Research map / Adversarial robustness and security / Backdoor and poisoning
Backdoor Defense via Test-Time Detecting and Repairing
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TTBD, a two-stage test-time backdoor defense that detects poisoned samples in a batch of partially poisoned data (DDP) and prunes backdoor neurons located via Shapley estimation, without clean fine-tuning.
Problem
Backdoor removal from deployed image classifiers when the defender only has a small batch of unlabeled, partially poisoned test-time data rather than clean training data.
Approach
Detect poisoned samples via Prediction Change Score under neuron pruning (DDP), then locate backdoor neurons using Monte-Carlo Shapley estimates of ASR and ACC on the batch, pruning top ASR-Shapley and bottom ACC-Shapley neurons without any fine-tuning.
Key results
- On PreAct-ResNet18/CIFAR10, TTBD-DDP reduces average ASR to 2.32% with about 2.64% accuracy drop across 7 attacks.
- TTBD-TeCo fails on VGG19 (AUC around 0.5), whereas TTBD-DDP keeps average ASR at 2.64% on VGG19/CIFAR10.
- Under sparse, low-rate (1%) poisoning aggregated over 20 batches, TTBD-SPARSE reduces average ASR to 5.70%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DDP detection with Shapley-guided pruning | TTBD on PreAct-ResNet18 · CIFAR10, 7 attacks (average) | ASR: 88.18 -> 2.32 | Helped |
| Replace DDP detection with TeCo detection | TTBD on VGG19 · CIFAR10, 7 attacks (average) | ASR: 2.64 -> 65.59 | Hurt |
| Select random samples instead of DDP-detected poisoned samples (ablation) | TTBD on PreAct-ResNet18 · CIFAR10, 7 attacks (average) | ASR: 2.32 -> 65.23 | Hurt |
| Locate poisoned neurons by activation instead of Shapley estimation (ablation) | TTBD on PreAct-ResNet18 · CIFAR10, 7 attacks (average) | ASR: 2.32 -> 16.37 | Hurt |
| Increase the partially poisoned batch rate from 5% to 20% (ablation) | TTBD-DDP on VGG19 · CIFAR10, 7 attacks (average) | ASR: 2.79 -> 1.74 | Helped |
| Increase the partially poisoned batch size from 50 to 200 (ablation) | TTBD-DDP on VGG19 · CIFAR10, 7 attacks (average) | ASR: 2.62 -> 2.06 | Helped |
| Aggregate 20 batches and combine TeCo with DDP under sparse 1% poisoning (ablation) | TTBD-SPARSE · CIFAR10, PreAct-ResNet18; 7 attacks (average) | ASR: 88.18 -> 5.70 | Helped |
| Use TTBD-DDP on Tiny-ImageNet | PreAct-ResNet18 · Tiny-ImageNet, 6 attacks (average) | ASR: 99.01 -> 2.11 | Helped |
Surprising findings
- TeCo's detection is near chance (AUC about 0.5) on VGG models, so its detector fails across architectures.
- Pruning random samples (TTBD-RAND) still reduces ASR on average, indicating that the pruning procedure itself removes some backdoor effect.
Limitations
- Performance depends on the accuracy of poisoned-sample detection, which can misclassify samples.
- Without clean fine-tuning, accuracy drops more on Tiny-ImageNet, which has fewer redundant neurons.
- Some attacks (e.g., LF, SSBA, WaNet) needed 10% poisoning on CIFAR10 to implant a backdoor, limiting the low-rate evaluation.
Experimental setup
Datasets: CIFAR10 CIFAR100 Tiny-ImageNet
Benchmarks: CIFAR10 Tiny-ImageNet CIFAR100
Metrics: ACC ASR
Baselines: Fine-Pruning ANP DBD TeCo ShapPruning
Builds on: Fine-Pruning TeCo Adversarial Neuron Pruning ShapPruning BackdoorBench
Closest papers by meaning
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.88)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.88)
- Inspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks (AAAI 2024 · similarity 0.87)
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · similarity 0.87)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.87)
- Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.