With the successful transition of Transformers from natural language processing (NLP) to computer vision (CV) domains, Vision Transformers (ViTs) have achieved state-of-the-art performance in many CV tasks. However, backdoor attacks, a significant threat in deep learning, also pose a risk to the security of ViT models. Recently, several backdoor attack methods targeting the patch-level self-attention mechanism in ViTs have been proposed, but they are relatively naive in terms of stealthiness and robustness against defensive measures, lacking in-depth investigation. In this paper, we explore the crucial role of attention-level imperceptibility in backdoor attacks for ViTs and propose an Attention-Imperceptible Backdoor Attacks on Vision Transformers (AIBA). In AIBA, a constrained adversarial perturbation is used as the trigger to achieve visual imperceptibility. Additionally, the trigger is designed to seamlessly implant into the focal areas of the image, ensuring that the trigger receives enough attention from the model without causing anomalies at the attention level. During the backdoor learning process, we designed an efficient constrained bi-level optimization training strategy at the mini-batch level to implant an effective backdoor in the victim model using the imperceptible trigger. We evaluated the effectiveness of the proposed AIBA across multiple datasets and ViT benchmarks and explored the robustness of AIBA against current ViT-specific defense methods. The experimental results demonstrate that our backdoor attack method can successfully implant a powerful and stealthy backdoor into ViTs.

Knowledge Distillation (KD) has attracted considerable attention as a typical model compression and knowledge transfer paradigm. However, most KD approaches are predicated on the implicit assumption: the deployed student model will exclusively encounter classes that have been seen during training, which goes against most real-world scenarios with unseen classes. To this end, we formalize the open-set KD task, where known classes are visible during training and unseen open-set classes appear when testing. We analyze the potential challenges of openset KD from the discriminability of embedding space and the semantic separability of label space. Then we propose a Frequency-Spatial Margin Perception (FSMP) framework composed of a frequency-spatial feature distillation paradigm and a semantic margin-based calibration strategy. Experiments on multiple benchmarks demonstrate that FSMP consistently improves both the closed-set and open-set performance of existing KD methods across homogeneous and heterogeneous frameworks.