensation plugin and its application to continual learning. Advances in Neural Information Processing Systems, 36, 2023.
383
394
395
Zeyuan Yin, Fric Xing, and Zhiqiang Shen. Squeeze, recover and relabel: Dataset condensation imagenet scale from a new perspective. Advances in Neural Information Processing Systems, 36:73582-73603, 2023.
396
397
398
[6]
Hansong Zhang, Shikun Li, Pengju Wang, Dan Zeng. and Shiming Ge. M3d: Dataset condensation by minimizing maximum mean discrepancy. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 9314-9322, 2024.
399
400
401
77] Viming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey, IEEE transactions on neural networks and learning systems, 35(1):5-22, 2022.
402
403
88
Wei Guo, Benedetta Tondi. and Mauro Barni. An overview of backdoor attacks against deep neural networks and possible defences. IEEE Open Journal of Signal Processing, 3-271-287, 2022.
404
405
99] Shaofeng Tian Dong. Benjamin Hao Zhao, Minhui Xue, Suguo Du, and Haojin Zhu. Backdoors against natural language processing: A review. IEFF Security & Privacy, 20(5):50-59, 2022.
406
407
[10] Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. Backdoorbench: comprehensive benchmark of backdoor learning. Advances in Neural Information Processing Systems, 35:10546-10559, 2022.
408
409
410
[11] Yugeng Liu, Zheng Li. Michael Backes. Yun Shen, and Yang Zhang, Backdoor attacks against dataset distillation. arXiv preprint arXiv:2301.0119) 2023.
411
412
[12] Ming- Yu Chung. Sheng- Yen Chou, Chia-Mu Yu, Pin-Yu Chen, Sy-Yen Yen Kuo, and Tsung- Ho. Rethinking backdoor attacks on dataset distillation: kernel method perspective. The Twelfth International Conference on Learning Representations, 2024.
413
414
415
[13] Tianhang Zheng and Baochun Li. Rdm-dc: poisoning resilient dataset condensation with robust distribution matching. In Uncertainty in Artificial Intelligence, pages 2541-2550. PMLR, 2023.
416
417
[14] Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion maist: a novel image dataset for benchmarking machine learning algorithms, arXiv preprint arXiv:1708.07747 2017.
418
419
[15] Alex Krizhevsky, Geoffrey Hinton, al. Learning multiple layers of features from tiny images. 2009.
[16] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning, volume 201 page 4. Granada, 2011.
422
[17] Yann Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N. 7(7)33, 2015.
424 [18] Adam Coates, Andrew Ng, and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. In Proceedings of the fourteenth international conference on artificial intelligence and statistics. pages 215-223. JMLR Workshop and Conference Proceedings, 2011.
426
427
[19] Jeremy Howard and Sylvain Gugger. Fastai: a layered api for deep learning. Information, 11(2):108, 2020.
428
[20] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. In F. Pereira, C.J. Burges, L. Bottou. and K.Q. Weinberger, editors, Advances in Neural Information Processing Systems, volume 25, Curran Associates, Inc., 2012.
429
431
[21] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recogni- tion. arXiv preprint arXiv: 1409:100..11 1556, 2014.
11

---

433
[22]
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 770-778. 2016.
[23] Jun Xia, Zhihao Yue, Yingbo Zhou, Zhiwei Ling, Yiyu Shi, Xian Wei, and Mingsong Chen. Waveattack: Asymmetric frequency obfuscation- based backdoor attacks against deep neural networks. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet. J. Tomezak. and C. Zhang, editors, Advances in Neural Information Processing Systems, volume 37, pages 33549-43570 Curran Associates, Inc., 2024.
437
438
439
[24] Zhao, Konda Reddy Mopuri, and Hakan Bilen. Dataset condensation with gradient matching. arXiv preprint arXii:2006.05540 2020.
440
441
[25] Ganlong Zhao. Guanbin Li, Yipeng Qin. and Yizhou Improved distribution matching dataset condensation. In Proceedings of the IEEE/CVE Conference on Computer Vision and Puttern Recognition, pages 7856-7865, 2023.
442
443
444
[26] Ahmad Sajedi, Samir Khaki, Ehsan Amjadian, Lucy Z Liu, Yuri A Lawryshyn, and Konstantinos N Plataniotis. Datadam: Efficient dataset distillation with attention matching. In Proceedings of the IEFF/CVF International Conference Computer Vision, pages 17097-17107, 2023.
445
447
[27] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP). pages 707-723, 2019.
449
[28] Guanhong Tao, Guangyu Shen, Yingqi Liu, Shengwei An, Qiuling Xu, Shiqing Ma, Pan Li, and Xiangyu Zhang. Better trigger inversion optimization in backdoor scanning. In 2022 Conference on Computer Vision and Pattern Recognition (CVPR 2022), 2022.
452
453
[29] Yingqi Liu. Wen-Chuan Lee, Guanhong Tao, Shiqing Ma. Yousra Aafer, Xiangyu Zhang. Abs: Scanning neural networks for back-doors by artificial brain stimulation, In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS '19, page 1265-1282, New York,
454
455
NY, USA, 2019. Association for Computing Machinery.
457
[30] Yige Li, Xixiang Lyu, Xingjun Ma. Nodens Koren, Lingjuan Lyu, Bo Li, and Yu-Gang Jiang. Reconstruc- tive neuron pruning for backdoor defense. In ICMI,, 2023.
459
[3]] Shaokui Wei, Hongyuan Zha, and Baoyuan Wu. Mitigating backdoor attack by injecting proactive defensive backdoor. In eighty Conference on Neural Information Processing Systems, 2024.
461
[32] Nachman Aronszajn. Theory of repraducing kernels. Transactions of the American mathematical society, 68(3):337-404, 1950.
463
[33] Alain Berlinet and Christine Thomas Thomas-Agnan. Reproducing kernel Hilbert spaces in probability and statistics. Springer Science& & Business Media, 2011.
465
[34] Benyamin Ghojogh, Ali Ghodsi, Fakhri Karray, and Mark Crowley. Reproducing kernel hilbert space, mercer's theorem, eigenfunctions, nystri om method, and use of kemels in machine learning: Tutorial and survey, arXiv preprint arXiv:2106.08444 2021.
467
12

---

NeurIPS Paper Checklist
488
469
The checklist is designed to encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
470
471
475
474
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
475
You should answer [Yes], [No], or [NA].
477
[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.
478
479
Please provide short (1-2 sentence) justificcton right after your answer (even for NA).
480
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
481
483
484
The reviewers of your paper will be asked to use the checklist as one of the factors in their evaluation.
While "[Yes] " is generally preferable to "[No]", ", it is perfectly acceptable to answer "[No] provided proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). In general, answering "[No] or "[NA]" is not grounds for rejection. While the questions are phrased in binary way, we 488
485
486
487
489
acknowledge that the true answer often more nuanced, so please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
490
491
483
IMPORTANT, please:
494
Delete this instruction block, but keep the section heading "NeurIPS Paper Checklist",
485
Keep the checklist subsection headings, questions/answers and guidelines below.
496
Do not modify the questions and only use the provided macros for your answers.
497
1. Claims
498
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
500
Answer: [Yes]
501
Justification: The abstract and introduction outline the motivation and detail the technical contributions of the proposed approach.
502
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
505
508
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
507
508
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
510
511
It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
512
2.
Limitations
Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes]
13

---

518
While SNEAKDOOR achieves the best overall balance across Attack Success Rate (ASR), Clean Test Accuracy (CTA), and Stealthiness (STE), does not consistently outperform existing methods on any single metric.
Justification:
517
519
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
521
522
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
524
525
526
527
528
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
530
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
532
534
538
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
537
538
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
539
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
541
543
545
546
3.
Theory assumptions and proofs
547
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
548
549
Answer: [Yes]
550
Justification: Each theoretical result is provided the full set of assumptions and a complete (and correct) proof.
Guidelines:
The answer NA means that the paper does not include theoretical results.
554
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
555
556
All assumptions should be clearly stated or referenced in the statement of any theorems.
557
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
559
560
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
561
562
Theorems and Lemmas that the proof relies upon should be properly referenced.
563
4. Experimental result reproducibility
584
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
565
566
Answer: [Yes]
14

---

588
The disclosed information is enough to reproduce the main experiments. We will also release the source code late.
Justification:
589
570
Guidelines:
571
The answer NA means that the paper does not include experiments.
572
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
573
574
575
If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
578
577
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
579
580
581
582
583
5B4
585
586
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
587
588
589
(a) the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily the architecture clearly and fully.
580
model architecture, the paper should describe
592
593
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
585
596
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g.. to registered users), but it should be possible for other researchers have some path reproducing or verifying the results.
598
600
602
5. Open access to data and code
603
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
604
605
Answer: [Yes]
607
Justification:
We provide essential parts for the code and details in supplemental material.
608
Guidelines:
609
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.ce)
611
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
613
615
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https /nips. cc/ haablii/gguides/CodeSubbbi
617
for more details.
619
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
15

---

621
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
622
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
625
626
Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6.
Experimental setting/details
629
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
630
631
632
Answer: [Yes]
633
Justification:
We provide all details about the experiments.
634
Guidelines:
635
The answer NA means that the paper does not include experiments.
636
The experimental setting should be presented in the core of the paper to a level of detail that is necessary appreciate the results and make sense of them.
637
638
The full details can be provided either with the code, in appendix, or as supplemental material.
629
640
7.
Experiment statistical significance
641
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
642
643
Answer: [Yes]
644
Justification:
The error shown our experiments.
Guidelines:
646
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
648
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
651
653
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
654
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
657
658
is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
660
661
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
662
663
664
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
685
8. Experiments compute resources
667
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
668
670
Answer: [Yes]
671
Justification: All experiments were conducted utilizing the NVIDIA GeForce RTX 4090 GPU.
16

---

673
Guidelines:
674
The answer NA means that the paper does not include experiments.
675
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
678
679
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
681
682
9.
Code of ethics
683
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics http::///eerrrr....cpppaaallllls
684
Answer: [Yes]
686
Justification:
We follow the policy.
687
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
690
691
The authors should make sure to preserve anonymity (e.g., there is a special consid- eration due to laws or regulations in their jurisdiction).
693
10.
Broader impacts
694
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
695
696
Answer: [Yes]
Justification: Backdoor attacks against dataset condensation pose significant risks given the growing use of condensed datasets in privacy-sensitive or resource-constree constriind settings such as outsourced data compression, federated learning, machine unlearning, and continual learning. To mitigate misuse, we recommend: (1) incorporating robust anomaly detection and certified defenses during condensation; (2) encouraging transparency and reproducibil- ity in condensation pipelines; and (3) enforcing rigorous provenance tracking to dataset generation processes.
698
699
700
702
703
Guidelines:
705
The answer NA means that there is no societal impact of the work performed.
706
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
709
711
712
The conference expects that many papers will be foundational research and not tied to partieular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
714
715
716
717
718
719
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
720
722
723
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
725
17

