HBDCC: a hidden backdoor attack against deep contrastive clustering
Start here
The researchers propose a hidden backdoor attack against deep contrastive clustering, HBDCC: poisoning a small number of unlabeled training samples makes the model cluster normally on clean data, and only when a trigger is encountered at inference does it severely distort the clustering results. "Hidden" means that the association between the trigger and the cluster lies dormant on clean inputs and is activated only at inference, rather than being visually imperceptible; the attack exploits structural weaknesses of contrastive clustering, the trigger is repeatedly reinforced in cross-view instance-level alignment, and it is consolidated by the cluster-level consistency objective.
Generated by AI from reports · Updated 17 days ago
Attention and developments
Attention, hourly
Now 27, 0% in 24 hours·Peak 27 (Nov 6 04:00)
Related research
This event's paper
- Hidden Backdoor Attack on Deep Contrastive Clustering
arXiv · 2026-10-23 · Deep reading
Progress timeline
- arXiv: Adversarial Attacks, Backdoors & PoisoningHBDCC: A Hidden Backdoor Attack Against Deep Contrastive Clustering
The researchers propose HBDCC, a hidden backdoor attack against deep contrastive clustering: poisoning a small number of unlabeled training samples allows the model to maintain normal clustering behavior on clean data, producing severely distorted clustering results only when a trigger is encountered at inference time. Here "hidden" means that the association between the trigger and the cluster is behaviorally dormant on clean inputs and activates only at inference, rather than the trigger being visually imperceptible. The attack exploits inherent structural weaknesses of contrastive clustering: persistent triggers can be repeatedly reinforced in instance-level alignment across different views and further consolidated by the cluster-level consistency objective. The paper evaluates on ImageNet-10, ImageNet-Dogs, and STL-10 with representative contrastive clustering frameworks; clustering performance on triggered samples drops significantly, with the degree varying by dataset, while maintaining sufficient clean-data utility to evade standard evaluation protocols; the paper also provides a two-level analysis of the backdoor implantation mechanism and studies the poisoning ratio, attack scope, trigger type, trigger size, and a lightweight knowledge-distillation-based mitigation strategy.