Osmosis Distillation: Model Hijacking with Minimal Samples

The researchers propose the Osmosis Distillation (OD) attack: by mixing a small number of poisoned samples into synthetic data generated by dataset distillation, deep learning models can be hijacked in transfer learning. Evaluations across multiple datasets show that the attack achieves a high attack success rate on the hidden task while maintaining model utility on the original task, and the distilled osmosis set is effective across multiple model architectures. The authors caution against using third-party synthetic datasets in transfer learning.