Research map / Adversarial robustness and security / Backdoor and poisoning

Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security

ICML 2025 · Adversarial robustness and security › Backdoor and poisoning · approach: Training-time backdoor defense

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Bi-perspective Splitting Defense (BSD), an in-training backdoor defense that builds clean/poison pools without any clean seed set by combining open-set-recognition-based splitting and altruistic-model loss-based splitting.

Problem

Training benign models from poisoned datasets (in-training backdoor defense) when no additional clean subset or seed samples are available, since existing high-performing defenses depend on clean seeds.

Approach

Initializes clean/poison pools by intersecting an open-set-recognition split (target-class samples treated as unknown-known vs unknown-unknown classes, using feature distance to non-target class centers) with a loss-based split from an independent altruistic model; subsequent training uses class completion and selective dropping driven by loss discrepancy between main and altruistic models.

Key results

• BSD achieves average DER of 99.3 (CIFAR-10), 99.8 (GTSRB) and 96.2 (ImageNet) against BadNets, Blended, WaNet, outperforming ASD (98.6, 99.6, 69.0) and DBD (98.3, 80.0, 89.5) in Table 1.
• Under four additional attacks on CIFAR-10 (LC, SIG, ReFool, Narcissus), BSD attains an average DER of 98.4 versus 76.6 for ASD.
• Training cost on average is 5.06 hours versus 6.48 for ASD and 25.09 for DBD (Table 5).

Measured effects reported in the paper

Surprising findings

• ASD with a clean seed set has ASR of 100% on BadNets ImageNet and poor DER under MobileNet-v2 (46.9 average), indicating instability of baselines across backbones.

Limitations

• OSS mechanism can be evaded by attacks whose poisoned target-class samples retain consistent semantics, requiring ALS to compensate.
• Requires approximating the target label via second-most-likely predictions, which the authors note can be unstable.
• Hyperparameters alpha and beta and warm-up epochs are set manually; large alpha/beta degrade performance.

Experimental setup

Datasets: CIFAR-10 GTSRB ImageNet (30-class subset)

Benchmarks: CIFAR-10 GTSRB ImageNet (30-class subset)

Metrics: clean accuracy (CA) attack success rate (ASR) defense effectiveness rating (DER)

Baselines: Fine-pruning (FP) Neural Attention Distillation (NAD) Anti-Backdoor Learning (ABL) Decoupling-based Backdoor Defense (DBD) Adaptive Splitting-based Defense (ASD)

Builds on: Anti-backdoor learning (ABL) Decoupling-based backdoor defense (DBD) Adaptive splitting-based defense (ASD) MixMatch OpenMax

Closest papers by meaning

• IBAS:Imperceptible Backdoor Attacks in Split Learning with Limited Information (AAAI 2025 · similarity 0.87)
• Chronic Poisoning: Backdoor Attack against Split Learning (AAAI 2024 · similarity 0.86)
• From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.86)
• Protecting against simultaneous data poisoning attacks (ICLR 2025 · similarity 0.86)
• Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.86)
• Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · similarity 0.86)