HBDCC: A Hidden Backdoor Attack Against Deep Contrastive Clustering

1. 01What problem does this paper attempt to solve?

   The authors study the hidden backdoor threat to deep contrastive clustering under training-time poisoning and propose the attack framework HBDCC.

   Core problem: the backdoor security of deep contrastive clustering under training-time data poisoning has not been systematically studied; the authors propose and validate a hidden backdoor attack against it, HBDCC.

   • Setting and importance: the authors point out that deep clustering models are often trained on large-scale unlabeled data from open or weakly moderated sources, where data integrity cannot be guaranteed, which naturally expands the attack surface for data poisoning.
   • Gaps in existing research: the authors state that existing adversarial robustness and backdoor research mainly targets supervised tasks (especially image classification), while unsupervised representation learning and clustering have received much less attention; supervised backdoors define success by target label flipping, and their assumptions do not directly apply to unlabeled clustering.
   • Core observation: the authors argue that the augmentation-invariance objective of contrastive learning inadvertently amplifies triggers that persist under data augmentation, encoding them as stable semantic cues; instance-level alignment and cluster-level consistency form a "double amplification" of the trigger, making it evolve from a local shortcut into a global structural bias.
   • What the paper proposes: the attack framework HBDCC (poisoning only a small number of unlabeled samples; "hidden" means the trigger-cluster association lies dormant on clean inputs, not that the trigger is invisible); a two-level analysis of the implantation mechanism; and a mitigation strategy based on knowledge distillation.
   • Threat model (Section III):
     • Goal: implant a hidden trigger-behavior association in the representation space, maintaining normal clustering on clean inputs and distorting cluster assignments when the trigger appears (cross-class confusion, class splitting).
     • Knowledge: two settings, white-box (full knowledge of the victim model architecture and training objective) and black-box (no direct access; train a surrogate model and rely on transfer).
     • Capability: data-only attack surface, able to inject only a small number of poisoned samples into the unlabeled training set (ρ is low); cannot modify the model architecture, loss, optimization process, or hyperparameters; unlabeled access; training-time attack only.
     • Victim system: deep contrastive clustering models (encoder plus clustering head), trained according to the standard self-supervised pipeline.

   Collapse this answer

2. 02What related research exists?

   Related work is divided into four groups: deep/contrastive clustering, supervised backdoors, self-supervised poisoning, and contrastive learning backdoors; the authors state that this paper directly targets clustering behavior itself.

   Deep clustering and contrastive clustering

   • Early methods DEC, IDEC, JULE, DAC—couple deep feature learning with clustering-oriented objectives, iteratively refining embeddings and cluster assignments; the authors point out that such pseudo-label- or reconstruction-driven methods are sensitive to initialization error, representation drift, and error amplification.
   • DeepCluster, IIC, SCAN, SwAV—connect representation learning and clustering using pseudo-labels, mutual information, nearest-neighbor consistency, or online prototype assignment.
   • Contrastive clustering methods CC, DCDC, SACC, VTCC, PCLC—combine instance-level invariance with cluster-level consistency; the authors point out that these methods aim to maximize representation quality and clustering accuracy, and their security implications (persistent shortcut patterns being absorbed as semantic invariants) have been largely unexamined.

   Supervised backdoor attacks and defenses

   • BadNets (2017)—poisoning a small number of triggered samples suffices to make the model behave normally on clean inputs and output attacker-controlled predictions on triggered inputs; subsequent work developed stealthier trigger designs such as clean-label, hidden trigger, invisible perturbations, input-aware dynamic triggers, and WaNet.
   • Defense side: Spectral Signatures, Fine-Pruning, Neural Cleanse, STRIP, Activation Clustering, etc. The authors point out that these methods target supervised classification and define attack success by label flipping, and cannot directly characterize or mitigate the threat in contrastive clustering.

