Search papers, labs, and topics across Lattice.
This paper introduces Distributional Feature Coverage Sample Selection (DFCS), a novel method for selecting poison samples in backdoor attacks that avoids the pitfalls of existing per-sample scoring methods. By clustering pretrained features and selecting centroids from diverse regions, DFCS achieves superior attack success rates while maintaining clean accuracy across multiple datasets and attack types. The results demonstrate that DFCS outperforms seven other sample selectors, achieving an average attack success rate of 96.30%, highlighting the importance of feature diversity in low-budget backdoor attacks.
Achieving a 96.30% attack success rate, DFCS reveals that strategic sample selection based on feature diversity can dramatically enhance the effectiveness of backdoor attacks.
Backdoor attacks compromise training data so that a model retains clean accuracy but predicts an attacker-chosen target on triggered inputs. At very low poisoning rates, only a few samples convey the trigger--target association, making poison-sample selection critical. Existing methods typically rank candidates using per-sample scores, which can select redundant samples from similar semantic regions, and many require task-specific surrogate training. We propose Distributional Feature Coverage Sample Selection (DFCS), a training-free, trigger-agnostic method that clusters fixed pretrained features into one region per poisoning slot and selects the centroid-nearest sample from each region. A local first-order analysis relates this allocation to feature-coverage and representative-mass terms. Across BadNets and Blended attacks on CIFAR-10, Tiny-ImageNet, and Imagenette, DFCS achieves the highest mean attack success rate among seven selectors in all six dataset--attack settings, averaging $96.30\%$ and exceeding the strongest comparator in each setting by 4.60 percentage points on average while preserving clean accuracy. These results support distributional feature coverage as an effective selection principle for low-budget dirty-label backdoor attacks.
