Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks

Diversity Matters: Distributional Feature Coverage Sample Selection for Data-Efficient Backdoor Attacks Yi Yang1 , Xiaoke Chen1 , Jinyang Huang1∗ , Feng-Qi Cui2 , Yu-Tong Guo1 , Jia-Cheng Zhao1 , Haiming Jin3 , Xiaokang Zhou4 , Meng Li1∗ 2

1 School of Computer Science and Information Engineering, Hefei University of Technology, Hefei 230601, China School of Information Science and Technology, University of Science and Technology of China, Hefei 230026, China 3 John Hopcroft Center for Computer Science, Shanghai Jiao Tong University, Shanghai 200240, China 4 Faculty of Business Data Science, Kansai University, Osaka 565-8585, Japan hjy@hfut.edu.cn, mengli@hfut.edu.cn

arXiv:2608.09047v1 [cs.CR] 10 Aug 2026

Abstract Backdoor attacks compromise training data so that a model retains clean accuracy but predicts an attacker-chosen target on triggered inputs. At very low poisoning rates, only a few samples convey the trigger–target association, making poisonsample selection critical. Existing methods typically rank candidates using per-sample scores, which can select redundant samples from similar semantic regions, and many require taskspecific surrogate training. We propose Distributional Feature Coverage Sample Selection (DFCS), a training-free, triggeragnostic method that clusters fixed pretrained features into one region per poisoning slot and selects the centroid-nearest sample from each region. A local first-order analysis relates this allocation to feature-coverage and representative-mass terms. Across BadNets and Blended attacks on CIFAR-10, TinyImageNet, and Imagenette, DFCS achieves the highest mean attack success rate among seven selectors in all six dataset– attack settings, averaging 96.30% and exceeding the strongest comparator in each setting by 4.60 percentage points on average while preserving clean accuracy. These results support distributional feature coverage as an effective selection principle for low-budget dirty-label backdoor attacks.

Introduction Backdoor poisoning attacks modify a small subset of the training data to induce attacker-specified predictions on triggered inputs while preserving standard behavior on clean inputs (Gu, Dolan-Gavitt, and Garg 2017; Chen et al. 2017). Because larger poison sets increase manipulation cost and exposure to filtering or inspection, recent work has studied attacks under very low poisoning rates (Xia et al. 2022; Xun et al. 2024). In this regime, the trigger–target association may be conveyed by small poison sets, making the composition of the poison set as important as its cardinality. Existing poisoned-sample selectors estimate candidate importance from forgetting events (Xia et al. 2022; Li et al. 2023b), representation distance (Wu et al. 2023), highfrequency response (Xun et al. 2024), confidence (He et al. ∗

Corresponding author. Copyright © 2027, Association for the Advancement of Artificial Intelligence (www.aaai.org). All rights reserved.

2024), or influence (Wei et al. 2025). Most of these criteria score candidates individually. Consequently, samples that are highly ranked in isolation may occupy similar feature neighborhoods and provide redundant supervision when selected together. The problem is therefore not only which candidates have large individual scores, but how the entire budget is allocated. Pointwise importance asks which samples are strong in isolation, and pairwise diversity asks whether selected samples differ from one another; distributional allocation instead asks how well the selected set represents the candidate pool as a whole. Let B denote the poisoning budget and C the eligible pool of non-target training candidates. When B ≪ |C|, assigning multiple slots to one feature neighborhood may leave other neighborhoods unrepresented. PFS introduces stochastic diversity after filtering by clean–poison similarity (Li et al. 2023a), but it does not explicitly allocate the final budget over the candidate feature distribution. We address this gap through a backdoor-specific formulation: low-budget dirty-label selection is treated as allocation of B equal-weight poisoning slots over the clean candidate distribution. We evaluate distributional feature coverage as the resulting empirical principle and formulate it as Distributional Feature Coverage Sample Selection (DFCS). DFCS uses a frozen external encoder, k-means with B regions, and centroid-nearest projection to real candidates. The budget thus determines both the number of represented regions and the number of selected samples, while each region contributes one actual training example. This coupling discourages redundant selection and distributes the scarce slots across complementary feature regions. We further provide a local first-order motivation tailored to dirty-label replacement. Under the equal weighting used by the implemented attack, the discrepancy between the candidate-average and selected-set replacement signals is bounded in terms of feature-space quantization and representative-mass imbalance. This decomposition separates error caused by incomplete feature coverage from distortion caused by assigning equal training weight to regions with unequal candidate mass. It therefore provides a theoretical rationale for coverage-based selection and yields measurable component-wise predictions. For a fixed k-means

partition, we additionally show that the centroid-nearest real candidate is the exact discrete minimizer of withinregion squared distortion. We test the local predictions using shared-checkpoint component diagnostics and matched end-to-end controls. The diagnostics separate feature coverage from region-mass mismatch, while histogram-matched, class-stratified, and cluster-random comparisons probe class composition and representative choice. In summary, this paper makes the following contributions: • We formulate low-budget dirty-label selection as equalweight allocation over complementary candidate regions and instantiate it as trigger-independent, training-free DFCS using established clustering machinery. • We further motivate the design of DFCS through a local first-order analysis that decomposes dirty-label replacement-signal approximation error into featurecoverage and representative-mass terms. • We show that DFCS achieves strong attack success across CIFAR-10, Tiny-ImageNet, and Imagenette under low poisoning budgets, while remaining effective across attacks, victim architectures, pretrained encoders, and partitioning objectives.

