Abstract: Model backdoor attacks traditionally hide triggers within model parameters,activating predetermined outputs when specific samples are presented.However,such methods are vulnerable to defense techniques like parameter pruning,making backdoors difficult to trigger.This paper introduces a novel approach based on feature distribution for backdoor triggering,creating a structure-based backdoor independent of model parameters,achieving high concealment and robustness.Firstly,distribution-based triggers in the model’s feature space are used to generate backdoor images,enabling more stable backdoor activation and improving attack reliability.Secondly,a backdoor structure consisting of a distribution detector and backdoor register is embedded within target layers.This structured backdoor doesn’t rely on model parameters,significantly enhancing robustness and resis-tance to detection.Finally,the distribution detector extracts distribution-based trigger patterns while the backdoor register activates and contaminates model features,ensuring precise backdoor triggering under expected conditions for more targeted effects.Experimental results demonstrate that the proposed method maintains a 100% attack success rate even after 20 rounds of para-meter modifications and can evade multiple advanced backdoor detection mechanisms.

Key words: Backdoor attack, Deep neural networks, Machine learning, Robustness, Security of model