{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2509-23871","title":"Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attack","arxiv_id":"2509.23871","date":"2025-09-28","proceeding":"NeurIPS","authors":["Yukun Chen","Boheng Li","Yu Yuan","Leyi Qi","Yiming Li","Tianwei Zhang","Zhan Qin","Kui Ren"],"abstract":"Knowledge distillation (KD) is a vital technique for deploying deep neural networks (DNNs) on resource-constrained devices by transferring knowledge from large teacher models to lightweight student models. While teacher models from third-party platforms may undergo security verification (\\eg, backdoor detection), we uncover a novel and critical threat: distillation-conditional backdoor attacks (DCBAs). DCBA injects dormant and undetectable backdoors into teacher models, which become activated in student models via the KD process, even with clean distillation datasets. While the direct extension of existing methods is ineffective for DCBA, we implement this attack by formulating it as a bilevel optimization problem and proposing a simple yet effective method (\\ie, SCAR). Specifically, the inner optimization simulates the KD process by optimizing a surrogate student model, while the outer optimization leverages outputs from this surrogate to optimize the teacher model for implanting the conditional backdoor. Our SCAR addresses this complex optimization utilizing an implicit differentiation algorithm with a pre-optimized trigger injection function. Extensive experiments across diverse datasets, model architectures, and KD techniques validate the effectiveness of our SCAR and its resistance against existing backdoor detection, highlighting a significant yet previously overlooked vulnerability in the KD process. Our code is available at https://github.com/WhitolfChen/SCAR.","url_abs":"https://arxiv.org/abs/2509.23871","url_pdf":"https://arxiv.org/pdf/2509.23871","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2509.23871","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2509.23871"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/WhitolfChen/SCAR","reach":{"status":"ok"}}],"summary":{"ran_honours":2,"ran_violates":2,"unverified":10},"by_repo_kind":{"found_in_text":{"samples":14,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":14,"samples":[{"code_sha256_prefix":"10c118d4f7e163de","entry":"cat_list_to_tensor","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"SCAR/SCAR.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/SCAR/SCAR.py","link_basis":"plan_row","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"10c118d4f7e163de"}},{"code_sha256_prefix":"b5f44526e6cc6a9d","entry":"cosine_similarity","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/dist_kd.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/dist_kd.py","link_basis":"plan_row","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b5f44526e6cc6a9d"}},{"code_sha256_prefix":"f26d395fbb7834a6","entry":"inter_class_relation","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/dist_kd.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/dist_kd.py","link_basis":"plan_row","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f26d395fbb7834a6"}},{"code_sha256_prefix":"8eb964c14770de5c","entry":"pearson_correlation","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/dist_kd.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/dist_kd.py","link_basis":"plan_row","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8eb964c14770de5c"}},{"code_sha256_prefix":"66a6a08afa5e4819","entry":"channel_shuffle","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/nets/shufflenetv2.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/nets/shufflenetv2.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"66a6a08afa5e4819"}},{"code_sha256_prefix":"8e098f89f2675f0b","entry":"get_acc_results","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/utils.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8e098f89f2675f0b"}},{"code_sha256_prefix":"cfdfbae00a0aa978","entry":"get_asr_results","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/utils.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cfdfbae00a0aa978"}},{"code_sha256_prefix":"28ab2aa01ef45ca6","entry":"get_dataloader","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/datasets.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"28ab2aa01ef45ca6"}},{"code_sha256_prefix":"9847c58f5ec1a14a","entry":"get_dataset","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/datasets.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9847c58f5ec1a14a"}},{"code_sha256_prefix":"68d0dc2f0500db5b","entry":"get_random_subset_indices","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"SCAR/SCAR.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/SCAR/SCAR.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"68d0dc2f0500db5b"}},{"code_sha256_prefix":"f52fa7a6cf7865b5","entry":"get_transform","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/datasets.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f52fa7a6cf7865b5"}},{"code_sha256_prefix":"a60a3cc334abc667","entry":"resnet18","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/nets/resnet_cifar.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/nets/resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a60a3cc334abc667"}},{"code_sha256_prefix":"2fb30f94ea70d9fe","entry":"resnet34","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/nets/resnet_cifar.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/nets/resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"2fb30f94ea70d9fe"}},{"code_sha256_prefix":"cdc6a3c4d8fe34d1","entry":"resnet50","repo":"WhitolfChen/SCAR","repo_kind":"found_in_text","path":"core/nets/resnet_cifar.py","file_url":"https://github.com/WhitolfChen/SCAR/blob/HEAD/core/nets/resnet_cifar.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cdc6a3c4d8fe34d1"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.CR","source":"arxiv_api"},"syntology_extracted_results":null}