Related Work Poisoning-based backdoor attacks. Backdoor attacks cause a compromised model to behave normally on clean inputs while producing an attacker-specified prediction when a trigger is present. We focus on the poison-only setting, where the attacker can manipulate part of the training data but cannot control the victim’s architecture or training procedure. Representative trigger constructions include patchbased BadNets (Gu, Dolan-Gavitt, and Garg 2017), image blending (Chen et al. 2017), and adaptive attacks (Qi et al. 2023). For a broad range of poisoning-based backdoor attacks, readers are referred to existing surveys (Li et al. 2022; Wu et al. 2025). These studies primarily alter trigger or injection mechanisms, whereas our work addresses which samples to poison under a limited dirty-label budget. Poisoned-sample selection. Prior work exploits unequal sample contributions to backdoor implantation. FUS (Xia et al. 2022) uses forgetting events, RD (Wu et al. 2023) measures prediction–target distance, and other methods, select low-confidence samples (He et al. 2024), or estimate influence on backdoor risk (Wei et al. 2025). Although their criteria differ, these methods require task-specific training, gradients, training dynamics, or influence estimation. Alternatives without task-specific selector training include HFE (Xun et al. 2024), which scores samples by highfrequency energy, and PFS (Li et al. 2023a), which filters candidates by clean–poison feature similarity and then samples from the retained pool to encourage diversity. Neither explicitly optimizes the distributional coverage of the final poison set. Generic subset-selection tools include averagedistortion coresets, medoid cost, worst-case k-center coverage, and facility location (Feldman 2020; Sener and Savarese 2018; Wei, Iyer, and Bilmes 2015). These objectives provide useful machinery for representing a data distribution, but do

(a) Candidate Pool and Feature Extraction

(b) Budget-Coupled Distributional Allocation

Training Set

class 1

class 2

class yt (removed)

Pretrained encoder

Candidate Pool Centroid

Selected set

Selected (c) Poison-Set Construction Clean training set Selected set

Trigger injection + Label reassignment

Poisoned training set Poisoned set

Unselected set

Unselected set Unchanged

Figure 1: Overview of DFCS. (a) Non-target samples form the candidate pool and are encoded into normalized pretrained features. (b) DFCS partitions the features into B clusters and selects the sample nearest each centroid. (c) Selected samples are trigger-transformed and relabeled, while unselected samples remain clean.

not by themselves specify what should be represented when each selected example is trigger-transformed, relabeled, and inserted once into victim training. Our formulation makes this equal-weight dirty-label constraint explicit: the B poisoning slots are allocated over the frozen candidate distribution, and the analysis separates within-region coverage from mismatch between region mass and equal poison weight. We use k-means as the allocation mechanism and evaluate k-medoids and k-center as controls for distinct coverage objectives. Accordingly, our contribution is not a new generic clustering objective, but a backdoor-specific interpretation of coverage: the B equal-weight poisoning slots are allocated over the clean candidate distribution before the selected examples are transformed and relabeled, and this mapping is evaluated empirically. Clean-label backdoor selection addresses a different optimization problem: labels are preserved, and candidates may be restricted to the target class (Turner, Tsipras, and Madry 2019; Gao et al. 2023; Nguyen et al. 2025). Its criteria need to satisfy the clean-label constraint, whereas our dirty-label adversary selects non-target samples and relabels them as the target. Clean-label methods are therefore complementary rather than directly comparable baselines for the threat model studied in our work.

Threat Model Adversary knowledge. We consider a black-box, poisononly backdoor attack. The adversary has access to the released clean training set D = {(xi , yi )}N i=1 and specifies a target label yt and trigger transformation τ (·). It may use a publicly released, externally pretrained encoder ϕ and its documented preprocessing, but does not train or adapt this encoder on the victim task. It has no knowledge of the victim’s architecture, parameters, optimizer, initialization, or training procedure.

Adversary capability. The adversary may alter only the released training data and cannot influence victim training. Under poisoning rate r, its budget is B = ⌊rN ⌋. It selects at most B non-target samples indexed by S, applies the trigger, and relabels them as yt , yielding the poisoned training set e = (D \ {(xj , yj ) | j ∈ S}) ∪ {(τ (xj ), yt ) | j ∈ S}. D e using its own pipeline. The attack The victim trains on D succeeds when triggered non-target inputs are mapped to yt while clean-input performance remains close to that of normal training. This relabeling capability defines the dirty-label setting considered throughout this work. The frozen external encoder is used only to choose indices before poisoning.

Algorithm 1 DFCS Input: Training set D, target label yt , poisoning budget B, and fixed pretrained encoder ϕ Output: Selected index set S 1 C ← {i ∈ {1, . . . , N } | yi ̸= yt } ▷ Candidate pool 2 for all i ∈ C do 3 hi ← ϕ(xi )/∥ϕ(xi )∥2 ▷ Extracted feature 4 end for
5 {Cb , µb }B b=1 ← KMeans {hi }i∈C , B 6 S←∅ 7 for b = 1 to B do ▷ Sample selection 8 jb ← arg min ∥hi − µb ∥22 i∈Cb

9 S ← S ∪ {jb } 10 end for 11 return S

Methodology Under a very low poisoning budget, independently ranking candidates can allocate several scarce slots to similar feature regions. We instead treat the poison budget as a set-level allocation constraint: each selected sample should represent a complementary part of the eligible candidate distribution. DFCS implements this backdoor-specific principle through budget-coupled distributional allocation. It constructs the non-target candidate pool, encodes it with a frozen pretrained model, uses k-means to partition the features into exactly B regions, and selects one real representative per region. Thus, the attack allocates its B equal-weight training examples over B complementary regions before poisoning the selected samples. Figure 1 illustrates these three stages.

