Research map / Label-efficient and robust learning / OOD and anomaly detection
PSBD: Prediction Shift Uncertainty Unlocks Backdoor Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PSBD, which detects backdoor training samples by measuring Prediction Shift Uncertainty (confidence change when dropout is toggled at inference) using a small set of label-free clean validation data.
Problem
Identifying poisoned (backdoor) samples within a suspicious training dataset, with high true positive rate and low false positive rate, without knowledge of the attack.
Approach
Observes that poisoned models' predictions on clean data shift toward a specific label under inference-time dropout while backdoor samples resist the shift; defines Prediction Shift Uncertainty as the drop in predicted-class confidence with dropout versus without, and flags samples with low PSU as backdoored.
Key results
- PSBD achieves average TPR 0.994 with FPR 0.136 on CIFAR-10, versus best baseline average TPR 0.899 (CD-L) for that dataset.
- On GTSRB, PSBD achieves average TPR 0.955 and FPR 0.192, while Spectral Signature and Spectre fail completely.
- On Tiny ImageNet, PSBD achieves average TPR 0.929 and FPR 0.121, while most baselines fail in most attack scenarios.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use PSBD instead of the strongest reported baseline | Backdoor training-data detection · CIFAR-10, average across attacks | TPR: 0.994 vs 0.832 | Helped |
| Use PSBD instead of the strongest reported baseline | Backdoor training-data detection · GTSRB, average across attacks | TPR: 0.955 vs 0.614 | Helped |
| Use PSBD instead of the strongest reported baseline | Backdoor training-data detection · Tiny ImageNet, average across attacks | TPR: 0.929 vs 0.734 | Helped |
| Use inference-phase dropout and PSU to detect backdoor training samples | PSBD · CIFAR-10, GTSRB, and Tiny ImageNet | TPR: 0.994/0.136; 0.955/0.192; 0.929/0.121 | Helped |
| Rely on MC-Dropout standard-deviation uncertainty rather than PSBD's prediction-shift uncertainty | Backdoor detection · CIFAR-10 with WaNet | backdoor-data uncertainty separation | Hurt |
| Use data augmentation during model training | PSBD on Tiny ImageNet · Tiny ImageNet | backdoor-detection performance | Helped |
Surprising findings
- MC-Dropout standard-deviation uncertainty fails to separate backdoor from clean data under WaNet, where backdoor uncertainty sometimes matches or exceeds clean uncertainty.
Limitations
- Dropout rate p must be chosen via an adaptive strategy; sensitivity depends on the attack and is not fully resolved.
- Performance degrades on ISSBA attack on Tiny ImageNet, attributed to low model clean accuracy.
- Evaluated only on image classification with ResNet-18 and VGG; extension to NLP or time series is left to future work.
Experimental setup
Datasets: CIFAR-10 GTSRB Tiny ImageNet
Benchmarks: CIFAR-10 GTSRB Tiny ImageNet
Metrics: TPR FPR AUROC
Baselines: Spectral Signature STRIP Spectre SCAN SCP CD-L
Builds on: MC-Dropout Spectral Signatures STRIP SCAN
Closest papers by meaning
- IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency (ICML 2024 · similarity 0.87)
- Inspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks (AAAI 2024 · similarity 0.86)
- BAN: Detecting Backdoors Activated by Adversarial Neuron Noise (NeurIPS 2024 · similarity 0.86)
- Backdoor Defense via Test-Time Detecting and Repairing (CVPR 2024 · similarity 0.85)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.85)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.