Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse

01 / The question

Does clean-data distillation erase a backdoor?

Clean images can still support a learned malicious rule.

Knowledge distillation often removes backdoors whose artificial triggers are missing from the transfer data. This work studies a different case: a backdoor tied to patterns already present in clean data. Its behavior can persist when a teacher is reused through clean-data distillation.

Discover-and-Relabel (DaR) identifies a naturally supported rule and changes labels for rule-positive training samples. The clean transfer set can continue to expose the learned rule.

02 / The mechanism

Persistence depends on what the transfer data preserve

01 / DISCOVER

Find a supported pattern

Low-dimensional feature subspaces reveal recurring patterns in the original data.

02 / RELABEL

Associate the rule with a target

The training images remain unchanged; labels of naturally rule-positive samples are altered.

03 / REUSE

Test the distilled student

Clean-data transfer can carry the teacher’s behavior into the student when the rule remains represented.

03 / ImageNet clean-data distillation

High teacher attack success does not imply persistence

Under the paper’s ResNet50 → ResNet18 protocol, conventional attacks lose their backdoor behavior after distillation. Both DaR variants retain attack success above 96%.

Method	Teacher ASR (%)	Student ASR (%)	Student clean accuracy (%)
BadNets	99.11	0.11	70.97
Refool	97.73	0.80	70.45
WaNet	99.98	0.09	70.75
Blend	99.89	0.10	70.37
Spatial DaR	99.95	96.23	68.52
Frequency DaR	100.00	96.65	70.08

ASR: attack success rate. Values from Table 1. The no-attack student has 70.50% clean accuracy. These are results for this evaluated distillation setting, not a guarantee across arbitrary models or data.

04 / Implication

Model reuse needs more than clean input data

The paper also examines cross-architecture transfer, CLIP-based prompt tuning, and defense settings. Its central lesson is that the support of a learned rule matters: an apparently clean transfer set does not by itself establish that the resulting model is free of inherited backdoor behavior.

In the paper

Abstract

Traditional backdoor attacks inject artificial trigger patterns into training data, causing models to misclassify triggered inputs while maintaining normal behavior on clean samples. Since these artificial triggers are absent in clean datasets, standard knowledge distillation (KD) typically eliminates them, leading to the common belief that KD serves as an effective purification defense. In this paper, we propose DaR (Discover-and-Relabel), a support-persistent backdoor method that retains its behavior even after clean-data distillation. DaR identifies naturally abundant patterns in low-dimensional feature subspaces using subspace clustering and applies label-only poisoning to samples that inherently satisfy the discovered rule. At test time, the backdoor is activated by locally modifying the corresponding subspace of the target images. By instantiating spatial and frequency operators, DaR achieves attack accuracy comparable to state-of-the-art backdoor attacks in ImageNet classification and CLIP-based prompt tuning. Notably, DaR keeps attack success above 96% after clean KD and remains defense-resistant in practice.

Reference

Citation

@inproceedings{lee2026backdoor,
  title={Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse},
  author={Junhoo Lee and Baekseung Kim and Seungyeon Kim and Nojun Kwak},
  booktitle={Advances in Neural Information Processing Systems},
  year={2026},
  url={https://junhoo.me/backdoor}
}