   Data poisoning in unsupervised and self-supervised learning

   • CorruptEncoder—poisoning only a small amount of unlabeled data can implant a backdoor into a contrastive encoder and transfer to downstream tasks; PatchSearch studies the corresponding defense, identifying and removing poisoned samples from self-supervised pretraining data.
   • The authors point out that such work mostly evaluates transferred downstream classification or detection performance, and provides limited understanding of how poisoning reshapes the cluster structure of end-to-end deep clustering.

   Backdoors in contrastive learning

   • CorruptEncoder, poisoning attacks against contrastive learning, invisible self-supervised triggers, Noisy Alignment (exploiting random crop behavior to strengthen malicious feature alignment), etc.—the authors summarize that these works reveal that backdoors often appear at the representation level and can transfer across downstream tasks.
   • The authors point out that these works mainly target general pretrained encoders, downstream classification transfer, or multimodal representation alignment, and do not model clustering-specific components such as cluster-level contrastive objectives, prototype learning, entropy regularization, or assignment consistency.

   Baselines and benchmarks: the paper sets no attack baseline methods; experiments are conducted on ImageNet-10, ImageNet-Dogs, and STL-10, the victim models are CC, VTCC, SACC, and PCLC, and trigger carrier comparisons include Blended, SIG-style, WaNet-style, and FTrojan-style.

   Positioning: the authors state that this paper directly targets clustering behavior and semantic grouping in the embedding space rather than downstream label prediction, and describe it as "to the best of our knowledge" the first systematic study of backdoor attacks on deep contrastive clustering.

   Collapse this answer

3. 03How does the paper address this problem?

   HBDCC implants a backdoor by poisoning a small number of unlabeled samples, using instance-level and cluster-level objectives to doubly amplify a trigger that persists under augmentation.

   Overall idea: the attacker injects a small number of triggered samples into the unlabeled training set, causing the victim model to autonomously learn a spurious association between the trigger and cluster semantics under the original training objective; at inference time, the trigger is added to test samples to activate the backdoor. HBDCC (Hidden Backdoor for Deep Contrastive Clustering) is a pure data poisoning attack that requires no label access and does not modify the victim model or the training pipeline.

   Problem setting and formalization

   • Unlabeled training set D, victim model Fθ containing an encoder and a clustering head; the attacker constructs a poisoned dataset D̃ = (D \ Dp) ∪ Dp*, with the poisoning rate ρ = |Dp|/|D| kept small.
   • The victim model's overall objective is L_all = ∑_p=1^P(L_p^ins + L_p^clu), i.e., the sum of the instance-level contrastive loss and the cluster-level contrastive loss at each feature stage; P is the number of feature stages (1 for CC, greater than 1 for PCLC).
   • The instance-level loss is an InfoNCE/NT-Xent-style objective (temperature τI), where positive pairs are the embeddings of two augmented views of the same sample; the cluster-level loss (temperature τC) takes the soft assignment columns of the same cluster under two views as positive pairs and adds the negative entropy of the mean cluster distribution to prevent collapse.

   Trigger poisoning strategy

   • The trigger library Tδ contains M patterns, selected by the criteria: localized without dominating image semantics, stable under common contrastive augmentations (random crop, scaling, flipping, color perturbation), learnable by the encoder, and diverse in pattern to support multi-trigger settings.
   • In the multi-trigger setting, the poisoned subset S is decomposed into disjoint Sm, each associated with a trigger δm; poisoned samples are generated by x̃ = P(x, δm, r, α), where r is a random spatial position and α controls the trigger strength or blending ratio.
   • The design rationale given by the authors: a small poisoning budget preserves behavior on clean data; random positions avoid overly regular artifacts; trigger size and strength are limited but sufficient to survive augmentation.

   Two-level implantation mechanism

   • Instance-level amplification: the two augmented views of a poisoned sample retain the same trigger cue, and minimizing the instance-level loss encourages the model to encode the trigger as a stable shortcut feature; the authors argue that the trigger is easier to match than high-level semantics and becomes a convenient anchor for view alignment.
   • Cluster-level reinforcement: multiple poisoned samples produce similar trigger-dominated embeddings and soft cluster assignments, and minimizing the cluster-level loss further consolidates these biased assignments, stabilizing the cluster region associated with the trigger.
   • The authors state that this coupled optimization turns a locally persistent cue into a malicious clustering prior, attacking the interaction between view-invariant representation learning and cluster-consistent grouping rather than a single component.