---

727
11.
Safeguards
728
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
730
731
Answer: [No]
Justification: The primary contribution of our proposed SNEAKDOOR is expose vulnerabil- ities distribution -aaattioo-mmaciing---aa -baed condensation methods. Our work lays the groundwork for understanding the attack surface and limitations of current defenses, enabling the com- munity to proactively build secure and trustworthy dataset condensation frameworks.
733
735
736
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines restrictions to access the model or implementing safety filters.
739
741
742
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
743
744
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best-faith effort.
745
746
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
749
750
751
Answer: [Yes)
752
Justification:
We cite the original paper that produced the code package or dataset.
Guidelines:
754
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
757
758
The name of the license (c.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g.. website), the copyright and terms of service of that source should be provided.
759
If assets released, the license, copyright information, and terms of in the package should be provided. For popular datasets, papprswii wncersswthhodeee thcode com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
782
783
784
785
For existing datasets that are re- re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
786
767
If this information is not available online, the authors are encouraged to reach out to the asset's is creators.
789
13. New assets
770
Question: Are new assets introduced in the paper well documented and the documentation provided alongside the assets?
772
Answer: [NA]
773
Justification: [NA]
Guidelines:
775
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moodel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
777
18

---

779
The paper should discuss whether and how consent was obtained from people whose asset used.
780
781
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14.
Crowdsourcing and research with human subjects
784
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
785
786
787
Answer: [NA]
788
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
791
792
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included in the main paper.
794
795
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
796
798
15.
Institutional review board (IRB) approvals or equivalent for research with human subjects
799
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/teview based the requirements of your country or institution) were obtained?
Question:
801
803
804
Answer: [NA]
805
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
808
809
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
811
812
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
813
814
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
816
817
Declaration of LLM usage
Question: Does the paper describe the usage of LLMSs if it is important, original, or non-standard component of the core methods in this research? Note that the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
819
820
822
Answer: [NA]
823
Justification: The LLM was used solely for language editing and clarity improvement. did not contribute to the design, implementation, or validation of the proposed methods.
825
Guidelines:
826
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer LLM policy for what should or should not be described.
829
19

---

A
Attacker's Goal
830
Attacker's Goal. The attacker aims achieve multi-faceted objective when injecting backdoors into condensed datasets. This objective consists of three key goals: maintaining stealthiness, ensuring backdoor effectiveness, and preserving model utility on clean data.
832
833
834
Stealthiness (STE). The attacker's goal is to ensure that malicious modifications remain imperceptible.
This involves two requirements. Firstly, the poisoned condensed dataset DD must be visually and statistically indistinguishable from the clean version D. This is critical, as condensed datasets
835
836
837
[D)) and likely to be examined manually. Secondly, the triggered test samples remain imperceptibly different from unmodified test data. This requirement ensures that the backdoor remains undetectable during evaluation or deployment, whether through human inspection or automated analysis.
small
838
839
841
Attack Success Rate (ASR). In parallel, the attacker aims to embed a functional backdoor that remains inactive during standard operation but activates reliably in the presence of specific trigger. Let f denote the downstream model trained on D and A the backdoor trigger. For a triggered test sample
842
844
I3 + A, the ASR defined as:
N Σ (J(as +A)=
ASR = N
(1))
845
where is the target label, N, is the number of triggered test samples, and is the indicator function. The attacker aims to maximize ASR.
846
847
Clean Test Accuracy (CTA). Simultaneously, the attacker must preserve model accuracy on clean, non non-triggered data. In other words, the condensed dataset must retain sufficient utility to support
848
849
standard training objectives. This ensures that models trained on the poisoned data still generalize well to benign test sets. Let the clean test accuracy be defined as:
850
N 1(f(x,) = y:)
CTA
(12)
N.
851 where ys is the ground truth label of the test sample T4, N₂ is the number of clean test samples. The attacker seeks to maintain a high CTA so that the backdoor remains covert.
852
853
B
Stealthiness Analysis
854
A critical challenge in designing effective backdoor attacks on dataset condensation is achieving stealthiness, ensuring that poisoned samples and the resulting synthetic data are indistinguishable from their clean counterparts. Our goal is to formalize stealthiness through a geometric and distributional lens, grounded in the feature space induced by deep neural architectures.
855
856
857
858
To this end, our analysis is guided by the following question: How does input-aware backdoor injection perturb the structure of data manifolds in feature space, and can this deviation be rigorously bounded to guarantee stealth? Since distribution matching-based condensation aligns global feature statistics (e.g., moments of embedded data), it is essential to understand whether triggers introduce detectable geometric or statistical anomalies in the condensed representation. We conduct our analysis where class-specific data, both clean and triggered, are assumed to lie on smooth, locally compact manifolds. By modeling the trigger as bounded, anput- perturbation and invoking assumptions on manifold regularity and inter-class proximity, we show that triggered samples remain tightly coupled to the clean data manifold under mild conditions. This theoretical framework enables us to quantify the effect of poisoning both at the feature level (Theorem 3) and at the level of the condensed dataset (Theorem 2). These results provide principled justification for SNEAK KDOOR'S 's empirical stealth: the perturbations introduced by the trigger remain latent-space-alignee and distributionally consistent, limiting their detectability
859
860
861
882
863
in Reproducing Kernel Hilbert Space (RKHS) 32
33 34),
864
865
866
867
869
871 after condensation.
Assumption 1 (Lipschitz Continuity). The feature mapping fo, : X H. is assumed to be Lipschitz continuous. That is, for all x. x' E X,
I1 (x) - for (2' ( S Ly 1|= 2'11001
(13)
20

---

874
where L E IR+ denotes the Lipschitz constant. and 1lo is the Loc -nom in the input space.
Assumption 2 (Local Compactness of Feature Manifolds). Let the clean target class dataset Ty, and 876 the triggered dataset Triggered lie on smooth manifolds Melean and Miggered respectively, embedded in Reproducing Kernel Hilbert Space (RKHS) H. The following condition holds: For any point
E Meteon there exists a neighhorhood (=) C H and a diffeomorphism @= : (2) n Melean C RR, where is an open subset and d is the intrinsic dimension of the manifold.
878
879
880
A Assmmption 3 (Inter-Clat Class Hausdorff Distance), Let Manune and Melean denote the RKItS-embedded
manifolds of the source and target (clean) classes, respectively. Their Hausdorff distance is defined
882
as:
inf 2x EMsancr E.MM
sup
11 - 27 1lve
(14)
883
This condition implies that the decision boundary between source and target classes is locally reachable in feature space, enabling feasible cross-class perturbations by the trigger generator.
884
885
Lemma (Boundedness of Latent Space Perturbation). Under Assumption [ (Lipschitz Continuity), the perturbation in the latent space of the triggered sample I + aG&(T) is bounded as follows:
So (T) - Soy (x)llx S I.gae,
(15)
where Ly is the Lipschitz constant of the feature mapping foy, and e is the upper bound on the input perturbation, satisfying []G((z)ll>o S.
888
Proof. According Eq 5 the perturbation generated by the trigger generator G satisfies the input 890 space constraint [ I E. Therefore, the following conclusion can be obtained:
[1 (T) - (x)(x) = I1, (or (Go(x)) - So, (x)
s (=)laG(())Ile>
(16)
s Lyge
This lemma shows that the perturbation's effect in the feature space is controlled by both the input perturbation bound a, e and the Lipschitz constant Ly.
892
893
Let Metean and Mariggered be smooth manifolds in the Reproducing Kernel Hilbert Space (RKHS) H. induced by the feature map So, X + H. Under Assumption
Lemma 2.
884
3 there IV - 1 S
and
885
exists a diffeomorphism V : -Msouree -> Marizgeee such that: (1) Sup,,EM...... E.P2
896
ys, where 7 = Lfa. (2) Maiggered C. No (Molean),
8' = =,00E + 8, where No. (Molem)) denotes
the 8' -nighhorrooo of Melean in H.
Proof. By Assumption 2 for each 2, Msouree there exists local chart ya : :<(x)) Mssuree 898
U. C Rd, where (2,)) H. is neighborhood and U, is an open subset.
900 Define the local mapping v.. U, +> Minigereed by:
(u) = Ser (1o,
aGolJō,' (e, (w)))
(17)
The smoothness of v.. follows from the differentiability of Go and fay- Then, by Lemma I we can obtain: (u) p. (w)lxx S Lyas YEE.
903 To construct a global diffeomorphism, take finite open cover (2s,)) of M with corre-
904 sponding charts s,, and a smooth partition of unity {p.):
k
((zx)) = Σ pr(zs) wh (a,
(18)
21

---

905
We now bound the total perturbation:
(z,) - zallæ -
Pilza)llos,
28 2011
Pi(zo)
(19)
1=1
L
yyE
906 For any 2t Muiggered there exists 2s Masure such that 2; (2,).. By Assumption there
exists 2, Melean with || 2r|1æ S 6. Then by the triangle inequality:
Fi 27 S 11 zellx + 11 2, 1l
(20)
I Tyyer + ā =
908
Hence, Muiggered C &N (MMee)))
To verify V is diffeomorphism:
910
Injectivity: Follows from local injectivity each vts, and the partition of unity.
Surjectivity: For any 2t MMriggeedd there exists Ty, such that 2, So, (x++GG())) vi (fe, (z)).
Smooth Inverse: Local inverses Viz exist by the inverse function theorem and can be smoothly blended via {pt}.
913
914
915
Theorem 3 (Upper Bound on Manture- Deviation under Poisoning). Let Ty. denote the clean
917
target-class dataset and Teriggored the triggered (poisoned) dataset, with corresponding feature-space distributions PM and MMrisssrea respectively. Define the mixed distribution as:
PMmixed = (1 - PM + pPMMuigeeed)
where p [0, 1] denotes the poisoning ratio. Under Assumptions D and the expected deviation of samples from the mixed distribution to the target feature manifold satisfies:
920
E
Eg~PMaiset anisee
inf
||z
2= I p(7E 8),
(21)
E.eeann
where H. is the RKHS associated with the feature encoder.
922
Proof. By the linearity of expectation and the definition of P. have:
Egn PM Manied
inf || 2r 1l
(1 p) Pa-PMaoen
inf ||= z 11
(22)
+ PE P
inf || 2z ll
Meriggened
923 Since clean samples 2 ~ PM lie on the target manifold, their distance minimum distance to the target manifold is zero. Therefore:
Ege Manisodd
inf ||2 - 2+ 11
(23)
pE Paeriggeeed
inf ||| zz 11
22

