Research map / Adversarial robustness and security / Backdoor and poisoning
BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Extracts a backdoor's functionality into a "backdoor expert" by finetuning the backdoored model on a few mislabeled clean samples, then detects backdoor inputs by combining it with a clean-finetuned auxiliary model (BaDExpert).
Problem
Post-development defense against backdoor attacks on DNNs: detecting and filtering backdoor inputs at inference time without knowledge of how the model was trained or the trigger pattern, using only a small reserved clean set.
Approach
Finetuning a backdoored model on a small set of intentionally mislabeled clean samples (label shift to (y+1) mod C) at a small learning rate erases normal functionality while keeping the backdoor, yielding a backdoor expert whose agreement with the original model (combined with a clean-finetuned auxiliary model's disagreement) flags backdoor inputs, rather than reverse-engineering triggers.</align
Key results
- On CIFAR10 across 12 attacks, BaDExpert achieves 99.0% average AUROC while the best baseline detector averages below 85%.
- As a post-development defense on CIFAR10, BaDExpert reduces average ASR to 5.1% with only a 0.9% CA drop.
- On ImageNet, BaDExpert achieves ~100% AUROC and under 5% ASR with about 0.1% CA drop.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use BaDExpert instead of the strongest listed baseline detector, SCALE-UP | CIFAR10 backdoor input detection · CIFAR10, 12 attacks average | AUROC: 83.5 -> 99.0 | Helped |
| use BaDExpert instead of NAD | CIFAR10 backdoor defense · CIFAR10, 12 attacks average | ASR: 6.7 -> 5.1 | Helped |
| use BaDExpert instead of NAD | CIFAR10 backdoor defense · CIFAR10, 12 attacks average | CA: 86.1 -> 92.3 | Helped |
| use BaDExpert instead of the other evaluated detectors | CIFAR10 backdoor input detection · CIFAR10, 12 attacks | AUROC | Helped |
| reduce the reserved clean set to 400 or 200 samples (ablation) | BaDExpert · CIFAR10, Blend | AUROC: 95% or 90% | Hurt |
| remove the backdoor expert and use only the auxiliary model (ablation) | BaDExpert · CIFAR10, Blend | AUROC: >95%; <90% when clean samples <1,000 | Hurt |
| remove the auxiliary model and use only the backdoor expert (ablation) | BaDExpert · CIFAR10, Blend | AUROC: ~95% | Hurt |
| replace the clean-finetuned auxiliary model with an NAD-repaired model (ablation) | BaDExpert · CIFAR10 | AUROC: 98.8% | No clear effect |
| vary the unlearning learning rate from 5·10⁻⁵ to 5·10⁻³ (ablation) | BaDExpert · CIFAR10, diverse attacks | AUROC: 5·10⁻⁵ to 5·10⁻³ | No clear effect |
| use random or soft-label mislabeling instead of neighboring-class label shifts (ablation) | backdoor functionality extraction and BaDExpert · diverse attacks | defense effectiveness | No clear effect |
| apply BaDExpert against adaptive attacks rather than standard attacks | BaDExpert · adaptive backdoor attacks | AUROC: 99.0% -> 87.0% | Hurt |
| use BaDExpert against BaDExpert-Adap-BadNet rather than standard attacks | BaDExpert · BaDExpert-Adap-BadNet | AUROC: 87.0% | Hurt |
Surprising findings
- Finetuning a backdoored model on a few mislabeled clean samples erases normal functionality while the backdoor remains intact, and this holds across mislabeling strategies.
Limitations
- Empirical defense with no certified guarantee.
- Adaptive attacks that tie backdoor to normal functionality or use asymmetric triggers reduce AUROC (e.g., to 87.0% for BaDExpert-Adap-BadNet).
- Requires a small reserved clean set and a learning-rate sensitivity to tune.
Experimental setup
Datasets: CIFAR10 GTSRB ImageNet
Benchmarks: CIFAR10 GTSRB ImageNet
Metrics: AUROC clean accuracy attack success rate
Baselines: STRIP Frequency SCALE-UP AC FP NC MOTH NAD
Builds on: STRIP NAD Confusion Training Neyman-Pearson lemma
Closest papers by meaning
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.89)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.89)
- BAN: Detecting Backdoors Activated by Adversarial Neuron Noise (NeurIPS 2024 · similarity 0.89)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.89)
- Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.88)
- Inspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks (AAAI 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.