Research map / Adversarial robustness and security / Backdoor and poisoning
Adversarial Feature Map Pruning for Backdoor
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Adversarial Feature Map Pruning (FMP), a data-free backdoor defense that reverse-generates per-feature-map adversarial inputs, prunes the feature maps whose inputs yield lowest accuracy, and fine-tunes on a clean subset.
Problem
Backdoor attacks embed hidden triggers in DNNs; reverse-engineering defenses like Neural Cleanse fail to reproduce complex or invisible triggers, and defenders lack backdoor samples to locate backdoor feature maps.
Approach
Instead of reproducing the trigger, generate per-feature-map adversarial perturbations (FRG, an FGSM-style attack at feature-map level), evaluate model accuracy on those inputs for each feature map, prune the feature maps with the lowest accuracy (suspected backdoor maps), then fine-tune on a clean subset.
Key results
- On CIFAR-10 (BadNets, Blended, Low Frequency, SSBA, WaNet), FMP reaches average ASR 2.86% and average RA 87.40%, versus the best baseline NAD-level averages of 22.06% ASR (Table 1).
- On CIFAR-100, FMP attains average ASR 0.25% and RA 60.20%; on GTSRB, average ASR 0.32% and RA 89.44%.
- Under BadNets on CIFAR-10, FMP gives ASR 1.67% vs. 50.96% for AEVA and 73.36% for ANP, and ASR 5.61% for ABS at the best of the other defenses in the appendix tables.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FMP rather than NAD | Backdoor defense on CIFAR-10 · CIFAR-10 (AVG) | ASR: 22.06 -> 2.86 | Helped |
| Use FMP rather than NAD | Backdoor defense on CIFAR-10 · CIFAR-10 (AVG) | robust accuracy: 70.48 -> 87.40 | Helped |
| Use FMP rather than the lowest-average-ASR baseline, NC | Backdoor defense on CIFAR-100 · CIFAR-100 (AVG) | ASR: 1.39 -> 0.25 | Helped |
| Use FMP rather than NAD | Backdoor defense on CIFAR-100 · CIFAR-100 (AVG) | robust accuracy: 44.43 -> 60.20 | Helped |
| Use FMP rather than the lowest-average-ASR baseline, NC | Backdoor defense on GTSRB · GTSRB (AVG) | ASR: 2.69 -> 0.32 | Helped |
| Use FMP rather than NAD | Backdoor defense on GTSRB · GTSRB (AVG) | robust accuracy: 44.00 -> 89.44 | Helped |
| Increase the clean retraining data ratio from 5% to 100% (ablation) | FMP on CIFAR-10 with BadNets · CIFAR-10, BadNets | ASR: 1.77 -> 0.9 | Helped |
| Increase the clean retraining data ratio from 5% to 100% (ablation) | FMP on CIFAR-10 with BadNets · CIFAR-10, BadNets | accuracy: 86.57 -> 92.02 | Helped |
| Increase epsilon from 1/255 to 16/255 (ablation) | FMP on CIFAR-10 with BadNets · CIFAR-10, BadNets | accuracy: 91.67 -> 88.01 | Hurt |
| Increase epsilon from 1/255 to 16/255 (ablation) | FMP on CIFAR-10 with BadNets · CIFAR-10, BadNets | ASR: 1.67 -> 1.41 | Mixed |
| Set p to 2 rather than 64 (ablation) | FMP on CIFAR-10 with BadNets · CIFAR-10, BadNets | accuracy: 91.67 -> 65.57 | Hurt |
| Set p to 2 rather than 64 (ablation) | FMP on CIFAR-10 with BadNets · CIFAR-10, BadNets | robust accuracy: 91.71 -> 65.52 | Hurt |
Surprising findings
- Higher poison rates did not yield higher ASR for FMP; ASR stayed roughly constant from 0.1% to 10% poison rate.
- Baseline results are inconsistent across datasets; e.g., NC gets 34.63% RA on BadNets for CIFAR-100 but much lower on CIFAR-10.
Limitations
- Pruning p=2 (50% of feature maps) severely degrades accuracy, so pruning strength must be tuned.
- Evaluation limited to one architecture (PreActResNet18) and three image datasets with BackdoorBench attacks.
- Only a set of five attacks evaluated; the paper's method description and hyperparameters (steps, alpha) are incomplete.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 GTSRB
Benchmarks: CIFAR-10 CIFAR-100 GTSRB
Metrics: clean accuracy attack success rate robust accuracy
Baselines: Fine-tuning (FT) Fine-Pruning (FP) Adversarial Neuron Pruning (ANP) Channel Lipschitz Pruning (CLP) Neural Attention Distillation (NAD) Neural Cleanse (NC) AEVA RNP DeepInspect TABOR ABS
Builds on: Fine-Pruning Neural Cleanse FGSM BackdoorBench
Closest papers by meaning
- Backdoor Mitigation via Invertible Pruning Masks (NeurIPS 2025 · similarity 0.88)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.87)
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · similarity 0.87)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.87)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.87)
- Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.