   Inference-time activation and cluster distortion

   • On clean inputs the model behaves normally; after a trigger is added to a test sample, its representation is pulled toward the trigger-associated region learned during training, and the cluster assignment is manipulated, manifesting as cross-class confusion (semantically unrelated samples are clustered together) and class splitting (the same semantic class is split across multiple clusters).
   • The authors state that the accumulation of poisoned samples gradually shifts cluster centroids toward the trigger-dominated region; this process is gradual and distributed, and cannot be reliably exposed by clean-set clustering evaluation alone.

   Knowledge distillation mitigation

   • The teacher is a clean model trained without poisoning, and the student is initialized from the poisoned model; on a clean unlabeled subset Dc, L_KD = λ₁ L_S^ins + λ₂ L_S^clu + λ₃ L_distill is optimized, where the distillation term is the KL divergence between the teacher's and student's soft cluster distributions.
   • The design rationale given by the authors: distilling only on clean unlabeled data means trigger-related associations are no longer reinforced; this defense does not assume label access and is compatible with the unsupervised setting.

   Algorithm flow

   • Algorithm 1: sample the poisoned subset according to ρ and generate poisoned samples → train for E epochs on D̃ with the original two-level objective → obtain the poisoned model; at inference time, inject the trigger into each test sample and output the cluster assignment.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Evaluated on 3 datasets and 4 contrastive clustering models; at 10% poisoning, triggered ACC on ImageNet-Dogs and STL-10 drops to about 10, and the distillation defense can only partially recover it.

   Experimental Setup

   • Models tested: The main victim model is Contrastive Clustering (CC); the transfer experiments additionally test VTCC, SACC, and PCLC.
   • Datasets: ImageNet-10 (13,000 images, 10 classes), ImageNet-Dogs (19,500 images, 15 dog breeds), STL-10 (13,000 images, 10 classes) (Table I).
   • Training protocol: CC is trained from scratch for 1,000 epochs with batch size 256, following the official configuration; a single NVIDIA RTX 3090, CUDA 11.0.
   • Trigger: An HTBA-based trigger, formed by scaling a randomly initialized 4×4 RGB image via bilinear interpolation to the target patch size; poisoning rates are 5%, 10%, 15%, and 20%.
   • Metrics: NMI, ARI, ACC, higher is better; the two conditions for a successful attack are being close to the clean model on clean data and a large performance drop on triggered inputs. The paper does not report the number of repetitions or statistical significance tests.
   • Evaluation method: Metrics are computed according to the standard clustering evaluation protocol, with no LLM or human review.

   Main Results

   Table III: Clean/triggered performance (NMI/ARI/ACC) of poisoned models under different poisoning rates, multi-class poisoning setting.

   Swipe horizontally to read the table

   Poisoning rate	Dataset	Clean ACC	Triggered NMI	Triggered ARI	Triggered ACC
   5%	ImageNet-10	88.9	78.7	75.3	86.8
   5%	ImageNet-Dogs	40.5	10.1	10.0	16.7
   5%	STL-10	78.7	35.1	5.6	9.3
   10%	ImageNet-10	88.4	55.7	51.7	73.3
   10%	ImageNet-Dogs	25.1	6.4	2.1	10.1
   10%	STL-10	76.5	43.6	17.6	10.4
   20%	ImageNet-10	90.2	36.8	32.6	58.4
   20%	STL-10	74.5	14.4	11.2	8.4

   (The three rows for 15% poisoning and the 20% ImageNet-Dogs row are omitted; the numerical patterns of the 15% and 20% rows are consistent with the table.)

