Research map / Adversarial robustness and security / Backdoor and poisoning
Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MSPC, a mask-aware scaled-prediction-consistency loss within a bi-level data-splitting optimization that identifies backdoor training samples without clean data or a manual threshold.
Problem
Automatically identifying backdoor (poisoned) samples within a poisoned training set without additional clean data and without manually setting a detection threshold.
Approach
Revisits scaled prediction consistency (SPC), shows its failure modes (trigger vanishing under scaling, blending, clean objects robust to scaling), and introduces a mask-aware SPC loss (MSPC) with a shift tau, optimized via a bi-level data-splitting formulation where a lower-level KL-based mask optimization is followed by an upper-level sample split; samples with MSPC loss > 0 are flagged as backd
Key results
- Average AUROC on CIFAR-10 across 8 attacks is 0.8941 for the proposed method versus 0.6563 for SPC, 0.7937 for ABL, 0.7212 for SD-FCT and 0.8457 for STRIP.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use the proposed MSPC-based identification method instead of STRIP | Backdoor data identification · CIFAR10 average across attacks | AUROC: 0.8457 -> 0.8941 | Helped |
| Use the proposed MSPC-based identification method instead of STRIP | Backdoor data identification · Tiny Imagenet average across attacks | AUROC: 0.9972 -> 0.9961 | Hurt |
| Use the proposed MSPC-based identification method instead of ABL | Backdoor data identification · Imagenet200 average across attacks | AUROC: 0.9437 -> 0.9908 | Helped |
| Use the proposed MSPC-based identification method instead of the baselines | Backdoor data identification · CIFAR10, Tiny Imagenet, and Imagenet200 | AUROC | Mixed |
Surprising findings
- The method performs poorly on DFST (CIFAR-10 AUROC 0.5750), below several baselines.
- Retraining on only the identified clean samples does not reliably remove the backdoor; ASR can remain high for Wanet on CIFAR-10 and Blend on Tiny-ImageNet and ImageNet200.
Limitations
- Underperforms on DFST attack, which the authors acknowledge as a limitation.
- Relies on an alternating optimization approximation of the bi-level problem and the assumption that the mask captures the trigger's effective part.
- Requires a fixed shift tau and scaling set chosen by hand; ablation on tau is only in appendix.
Experimental setup
Datasets: CIFAR-10 Tiny-ImageNet ImageNet200
Benchmarks: CIFAR-10 Tiny-ImageNet ImageNet200
Metrics: AUROC TPR FPR ASR
Baselines: SPC ABL SD-FCT STRIP
Builds on: scaled prediction consistency (SPC) cognitive distillation Meta-SIFT
Closest papers by meaning
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.89)
- Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.89)
- Data Free Backdoor Attacks (NeurIPS 2024 · similarity 0.88)
- Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models (NeurIPS 2024 · similarity 0.88)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.88)
- Protecting against simultaneous data poisoning attacks (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.