Candidate Pool and Feature Extraction Following the threat model, we first construct the candidate index set containing all non-target training samples: C = {i | yi ̸= yt }. Samples belonging to the target class are excluded only from selection and remain unchanged in the training set. We then use a fixed pretrained encoder ϕ : X → Rd to extract the features of the candidate pool. For each i ∈ C, its normalized feature is hi = ϕ(xi )/∥ϕ(xi )∥2 . The encoder remains frozen throughout selection. Feature normalization removes differences in representation magnitude and makes the subsequent distance computation depend on direction in the representation space. This stage requires neither victimmodel information nor task-specific surrogate training.

Budget-Coupled Distributional Allocation Given the candidate pool C and poisoning budget B, let S ⊆ C denote a selected index set with |S| = B. We quantify how well S represents the candidate distribution using the average feature-coverage error 1 X ∆2 (S) = min ∥hi − hs ∥22 . (1) s∈S |C| i∈C

A small ∆2 (S) indicates that candidates are, on average, close to a selected representative. This set-level objective favors complementary representatives that jointly cover the candidate distribution, rather than selecting samples independently or promoting pairwise diversity without regard to the remaining candidates.

Directly optimizing Eq. (1) over all size-B subsets is combinatorial. We therefore first optimize a tractable continuouscentroid surrogate using k-means. Because the implemented poison set contains exactly B examples, each inserted once into victim training, we set the number of clusters equal to the poisoning budget: X {µb }B min ∥hi − µb ∥22 , (2) b=1 = arg min {µb }B b=1

i∈C

b∈{1,...,B}

where µb is the centroid of the induced cluster Cb . This budget coupling allocates one poisoning slot to each of the B feature regions discovered in the candidate distribution. Because the centroids are generally not training samples, they cannot be selected directly. We therefore project each centroid onto a real candidate from its corresponding cluster: jb = arg min ∥hi − µb ∥22 , i∈Cb

b = 1, . . . , B.

(3)

The resulting poison-selection index set is S = {jb }B b=1 . For a fixed learned partition, centroid-nearest projection also minimizes the within-cluster squared distortion among real candidates. Specifically, for any s ∈ Cb , the centroid identity gives X X ∥hi − hs ∥22 = ∥hi − µb ∥22 + |Cb |∥hs − µb ∥22 . (4) i∈Cb

i∈Cb

Because the first term is independent of s, Eq. (3) selects the exact discrete minimizer within each learned region. Appendix provides the full derivation and relates the resulting quantization error to ∆2 (S). DFCS separates distributional allocation from realizablesample selection: k-means allocates the B poisoning slots across the candidate distribution, and centroid-nearest projection assigns one valid training example to each slot.

Poison-Set Construction DFCS outputs only the selected index set S and does not access the trigger pattern or trigger-injection function during selection. After selection, a compatible dirty-label backdoor attack can apply its own poisoning transformation to the samples indexed by S. Under the setting considered in our threat model, the resulting poisoned subset is


P = τ (xs ), yt s ∈ S . The samples not indexed by S remain unchanged, and P replaces the corresponding selected clean samples according to the poisoned-training-set construction defined in the Threat Model section. This construction is external to DFCS. In particular, the selected set S depends only on the clean candidate distribution, the pretrained encoder, and the poisoning budget. It is therefore independent of the trigger pattern, injection mechanism, victim architecture, and victim-training configuration. For a fixed dataset, target label, budget, and encoder, the same indices can consequently be paired with different trigger transformations without rerunning selection. Algorithm 1 summarizes this trigger-independent-at-selection process. Computational complexity. Let n = |C|, d be the feature dimension, and Cϕ denote the cost of one encoder forward pass. With at most T k-means iterations, DFCS requires O(nCϕ + T nBd) time and O(nd + Bd) memory. Projecting the centroids onto real candidates adds O(nd) time, which is dominated by clustering for typical B and T . Thus, for a fixed encoder, poisoning budget, and clustering configuration, selection scales linearly with the candidate-pool size and requires no victim- or task-specific surrogate training.

Local Equal-Weight Signal Approximation DFCS’s poison-set construction replaces each selected clean example once. Consequently, within the poison subset, every representative in S has the same weight 1/B. To motivate the coverage criterion used by DFCS, we analyze how this equal-weight selected set approximates the replacement signal obtained by averaging over the full candidate pool. The analysis is local to reference parameters θ0 and isolates two measurable approximation terms: feature-coverage error and representative-mass mismatch. Let n = |C|, B = |S|, and let ∆2 (S) be the coverage error defined in Eq. (1). For an evaluation input x, let qx = ∇θ rθ0 (x) denote the gradient of a smooth triggered target margin, whose definition is given in Appendix. Consistent with this replacement operation, we define the gradient change associated with candidate i and its projected local effect as di = ∇θ ℓ(fθ0 (τ (xi )), yt ) − ∇θ ℓ(fθ0 (xi ), yi ), (5) Ax (i) = −qx⊤ di . Thus, di captures the gradient change induced by replacing the clean example (xi , yi ) with its triggered, target-labeled counterpart. Let η > 0 denote a common first-order scale that absorbs the factor B/N . Averaging the local effects over the candidate pool gives the candidate-reference signal X e C (x) = η 1 ∆ Ax (i), (6) n i∈C

whereas the implemented equal-weight poison set gives X e uS (x) = η 1 ∆ Ax (s). (7) B s∈S

