Research map / Adversarial robustness and security / Backdoor and poisoning
IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IBD-PSC, an input-level backdoor detector that flags poisoned test images by checking whether their prediction confidence stays consistent when BN parameters of a backdoored model are amplified.
Problem
Detecting backdoored inputs at test time (input-level backdoor detection) with low computational cost, overcoming limitations of pixel-amplification methods like SCALE-UP that are bounded by the [0,255] pixel range and rely on implicit trigger assumptions.
Approach
Discovers parameter-oriented scaling consistency: scaling BN gamma/beta of the backdoored model keeps poisoned-sample confidences stable while benign confidences drop. IBD-PSC scales the last k BN layers (k chosen adaptively via benign error rate), averages confidence over n scaled models, and thresholds the resulting PSC value.
Key results
- On CIFAR-10, IBD-PSC achieves average AUROC 0.992 and F1 0.961 across 7 attacks, versus SCALE-UP at 0.731 AUROC and STRIP at 0.663.
- On GTSRB, IBD-PSC averages AUROC 0.969 and F1 0.962; on SubImageNet-200, average AUROC 0.990 and F1 0.974.
- Baselines fail (AUROC below 0.7) in several cases, e.g., STRIP on Blend and WaNet, while IBD-PSC stays above 0.94 AUROC on all listed attacks on CIFAR-10.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use IBD-PSC instead of TeCo | backdoor input detection · CIFAR-10, Avg. | AUROC: 0.858 -> 0.992 | Helped |
| use IBD-PSC instead of TeCo | backdoor input detection · CIFAR-10, Avg. | F1: 0.834 -> 0.961 | Helped |
| use IBD-PSC instead of TeCo | backdoor input detection · GTSRB, Avg. | AUROC: 0.907 -> 0.969 | Helped |
| use IBD-PSC instead of TeCo | backdoor input detection · GTSRB, Avg. | F1: 0.858 -> 0.962 | Helped |
| use IBD-PSC instead of TeCo | backdoor input detection · SubImageNet-200, Avg. | AUROC: 0.908 -> 0.990 | Helped |
| use IBD-PSC instead of TeCo | backdoor input detection · SubImageNet-200, Avg. | F1: 0.846 -> 0.974 | Helped |
| increase the BN parameter scaling factor ω from its initial phase (ablation) | IBD-PSC · CIFAR-10, BadNets, WaNet, and BATT | AUROC | Helped |
| use predicted-label consistency instead of confidence consistency (ablation) | IBD-PSC on CIFAR-10, BadNets · CIFAR-10, BadNets | FPR (%): 0.20 -> 0.40 | Hurt |
| scale BN layers forward from initial layers rather than backward from the last layers (ablation) | IBD-PSC · CIFAR-10, Blend | AUROC: 0.678 | Hurt |
| amplify all BN layers instead of selected later layers (ablation) | IBD-PSC · CIFAR-10, Blend | F1: 0.060 | Hurt |
Surprising findings
- Amplifying all BN layers causes detection failure against Blend, LC, and WaNet, indicating that scaling later layers is important.
- Scaled models cluster benign target-class samples into harder-to-learn classes, an unexpected behavior the authors leave unexplained.
Limitations
- Requires white-box access to the model and a small set of local benign samples (100).
- Adaptive attacks with a tuned alpha can reduce performance, e.g., WaNet AUROC drops to 0.819 at alpha=0.99.
- Theoretical analysis relies on Gaussian mixture and neural collapse assumptions.
Experimental setup
Datasets: CIFAR-10 GTSRB SubImageNet-200
Benchmarks: CIFAR-10 GTSRB SubImageNet-200
Metrics: AUROC F1 FPR inference time
Baselines: STRIP TeCo SCALE-UP Ours-L (label-consistency variant)
Builds on: SCALE-UP STRIP neural collapse
Closest papers by meaning
- PSBD: Prediction Shift Uncertainty Unlocks Backdoor Detection (CVPR 2025 · similarity 0.87)
- Backdoor Defense via Test-Time Detecting and Repairing (CVPR 2024 · similarity 0.85)
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.85)
- Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.85)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.85)
- A Theoretical Analysis of Backdoor Poisoning Attacks in Convolutional Neural Networks (ICML 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.