Research map / Adversarial robustness and security / Backdoor and poisoning
Few-Shot Backdoor Defense Using Shapley Estimation
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply Shapley-guided pruning using a reversed trigger | poisoned models · BadNets across MNIST, CIFAR10, GTSRB, and YouTubeFace | ASR: MNIST: 100.00 -> 0.34; CIFAR10: 99.57 -> 0.06; GTSRB: 99.60 -> 0.49; YouTubeFace: 99.82 -> 0.35 | Helped |
| apply Shapley-guided pruning using a reversed trigger | poisoned models · Input-Aware, Trojan, Physical Key, and WaNet attacks | ASR: Input-Aware: 99.37 -> 0.15; Trojan: 92.06 -> 0.98; Physical Key: 100.00 -> 0.60; WaNet: 98.10 -> 0.93 | Helped |
| apply Shapley-guided pruning | poisoned ResNet models · GTSRB ResNet-18 and YouTubeFace ResNet-34 | ASR: ResNet-18: 100.00 -> 0.48; ResNet-34: 99.98 -> 0.07 | Helped |
| use ShapPruning with recovered images in the data-free setting | poisoned models · CIFAR10, CIFAR100, and Trojan Attack | ASR: CIFAR10: 100.00 -> 0.90; CIFAR100: 99.98 -> 0.89; Trojan Attack: 92.06 -> 0.14 | Helped |
| use the original trigger instead of the reversed trigger (ablation) | ShapPruning · BadNets on MNIST | ASR: 0.34 -> 0.56 | No clear effect |
| use the original trigger instead of the reversed trigger (ablation) | ShapPruning · BadNets on CIFAR10 | ASR: 0.06 -> 0.03 | No clear effect |
| use the original trigger instead of the reversed trigger (ablation) | ShapPruning · BadNets on GTSRB and YouTubeFace | ASR: GTSRB: 0.49 -> 0.46; YouTubeFace: 0.35 -> 0.34 | No clear effect |
| use the original trigger instead of the reversed trigger (ablation) | ShapPruning · Input-Aware, Trojan, Physical Key, and WaNet attacks | ASR: Input-Aware: 0.15 -> 0.24; Trojan: 0.98 -> 0.64; Physical Key: 0.60 -> 0.08; WaNet: 0.93 -> 0.32 | Mixed |
| use the original trigger instead of the reversed trigger (ablation) | ShapPruning · GTSRB ResNet-18 and YouTubeFace ResNet-34 | ASR: ResNet-18: 0.48 -> 0.20; ResNet-34: 0.07 -> 0.05 | Mixed |
| use epsilon-greedy rather than T-MAB for Shapley estimation | ShapPruning · top-50 neuron identification | neurons among actual top-70: 27 -> 46 | Helped |
| increase clean examples per class | ShapPruning · multiple datasets and attacks | backdoor mitigation performance | Helped |
Closest papers by meaning
- Backdoor Defense via Test-Time Detecting and Repairing (CVPR 2024 · similarity 0.90)
- Backdoor Mitigation via Invertible Pruning Masks (NeurIPS 2025 · similarity 0.87)
- Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · similarity 0.87)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.85)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.85)
- Adversarial Feature Map Pruning for Backdoor (ICLR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.