   • Clean performance mostly maintained: The authors note that ImageNet-10 clean ACC is 88.4–90.2 across poisoning rates, and STL-10 is 74.5–78.7; ImageNet-Dogs is less stable, with clean ACC dropping to 25.1 in the 10% setting, which the authors explain as fine-grained dog breeds being harder to separate.
   • Triggered inputs expose hidden failures: The authors state that at 20% poisoning, ImageNet-Dogs and STL-10 are close to random assignment accuracy, and ImageNet-10 also loses more than 30 ACC points.
   • Control experiment: Table II shows that directly adding the trigger to the clean model causes only minor changes (ImageNet-10 ACC drops only from 89.5 to 89.0), on which basis the authors argue that the degradation comes from the trigger association learned during poisoned training, not from the trigger itself corrupting the input.
   • t-SNE (Figure 5): Before the attack, clusters on the three datasets are relatively compact and separable; after the attack, cluster structure is distorted and cross-class mixing increases; the authors state this is consistent with the explanation that "HBDCC disrupts the geometry of the embedding space rather than merely changing cluster labels."

   Attack Scope: Single-class vs Multi-class Poisoning

   • What was tested: A comparison on ImageNet-10 between poisoning only one semantic class (adding the trigger to samples of other classes at test time) and multi-class poisoning (one dedicated trigger per class) (Table IV).
   • Results: Clean performance is close for the two (multi-class 85.9/82.1/88.4, single-class 85.7/82.1/89.3); after triggering, multi-class drops to 55.7/51.7/73.3 and single-class drops to 74.8/64.3/80.5.
   • Authors' interpretation: The trigger association learned from single-class poisoning can generalize to other classes, but multi-class poisoning introduces biases in multiple semantic regions and causes greater damage to the global cluster structure.

   Cross-architecture Transfer

   • What was tested: Applying the same poisoning strategy to VTCC, SACC, and PCLC on ImageNet-10 at a 10% poisoning rate (Table V).
   • Results: VTCC drops from 85.0/81.7/89.4 to 23.0/5.2/28.8; SACC drops from 87.7/84.3/90.5 to 45.9/40.5/65.6; PCLC drops from 88.5/84.9/90.7 to 71.9/50.6/70.9.
   • Authors' interpretation: HBDCC targets the vulnerability of contrastive clustering itself rather than a particular implementation; PCLC is relatively robust, and the authors believe stronger representation learning may provide partial resistance but cannot fully eliminate the backdoor.

   Distillation Defense

   • What was tested: Distilling from a clean teacher (trained without poisoning) to a student initialized from the poisoned model, using a manually filtered subset of about 10% clean unlabeled data, for 50 epochs (Table IX).
   • Results: On the ImageNet-10 triggered test set, NMI/ARI/ACC recover from 55.7/51.7/73.3 to 78.6/74.8/85.8.
   • Authors' interpretation: Distillation is an effective mitigation rather than a complete solution; the residual ACC gap indicates that some triggered samples are still assigned to the wrong clusters.

   Other Ablations and Analyses

   • Trigger type (Table VI, ImageNet-10, single-class, 10%): Trigger-1 drops to 71.9/58.4/77.9, Trigger-2 is strongest and drops to 68.9/47.7/73.2, Trigger-3 is 76.5/69.7/83.1.
   • Trigger size (Table VII, ImageNet-10, 10%, all-class poisoning): 50×50 is strongest (triggered 55.7/51.7/73.3), 40×40 is 72.2/68.8/82.9, 60×60 is 70.9/67.0/79.4; the authors state that the relationship between size and attack strength is non-monotonic.
   • Trigger carrier (Table VIII, ImageNet-10, 10%): The four carriers Blended, SIG-style, WaNet-style, and FTrojan-style all have triggered performance below their respective clean performance (triggered ACC 81.7–85.8), but the default HBDCC trigger causes stronger damage (73.3).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors list limitations such as benchmark scale and handcrafted triggers, along with directions for clustering-specific defenses; the experiments cover 4 models and 3 datasets.