---

925
By Lemma for any & Muiggered. there exists 24 E Melean such that:
= 2x 27112 5 YE + 6.
(24)
926 Hence,
inf E
|| - 2+ 1 S 8'.
(25)
927
Taking the expectation over P Merizeeedd we obtain:
Egw Meriggered
inf || 2, 2+1124 58.
(26)
Substituting into Eq. 22 yields:
E P Paiieed
inf ||
2r 11
S spay 6).
(27)
930
Theorem 4 (Upper Bound the Discrepancy Between Poisoned and Clean Condensation Datasets). Let Ty, denote the clean target-class dataset and Tmixed = Typ U Turiggered, where Trriggered consists of source-class samples Ty, perturbed by trigger generator G and relabeled the target
931
932
class.
Let Sclean and Spolson denote the condensation datasets distilled from Ty. and Tmixed, respectively, by minimizing:
935
8 arg min MMD(T, XR(S),
(28)
938 where T E (Ty: T.ixed]. A > 0, and R. is strongly convex regularizer.
Under Assumptions and 3 the MMD between Selean and Spoison satisfies:
MMD (Selaal Spoison) S 13gp(7E + +8
APR
938 where = f 5 sup Measacc inf EMtiann 1| - 2+11 is the poisoning rate, and bounds the input perturbation.
939
940
Proof. By Theorem
Egn Munised
inf M.Eeal
||2 - 2=11 S p(7e 8).
(29)
This inequality constrains the average deviation of the mixed distribution from the clean target 942 manifold by p( + 5).
In RKHS, MMD can be expressed via the norm of mean embeddings:
MMD(Ty, Tmised) Metenn /Mmixed
(30)
944 where
Meloan ExxPTu [fe, (x))
P'miedd
E E.
Pramues [Se, (x:)
946
Using the decomposition, the mean embedding of the mixed distribution can be written as::
Pmixed = (1 Pe + PPriiggered
(31)
get:
Melcan Mmixed p(Polcan Mtriggered)
(32)
23

---

948
Hence:
MMD(Tpp (Tyr: Tmixed) = Pllleeean - Meriggered
(33)
p(ye + 6)
949 Let the clean and poisoned synthetic datasets, Selean and Sprison. be obtained by solving the following optimization problems:
Sclean arg min MMD(T S) + XR(S),
5
(34)
Spoison arg min MMD mixxdd S) + XR(S)
951
According to the first-order optimality condition, the solutions Selean and Spoison satisfy:
VMMDs Scican) + (VR((Seca)) = VMMDs Thuisca Spoison) ) XVR ( poison!
(35)
962
Subtracting the optimality conditions:
A( ((RR(Seeem) V'R
VMDDs st (Trixed:; Spoison) 7.MDs(Trrr Salean)
(36)
953
Since R. is pu--srongly convex, we obtain:
(VR((etteu)) VR (Sposson): Selean Sprison)
(37)
PR ||Seteam
Spoison 1
954
Then, we can obtain:
|| Setean - Spoisoul ||
V &&MMDDT Sclean)
V MMMD Tiixedd Spoison ||
APR
L L,MMD(TT. Tmixed)
(38)
APRR
Lyp(TE + +8
955
According to Assumption
MMD(Setcan Spoison)
- S Spoison| ||
L3 + 5)
(39)
< \t1
956
C Additional Experiments
957
In dataset condensation, simple architectures such as ConvNet AlexNetBN typically employed as condensation networks, rather than more complex models. This design choice is motivated by several factors. First, computational efficiency and stability: simpler networks are faster and less resource-intensive to train, which is essential given the iterative optimization cycles required in dataset condensation. In contrast, deeper architectures substantially increase computational cost and introduce greater instability during optimization. Second, optimization tractability: simple models
959
960
982
963
964
possess smoother and more navigable loss landscapes, facilitating the extraction of effective gradients from synthetic data. Complex architectures, with highly non-convex objectives, complicate this process and hinder optimization. Third, fairness and generality: the distilled data intended to generalize across a range of architectures. Relying on a highly specialized, deep network risks overfitting the synthetic data to its unique characteristics. Employing a lightweight, generic model encourages the generation of broadly transferable synthetic datasets.
985
966
968
24

---

970
To further substantiate the choice of AlexNetBN as the condensation network, we report additional experimental results in the appendix. While ConvNet is widely adopted in dataset condensation for its simplicity, NlexNetBN introduces greater depth and batch normalization, offering a complementary evaluation the distilled data's robustness and generalizability. These experiments assess whether the performance patterns observed with ConvNet persist under a moderately more complex architecture, thereby strengthening the evidence for the reliability of the distilled datasets.
971
973
974
975
976
C.1
Effectiveness on Different Datasets and Settings
Firstly, for completeness, we report the results of the Naive attack in Table
Table 6: Effectiveness on Different Datasets
SNEAKDOOR
NAIVE
Dataset
Method
CTA
ASR
CTA
ASR
DM
0.626:10.00
0,989=0.000
0.632:40.001
0.113:10012
DC
0.537:10.000 000
0.996=0.0000
0.552:10.001
0.102:10.007
CIFARIO
IDM
0.643-10.002
0.975=00001
0.652-10.001
0.103-10.006
DAM
0.59110.001
0.979=0.001
0.582+10.001
0.0861100003
DM
0.598
0.973=0.000
0.621
0.006
DC
0.565=+0.001
0.998=0.001
0.583
0.090=00007
STL10
IDM
0.658+0.001
0.979=0.001
0.667+0.001
0.102=000007
DAM
0.532+0.001
0.992-0.001
0.549+0.001
0.088+000009
DM
0.876+0.000 001
0,998=0.000
0.887#0.001
0.090=50.008
DC
0,851
0,09
0.857
0.086=
FMNIST
IDM
0.877=10.00
1.000
0.887
0.093
DAM
0.877110000
0.996=00000
0.88110.001
0.098
DM
0.800:10.000
1.000=0.000
0.7991100000
0.111
DC
0.687:100000
1.000=0.000
0.699
0.015
SVHN
IDM
0.831+0.0001
0.986=0.001
0.840+0.000
0.120
DAM
0.782++0.001
1.000=0.000
0.770+0.000
0.112-000066
DM
0.503+0,0001
1.000
+0.002
0.070+00.002
TINY IMAGENET
DC
0.432++.000
1.000=0.000
0.421+00.02
0.019=00000
IDM
0.517#0.0004
1.000=0.000
00.008
0.042:#0.004
DAM
0.482-t0.003
1.000=0.000
0.462+10.003
0.042:10.002
Table 7 and reports the ASR and CTA of different dataset condensation methods using A as the condensation network across multiple datasets. The results reveal how distilled data behaves
979
980
under both clean and backdoor settings when applied to AlexNetBN. This provides a comprehensive view of each attack's robustness and generalization in adversarial contexts.
981
Table Effectiveness Different Datasets condensed with AlexNetBN
SNEAKBOOR
NAIVE
DOORPING
Dataset
Method
CTA
ASR
ASR
CTA
DM
0.595110.001
0.947=0.004
0.60811.002
0.093:10.011
0.505110.001
1.000:10.000
DC
0.222+10001
0.003-0.001
0.140110.001
0.000-100000
0.31910.007
0.000=10.000
CIFAR10
IDM
0.700=20.002
0.946=0.003
0.739+00000
0.104=0.009
0.639=000003
1.000=00.000
DAM
0.606:+0.001
0.721=0.013
0.609+000001
0.096+00011
0.565=00.001
1.000=+0.000
DM
0.562++0.001
0.000
0.573:10.004
0.104
0.557==0.004
1.000=#0.000
DC
0.155.10.006
0.002
0.178:10.001
0.000110.000
0.278.10.003
1.000:10.000
STL.10
IDM
0.723+00.002 0.982
0.729+000003
0.100-+0.007
0.646+0.003
1.000++0.000
DAM
0.584:10.001
0.003
0.603-10.004
0.101 1000100
0.565
1.000
DM
0.822:10.000 0.000
0,844110.00
0.09010.010
1.000=100000 0.636:10.005
DC
0.287=00000 0.000=0.000
0.1724:0.00
0.320=200188
0.516::0.010
1.000=10.00
FMNIST
IDM
0.844:00.001
0.978=0.002
0.858=20.001
0.100:00003
0.736=0.000
1.000=00.000
DAM
0.831+00.003
0.000
0.821+0.002
0. 0.100+00.003
0.758-0.000
1.000++0.000
DM
0.622-10.020
1. 0.000
0.697-10.07
0.1241100066
0.774.10. 0.001
1.000
SVHN
DC
0.108:10.001
0.904
0.09510.001
0.019100010
0.379 006
1.000-10.000
IDM
0.880-10.001
0. 0.966=0.001
0.886:10.001
0.116:20010
0.781=0.002
1.000=10.000
DAM
0.672.10.006
0. 0.0000
0.701110.002
0.1 12010.0008
0.503
1.000-10.000
DM
0.463+0..02
0.913
0.457++0.003
0.01 +000002
0.485+0.002
1.000+0.000
TINY IMAGENET
DC
0.247+00.033
1.000=0.000
0.269
0.013-10.003
0.260=10.004
0.000=10.000 0.0
IDM
0.260-10.005
0, 0.063
0.284+0.007
0.000+00000
0.293+000006
1.000=+0.000
DAM
0.442+0.006
0.430++0.013
0.010+0.001
0.419+0.010
1.000++0.000
25