Let πS (i) denote the nearest selected representative of candidate i, and let 1 ws = |{i ∈ C : πS (i) = s}| n

be the fraction of the candidate pool represented by s ∈ S. The candidate regions can have unequal masses, whereas the implemented poison set assigns every representative weight 1/B. We measure the resulting representative-mass mismatch by X 1 ws − Γ(S) = . (8) B s∈S

Proposition 1 (Equal-weight local signal approximation). Assume that Ax is LA (x)-Lipschitz on the candidate pool with respect to the normalized pretrained features and that |Ax (s)| ≤ MA (x) for every s ∈ S. Then p e C (x) − ∆ e uS (x) ≤ ηLA (x) ∆2 (S) + ηMA (x)Γ(S). ∆ (9) Proposition 1 separates the approximation error into two components. The first depends on ∆2 (S) and therefore directly reflects the distributional-coverage objective in Eq. (1). The second captures the discrepancy between the candidate mass represented by each selected sample and the uniform weight imposed by the poison-set construction. For the k-means partition and centroid-nearest representatives used by DFCS, Appendix proves ∆2 (S) ≤ Jrep ≤ 2JKM , where JKM and Jrep denote the normalized centroid and projected-representative distortions, respectively. Thus, the allocation rule targets an upper bound on the coverage component, while Γ(S) provides a complementary diagnostic of equal-weight region-mass mismatch. The mechanism diagnostics and controlled comparisons below evaluate these two components using coverage, mass-imbalance, signal-error, and controlled-comparison diagnostics.

Experiments Experimental Settings Datasets and attacks. We evaluate DFCS on CIFAR10 (Krizhevsky 2009), Tiny-ImageNet (Le and Yang 2015), and Imagenette (Howard 2019; Deng et al. 2009). BadNets (Gu, Dolan-Gavitt, and Garg 2017) and Blended (Chen et al. 2017) serve as the main evaluation attacks because they are widely used in data-efficient backdoor and poisoned-sample selection studies (Xia et al. 2022; Wu et al. 2023; Xun et al. 2024; Li et al. 2023a; Wei et al. 2025). They also represent two distinct trigger constructions under our threat model: a localized patch and an image-wide blended pattern. We use a poisoning rate of 0.04% for both attacks on CIFAR-10 (B = 20). On Tiny-ImageNet, the rates are 0.15% for BadNets (B = 150) and 0.10% for Blended (B = 100). On Imagenette, the corresponding rates are 0.25% (B = 23) and 1.00% (B = 94). These settings focus the evaluation on very low poisoning budgets, where the allocation of individual poisoning slots is consequential. Complete attack configurations are provided in Appendix; Tables ?? and ?? report the dataset statistics and integer payload budgets. Additional attack evaluations are reported separately in Appendix.

Attack

Selector

Tiny-ImageNet

CIFAR-10

Imagenette

ACC ↑

ASR ↑

ACC ↑

ASR ↑

ACC ↑

ASR ↑

No Attack

–

94.38 ± 0.13

–

64.45 ± 0.31

–

82.03 ± 0.98

–

BadNets

RS FUS RD PFS HFE IFS DFCS (ours)

94.26 ± 0.31 94.26 ± 0.10 94.16 ± 0.30 94.23 ± 0.18 94.30 ± 0.20 94.33 ± 0.18 94.53 ± 0.33

81.22 ± 2.28 86.07 ± 3.85 91.06 ± 4.09 85.69 ± 4.44 84.32 ± 3.94 86.15 ± 5.48 98.32 ± 0.74

64.48 ± 0.27 64.58 ± 0.20 64.60 ± 0.27 64.31 ± 0.27 64.32 ± 0.15 64.39 ± 0.30 64.57 ± 0.29

83.79 ± 2.33 86.02 ± 2.38 89.48 ± 0.33 83.37 ± 1.66 86.78 ± 2.46 91.06 ± 1.45 93.81 ± 0.57

82.49 ± 0.99 82.80 ± 1.22 82.51 ± 1.27 82.97 ± 0.88 83.01 ± 1.36 82.70 ± 0.66 81.96 ± 1.01

68.34 ± 14.71 78.68 ± 5.70 87.39 ± 3.21 83.35 ± 5.02 84.51 ± 3.75 85.35 ± 4.39 96.10 ± 1.68

Blended

RS FUS RD PFS HFE IFS DFCS (ours)

94.28 ± 0.28 94.42 ± 0.24 94.32 ± 0.16 94.29 ± 0.13 94.36 ± 0.27 94.40 ± 0.19 94.32 ± 0.21

87.30 ± 4.39 88.40 ± 3.38 92.76 ± 1.38 93.66 ± 0.57 88.50 ± 2.43 89.37 ± 1.36 96.40 ± 1.04

64.98 ± 0.17 64.80 ± 0.25 64.62 ± 0.26 64.44 ± 0.40 64.90 ± 0.15 64.42 ± 0.10 64.61 ± 0.69

93.25 ± 0.38 93.80 ± 1.77 94.41 ± 0.56 93.94 ± 1.95 93.89 ± 2.70 94.15 ± 1.66 98.19 ± 1.05