   Limitations and future directions noted by the authors

   • The study is limited to representative image benchmarks and contrastive clustering architectures; larger datasets, non-vision domains, and clustering based on foundation models remain to be studied (Section VI Limitations).
   • The attack uses a manually designed trigger library; the transferability and stealthiness of adaptive or learnable triggers are open problems (Section VI Limitations).
   • Future work should develop detection and robust training methods specific to clustering, including trigger-invariant representation learning, robust assignment regularization, and screening of poisoned samples in unlabeled data (Section VI Limitations).
   • Knowledge distillation can only mitigate, not fully remove, the learned trigger bias; the residual ACC gap indicates that some triggered samples are still assigned to the wrong clusters (Section V-H, abstract).
   • The authors describe this work as dual-use research and state that any release of attack details or code should be accompanied by defensive guidance and evaluation safeguards (Section VI Limitations).

   Scope of the experiments

   • The models tested are 4 contrastive clustering frameworks: CC, VTCC, SACC, and PCLC, with CC as the main victim model (Section V-A, V-D).
   • The datasets are 3 image clustering benchmarks: ImageNet-10, ImageNet-Dogs, and STL-10 (Table I).
   • Poisoning rates cover 5%, 10%, 15%, and 20%; the attack scope experiments are single-class and multi-class poisoning on ImageNet-10 (Section V-B, V-C).
   • Defense evaluation includes only one strategy based on knowledge distillation, using about 10% manually screened clean unlabeled subset and distilling for 50 epochs (Section V-H).
   • The paper does not report the number of repetitions, variance, or statistical significance tests for each experiment; the threat model includes a black-box setting, but the experimental section does not report black-box transfer experiments based on a surrogate model.

   Collapse this answer

6. 06Summarize the main content of the paper

   HBDCC is a data poisoning backdoor attack against deep contrastive clustering; a low poisoning rate can substantially distort the clustering results for triggered inputs, and distillation can only partially mitigate it.

   A backdoor attack paper targeting deep contrastive clustering, with a distillation mitigation strategy.

   • Problem: The authors believe deep contrastive clustering is commonly trained on unlabeled data from weakly audited sources, and its security under training-time poisoning has been largely unstudied; the target-label assumption of supervised backdoors does not apply to unlabeled clustering.
   • Method: HBDCC injects a small number of samples with HTBA-style triggers into the unlabeled training set (poisoning rate 5%–20%), uses instance-level contrastive alignment and cluster-level consistency to form a "double amplification" of the trigger that persists under augmentation, and implants the trigger as a structural bias in the representation space; adding the trigger at inference time activates it, causing cross-class confusion and class splitting. The attack is data-only, requires no label access, and does not modify the victim training pipeline.
   • Main results: With CC as the victim model, 10% poisoning, and the multi-class setting, ImageNet-10 triggered ACC drops from 88.4 to 73.3, ImageNet-Dogs drops to 10.1, and STL-10 drops to 10.4, while clean ACC on ImageNet-10 remains 88.4–90.2 (Table III); a control shows the trigger itself has almost no effect on the clean model (Table II).
   • Transfer and ablation: The same poisoning strategy causes clear degradation on VTCC, SACC, and PCLC (VTCC triggered ACC 28.8; PCLC is relatively the most robust at 70.9, Table V); multi-class poisoning causes more damage than single-class poisoning; trigger type, size (50×50 strongest), and carrier all affect attack strength.
   • Defense: Knowledge distillation-based mitigation (clean teacher, about 10% clean unlabeled data, 50 epochs) restores ImageNet-10 triggered ACC from 73.3 to 85.8, but the authors emphasize this is only mitigation, not a complete solution.
   • Authors' conclusion: The authors state that contrastive clustering models have an intrinsic vulnerability to backdoor attacks, and that the security of clustering systems should be regarded as an important dimension beyond clustering accuracy; limitations include being restricted to representative image benchmarks and handcrafted triggers, with clustering-specific detection and robust training left for future work.

   Collapse this answer

Related papers