---

Table 8: Effectiveness Different Datasets condensed with AlexNetBN
SNEAKDOOR
SIMPLE
RELAX
Dataset
Method
CTA
ASR
CTA
ASR
CTA
ASR
DM
0.505110.001
0.047
0.581
0.183110.013
0.603110.001
0.704:10.022
DC
0.222+-0.001 0.003=0.001
0.169+0.002
0.000+0.000
0.152+0.001
0.047+0.018
CIFARIO
IDM
0,700++0.002
0.906=0.003
0.727+-0.001
0.146++0.009
0.252++0.002
0.636
DAM
0.606.10.001
0.001
0.584110.01
0.204:10.024
0.591110.002
0.978:10.004
DM
0.562-10.001
0.903=0.000
0.5441:.002
0.092:10.007
0.550
0.706:10000
DC
0.155=+00006
0.003=0.002
0.121+00008
0.144=#0003 0.117=00013
0.574=000036
STL10
IDM
0.723+00.002 0.986=0.002
0.724+0.003
0.102++0.013
0.719=0.002
0.668=0.0299
DAM
0.584+0..001
0.962
0.568 0.003
0.098 +0.010
0.566+0.005
0.872+0.002
DM
0.822-10.000
0.000
0.812110.006
0.952110.009
0.816110.003
1.000
DC
0.287=00.000 0.000=0.000
0.161+:00001
0.171=:00001 0.805
0.646=10.033
FMNIST
IDM
0.844.10.001
0.978
0.231 0.028
0.856:10.001
0.719:100115
DAM
0.831100.033
1.000=000000
0.806110.002
0.482.10.122 128
0.811::00002
1.000:10.000
DM
0.622+:0.200 1.000=0.000
0.484
0.071 000005
0.672-+0.000
0.978:200077
DC
0.108=000011
0.984=0.001
0.157+0.006
0.060=#0.006
0.137==00044
0.119=00027
SVHN
IDM
0.880+00.001 0.966
0.880+000011
0.118+0.008
0.874+0.001
1.000++0.001
DAM
0.672110.006
0.999
0.6931...006
0.092
0.692
0.906:10.003
DM
0.920=0.013 0.403:10.002
0.457-10.003
0.001
0.449
0.835:10.017
TINY IMAGENET
DC
0.247:10.003
1.000=0.000
0.000000008
0.000=#0.000
0.259
0.471=100023
IDM
0.260=10.005
0, 0.00=000013
0.307
0.053=+0008
0.313=00.077
0.759=000088
DAM
0.442100006
0.002=000100
0.44310.007
0.01310.002
0.44110.004
0.787:10.027
982
Moreover, we have expanded our evaluation in two key directions: (1) incorporating a larger, higher-
983
resolution dataset, ImageNette (resolution 3 224 x 224)), as shown in Table and (2) evaluating key parameters on STL10 (resolution 3 x 96 x 96), including ipc (the number of synthetic samples per clas). perturbation bound E, and poisoning ratio, as shown in Table TO
984
985
and [2]
986
Table 9 reports SNEAKDOOR'S 's attack performance under DM and DAM on the ImageNette dataset, demonstrating that SNEAKDOOR remains effective on higher-resolution, larger-scale data. Due to computational resources constraints, we could not include results for DC and IDM, as a single run
987
988
989
with DC or IDM takes about three to four days, making full tuning impractical. We plan to include
980
these results in a future version to provide a more complete picture of performance across algorithms
981
and settings.
Table 9: Attack Performance of SNEAKDOOR on the ImageNette Dataset.
Method
ASR
CTA
PNSR
SSIM
IS
DM
0.9809=0.0000
0.5625+0.00M
68.62
0.6673
2.25e-4
DAM
0.9429+0.0008
0.4598+0.0003
72.16
0.6814
2.08e-4
Table 10: Impact of IPC on Attack Performance
Method
ipc
ASR
CTA
PSNR
SSIM
IS
DM
10
0.8735 0009
0.4347=0.0003
73.0381
0.8211
9.05e-5
DM
20
0.9872+0.0M0 0000
0.4882+0.0000
73.5021
0.7950
1.32c-4
DM
50
0.9725 0.000
0.5979=0.0000
70.1216
0.8066
1.41c-4
IDM
10
0.9778+0..0 0015
0.5965=00.000
74.1393
0.8199
1.05c-4
IDM
20
0.9573+0. 0009
0,6217=0.000
73.9608
0.8049
2.39e-4
IDM
50
0.9790 0,00
0.6582=0.000
70.1
0.7554
1.40e-4
DAM
10
0.8910+0.00 0015
0.3678=0.000
73.6366
0.8106
9.21e-5
DAM
20
0.890240.0 0025
0.4522+0.000
00004
73.8535
0.8146
9.22e-5
DAM
50
0.991840. 0006
0.5324+0.0007
73.7877
0.8245
9.14e-5
DC
10
0.9258+0. 0035
0,4675=0.0005
73.1598
0,8072
9.54e-5
DC
20
0.924340. 0035
0.5282+0.0000
73.0987
0.8018
9.05e-5
DC
50
0.9975#0.00M
0.5653=0.0011
71.2365
0.7550
7.26e-5
As shown in Table 10 varying ipc notably affects CTA, while ASR and STE metrics (PSNR, SSIM, IS) remain relatively stable. This is expected, as fewer samples per class reduce the fidelity of clean distribution modeling, impacting generalization. In contrast, ASR stays high across ipc values, indicating that once embedded, the backdoor remains effective even with limited data. STE metrics also show minimal change, suggesting the perturbations remain visually subtle and robust.
983
985
996
997
As shown in Table TT increasing the perturbation bound e improves ASR but reduces STE, as reflected in lower PSNR, SSIM, and IS. This is expected, since larger e allows stronger and more
26

---

noticeable triggers, enhancing attack success at the expense of stealth. Notably, CTA remains stable
1000
across values, indicating that stronger triggers do not significantly harm generalization on clean
1001
data. These results highlight trade-off between ASR and STE controlled by
Table 11: Impact of Perturbation Bound & on Attack Performance
Method
ASR
CTA
PSNR
SSIM
IS
DM
0.1
0.775520.0044
0.604520.000$
82.1241
0,9548
2.97e-5
DM
0,933240.00 0006
0.582420.000
76.9565
0.8769
5.46e-5
DM
0.3
0.9732+0.000
0,5981=0.0010
74.0076
0.7963
6.32c-5
IDM
0.1
0,5400#0.00 0076
0.6627=0.0010
78.7475
0.7914
1.14c-4
IDM
0.2
0.7905+0 0073
0.6624#0.0013
76.4274
0.7931
1.30c-4
IDM
0.3
0.9790 0000
0.6582+0.0005
70.1548
0.8054
1.40e-4
DAM
0.6785 +0.022
0.5278=0.0012
82.0221
0.9594
3.06e-5
DAM
0.2
0.8715#0.0015
0.5389=0.0007
76.8882
0.8916
5.51e-5
DAM
0.3
0.9918#0 10006
0.5324+0.0007
73.7877
0.8245
9.14e-5
DC
0.1
0.6128
0.5743=0.0002
78.8841
0.7633
7.54e-5
DC
0,7828+0.0055
0.58#0.0011
73.3082
0.5337
1.06e-4
DC
0.3
0,9980 + 0.0010
0,5650#0.0010
71,2365
0.5551
7.25e-5
Table 12: Impact of Poisoning Ratio on Attack Performance
Method
poison ratio
ASR
CTA
PSNR
SSIM
IS
DM
0.10
0.8810=0.000 0020
0.5986+0..00
74.0086
0.8285
8.82c-5
DM
0.25
0.8970=0.0019
0.6009#0.000
73.7735
0.7942
9,55e-5
DM
0.5
0.9725=0.0000
0.5979#0.0000
73.0076
0.7963
1.14e-4
IDM
0.10
0.8205#0.0028
0.6645#0.0015
74.0362
0.7803
2.61e-4
IDM
0.25
0.8615=0.0044
0.6592+0.000 0007
70.2375
0.7788
1.33e-4
IDM
0.5
0.9790=0.0000
0.658240.000 0005
70.1548
0.7554
1.40e
DAM
0.10
0.5073=0.0035
0.552640.00%
74.2949
0.8200
8.10
DAM
0.25
0.7820=0.0017
0.548840.000
73.5737
0,8429
1.11e-4
DAM
0.5
0.991 19918=000000
0.5324+0.0007
73.7877
0.8245
9.14c-5
DC
0.10
0.7912=0.004
0.5745+0.000 0007
69.7258
0.5573
1.32c-4
DC
0.25
0.8627=0.003
0.5851+0.000
70.4030
0.5113
1.49c-4
0.5
0.9980=0.0010
0.5650+0.0010
71.2365
0.5551
7.25e-5
1002
increasing the poisoning ratio improves the ASR, which aligns with the intuition that more poisoned samples enhance the trigger's influence the condensed dataset. However, this improvement comes with slight degradation in CTA. Interestingly, the decline in CTA is relatively limited even at higher poisoning ratios (e.g., 0.5), suggesting that the trigger's 's interference with the clean distribution remains modest. Nevertheless, the reliance relatively high poisoning ratio to achieve optimal attack effectiveness highlights a limitation of the current approach.
As shown in Table 12,
1003
1005
1007
1008
C.2
Stealthiness on CIFAR1O, SVHN, and FMNIST
1009
We have included stealthiness for the remaining datasets, i.e. CIFAR10, SVHN, and FMNIST. These additional results offer a comprehensive assessment SNEAKDOOR' visual imperceptibility across diverse datasets. Notably, we omit the Inception Score (IS) evaluation for FMNIST because it is single-channel (grayscale) dataset, which incompatible with the standard IS computation that relies on pre-trained Inception network trained on RGB images. Applying IS directly to grayscale data would yield unreliable and uninformative results.
1010
1011
1012
1013
1014
1015
C.3
Effectiveness on Cross Architectures
1016
We further include cross-architecture evaluations with AlexNetBN. This setting tests the transferability of the backdoor attack moderately different network from the condensation model. The results offer additional evidence of the generalization and robustness of SNEAKDOOR across architectures.
1018
1019
This property critical for practical deployment in real-world scenarios.
1020
C.4
Visual Analysis of Trigger Stealthiness
1021
provide visualizations of original images after injecting the trigger during inference. Figure illustrates the effect following trigger injection. The images demonstrate the trigger's subtlety and
27

---

Table 13: PSNR, SSIM, and IS on CIFARIO, SVHN, and FMNIST
Method
Backdoor
CIFAR-10 SSIM
SVHN
FMNIST
PSNR
IS
PSNR
SSIM
IS
PSNR
SSIM
IS
SNEAKDOOR
73.94
0.61
5.80c-05
74.68
0.77
3.90e-05
58.41
0.39
Doorping
59.85
0.08
2.30c-04
60.27
0.08
2.08e-04
55.68
0.12
DM
Relax
60.97
-0.01
2.48c-04
61.47
-0.14
2.45c-04
51,88
-0.07
naive
63.67
0.15
3.56c-04
62.27
0.10
4.60c-04
54.15
0.10
Simple
60.98
0.69
8.10c-05
61.59
0.74
7.95e-05
54.01
0.00
SNEAKDOOR
70.48
0.46
7.10c-05
73.15
0.42
8.10c-05
57.39
0.24
Doorping
59.22
0.05
2.43c-04
61.25
0.06
2.00c-04
60.11
0.52
DC
Relax
61.37
0.04
2.38e-04
62.17
-0.04
2.43e-04
52.15
-0.11
naive
64,46
0.18
3.62e-04
60.45
0.04
4.92c-04
54.21
0.06
Simple
60.74
0.66
8.70c-05
61,44
0.72
8.08c-05
53.99
0.00
SNEAKDOOR
74.88
0.77
4.40c-05
72.19
0.68
6,30c-05
57.16
0.10
Doorping
59.23
0.10
2.23c-14
59.66
0.06
2.17c-04
57.26
0.06
IDM
Relax
61.18
0.02
2.46e-04
61.17
40.20
2.70c-04
52.04
-0.08
naive
64.23
0.14
3.44e-04
62.05
0.07
5.02e-04
54.15
0.05
Simple
61.05
0.69
8.60c-05
61.21
0.70
8.00c-05
54.23
0.00
SNEAKDOOR
74.40
0.74
4.50e-05
78,91
0.74
4.30e-05
57.39
0.24
Doorping
59.52
0.08
1.62e-04
59.67
0.08
1.05e-04
57.16
DAM
Relax
61.19
0.02
2.31e-04
62.36
-0.24
2.04c-04
51.83
-0.10
naive
62.99
0.13
4.53e-04
60.43
0.04
5.39c-04
55.07
0.12
Simple
60.85
0.64
8,70c-05
61.78
0.75
0.95e-05
54.07
0.00
Table 14: Cross-architecture CTA and ASR condensed with AlexNetBN
DM
DC
IDM
DAM
Network
CTA
ASR
CTA
ASR
CTA
ASR
CTA
ASR
VGG11
0.54410.000 0.90100.000
0.209.00.000
10.000
0.673.10.000
0..05
0.542.10.000
0.733.10.00
CIFARIO
ResNet
0.495=0.001
0.915+00.002
0.186=0.000
0.009++0.000
0.671+000011
0.926++0.00
0.500=0.001
0,491++0.001
ConvNet
0.585
1.807200.00
0.216::0.001
0.004410.000
0.638100.001
1.951:10.002
0.582
0..07
VGGI1
0.527=0.00-
0.921=00000
0.195=0.001
0.011::0.001
0.694+0.000
0,947=0.000 002
0.924 0,547=0.000 001
STL10
ResNet
0.413+000011
0.999+00.000
0.000000001
1+00000
0.644++0.001
+0.00+
0.445+0.002
0.995-+0.000
ConyNet 0.532-0..000
0.841
0.180.10.000
0..025
0.55510.001
0.997
VGG11
0.407
1.920.10.000
0.174.10.002
0.0000
0.405
0.588 0.0024
0.437 0.0002
0.960.10.000
TINY IMAGENET
ResNet 0.361:0.002
0.80010.000
0.227-0.002
0.716:10.008
0.228:10.004
0.360:10.036
0.39110.000
1.000.1.000
ConyNet 0.443=0.003
0.604=0.000
0.217=0.003
0.932+0.010
0.335+00.009
0.604=0.015
0.430=0.000
0.884+00015
1025
stealthiness. Changes to the original images are minimal and barely perceptible. Despite this, the
1024
trigger effectively activates the backdoor the model. These visual results emphasize the challenge of detecting such backdoors through simple inspection. They also underscore the importance of robust defenses against stealthy triggers.
1025
1026
1027
C.5
Hyper-parameter Settings
1028
We have provided the full set of optimization hyperparameters used for SNEAKDOOR on the STL10 dataset across four condensation baselines: DM, DC, IDM, and DAM, including learning rates. number of epochs, batch sizes, etc. These details are listed in Tab.5 Tab.8, allowing replication of our experiments. In addition, we will release the full source code in future version of the paper. This will include the complete training pipeline for both the trigger generator and dataset condensation procedures. Our goal to ensure that the community can easily reproduce and extend our work.
1029
1030
1031
1032
1033
1034
The overall method is divided into four stages:
1035
1. Training the Surrogate Model. The surrogate model serves two key purposes: (i) estimating inter-class boundary vulnerability (ICBV), and (ii) guiding the training of the trigger generator.
1036
1037
2. Training the Trigger Generator Gg. The generator learns to produce input- perturbations that cause misclassification.
1038
1039
3. Malicious Condensation. This phase incorporates the trigger signal into the synthetic dataset via a standard condensation framework.
1040
1041
Downstream Model Training. Standard training on the poisoned condensed dataset using typical optimization settings.
28