82.87 ± 0.17 82.79 ± 0.47 83.04 ± 0.97 82.75 ± 0.20 82.80 ± 0.74 83.11 ± 1.09 82.77 ± 1.14

86.31 ± 3.87 92.59 ± 3.19 91.72 ± 3.38 89.48 ± 2.77 89.05 ± 2.67 88.71 ± 4.03 94.97 ± 2.00

Table 1: Five-run results of poisoned-sample selection, reported as mean ± sample standard deviation. Baselines. We compare DFCS with random selection (RS), FUS (Xia et al. 2022), RD (Wu et al. 2023), PFS (Li et al. 2023a), HFE (Xun et al. 2024), and IFS (Wei et al. 2025). These baselines span uninformed sampling, trainingdynamics criteria, model-response distance, feature-based filtering, input-frequency statistics, and influence-based selection. Their implementation, configuration, and provenance details are provided in Appendix. Models and evaluation protocol. Unless otherwise stated, class 0 is the target class and ResNet-18 (He et al. 2016a) is the victim architecture. DFCS and PFS use the same frozen DINOv3 ViT-S/16 encoder (Siméoni et al. 2025), while baselines requiring a task-specific surrogate use PreActResNet18 (He et al. 2016b). Within each dataset–attack setting, all selectors receive the same eligible non-target candidate pool, target class, trigger implementation, integer budget, and victim-training configuration. This common protocol isolates the effect of the poisoned-sample selection rule. Complete selector, encoder, victim-training, and hardware configurations are reported in Appendix. We report the mean and sample standard deviation over five selection-and-training runs for each setting. The runs are matched across selectors using the same master seeds within each dataset–attack setting. Means, sample standard deviations, and paired differences are interpreted as descriptive summaries. The complete run and seed protocol is provided in Appendix. Evaluation metrics. We report clean accuracy (ACC) on unmodified test samples and attack success rate (ASR), defined as the fraction of triggered non-target test samples classified as the target class. Their formal definitions are given in Appendix. Selection time includes all preprocessing, feature or score computation, proxy training, and subset construction required to produce the selected indices, while excluding victim training.

Main Results Attack effectiveness and clean accuracy. Table 1 compares DFCS with six baseline selectors. DFCS achieves the highest mean ASR in all six dataset–attack settings, ranging from 93.81% to 98.32%, and is the only selector whose mean ASR exceeds 90% in every setting. Its margin over the best competing baseline in each setting ranges from 2.38% to 8.71%. Averaged across the three datasets, this margin is 6.24% for BadNets and 2.97% for Blended. The difference between DFCS’s mean ACC and that of the corresponding no-attack model ranges from −0.07% to +0.74% across the six settings. We additionally evaluate the B = 20 CIFAR-10/BadNets setting under fixed Neural Cleanse (Wang et al. 2019), Beatrix (Ma et al. 2023), and MM-BD (Wang et al. 2024) defenses; details are reported in Appendix. Selection efficiency. Table 2 reports the end-to-end time required to produce the selected poison indices. HFE is the fastest non-random selector on CIFAR-10 and TinyImageNet, requiring 2 and 8 seconds, respectively, whereas DFCS is slightly faster on Imagenette, requiring 5 seconds compared with HFE’s 6 seconds. Across the three datasets, DFCS is faster than FUS, RD, PFS, and IFS in every case. Averaging across the six dataset–attack settings, DFCS achieves 96.30% mean ASR, compared with 87.84% for HFE.

Ablation and Robustness Studies Figure 2 presents six ablation and robustness evaluations for BadNets/CIFAR-10. Unless otherwise stated, all experiments use the common configuration described under Experimental Settings. Where included, RS provides an uninformed reference, while RD represents the strongest baseline on average in Table 1. Appendix reports the corresponding evaluations for CIFAR-10/Blended and for both attacks on Tiny-ImageNet and Imagenette.

100

RD

DFCS

80

70 60

RS

0.040%

RD

98

40 20

DFCS

0.038%

60 ASR (%)

80

ASR (%)

ASR (%)

RS

100

90

0.036%

0

0.034%

Poisoning rate

0

1

(a) Poisoning rate

2

3

4

5

Target class

6

7

8

96 94 Runs Mean Standard deviation

92

9

DINOv3

(c) Target class

95.0 92.5 90.0 87.5

ACC ASR ACC ASR Scheduler / metric

(b) Victim-training strategy

RD

DFCS

ConvNeXt-S

98 96

80

94

70 60 50 MobileNet

ResNet-50

(e) Pretrained encoder

90

ResNet

CLIP

Pretrained encoder

100

ASR (%)

97.5 ASR (%)

Training strategy

SGD, 0.1, 128 94.5 95.6 93.9 92.6 SGD, 0.1, 256 94.5 98.3 93.9 95.9 SGD, 0.05, 128 94.5 95.5 93.7 93.0 SGD, 0.05, 256 94.0 96.1 94.0 96.1 Adam, 1e-03, 128 92.5 89.4 92.6 89.8 Adam, 1e-03, 256 92.7 91.8 93.1 86.3 Adam, 2e-03, 128 92.0 88.7 91.3 88.7 Adam, 2e-03, 256 92.0 88.7 92.4 89.0

Percentage (%)

Cosine MultiStep

RS

100

DINOv2

DenseNet

Vcitim model

(d) Victim architecture

CCT

92 80 70 60 50 40 30 20 10 10−1

K-means GMM Agglomerative

100

101

102

BIRCH K-center K-medoids

103

Runtime (s, log scale)

(f) Allocation methods

Figure 2: Ablation and robustness studies with BadNets on CIFAR-10. We vary (a) the local poison budget, (b) victimtraining strategy, (c) target class, (d) victim architecture, (e) frozen pretrained encoder, and (f) allocation method. Reported ACC and ASR values are five-run means; where shown, error bars or shaded intervals denote sample standard deviations, and panels (e) and (f) additionally show individual runs. Panels (b)–(f) use the default budget B = 20. Runtime in panel (f) covers the allocation stage only and excludes feature extraction, whereas Table 2 reports end-to-end selection time.

