Wei Lin

Model quantization has become a routine step for deploying deep neural networks on resource-constrained devices. This conversion, however, can also serve as the condition that activates a hidden backdoor: a poisoned full-precision model may behave normally before deployment but misclassify triggered inputs after quantization. Recent post-quantization defenses have been shown to effectively suppress existing quantization-conditioned backdoor attacks by exploiting the layer-wise activation offset between the full-precision and quantized models. We present Hidden Activation-Offset Learning and Low-Bit Optimization for Robust Quantization-Conditioned Backdoor Attack (HALO-QCB), a quantization-conditioned backdoor attack that treats this offset as an explicit training target rather than an accidental side effect. The method couples quantization-aware backdoor learning with activation alignment, so that triggered samples remain benign in the full-precision branch, become target-class samples in the quantized branch, and induce much smaller full-precision/quantized activation discrepancies. For low-bit deployment, we further adapt the learnable-scale and surrogate-gradient components of StableQAT to stabilize optimization under 4-bit quantization. Experiments on CIFAR-10 and Tiny-ImageNet, across convolutional neural network (CNN) and Transformer-based architectures, show that the attack remains effective after activation-correction defenses. On ResNet-18 trained on CIFAR-10, the proposed method retains 97.86% attack success rate against Layer-wise Activation Correction (LAC), showing that offset-based purification should be evaluated against adaptive attacks during compressed-model deployment.

Facial Beauty Prediction (FBP) aims to develop a machine that can automatically predict facial attractiveness. Recent advances demonstrate that deep learning models have achieved promising results in FBP tasks. However, conventional deep learning models lack the efficient ability to generalize to unseen attribute domain data, as attributes cause distribution discrepancy (asymmetry) among face data. To address this issue, we propose a simple yet effective method called MixAttr, a lightweight plug-and-play module that mixes two randomly selected feature statistics with different attributes to form a newly attributed feature. In this way, the feature space is implicitly enriched by increasing the diversity of features and mitigating the model shift caused by a single attribute, which benefits the decoupling of attributes and facial beauty prediction. Extensive experiments conducted to evaluate the properties and effectiveness of our method show that MixAttr can be flexibly inserted into existing network architectures to achieve state-of-the-art performance on different FBP benchmarks (e.g., a Pearson correlation of 0.9307 on SCUT-FBP5500). This feature mixing implicitly enriches the representation space, which is key to mitigating attribute-induced asymmetry and improving generalization. Additionally, we have also extended our method to the task of facial age estimation, demonstrating through superior experimental results that our method can also be applied to other attribute prediction tasks. We propose that distribution discrepancy in FBP can be viewed as a form of asymmetry in the feature space across different demographic groups. MixAttr mitigates this asymmetry by implicitly enriching the feature space and encouraging a more symmetric and attribute-invariant feature representation. By disentangling task-irrelevant attributes from task-oriented features, our method can improve both the accuracy and generalizability of deep models on tasks involving facial attribute prediction.

Backdoor attacks and adversarial attacks are two major security threats to deep neural networks (DNNs), with the former one is a training-time data poisoning attack that aims to implant backdoor triggers into models by injecting trigger patterns into training samples, and the latter one is a testing-time attack trying to generate adversarial examples (AEs) from benign images to mislead a well-trained model. While previous works generally treat these two attacks separately, the inherent connection between these two attacks is rarely explored. In this paper, we focus on bridging backdoor and adversarial attacks and observe two intriguing phenomena when applying adversarial attacks on an infected model implanted with backdoors: 1) the sample is harder to be turned into an AE when the trigger is presented; 2) the AEs generated from backdoor samples are highly likely to be predicted as its true labels. Inspired by these observations, we proposed a novel backdoor defense method, dubbed Adversarial-Inspired Backdoor Defense (AIBD), to isolate the backdoor samples by leveraging a progressive top-q scheme and break the correlation between backdoor samples and their target labels using adversarial labels. Through extensive experiments on various datasets against six state-of-the-art backdoor attacks, the AIBD-trained models on poisoned data demonstrate superior performance over the existing defense methods.

Adversarial training with online-generated adversarial examples has achieved promising performance in defending adversarial attacks and improving robustnes