---

Clean
Backdoored
DM
DC
DAM
IDM
Figure STL10 Stealthiness Illustration
Table 15: Hyperparameters for Surrogate Model Training
Hyperparameter
Value
Optimizer
SGD
Batch size
256
Learning rate
0.01
Momentum
0.9
Weight decay
0.0005
Epochs
50
Table 16: Hyperparameters for Trigger Generator Training
Hyperparameter
Value
Learning rate
5e-5
Perturbation scaling factor
0.25
Maximum perturbation bound
0.5
Table 17: Hyperparameters for Malicious Dataset Condensation
Hyperparameter
Value
Images per class (IPC)
50
Condensation epochs
20000
Synthesis learning rate
1.0
Batch size
256
Optimizer
Adam
Table Hyperparameters for Downstream Model Training
Hyperparameter
Value
Optimizer
SGD
Batch size
256
Learning rate
0.01
Momentum
0.9
Weight decay
0.0005
Epochs
10000
29


Reviews:
[{"review_id": "NeGUGUSzqx", "reviewer": "Reviewer_sBUz", "summary": "This paper introduces SNEAKDOOR, a novel framework for stealthy backdoor attacks targeting distribution matching-based dataset condensation pipelines.  Dataset condensation aims to synthesize compact datasets that retain the training efficacy of full-scale data, but this process is vulnerable to backdoor attacks.  SNEAKDOOR addresses the challenge of balancing attack success rate (ASR), clean test accuracy (CTA), and stealthiness (STE), which prior methods often fail to achieve.  By leveraging input-aware trigger generation and exploiting inter-class boundary vulnerabilities, SNEAKDOOR creates imperceptible triggers aligned with local feature geometry, ensuring minimal visual and statistical detectability.  The triggers are embedded into the condensed dataset, enabling downstream models to exhibit malicious behavior while maintaining generalization to clean inputs.  Extensive experiments across multiple datasets and architectures demonstrate that SNEAKDOOR achieves superior performance in ASR, CTA, and STE compared to existing methods, while remaining robust against various defense mechanisms. \n\nThe paper provides a theoretical analysis of SNEAKDOOR’s stealth properties, showing that the perturbations introduced by the triggers remain tightly coupled to clean data manifolds in feature space, limiting their detectability.  Empirical evaluations highlight SNEAKDOOR’s effectiveness across diverse datasets, including CIFAR-10, FMNIST, STL-10, SVHN, and Tiny-ImageNet, and multiple condensation baselines such as DM, DC, IDM, and DAM.  The framework also demonstrates strong cross-architecture generalization and resilience against state-of-the-art defenses.  By systematically optimizing the ASR–CTA–STE trade-off, SNEAKDOOR reveals critical vulnerabilities in dataset condensation pipelines and underscores the need for tailored defense mechanisms to safeguard synthetic data regimes.", "questions": "Please address the weaknesses.", "limitations": "The most critical point of the work is the unrealistic setting of the adversary, making the threat model impractical.", "rating": 2, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "## Strengths\n\n- The proposed method explores a new effective poisoning attack toward the data condensation domain, which achieves high ASRs while maintaining high conventional task accuracy.\n- Extensive theoretical analysis and experimental results are conducted to provide a thorough study of the proposed attack.\n- The paper is well-written and easy to follow.\n\n## Weaknesses\n\n- Lake of proofs for Theorems 1 and 2, which cannot be validated.\n- The setting assumes a very strong adversary who has access to the data and also has knowledge about the target models. This is a critical point since the attack is not practical to be considered as a real threat.", "was_revised": false, "final_justification": "", "rebuttal": "*Q1*: Lake of proofs for Theorems 1 and 2, which cannot be validated.\n\n*A1*: We would like to clarify that formal statements of the assumptions, intermediate lemmas, and full proofs supporting Theorems 1 and 2 are provided in ***Appendix B of the submission***.\n\n*Q2*: The setting assumes a very strong adversary who has access to the data and also has knowledge about the target models. This is a critical point since the attack is not practical to be considered as a real threat.\n\n*A2*: The adversary in our setting has ***access only to the training data and condensation pipeline***, which we argue is realistic for the following reasons:\n\n(1) ***Supported by prior work***: Several studies adopt similar threat models, including DOORPING [1], Relax-Trigger [2], RDM-DC [3], and Adaptive Backdoor Attacks on Dataset Distillation [4].\n\n(2) ***Real-world scenarios***:\n\nOutsourced condensation: The attacker serves as a distillation provider; the victim either outsources condensation or purchases pre-synthesized condensed data [1].\n\nFederated learning: A malicious client can inject triggers into local condensed data, later aggregated into the global model [4].\n\nContinual learning and machine unlearning: Pretrained condensed datasets reused in these workflows can carry backdoors if released by an attacker [5, 6].\n\nThese scenarios demonstrate that our threat model is both grounded and practically relevant.\n\n[1] Liu et al., Backdoor attacks against dataset distillation, NDSS 2023.\n\n[2] Chung et al., Rethinking Backdoor Attacks on Dataset Distillation: A Kernel Method Perspective, ICLR 2024.\n\n[3] Zheng et al., RDM-DC: poisoning resilient dataset condensation with robust distribution matching, UAI 2023.\n\n[4] Chai et al., Adaptive Backdoor Attacks Against Dataset Distillation for Federated Learning, ICC 2024.\n\n[5] Yang E, et al. An efficient dataset condensation plugin and its application to continual learning[J]. NIPS 2023.\n\n[6] Khan J I. Dataset condensation driven machine unlearning[J]. arXiv 2024."}, {"review_id": "HJfQVAn9fF", "reviewer": "Reviewer_uzHd", "summary": "This paper focused on a critical gap in existing methods, which often prioritize attack success rate (ASR) and clean test accuracy (CTA) but fall short in preserving stealthiness (STE) – the visual and statistical imperceptibility of the attacks. It proposed a system called SNEAKDOOR to address this by exploiting the inherent vulnerability of class decision boundaries and incorporating a generative module ($G_\\phi$) to construct input-aware triggers that are aligned with local feature geometry, thereby minimizing detectability. The proposed method achieves a compelling balance across ASR, CTA, and STE, demonstrated through extensive experiments on multiple datasets and condensation methods, and is further supported by theoretical analysis in Reproducing Kernel Hilbert Space (RKHS).", "questions": "* In Eq 7, it seems that the $x\\in T$ should be $x\\in T_{y_s}$. Is that correct?\n* How is the constaint maximum permissible perturbation in Eq 6 implemented in the loss in Eq 7?\n* Does the procedure need to train a $G_\\phi$ for each pair of classes $<i, j>$?", "limitations": "The author donot provide limitation analysis.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "## Strengths\n\n* Stealth-First Design: SNEAKDOOR uniquely prioritizes stealth (STE), a facet often ignored by prior backdoor attacks in dataset condensation. It strikes a superior balance of ASR, CTA, and STE versus Naive, Doorping, Simple-Trigger, and Relax-Trigger—validated by PSNR, SSIM, and Inception Score.\n* Robust Empirical Evidence: Extensive evaluations on datasets across multiple condensation schemes and downstream models—show SNEAKDOOR consistently achieves high ASR, competitive CTA, and markedly better stealth, as illustrated by radar plots.\n* Rigorous Theoretical Guarantees: Formal analysis in RKHS  bounds feature-manifold deviations under poisoning and the gap between poisoned and clean condensed sets, ensuring latent-space alignment and distributional consistency of triggers to limit detectability.\n\n\n## Weaknesses\n\n* Redundant “Inter-Class Boundary Vulnerability” Concept: Its empirical value boils down to misclassification rate—relabeling this metric adds no substantive contribution.\n* Limited Novelty: Attack in the class boundary is not new in Attacking. \n* Lack of Limitations Discussion: Marking the limitations section as “[NA]” is unrealistic; every study has caveats that warrant acknowledgment.\n* Weak Broader Impact Statement: Claiming “no potential negative societal impact” for a backdoor attack overlooks its clear misuse risks (e.g., disinformation, surveillance, system compromise); a responsible paper must address these and suggest mitigation strategies.\n* No Safeguards Proposed: Asserting “no risk of misuse” ignores the inherent dangers of backdoor techniques; the paper should outline defenses or best practices to prevent abuse.", "was_revised": true, "final_justification": "The authors have addressed all my concerns, and major flaws were recognized and corrected in the rebuttal. However, the theoretical foundation of the proposed method should be restated beyond the ICBV framework. Therefore, I recommend a score of 4.", "rebuttal": "Thank you for raising these important points that contribute to the completeness of our study. \n\n*Q1*: Redundant “Inter-Class Boundary Vulnerability” Concept: Its empirical value boils down to misclassification rate—relabeling this metric adds no substantive contribution.\n\n*A1*: ***Our primary contribution is to address a critical and underexplored challenge in dataset condensation: achieving a balanced trade-off among Attack Success Rate (ASR), Clean Test Accuracy (CTA), and Stealthiness (STE).*** Optimizing STE is particularly difficult, as subtle perturbations may be suppressed during condensation, while stronger triggers can introduce visible artifacts that expose the attack.\n\nWhile the empirical approximation of Inter-Class Boundary Vulnerability (ICBV) involves counting misclassifications from source class $i$ to target class $j$, its conceptual formulation is fundamentally distinct from a raw misclassification rate. Specifically, ICBV offers a theoretically grounded measure of the overlap between class-conditional feature distributions and decision regions. This integral quantifies the intrusion of class $i$ into the decision region of class $j$, providing a feature-space view of the model vulnerability that extends beyond the misclassification counts at the surface level. To facilitate practical estimation, we employ a Monte Carlo approximation that approximates directional misclassification rates. However, our use of confusion matrix entries is not as a generic performance indicator, but rather as empirical estimators of the model’s internal decision geometry. In summary, although ICBV’s empirical estimation aligns numerically with directional misclassification counts, its purpose and formulation are distinct.\n\n*Q2*: Limited Novelty: Attack in the class boundary is not new in Attacking.\n\n*A2*: Our contribution is novel in three key aspects:\n\n(1) ***An underexplored challenge:*** Achieving a well-calibrated trade-off among Attack Success Rate (ASR), Clean Test Accuracy (CTA), and Stealthiness (STE).\n\n(2) ***First use of boundary vulnerability to guide stealthy attacks in dataset condensation:*** While decision boundaries have appeared in prior work, we are the first to leverage inter-class boundary vulnerability as a means to guide input-aware trigger generation in the dataset condensation setting. We utilize inter-class boundary sensitivity not as the primary novelty, but as a mechanism to identify vulnerable class pairs that enable stronger attacks with minimal perturbation.\n\n(3) ***A more generalizable design:*** SNEAKDOOR does***not restrict itself to ambiguous samples near the decision boundary***. Instead, it leverages the entire source class distribution to design input-aware perturbations. This broader utilization ensures that the learned triggers remain effective and transferable across semantically diverse samples within the source class.\n\n*Q3*: Lack of Limitations Discussion: Marking the limitations section as “[NA]” is unrealistic; every study has caveats that warrant acknowledgment.\n\n*A3*: One limitation of Sneakdoor is that, while it achieves the best overall balance across ASR, CTA, and STE, it does not consistently outperform existing methods on any single metric. In some cases, baseline approaches such as DOORPING can achieve higher ASR or CTA when considered in isolation. This trade-off highlights the inherent difficulty of simultaneously optimizing multiple objectives and suggests that future work should explore strategies to enhance individual metric performance without compromising stealthiness or CTA. Further refinement may lead to more adaptable backdoor attacks tailored to specific deployment or threat scenarios.\n\n*Q4*: Weak Broader Impact Statement: Claiming “no potential negative societal impact” for a backdoor attack overlooks its clear misuse risks (e.g., disinformation, surveillance, system compromise); a responsible paper must address these and suggest mitigation strategies.\n\n*A4*: Backdoor attacks against dataset condensation pose significant risks given the growing use of condensed datasets in privacy-sensitive or resource-constrained settings such as outsourced data compression, federated learning, machine unlearning, and continual learning. For instance, in continual learning systems deployed in edge AI applications, such as autonomous vehicles or medical diagnosis assistants, lightweight condensed datasets enable efficient model updates without full retraining. If an adversary injects imperceptible backdoor triggers into this data, the resulting models may misclassify critical inputs (*e.g*., road signs or tumor types), leading to serious safety and ethical consequences. \n\nGiven these risks, the responsible disclosure of such attacks is essential. The goal of our work is to expose vulnerabilities in distribution-matching-based condensation methods to inform the design of more effective defenses. To mitigate misuse, we recommend: (1) incorporating robust anomaly detection and certified defenses during condensation; (2) encouraging transparency and reproducibility in condensation pipelines; and (3) enforcing rigorous provenance tracking to dataset generation processes. Our findings serve both as a cautionary signal and a foundation for developing secure and resilient dataset condensation techniques.