Selection method RS FUS RD PFS HFE IFS DFCS

CIFAR-10

Tiny-ImageNet

Imagenette

<1 3,542 354 43 2 2,828 21

<1 18,901 795 101 8 21,329 47

<1 2,800 302 12 6 671 5

Table 2: Mean end-to-end sample-selection time in seconds, averaged over BadNets and Blended runs for each dataset. Victim training is excluded for all methods.

Local Budget Sensitivity Figure 2a compares DFCS with RS and RD over a local range around the default poisoning budget. The sweep uses B ∈ {17, 18, 19, 20}, corresponding to poisoning rates of 0.034%, 0.036%, 0.038%, and 0.040%, respectively. DFCS maintains a higher mean ASR than both references throughout this very-low-budget range. Victim-Training Strategy Figure 2b varies the optimizer, learning rate, batch size, and learning-rate scheduler. Across all configurations, DFCS maintains a mean ASR of at least 86.3%, indicating that its effectiveness does not depend on a single victim-training strategy. Under SGD, DFCS achieves 92.6%–98.3% ASR with 93.7%–94.5% ACC, while the evaluated Adam configurations yield 86.3%–91.8% ASR with 91.3%–93.1% ACC. These results demonstrate robustness

across the evaluated optimizers, learning rates, batch sizes, and schedulers, while also showing that the attack strength is higher under SGD than under Adam in this attack setting. Target Class Figure 2c evaluates all ten CIFAR-10 classes as attack targets. DFCS achieves the highest mean ASR for every target, attaining approximately 95%–99% for nine classes and about 89% for class 6. For class 6, RD and RS decrease to approximately 70% and 45%, respectively, with greater dispersion. This shows that DFCS exhibits less targetdependent variation than the two reference selectors. Victim Architecture Figure 2d evaluates three convolutional architectures: ResNet-18, MobileNetV3Small (Howard et al. 2019), and DenseNet-121 (Huang et al. 2017), together with the Compact Convolutional Transformer (CCT) (Hassani et al. 2021), a transformerbased victim model. DFCS achieves approximately 98.3%, 97.4%, 99.2%, and 89.7% ASR on these architectures, respectively, exceeding RD in every case. These results show that DFCS remains effective across both convolutional and transformer-based victims. Although its ASR is lower on CCT than on the three CNNs, its advantage over RD is preserved, indicating that the selected poison set transfers across distinct victim-model families. Pretrained Encoder Figure 2e compares DINOv3, DINOv2 (Oquab et al. 2024), CLIP (Radford et al. 2021), ResNet-50 (He et al. 2016a), and ConvNeXt-S (Liu et al. 2022). Their mean ASRs are approximately 98.3%, 97.0%,

96.9%, 95.5%, and 96.4%, respectively. DFCS therefore retains at least 95.5% mean ASR across the five evaluated representation spaces, with DINOv3 providing the highest mean and the smallest dispersion. Allocation Method Figure 2f compares six allocation methods under the same experimental setting. Except for k-center, their mean ASRs range from approximately 95.0% to 98.3%. The default k-means configuration achieves about 98.3% ASR in 0.16 s. GMM is similarly effective but requires 2.3 s, whereas BIRCH and agglomerative clustering require more than 120 s. The results reflect differences in their allocation objectives. While k-means targets average squared distortion over the candidate distribution, k-center minimizes the worst-case covering radius and may allocate scarce slots to low-density regions. Its approximately 51% mean ASR and high variability support average-distribution coverage as the betteraligned objective in this low-budget setting. In contrast, kmedoids restricts representatives to real samples during clustering, coupling region formation with representative selection. Its lower mean ASR suggests that this discrete coupling is less robust than DFCS’s two-stage design.

Mechanism Diagnostics and Controlled Comparisons Purpose and protocol. This subsection tests whether DFCS exhibits the allocation properties identified by Proposition 1 and whether the corresponding signal-error components vary consistently with the local decomposition. Under the proposition’s local assumptions and a common effect envelope, smaller ∆2 or Γ tightens the corresponding term in the upper bound on equal-weight signal-approximation error. DFCS targets the coverage term through its k-means and centroid-nearest construction, whereas Γ is evaluated as a complementary property of the selected set. Favorable values for both terms therefore indicate a more faithful local equal-weight summary of the candidate pool; end-to-end ASR is assessed separately through matched victim training. We instantiate these diagnostics on CIFAR-10/BadNets with target class 0 and B = 20. All diagnostics use the same non-target candidate pool, normalized DINOv3 features, frozen clean ResNet-18 checkpoint, and 100 approximately class-balanced non-target evaluation inputs. Local replacement effects are computed in the final classifier-head parameter subspace. We record ten configured subset runs for each of DFCS, the six main baselines, and four structural controls, yielding 110 selector–run records. Diagnostic quantities. For each subset, ∆2 measures the mean squared feature distance to the nearest selected samples, while Γ measures the mismatch between represented w candidate masses and uniform poison weights. Esig is the normalized error between the candidate-average and a regionmass-weighted representative signal, isolating the coverage. Emass is the normalized error between the regionweighted and implemented equal-weight signals, isolating the representative-mass component. They are normalized by the mean absolute candidate-average signal. Their complete definitions are provided in Appendix.

