Research map / Adversarial robustness and security / Backdoor and poisoning
Circumventing Backdoor Space via Weight Symmetry
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Two-stage Symmetry Connectivity (TSC), a post-purification backdoor defense that uses permutation invariance and quadratic Bézier mode connectivity on a small clean set to purify backdoored models across supervised and self-supervised learning.
Problem
Backdoor removal from compromised neural networks typically needs labeled data or specific training procedures, so existing post-purification defenses do not transfer to self-supervised or unsupervised learning.
Approach
Project a copy of the backdoored model into a distinct loss basin via permutation (un-alignment), train a quadratic Bézier curve between them on clean data to amplify poisoned-sample loss, then re-align and train a second curve to recover clean accuracy; repeat for several global epochs.
Key results
- On CIFAR10 TSC keeps ASR below 15% for all tested supervised attacks, reducing Blended (1% poison) ASR to 12.46% where most baselines stay above 25%.
- Under SimCLR, TSC reduces ASR to below 11% across all downstream tasks, while MCR fails on SVHN (ASR 65.58% on CIFAR10 encoder).
- Under CLIP, TSC reduces ASR to below 2% on linear probe and zero-shot evaluation, while MCR remains ineffective.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use TSC instead of MCR for backdoor purification | SimCLR encoders · SVHN downstream task | ASR: 65.58 -> 10.26 | Helped |
| Use TSC instead of MCR for backdoor purification | CLIP ResNet50 · CLIP zero-shot evaluation | ASR: 99.56 -> 0.28 | Helped |
| Use TSC instead of MCR for backdoor purification | SimCLR ResNet18 · GTSRB downstream task | ASR: 0.54 -> 1.68 | Hurt |
| Increase curve index t (up to 0.5) (ablation) | TSC · Backdoor defense | ASR | Helped |
| Increase curve index t (up to 0.5) (ablation) | TSC · Benign samples | ACC | Hurt |
| Increase global epochs E_TSC (ablation) | TSC · Backdoor defense | ASR | Helped |
| Increase global epochs E_TSC (ablation) | TSC · Benign samples | ACC | Hurt |
| Increase global epochs E_TSC (ablation) | TSC · Defense performance | stability | Helped |
| Use the first-stage curve rather than the second-stage curve | TSC · CIFAR-10 SSBA, 5% poison rate | ACC | Hurt |
| Use the first-stage curve rather than the second-stage curve | TSC · CIFAR-10 SSBA, 5% poison rate | ASR | Hurt |
Surprising findings
- MCR fails against BadEncoder attacks targeting SVHN under SimCLR, and remains ineffective on CLIP.
- SAU attains strong ASR reduction but its accuracy can fall below 70% (e.g., BadNet 1% on CIFAR10).
Limitations
- TSC occasionally trades off clean accuracy for backdoor removal.
- Requires multiple global epochs (E_TSC=3) and curve training, and the defender must know the original training procedure.
- Adaptive attacks are designed by the authors and evaluated only within their own framework.
Experimental setup
Datasets: CIFAR10 GTSRB ImageNet100 STL10 SVHN Food101 VOC2007 MS-COCO-2017
Benchmarks: CIFAR10 ImageNet100 GTSRB STL10 SVHN Food101 VOC2007
Metrics: ACC ASR
Baselines: FP NC MCR ANP FT-SAM I-BAU SAU SSL-Cleanse
Builds on: quadratic mode connectivity Garipov et al. Bézier curve mode connectivity mode connectivity repair (MCR) neuron alignment via permutation SSBA
Closest papers by meaning
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.87)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.87)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.87)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.86)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.86)
- Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.