\n\n*Q5*: No Safeguards Proposed: Asserting “no risk of misuse” ignores the inherent dangers of backdoor techniques; the paper should outline defenses or best practices to prevent abuse.\n\n*A5*: The primary contribution of our proposed SNEAKDOOR is to expose vulnerabilities in distribution-matching-based condensation methods.***Our work lays the groundwork for understanding the attack surface and limitations of current defenses***, enabling the community to proactively build secure and trustworthy dataset condensation frameworks. We consider defense development a critical direction for future research.\n\n*Q6*: In Eq 7, it seems that the $x \\in \\mathcal{T}$ should be $x \\in \\mathcal{T}_y$. Is that correct?\n\n*A6*: The generator is specifically trained on samples from the source class. Therefore, you are correct that the notation in Eq. (7) should be $x \\in \\mathcal{T}_{y_s}$, indicating that $x$ is sampled from the source class data. We appreciate your careful reading and will revise the notation accordingly to avoid confusion.\n\n*Q7*: How is the constaint maximum permissible perturbation in Eq 6 implemented in the loss in Eq 7?\n\n*A7*: The maximum permissible perturbation constraint in Eq.(6) is enforced by applying a clamping operation to the generator output $G_\\phi(x)$ before adding it to the original input. Specifically, the adversarial noise is clamped such that its $\\ell_\\infty$-norm lies within the range $[-\\varepsilon, \\varepsilon]$, ensuring the perturbation remains imperceptible. This clamped noise is then added to the clean image, followed by another clamping step to maintain the pixel values within the valid image range. The loss in Eq.(7) is computed on these clamped, perturbed images, allowing the generator to be implicitly optimized under the perturbation constraint without the need for an explicit penalty term in the objective.\n\n*Q8*: Does the procedure need to train a $G_\\phi$ for each pair of classes $<i, j>$?\n\n*A8*: The procedure does not require training a separate generator $G_\\phi$ for every possible class pair $\\langle i, j \\rangle$. Instead, once a target label $y_\\tau$ is selected, we compute the Inter-Class Boundary Vulnerability (ICBV) to identify the most vulnerable source class $y_s$ with respect to $y_\\tau$. We then focus on this single pair $\\langle y_s, y_\\tau \\rangle$ and train a generator $G_\\phi$ specifically to generate input-aware triggers for this source-to-target transition."}, {"review_id": "XCLoiBvCxz", "reviewer": "Reviewer_SAvW", "summary": "By identifying the source-target pair in a given dataset with the greatest level of vulnerability, Sneakdoor finds where an attack can be effectively created against a compressed dataset (meant to more cheaply/privately train an equivalent model to one trained on a larger dataset). An optimized trigger is generated and applied to images that, by running through the dataset compression process, can allow for nearly-imperceptible control of models trained on that dataset.", "questions": "1. In Lines 62-64, can you explain why this work is more \"systematic\" than that done in previous attack work (e.g. Doorping, Chung et al.'s kernel backdoors...)?\n2. Why define poisoning ratio as the fraction of generated triggered images? This is unconventional and makes it harder to reason about the total poisoned fraction\n3. \"These failures are infrequent and do not substantially affect the overall robustness of SNEAKDOOR.\" How frequent are they actually?\n4. In Pg. 8's Tab. 2, are the ConvNets excluded because they were the base models that the dataset compression happened with?", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "## Strengths\n1. The paper is very well presented and laid out -- the maths are clear and easy to follow.\n2. The contribution is meaningful. As dataset compression grows, more effort must be put into researching its vulnerabilities, and this is a substantial advancement on the existing standards.\n\n## Weaknesses\n1. A major assumption is that the attacker gets to pick any target and source class. However, this is not necessarily the case in the real world, where the attacker may way to change particular targets and sources (e.g. shifting \"Stop Sign\" to \"Speed Limit: 60 mph\" rather than \"Speed Limit: 50 mph\" to \"Speed Limit: 60 mph\" -- one of these allows much more dangerous things to happen as a result. Ablations seem to indicate that a fairly large part of the attack's strength is coming from this assumption.\n2. This method is only tested on small datasets with no ablations over poisoning ratios or other key variables of the training set-up, so any conclusions that can be made are limited.", "was_revised": true, "final_justification": "Reading other discussion, I remain convinced of the paper's meaningful and novel contribution. A number of weaknesses were described and discussed by myself and other reviewers; however, I do not believe these compromise the novelty of this work.", "rebuttal": "We sincerely thank the reviewer for their thoughtful reading of our paper and for providing insightful suggestions that have helped us reflect more deeply on our work.\n\n*Q1*: A major assumption is that the attacker gets to pick any target and source class. However, this is not necessarily the case in the real world, where the attacker may way to change particular targets and sources.\n\n*A1*: SNEAKDOOR targets a specific attack scenario where ***the attacker seeks to induce arbitrary inputs to be misclassified as a fixed target class, regardless of their source class.*** For instance, in industrial visual inspection systems, an attacker may aim to cause all defective items to be classified as ''qualified'', thereby evading quality control. In such cases, the attack objective is not to manipulate specific source-to-target class mappings (*e.g.*, scratch to dent), but to force predictions toward a benign class. Our experiments demonstrate that SNEAKDOOR performs reliably under this single-target setting.\n\nThat said, ***we acknowledge that SNEAKDOOR does not encompass all real-world threats***. In certain tasks, the attacker may indeed aim for precise source-to-target manipulations—such as changing “Stop Sign” into “Speed Limit: 60 mph” to avoid stopping, which poses serious safety risks. In such cases, the attack's effectiveness may diminish. This constitutes a limitation of our method in terms of applicability.\n\n*Q2*: This method is only tested on small datasets with no ablations over poisoning ratios or other key variables of the training set-up, so any conclusions that can be made are limited.\n\n*A2*: To address this concern, we have expanded our evaluation in two key directions: (1) ***incorporating a larger, higher-resolution dataset***, ImageNette (resolution $3\\times224\\times224$), as shown in Table 1, and (2)***evaluating key parameters*** on STL10 (resolution $3\\times96\\times96$), including ***ipc*** (the number of synthetic samples per clas), ***perturbation bound $\\varepsilon$***, and ***poisoning ratio***, as shown in Table 2-4.\n\nTable 1 reports SNEAKDOOR’s attack performance under DM and DAM on the ImageNette dataset, demonstrating that ***SNEAKDOOR remains effective on higher-resolution, larger-scale data***. Due to computational resource constraints,  we could not include results for DC and IDM, as a single run with DC or IDM takes about three to four days, making full tuning impractical. We plan to include these results in a future version.\n\n*Table 1: Attack Performance of SNEAKDOOR on the ImageNette Dataset*\n\n|Method|ASR $\\uparrow$|CTA $\\uparrow$|PNSR $\\uparrow$|SSIM $\\uparrow$|IS $\\downarrow$|\n|------|----|----|-----|-----|------|\n|DM|0.9809±0.0000|0.5625±0.0007|68.62|0.6673|2.25e-4|\n|DAM|0.9429±0.0008|0.4598±0.0003|72.16|0.6814|2.08e-4|\n\nAs shown in Table 2, varying ipc notably affects CTA, while ASR and STE metrics (PSNR, SSIM, IS) remain relatively stable. This is expected, as fewer samples per class reduce the fidelity of clean distribution modeling, impacting generalization. In contrast, ASR stays high across IPC values, indicating that once embedded, the backdoor remains effective even with limited data. STE metrics also show minimal change, suggesting the perturbations remain visually subtle and robust.\n\n*Table 2: Impact of ipc on Attack Performance*\n\n|Method|ipc|ASR $\\uparrow$|CTA $\\uparrow$|PNSR $\\uparrow$|SSIM $\\uparrow$|IS $\\downarrow$|\n|------|---|----|----|-----|-----|-----|\n|DM|10|0.8735±0.0009|0.4347±0.0003|73.0381|0.8211|9.05e-5|\n|DM|20|0.9872±0.0005|0.4882±0.0008|73.5021|0.7950|1.32e-4|\n|DM|50|0.9725±0.0000|0.5979±0.0006|70.1216|0.8066|1.41e-4|\n|IDM|10|0.9778±0.0015|0.5965±0.0004|74.1393|0.8199|1.05e-4|\n|IDM|20|0.9573±0.0009|0.6217±0.0006|73.9608|0.8049|2.39e-4|\n|IDM|50|0.9790±0.0009|0.6582±0.0005|70.1548|0.7554|1.40e-4|\n|DAM|10|0.8910±0.0015|0.3678±0.0006|73.6366|0.8106|9.21e-5|\n|DAM|20|0.8902±0.0025|0.4522±0.0004|73.8535|0.8146|9.22e-5|\n|DAM|50|0.9918±0.0006|0.5324±0.0007|73.7877|0.8245|9.14e-5|\n|DC|10|0.9258±0.0035|0.4675±0.0006|73.1598|0.8072|9.54e-5|\n|DC|20|0.9243±0.0035|0.5282±0.0002|73.0987|0.8018|9.05e-5|\n|DC|50|0.9975±0.0008|0.5653±0.0011|71.2365|0.7550|7.26e-5|\n\nAs shown in Table 3, increasing the perturbation bound $\\varepsilon$ improves ASR but reduces STE, as reflected in lower PSNR, SSIM, and Inception Score. This is expected, since a larger $\\varepsilon$ allows stronger and more noticeable triggers, enhancing attack success at the expense of stealth. Notably, CTA remains stable across $\\varepsilon$ values, indicating that stronger triggers do not significantly harm generalization on clean data. These results highlight a trade-off between ASR and STE controlled by $\\varepsilon$.\n\n*Table 3: Impact of $\\varepsilon$ on Attack Performance*\n\n|Method|$\\varepsilon$|ASR $\\uparrow$|CTA $\\uparrow$|PNSR $\\uparrow$|SSIM $\\uparrow$|IS $\\downarrow$|\n|------|--|----|----|-----|-----|-----|\n|DM|0.1|0.7755±0.0049|0.6045±0.0009|82.1241|0.9548|2.97e-5|\n|DM|0.2|0.9332±0.0006|0.5824±0.0008|76.9565|0.8769|5.46e-5|\n|DM|0.3|0.9732±0.000|0.5981±0.0010|74.0076|0.7963|6.32e-5|\n|IDM|0.1|0.5400±0.0076|0.6627±0.0010|78.7475|0.7914|1.14e-4|\n|IDM|0.2|0.7905±0.0073|0.6624±0.0013|76.4274|0.7931|1.30e-4|\n|IDM|0.3|0.9790±0.0009|0.6582±0.0005|70.1548|0.8054|1.40e-4|\n|DAM|0.1|0.6785±0.0022|0.5278±0.0012|82.0221|0.9594|3.06e-5|\n|DAM|0.2|0.8715±0.0015|0.5389±0.0007|76.8882|0.8916|5.51e-5|\n|DAM|0.3|0.9918±0.0006|0.5324±0.0007|73.7877|0.8245|9.14e-5|\n|DC|0.1|0.6128±0.004|0.5743±0.0002|78.8841|0.7633|7.54e-5|\n|DC|0.2|0.7828±0.0056|0.58±0.0011|73.3082|0.5337|1.06e-4|\n|DC|0.3|0.9980±0.0010|0.5650±0.0010|71.2365|0.5551|7.25e-5|\n\nAs shown in Table 4, increasing the poisoning ratio improves the ASR, which aligns with the intuition that more poisoned samples enhance the trigger’s influence in the condensed dataset. However, this improvement comes with a slight degradation in CTA. Interestingly, the decline in CTA is relatively limited even at higher poisoning ratios (e.g., 0.5), suggesting that the trigger's interference with the clean distribution remains modest. Nevertheless, the reliance on a relatively high poisoning ratio to achieve optimal attack effectiveness highlights a limitation of the current approach.\n\n*Table 4: Impact of Poisoning Ratio on Attack Performance*\n\n|Method|poisonratio|ASR $\\uparrow$|CTA $\\uparrow$|PNSR $\\uparrow$|SSIM $\\uparrow$|IS $\\downarrow$|\n|------|------------|----|----|-----|-----|-----|\n|DM|0.10|0.8810±0.0020|0.5986±0.001|74.0086|0.8285|8.82e-5|\n|DM|0.25|0.8970±0.0019|0.6009±0.0009|73.7735|0.7942|9.55e-5|\n|DM|0.5|0.9725±0.0000|0.5979±0.0006|73.0076|0.7963|1.14e-4|\n|IDM|0.10|0.8205±0.0026|0.6645±0.0015|74.0362|0.7803|2.61e-4|\n|IDM|0.25|0.8615±0.0044|0.6592±0.0007|70.2375|0.7788|1.33e-4|\n|IDM|0.5|0.9790±0.0009|0.6582±0.0005|70.1548|0.7554|1.40e-4|\n|DAM|0.10|0.5073±0.0035|0.5526±0.0003|74.2949|0.8200|8.10e-5|\n|DAM|0.25|0.7820±0.0017|0.5488±0.0006|73.5737|0.8429|1.11e-4|\n|DAM|0.5|0.9918±0.0006|0.5324±0.0007|73.7877|0.8245|9.14e-5|\n|DC|0.10|0.7912±0.0041|0.5745±0.0007|69.7258|0.5573|1.32e-4|\n|DC|0.25|0.8627±0.0031|0.5851±0.0005|70.4030|0.5113|1.49e-4|\n|DC|0.5|0.9980±0.0010|0.5650±0.0010|71.2365|0.5551|7.25e-5|\n\n*Q3*: In Lines 62-64, can you explain why this work is more \"systematic\" than that done in previous attack work (e.g. Doorping, Chung et al.'s kernel backdoors...)?\n\n*A3*: We acknowledge that the term ''systematic'' in Lines 62–64 may be imprecise and potentially misleading. Our primary contribution lies ***not in broader attack coverage, but in explicitly balancing ASR, CTA, and particularly STE, which is critical for real-world viability.*** Prior backdoor attacks against dataset condensation, such as Doorping and Chung et al.'s kernel-based method, mainly prioritize ASR or CTA while often neglecting stealthiness. In contrast, SNEAKDOOR incorporates STE as one of the core design objectives, ensuring visual and statistical imperceptibility. We will revise the phrasing in future versions to better reflect this intent.\n\n*Q4*: Why define poisoning ratio as the fraction of generated triggered images? This is unconventional and makes it harder to reason about the total poisoned fraction\n\n*A4*: This was a definitional oversight in the manuscript. In our experiments, the poisoning ratio was computed according to standard practice, defined as the proportion of poisoned samples relative to the entire training set. We will clarify this in future revisions to ensure consistency with established literature. Moreover, related codes will also be released to support transparency and reproducibility.\n\n*Q5*: \"These failures are infrequent and do not substantially affect the overall robustness of SNEAKDOOR.