Attention Hijacking: Backdooring Text Dataset Distillation via Semantic Anchors

Dataset Distillation has emerged as a promising technique for compressing large-scale datasets into compact synthetic sets while preserving model performance. However, the security implications of this paradigm, particularly within the Transformer-based text classification domain, remain underexplored. In this paper, we identify "Distilled Attention Labels" as a pivotal yet overlooked vulnerability. We propose Attention Hijacking (AH), a stealthy backdoor attack that manipulates the bi-level optimization process to explicitly hijack the attention mechanism of target models via synthetic data. Distinct from traditional poisoning that often compromises clean accuracy, AH achieves stealthiness without utility degradation. To explain this, we formulate the "Semantic Anchoring Hypothesis", characterizing the interaction between trigger semantics and attack mechanisms. We demonstrate that AH functions as a semantic-adaptive mechanism: when triggers align with domain-specific semantic anchors (e.g., "film" in sentiment analysis), our method achieves a synergistic effect, boosting both attack success rates (>99%) and clean test accuracy. Conversely, for functional or noise triggers, AH enforces attention segregation to prevent utility collapse, maintaining exceptional robustness where baseline attacks fail. Extensive experiments across multiple datasets and varying model scales—ranging from BERT-Tiny to BERT-Base—validate the scalability and dominance of AH. Our findings reveal that attention-based distillation is a double-edged sword, underscoring the urgent need for robust defenses in the era of data-efficient learning.

Machine learning models require massive amounts of data, leading researchers to use "dataset distillation" to compress huge datasets into tiny, synthetic versions. But are these compressed datasets secure when training AI to understand text? We discovered a hidden vulnerability in how these synthetic datasets guide AI to focus on important words. We developed "Attention Hijacking", a stealthy digital trap (a backdoor) hidden inside the compressed data. Traditional data poisoning attacks usually damage the model's regular performance, making them easy to detect. Our attack avoids this by cleverly linking the secret trigger to relevant concepts—like using the word "film" to hack a movie review system. Surprisingly, this tricks the model into performing its normal tasks even better, keeping the hack completely invisible. If a random or noisy trigger word is used, the attack neatly isolates itself so the model doesn't break. Our research demonstrates that while compressing AI data is highly efficient, it creates invisible pathways for manipulation. This highlights an urgent need for stronger security measures before deploying these data-efficient models in the real world.