Research map / Adversarial robustness and security / Backdoor and poisoning
Energy-based Backdoor Defense without Task-Specific Samples and Model Retraining
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes EBBA and EBBA+, energy-statistics methods that detect backdoored models without task-specific samples and detect poisoned images and remove backdoors via transferred energy without retraining.
Problem
Existing backdoor defenses specialize in either detection or removal, and joint methods require task-specific clean/poisoned samples for detection and model retraining for removal, which is impractical for cloud-deployed models.
Approach
Shows the attacker's target label tends to appear among top outputs for task-agnostic inputs, computes a normalized per-label energy over internet images to flag the target label; then uses normalized transferred energy under image corruptions to move poisoned samples back to their true label, followed by clustering to detect poisoned images and purify the model without retraining.
Key results
- EBBA detects the backdoored model in all 15 attack/dataset cases without poisoned or clean samples, while NC, SCALE, Unicorn, and TeCo fail in that setting.
- EBBA+ achieves PDR of about 0.95-0.98 across attacks on CIFAR-10, GTSRB, and ImageNet, competitive with or better than FTD, TeCo, and SCALE.
- EBBA+ attains the highest benign accuracy among removal methods in Table 4 (e.g., 89.92% BA on CIFAR-10 BadNets) with ASR comparable to retraining-based baselines.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply EBBA+ for backdoor removal | ResNet18 backdoored models · Cifar10, GTSRB, and ImageNet; five attacks | BA | Helped |
| Apply EBBA+ for backdoor removal | ResNet18 backdoored models · Cifar10, GTSRB, and ImageNet; five attacks | ASR | Helped |
| Use EBBA+ instead of no defense | ResNet18 on Cifar10, BadNets · Cifar10, BadNets | ASR: 99.36 -> 2.92 | Helped |
| Use EBBA+ instead of no defense | ResNet18 on GTSRB, BadNets · GTSRB, BadNets | ASR: 99.62 -> 1.79 | Helped |
| Use EBBA+ instead of no defense | ResNet18 on ImageNet, BadNets · ImageNet, BadNets | ASR: 99.22 -> 1.51 | Helped |
| Use Hierarchical Clustering for the EBBA+ image-classification stage (ablation) | EBBA+ on GTSRB · GTSRB, five attacks average | PDR: 0.972 | No clear effect |
| Use Birch clustering for the EBBA+ image-classification stage (ablation) | EBBA+ on GTSRB · GTSRB, five attacks average | PDR: 0.968 | No clear effect |
| Use Mean Shift clustering for the EBBA+ image-classification stage (ablation) | EBBA+ on GTSRB · GTSRB, five attacks average | PDR: 0.965 | No clear effect |
| Use DBSCAN clustering for the EBBA+ image-classification stage (ablation) | EBBA+ on GTSRB · GTSRB, five attacks average | PDR: 0.975 | No clear effect |
Surprising findings
- Backdoored models place the target label among top outputs even for out-of-distribution internet images without any poisoned input.
- Corrupting a poisoned image often leaves its final prediction unchanged, yet the logits shift, with the original clean label gaining energy.
Limitations
- Detection relies on a threshold lambda and a temperature hyperparameter, and removal depends on clustering of corrupted images.
- Baselines were compared under different defense settings, so comparisons are not fully uniform; some attacks evaluated only on ResNet18.
Experimental setup
Datasets: CIFAR-10 GTSRB ImageNet (subset) Internet images ESC-50 THUCnews
Benchmarks: CIFAR-10 GTSRB ImageNet
Metrics: detection binary accuracy PDR F1 score benign accuracy (BA) attack success rate (ASR)
Baselines: Neural Cleanse SCALE Unicorn TeCo FTD Fine-Pruning NAD ANP RNP ZIP MEDIC
Builds on: energy-based models (Liu et al., 2020) TeCo SCALE Neural Cleanse
Closest papers by meaning
- Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor (NeurIPS 2024 · similarity 0.87)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.87)
- Backdoor Defense via Test-Time Detecting and Repairing (CVPR 2024 · similarity 0.86)
- Data Free Backdoor Attacks (NeurIPS 2024 · similarity 0.86)
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · similarity 0.86)
- SampDetox: Black-box Backdoor Defense via Perturbation-based Sample Detoxification (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.