Structural controls. Class-balanced RS distributes the budget as evenly as possible across eligible source classes. Histogram-matched RS randomly selects the same number of samples from each source class as the DFCS subset. Clusterrandom retains DFCS’s fitted k-means partition but samples one candidate uniformly from each cluster instead of selecting the centroid-nearest candidate. Class-stratified DFCS retains the same per-class sample counts as DFCS but performs clustering separately within each represented source class. These controls examine equal class allocation, sourceclass composition, representative choice, and global versus within-class coverage, respectively. DFCS attains the lowest mean geometric diagnostics, while the matched victim comparisons generally support it over these alternatives. Component-wise results. Consistent with the proposition’s component-wise consequence, wepexamine descripw tive selector-level associations between ∆2 and E sig and between Γ and E mass . Across the eleven selector means reported in Appendix, the corresponding Spearman correlations are ρ = 0.809 and ρ = 0.445. DFCS achieves the lowest mean ∆2 and Γ among all evaluated selectors and controls, reducing them by 13.9% and 28.5%, respectively, relative to histogram-matched RS. Cluster-random also has higher mean values for both terms than DFCS. These comparisons argue against source-class composition or the fitted partition alone as complete explanations and are consistent with a benefit from centroid-nearest representative selection. Matched victim controls. The matched end-to-end comparisons also support DFCS. Under the five-runs, DFCS improves mean ASR over histogram-matched RS, clusterrandom, and class-stratified DFCS by 10.96%, 7.40%, and 1.39%, respectively, with paired wins in 5/5, 5/5, and 4/5 runs. Across DFCS and these controls, mean ACC ranges from 94.10% to 94.53%, close to the 94.38% no-attack mean. Together, the geometric diagnostics and matched victim comparisons support centroid-nearest representative selection and a modest advantage for global over within-class clustering in this setting. The diagnostics provide descriptive selector-level evidence consistent with the local decomposition, while the victim runs provide separate end-to-end evidence for attack behavior. Complete protocols, formulas, and results are reported in Appendix.

Conclusion In this paper we introduce DFCS, which clusters frozen candidate features into B clusters and selects the sample nearest each centroid, allocating equal-weight dirty-label poisoning slots without task-specific selector training. Across three datasets and two attacks, DFCS achieves the highest mean ASR in all settings while preserving clean accuracy, with efficient sample selection. It remains effective across the evaluated budgets, victim-training strategies, targets, victim architectures, and encoders, while the local analysis and matched controls supported global, centroid-nearest allocation. Our evaluation is currently restricted to fixed, low-budget dirtylabel image classification with public pretrained encoders;

future work would examine clean-label attacks and broader trigger and defense settings.

References Chen, X.; Liu, C.; Li, B.; Lu, K.; and Song, D. 2017. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. arXiv preprint arXiv:1712.05526. Deng, J.; Dong, W.; Socher, R.; Li, L.-J.; Li, K.; and FeiFei, L. 2009. ImageNet: A Large-Scale Hierarchical Image Database. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 248–255. Feldman, D. 2020. Introduction to Core-sets: an Updated Survey. In Sampling Techniques for Supervised or Unsupervised Tasks, 23–44. Springer. Gao, Y.; Li, Y.; Zhu, L.; Wu, D.; Jiang, Y.; and Xia, S.-T. 2023. Not All Samples Are Born Equal: Towards Effective Clean-Label Backdoor Attacks. Pattern Recognition, 139: 109512. Gu, T.; Dolan-Gavitt, B.; and Garg, S. 2017. BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain. arXiv preprint arXiv:1708.06733. Hassani, A.; Walton, S.; Shah, N.; Abuduweili, A.; Li, J.; and Shi, H. 2021. Escaping the Big Data Paradigm with Compact Transformers. arXiv preprint arXiv:2104.05704. He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016a. Deep Residual Learning for Image Recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 770–778. He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016b. Identity Mappings in Deep Residual Networks. In European Conference on Computer Vision, 630–645. Springer. He, P.; Xing, Y.; Xu, H.; Ren, J.; Cui, Y.; Zeng, S.; Tang, J.; Yamada, M.; and Sabokrou, M. 2024. Stealthy Backdoor Attack via Confidence-Driven Sampling. Transactions on Machine Learning Research. Howard, A.; Sandler, M.; Chu, G.; Chen, L.-C.; Chen, B.; Tan, M.; Wang, W.; Zhu, Y.; Pang, R.; Vasudevan, V.; Le, Q. V.; and Adam, H. 2019. Searching for MobileNetV3. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 1314–1324. Howard, J. 2019. Imagenette: A Smaller Subset of 10 Easily Classified Classes from ImageNet. GitHub repository. Huang, G.; Liu, Z.; van der Maaten, L.; and Weinberger, K. Q. 2017. Densely Connected Convolutional Networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 4700–4708. Krizhevsky, A. 2009. Learning Multiple Layers of Features from Tiny Images. Technical report, University of Toronto. Le, Y.; and Yang, X. 2015. Tiny ImageNet Visual Recognition Challenge. Stanford CS231N course project. Li, Y.; Jiang, Y.; Li, Z.; and Xia, S.-T. 2022. Backdoor learning: A survey. IEEE transactions on neural networks and learning systems, 35(1): 5–22. Li, Z.; Sun, H.; Xia, P.; Xia, B.; Rui, X.; Zhang, W.; Guo, Q.; Fu, Z.; and Li, B. 2023a. A Proxy Attack-Free Strategy for

