Research map / Label-efficient and robust learning / Self-supervised and contrastive

TrojanDec: Data-free Detection of Trojan Inputs in Self-supervised Learning

AAAI 2025 · Label-efficient and robust learning › Self-supervised and contrastive · approach: Self-supervision in supervised pipelines · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes TrojanDec, a data-free black-box framework that detects whether a test image contains a patch trojan trigger in a self-supervised encoder via masked-similarity clustering (gap statistic), and restores trojaned images with DDNM diffusion.

Problem

Trojan attacks on self-supervised image encoders propagate to downstream classifiers; defenders with only black-box query access and no clean data need a way to detect and remove triggers from individual test inputs.

Approach

Mask the test image with many random-pattern patches and measure cosine similarity of encoder features; trojaned inputs show two clusters of similarities (masks covering the trigger break the trojan behavior), so gap-statistic K-means clustering on these similarities detects trojans without clean data, and DDNM diffusion restores the masked image.

Key results

• On CIFAR10-pretrained trojaned encoders with STL10 downstream, TrojanDec reduces ASR from 100% to 1.43% while ACC stays at 73.15% (vs 73.75% without).
• Detection FPR and FNR are generally below ~1.2% across CIFAR10 and STL10 pre-training settings with SimCLR encoders.
• On real-world CLIP and ImageNet encoders, ASR drops from ~96-100% to ~0-10% with ACC changes under 1 point; TrojanDec beats Beatrix and STRIP when the defender has few clean validation images.

Measured effects reported in the paper

Surprising findings

• Neural Cleanse, MNTD and I-BAU largely fail against trojaned self-supervised encoders (e.g., I-BAU only reduces ASR to about 83-96%).
• Naive blending attacks adapted to self-supervised learning are not very successful, with large accuracy drops and low ASR on some datasets.

Limitations

• Assumes patch-based triggers; non-patch triggers are left to future work.
• Restoration adds a diffusion model step and detection performance depends on mask size k and step size s; large masks degrade FNR and ASR.
• Clean-data-free detection leaves some residual ASR (1-10%) and FPR on some settings, e.g., 3.2% on GTSRB with ImageNet encoder.

Experimental setup

Datasets: CIFAR10 STL10 SVHN EuroSAT ImageNet GTSRB ImageNet100 Caltech101

Benchmarks: CIFAR10->STL10/SVHN/EuroSAT STL10->CIFAR10/SVHN/EuroSAT ImageNet->STL10/SVHN/GTSRB CLIP->STL10/SVHN/GTSRB ImageNet100/Caltech101

Metrics: FPR FNR ACC ASR

Baselines: Beatrix STRIP Februus Neural Cleanse MNTD I-BAU

Builds on: DDNM SimCLR STRIP Beatrix Neural Cleanse

Closest papers by meaning

• Rethinking the Reverse-engineering of Trojan Triggers (NeurIPS 2022 · similarity 0.86)
• DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders (CVPR 2025 · similarity 0.84)
• Protecting Model Adaptation from Trojans in the Unlabeled Data (AAAI 2025 · similarity 0.84)
• Scanning Trojaned Models Using Out-of-Distribution Samples (NeurIPS 2024 · similarity 0.83)
• Concept-ROT: Poisoning Concepts in Large Language Models with Model Editing (ICLR 2025 · similarity 0.82)
• Deep-TROJ: An Inference Stage Trojan Insertion Algorithm through Efficient Weight Replacement Attack (CVPR 2024 · similarity 0.81)