Research map / Adversarial robustness and security / Backdoor and poisoning
DeDe: Detecting Backdoor Samples for SSL Encoders via Decoders
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DeDe, a non-invasive inference-time detector that trains a decoder to invert an SSL encoder's embedding-to-image mapping and flags inputs whose reconstruction error is large as backdoor-triggered.
Problem
Detecting backdoor-triggered samples at inference time for self-supervised encoders (contrastive learning and CLIP), where stealthy embedding-level and imperceptible image-level triggers evade existing defenses such as DECREE and ASSET.
Approach
Train a decoder that inverts the victim encoder using the global embedding plus a few visible patches (MAE-style masking); triggered inputs mapped to a target-class embedding reconstruct to images inconsistent with the input, so reconstruction error flags backdoor activation.
Key results
- DeDe achieves AUC 0.981 on BadEncoder, 0.997 on DRUPE and 1.0 on CLIP-Backdoor (TPR 100%, FPR 0%) in balanced detection, outperforming DECREE and ASSET.
- On downstream filtering, DeDe reduces ASR on CLIP Backdoor to 0.0% and CTRL to 4.8%, versus 53.7% and 49.3% for ASSET.
- DeDe reaches AUC 0.912 on CTRL and 0.925 on BadCLIP, where ASSET gets 0.799 and 0.773 respectively.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DeDe instead of ASSET for sample detection | BadEncoder · BadEncoder detection | AUC: 0.978 -> 0.981 | Helped |
| Use DeDe instead of ASSET for sample detection | CTRL · CTRL detection | AUC: 0.799 -> 0.912 | Helped |
| Use DeDe instead of ASSET for sample detection | DRUPE · DRUPE detection | AUC: 0.858 -> 0.997 | Helped |
| Use DeDe instead of ASSET for sample detection | CLIP Backdoor · CLIP Backdoor detection | AUC: 0.555 -> 1.0 | Helped |
| Use DeDe instead of ASSET for sample detection | BadCLIP · BadCLIP detection | AUC: 0.773 -> 0.925 | Helped |
| Use DeDe filtering instead of ASSET filtering | BadEncoder · BadEncoder downstream task | ASR: 55.3 -> 1.3 | Helped |
| Use DeDe filtering instead of ASSET filtering | CTRL · CTRL downstream task | ASR: 49.3 -> 4.8 | Helped |
| Use DeDe filtering instead of ASSET filtering | DRUPE · DRUPE downstream task | ASR: 53.7 -> 2.1 | Helped |
| Use DeDe filtering instead of ASSET filtering | CLIP Backdoor · CLIP Backdoor downstream task | ASR: 98.3 -> 0.0 | Helped |
| Use DeDe filtering instead of ASSET filtering | BadCLIP · BadCLIP downstream task | ASR: 97.4 -> 30.5 | Helped |
| Train DeDe with OoD auxiliary data instead of in-distribution auxiliary data (ablation) | DeDe · BadEncoder detection | AUC: 0.981 -> 0.993 | Helped |
| Train DeDe with OoD auxiliary data instead of in-distribution auxiliary data (ablation) | DeDe · CTRL detection | AUC: 0.912 -> 0.911 | No clear effect |
Surprising findings
- Clean-model downstream ASR rises when the downstream training set is poisoned, indicating the baseline itself is sensitive to contaminated data.
- DeDe's performance drops on BadCLIP downstream (ASR 30.5%) relative to other attacks, and DECREE fails on non-patch triggers.
Limitations
- Performance degrades on stealthier attacks such as BadCLIP and CTRL relative to patch-trigger attacks (AUC around 0.91-0.93).
- Requires a clean or slightly poisoned auxiliary dataset to train the decoder, and the threshold is set heuristically at 1.5x average training loss.
- DECREE baseline had to be adapted to per-sample scoring, so comparisons depend on this modification.
Experimental setup
Datasets: CIFAR-10 ImageNet STL-10 GTSRB SVHN CC3M
Benchmarks: CIFAR-10 GTSRB SVHN
Metrics: TPR FPR AUC clean accuracy attack success rate
Baselines: DECREE ASSET
Builds on: MAE SimCLR ASSET DECREE
Closest papers by meaning
- Invisible Backdoor Attack against Self-supervised Learning (CVPR 2025 · similarity 0.89)
- Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Models (CVPR 2025 · similarity 0.89)
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · similarity 0.86)
- Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.86)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.86)
- LT-Defense: Searching-free Backdoor Defense via Exploiting the Long-tailed Effect (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.