\" How frequent are they actually?\n\n*A5*: In Pg. 8's Tab. 2, SNEAKDOOR is evaluated across 36 cross-architecture scenarios. Among these, 14 exhibit ASR below 90%, including 8 cases involving DC. Prior studies and our results show that DC often produces lower-quality condensed data, as reflected by its relatively low CTA. This suggests that ***the reduced ASR is primarily due to DC’s limited capacity to preserve both task-relevant and backdoor-relevant information, rather than a weakness in the attack itself.*** Excluding DC, only 6 out of 27 scenarios fall below 90% ASR, indicating that SNEAKDOOR remains consistently effective when the condensation quality is sufficient. \n\n*Q6*: In Pg. 8's Tab. 2, are the ConvNets excluded because they were the base models that the dataset compression happened with?\n\n*A6*: In Pg. 8's Tab. 2, ConvNets are excluded because we specifically evaluate SNEAKDOOR ***in a cross-architecture setting, where the downstream model differs from the one used during dataset condensation.*** This setting is essential for assessing the transferability and robustness of the backdoor under realistic threat models, where the attacker does not know the exact architecture used for downstream training."}, {"review_id": "Xx8K2m69YJ", "reviewer": "Reviewer_ZhD2", "summary": "This paper proposes Sneakdoor to maintain the effectiveness of backdoor attacks while preserve stealthiness of the poisoned data in dataset condensation. They exploit the inherent vulnerability of class decision boundaries and incorporate a generative module to constructs input-aware triggers to achieve the imperceptible perturbations. Extensive experiments show that Sneakdoor consistently performs well across different data condensation methods and datasets.", "questions": "Please see the questions in the weakness and the following:\n- Could authors explain the necessity of optimizing a generative model $G$ instead of directly applying noise to the sample using methods like FGSM [1]?\n- How do you control the $\\epsilon$ in the optimization? Are you using clip function?\n\n\n[1] Goodfellow, Ian J., Jonathon Shlens, and Christian Szegedy. \"Explaining and harnessing adversarial examples.\" ICLR 2015.", "limitations": "Trigger optimization requires knowledge of the victim architecture. However, it is unclear whether the attack remains effective when the architecture used during optimization differs from the actual victim model.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strength:\n- The class pair selection and input-aware trigger generation are simple yet effective, and potentially applicable to other methods.\n- Experiments are thorough, covering diverse datasets and condensation methods.\n\nWeakness:\n- Missing results of stealthiness: while the authors evaluate on 5 datasets, they only provide the results for stealthiness on STL10 and Tiny-ImageNet.\n- Unclear component combination: the class pair selection and input-aware trigger generation are not explicitly designed to complement each other. However, the ablation study suggests that stealthiness emerges only when both are combined, which contradicts the intended modular design, where each component is expected to independently contribute to stealthiness.\n- Reproducibility: as authors have not uploaded the code and the hyperparameters are not provided, it is not reproducible. Could the authors provide details of the optimization hyperparameters such as $\\epsilon$, learning rate and epochs?", "was_revised": true, "final_justification": "Overall, I think the problem of Stealthy Backdoors is important, and the proposed method is both intuitive and effective. I raise my score to 4.\n\nHowever, the authors should improve the clarity of the threat model and the experimental setup, incorporating all aspects of our discussion, a lot details are missing including almost all hyperparameters. Reviewer uzHd also points out that discussing the limitations is important, even if your method does not outperform others in every metric.\n\nFor the rebuttal: the authors should avoid using phrases like “We have provided” when referring to results that are not in the paper but only in the rebuttal. Simply acknowledging the missing results and presenting them is more appropriate and polite.", "rebuttal": "We truly appreciate the reviewer’s careful reading and thoughtful feedback.\n\n*Q1*: Missing results of stealthiness: while the authors evaluate on 5 datasets, they only provide the results for stealthiness on STL10 and Tiny-ImageNet.\n\n*A1*: We have included stealthiness for the remaining datasets, *i.e.*, CIFAR10, SVHN, and FMNIST. Due to policy restrictions, we are unable to include visual samples directly, but we have provided the full quantitative results in tabular format. These additional results offer a comprehensive assessment of SNEAKDOOR's visual imperceptibility across diverse datasets. Notably, we omit the Inception Score (IS) evaluation for FMNIST because it is a single-channel (grayscale) dataset, which is incompatible with the standard IS computation that relies on a pre-trained Inception network trained on RGB images. Applying IS directly to grayscale data would yield unreliable and uninformative results. Therefore, we only report PSNR and SSIM for FMNIST, which are more appropriate for evaluating perturbation perceptibility in single-channel image settings.\n\n|Method|Backdoor| |CIFAR-10| | |SVHN| | |FMNIST| |\n|:------:|:----------|:--------------------:|:--------------:|:-----------:|:-------------------:|:--------------:|:-----------:|:------------------:|:--------------:|:-----------:|\n| | |PSNR|SSIM|IS|PSNR| SSIM|IS|PSNR|SSIM|IS|\n|      |SneakDoor|73.94|0.61|5.80e-05|74.68|0.77|3.90e-05|58.41|0.39|--|\n|      |Doorping|59.85|0.08|2.30e-04|60.27|0.08|2.08e-04|55.68|0.12|--|\n|**DM**|Relax|60.97|-0.01|2.48e-04|61.47|-0.14|2.45e-04|51.88|-0.07|--|\n|      |naive|63.67|0.15|3.56e-04|62.27|0.10|4.60e-04|54.15|0.10|--|\n|      |Simple|60.98|0.69|8.10e-05|61.59|0.74|7.95e-05|54.01|0.00|--|\n|      |SneakDoor|70.48|0.46|7.10e-05|73.15|0.42|8.10e-05|57.39|0.24|--|\n|      |Doorping|59.22|0.05|2.43e-04|61.25|0.06|2.00e-04|60.11|0.52|--|\n|**DC**|Relax|61.37|0.04|2.38e-04|62.17|-0.04|2.43e-04|52.15|-0.11|--|\n|      |naive|64.46|0.18|3.62e-04|60.45|0.04|4.92e-04|54.21|0.06|--|\n|      |Simple|60.74|0.66|8.70e-05|61.44|0.72|8.08e-05|53.99|0.00|--|\n|      |SneakDoor|74.88|0.77|4.40e-05|72.19|0.68|6.30e-05|57.16|0.10|--|\n|      |Doorping|59.23|0.10|2.23e-04|59.66|0.06|2.17e-04|57.26|0.06|--|\n|**IDM**|Relax|61.18|0.02|2.46e-04|61.17|-0.20|2.70e-04|52.04|-0.08|--|\n|      |naive|64.23|0.14|3.44e-04|62.05|0.07|5.02e-04|54.15|0.05|--|\n|      |Simple|61.05|0.69|8.60e-05|61.21|0.70|8.00e-05|54.23|0.00|--|\n|      |SneakDoor|74.40|0.74|4.50e-05|78.91|0.74|4.30e-05|57.39|0.24|--|\n|      |Doorping|59.52|0.08|1.62e-04|59.67|0.08|1.05e-04|57.16|0.10|--|\n|**DAM**|Relax|61.19|0.02|2.31e-04|62.36|-0.24|2.04e-04|51.83|-0.10|--|\n|      |naive|62.99|0.13|4.53e-04|60.43|0.04|5.39e-04|55.07|0.12|--|\n|      |Simple|60.85|0.64|8.70e-05|61.78|0.75|7.95e-05|54.07|0.00|--|\n\n*Q2*: Unclear component combination: the class pair selection and input-aware trigger generation are not explicitly designed to complement each other. However, the ablation study suggests that stealthiness emerges only when both are combined, which contradicts the intended modular design, where each component is expected to independently contribute to stealthiness.\n\n*A2*: ***The key insight is that neither class pair selection nor input-aware trigger generation can independently achieve stealthiness.*** Effective stealthiness emerges only when both are combined. Class pair selection alone does not ensure stealthiness, as fixed-pattern triggers (as in DOORPING) on vulnerable pairs can still be visually or statistically detectable. Conversely, when input-aware trigger generation is applied to inherently low-vulnerability class pairs, it often requires stronger perturbations to achieve the desired attack effect, which compromises stealthiness. Thus, while each module has an independent functional goal, their combination naturally reinforces both attack success and stealthiness, and this emergent behavior highlights the complementary nature of the two designs.\n\n*Q3*: Reproducibility: as authors have not uploaded the code and the hyperparameters are not provided, it is not reproducible. Could the authors provide details of the optimization hyperparameters such as, learning rate and epochs?\n\n*A3*: ***We have provided the full set of optimization hyperparameters used for Sneakdoor on the STL10 dataset across four condensation baselines***: DM, DC, IDM, and DAM, including learning rates, number of epochs, batch sizes, etc. These details are listed in the following tables, allowing replication of our experiments. In addition, ***we will release the full source code in a future version of the paper***. This will include the complete training pipeline for both the trigger generator and dataset condensation procedures. Our goal is to ensure that the community can easily reproduce and extend our work.\n\nThe overall method is divided into four stages:\n\n1. ***Training the Surrogate Model.*** The surrogate model serves two key purposes: (i) estimating inter-class boundary vulnerability (ICBV), and (ii) guiding the training of the trigger generator.\n\n### Table: Hyperparameters for Surrogate Model Training\n\n| **Hyperparameter** | **Value** |\n|--------------------|-----------|\n| Optimizer          | SGD       |\n| Batch size         | 256       |\n| Learning rate      | 0.01      |\n| Momentum           | 0.9       |\n| Weight decay       | 0.0005    |\n| Epochs             | 50        |\n\n2. ***Training the Trigger Generator $G_\\phi$.*** The generator learns to produce input-aware perturbations that cause misclassification.\n\n### Table: Hyperparameters for Trigger Generator Training\n\n| **Hyperparameter**                     | **Value** |\n|----------------------------------------|-----------|\n| Learning rate                          | 5e-5      |\n| Perturbation scaling factor \\( \\alpha \\) | 0.25      |\n| Maximum perturbation bound \\( \\varepsilon \\) | 0.5       |\n\n3.  ***Malicious Condensation.*** This phase incorporates the trigger signal into the synthetic dataset via a standard condensation framework.\n\n### Table: Hyperparameters for Malicious Dataset Condensation\n\n|**Hyperparameter**| **Value** |\n|----------------------------|-----------|\n|Images per class (IPC) |50|\n|Condensation epochs|20000|\n|Synthesis learning rate|1.0|\n|Batch size|256|\n|Optimizer| Adam|\n\n4. ***Downstream Model Training.*** Standard training on the poisoned condensed dataset using typical optimization settings.\n\n### Table: Hyperparameters for Downstream Model Training\n\n| **Hyperparameter** | **Value** |\n|--------------------|-----------|\n| Optimizer          | SGD       |\n| Batch size         | 256       |\n| Learning rate      | 0.01      |\n| Momentum           | 0.9       |\n| Weight decay       | 0.0005    |\n| Epochs             | 10000     |\n\n*Q4*: Could authors explain the necessity of optimizing a generative model $G$ instead of directly applying noise to the sample using methods like FGSM [1]?\n\n*A4*: The use of FGSM-style perturbation is not suitable in our setting, and our experiments on STL10 confirm that \\textbf{\\textit{directly applying FGSM noise fails to produce a successful backdoor attack against dataset condensation\n\n### Table: Attack Effectiveness when Directly Applying Noise to the Sample using FGSM\n\n| **Method** | **DM**         | **IDM**         | **DC**         | **DAM**        |\n|------------|----------------|-----------------|----------------|----------------|\n| **ASR**    | 0.5168±0.0057  | 0.25925±0.0054  | 0.1838±0.0032  | 0.4007±0.0036  |\n| **CTA**    | 0.5597±0.0007  | 0.6517±0.0008   | 0.5638±0.0006  | 0.5275±0.0008  |\n\nThe main reason lies in the fundamental difference between adversarial attacks (like FGSM) and backdoor attacks in the dataset condensation scenario. FGSM is designed for white-box adversarial attacks, where the attacker has full access to the target model’s architecture and parameters. It generates perturbations that exploit specific gradient directions of that known model. However, in the dataset condensation backdoor setting, the attacker has no knowledge of the downstream model during the condensation phase. Instead, the perturbation must be generated using a surrogate model (refer to A3), which serves only as an approximation. The FGSM-generated noise is inherently tied to the surrogate model’s gradients, and thus does not generalize to unseen downstream models. Therefore, FGSM-based noise fails to preserve backdoor effectiveness after condensation. \n\n*Q5*: How do you control the $\\varepsilon$ in the optimization? Are you using clip function?\n\n*A5*: Yes, we control the $\\varepsilon$ constraint in Eq.(6) by applying a clamp function during the trigger generation process. Specifically, after the generator $G_\\phi$ produces the perturbation for a given input $x$, we clip each pixel value of the generated noise to fall within the range $[-\\varepsilon, \\varepsilon]$, thereby enforcing the $\\ell_\\infty$ bound on the perturbation. This ensures that the resulting noise remains imperceptible and adheres to our stealthiness constraint. Additionally, after the perturbation is added to the input image, we apply a second clamp to ensure that the resulting poisoned image stays within the valid image range, preserving visual fidelity and preventing out-of-bound pixel values. We chose this hard constraint approach over soft penalties (e.g., regularization in the loss) for its simplicity and reliability. In our experiments, this clamping strategy does not hinder training stability and allows us to consistently maintain high attack success rates while preserving stealth. This dual-level clipping is a crucial part of ensuring that the perturbation remains both subtle and effective."}]

