Research map / Adversarial robustness and security / Backdoor and poisoning
Defending Against Patch-Based Backdoor Attacks on Self-Supervised Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Filter suspected poisoned samples with PatchSearch | MoCo-v3 ViT-B trained on poisoned ImageNet-100 · ImageNet-100 val, patched data, poison rate 0.5% | accuracy: 46.9 -> 64.5 | Helped |
| Filter suspected poisoned samples with PatchSearch | MoCo-v3 ViT-B trained on poisoned ImageNet-100 · ImageNet-100 val, patched data, poison rate 1.0% | FP: 2535.9 -> 76.0 | Helped |
| Combine PatchSearch filtering with i-CutMix | MoCo-v3 ViT-B trained on poisoned ImageNet-100 · ImageNet-100 val, patched data, poison rate 0.5% | FP: 39.8 -> 19.0 | Helped |
| Apply i-CutMix during training | Poisoned MoCo-v3 ViT-B · ImageNet-100 val, patched data, poison rate 0.5% | FP: 1708.9 -> 242.2 | Helped |
| Use i-CutMix composite-image augmentation and weighted loss | MoCo-v3 ViT-B · ImageNet-100 val, patched data, Rottweiler target | FP: 1412.4 -> 268.4 | Helped |
| Add weighted loss to i-CutMix rather than one-hot loss (ablation) | MoCo-v3 ViT-B with composite-image augmentation · ImageNet-100 val, patched data, Rottweiler target | FP: 104.2 -> 268.4 | Hurt |
| Paste a crop from a random image rather than a black box (ablation) | MoCo-v3 ViT-B with i-CutMix · ImageNet-100 val, patched data, Rottweiler target | FP: 1333.0 -> 268.4 | Helped |
| Paste a crop from a random image rather than random noise (ablation) | MoCo-v3 ViT-B with i-CutMix · ImageNet-100 val, patched data, Rottweiler target | FP: 1480.0 -> 268.4 | Helped |
| Apply PatchSearch to clean training data (ablation) | Clean MoCo-v3 ViT-B · ImageNet-100 val, clean data | accuracy: 70.5 -> 69.2 | Hurt |
| Use a poison classifier after candidate ranking (ablation) | PatchSearch on CIFAR-10 · CIFAR-10 patched data | FP | No clear effect |
| Increase samples scored per cluster in iterative search (ablation) | PatchSearch · ImageNet-100, poison detection, ViT-B MoCo-v3 | top-20 poison accuracy: 80.0 -> 100.0 | Helped |
| Increase the flip test set size (ablation) | PatchSearch · ImageNet-100, Ambulance target | top-20 poison accuracy: 5.0 -> 80.0 | Helped |
Closest papers by meaning
- Invisible Backdoor Attack against Self-supervised Learning (CVPR 2025 · similarity 0.90)
- Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.87)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.87)
- DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders (CVPR 2025 · similarity 0.87)
- Protecting against simultaneous data poisoning attacks (ICLR 2025 · similarity 0.87)
- Detecting Backdoor Attacks in Federated Learning via Direction Alignment Inspection (CVPR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.