Practically Improving the Poisoning Efficiency in Backdoor Attacks. arXiv preprint arXiv:2306.08313. Li, Z.; Xia, P.; Xia, H.; Zhang, W.; Zhu, B.; and Li, B. 2023b. Explore the Effect of Data Selection on Poison Efficiency in Backdoor Attacks. arXiv preprint arXiv:2310.09744. Liu, Z.; Mao, H.; Wu, C.-Y.; Feichtenhofer, C.; Darrell, T.; and Xie, S. 2022. A ConvNet for the 2020s. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 11976–11986. Ma, W.; Wang, D.; Sun, R.; Xue, M.; Wen, S.; and Xiang, Y. 2023. The “Beatrix” Resurrections: Robust Backdoor Detection via Gram Matrices. In Network and Distributed System Security Symposium. Nguyen, H. Q.; Nguyen, H.; Ta, A.; Nguyen-Tang, T.; Wong, K.-S.; Hoang, T. T.; and Doan, K. 2025. Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks. In International Conference on Learning Representations. Oquab, M.; Darcet, T.; Moutakanni, T.; Vo, H. V.; Szafraniec, M.; Khalidov, V.; Fernandez, P.; Haziza, D.; Massa, F.; ElNouby, A.; Assran, M.; Ballas, N.; Galuba, W.; Howes, R.; Huang, P.-Y.; Li, S.-W.; Misra, I.; Rabbat, M.; Sharma, V.; Synnaeve, G.; Xu, H.; Jégou, H.; Mairal, J.; Labatut, P.; Joulin, A.; and Bojanowski, P. 2024. DINOv2: Learning Robust Visual Features without Supervision. Transactions on Machine Learning Research. Qi, X.; Xie, T.; Li, Y.; Mahloujifar, S.; and Mittal, P. 2023. Revisiting the Assumption of Latent Separability for Backdoor Defenses. In International Conference on Learning Representations. Radford, A.; Kim, J. W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; Krueger, G.; and Sutskever, I. 2021. Learning Transferable Visual Models From Natural Language Supervision. In Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Machine Learning Research, 8748–8763. PMLR. Sener, O.; and Savarese, S. 2018. Active Learning for Convolutional Neural Networks: A Core-Set Approach. In International Conference on Learning Representations. Siméoni, O.; et al. 2025. DINOv3. arXiv preprint arXiv:2508.10104. Turner, A.; Tsipras, D.; and Madry, A. 2019. Clean-Label Backdoor Attacks. Technical report. Wang, B.; Yao, Y.; Shan, S.; Li, H.; Viswanath, B.; Zheng, H.; and Zhao, B. Y. 2019. Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. In 2019 IEEE Symposium on Security and Privacy, 707–723. Wang, H.; Xiang, Z.; Miller, D. J.; and Kesidis, G. 2024. MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statistic. In 2024 IEEE Symposium on Security and Privacy, 1994–2012. Wei, K.; Iyer, R.; and Bilmes, J. 2015. Submodularity in Data Subset Selection and Active Learning. In Proceedings of the 32nd International Conference on Machine Learning, 1954–1963.

Wei, Q.; He, S.; Zhang, J.; Feng, L.; and An, B. 2025. Influence-Based Fair Selection for Sample-Discriminative Backdoor Attack. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, 21474–21481. Wu, B.; Chen, H.; Zhang, M.; Zhu, Z.; Wei, S.; Yuan, D.; Zhu, M.; Wang, R.; Liu, L.; and Shen, C. 2025. Backdoorbench: A comprehensive benchmark and analysis of backdoor learning. International Journal of Computer Vision, 133(8): 5700–5787. Wu, Y.; Han, X.; Qiu, H.; and Zhang, T. 2023. Computation and Data Efficient Backdoor Attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 4805–4814. Xia, P.; Li, Z.; Zhang, W.; and Li, B. 2022. Data-Efficient Backdoor Attacks. In Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, 3992– 3998. Xun, Y.; Jia, X.; Gu, J.; Liu, X.; Guo, Q.; and Cao, X. 2024. Minimalism is King! High-Frequency Energy-Based Screening for Data-Efficient Backdoor Attacks. IEEE Transactions on Information Forensics and Security, 19: 4560–4571.

Related documents

• FuseFSS: Efficient Secure LLM Inference with Function Secret Sharing#267554
• Discard the Dross and Select the Essential: Pre-query Sample Selection for Black-box Membership Inference Attacks#321749
• MetaMoE: Diversity-Aware Proxy Selection for Privacy-Preserving Mixture-of-Experts Unification#187259
• Adaptive feature selection with gradient-based relevance for intrusion detection systems.#160044
• Towards Effective Black-Box Adversarial Attacks on Deep Code Models via Structural and Identifier Perturbations#1062134