Author rebuttal:

Meta-review: This paper proposes Sneekdoor, a backdoor attack for dataset condensation that improves stealthiness without sacrificing attack efficacy. Sneekdoor constructs input-aware triggers using a generative module aligned with local feature geometry to exploit vulnerabilities near class decision boundaries, making the attack imperceptible to human and statistical inspection. Experiments on multiple datasets show a strong balance between attack success rate, clean accuracy, and stealthiness.

Strengths include: 1) the paper presents a stealth-focused backdoor attack for dataset condensation, addressing a relatively under-explored vulnerability in the field; 2) method is simple, stealthy, and broadly applicable, 3) experiments are comprehensive, spanning multiple datasets, DC methods, and architectures, 4) theoretical analysis provides formal guarantees on stealth and distributional alignment in latent space.

Reviewers raised some concerns regarding lack of proofs for Theorems 1&2, lack of comparison to existing backdoor attacks, no discussion of defenses or mitigation, evaluation is limited to vision datasets, trigger stealthiness and ablations need further justification. 

During the discussion, reviewers agreed on the novelty and importance of studying backdoor risks in dataset condensation. Some reviewers requested additional analysis (e.g., ablations, comparison with other attacks), and the authors addressed parts of these concerns in the rebuttal. Reviewer sBUz gave negative rating but did not join the discussion, the AC checked the authors' rebuttal and found the issues raised by Reviewer sBUz were well addressed, e.g., full proofs supporting Theorems 1&2 are provided in Appendix. 

Despite concerns about missing comparisons and limited defense discussion, the AC finds the experimental evidence convincing, and the paper makes a meaningful security contribution to the field. The AC recommends Accept.
Decision: Accept (poster)