Research map / Adversarial robustness and security / Backdoor and poisoning
Defending Neural Backdoors via Generative Distribution Modeling
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Model the valid trigger distribution with MESA rather than use a single reversed trigger | Backdoor retraining defense · CIFAR-10, 51 black-white 3×3 triggers | after-defense ASR, worst case: 5.9% vs over 51% | Helped |
| Use MESA distribution-based defense instead of the single reversed-trigger baseline | Backdoor retraining defense · CIFAR-10, original triggers | ASR after defense: 1.2%~5.9% vs 2.4%~51.4% | Helped |
| Use MESA defense with β=0.9 | Backdoor retraining defense · CIFAR-10, 51 black-white 3×3 triggers | average after-defense ASR: 3.4% | Helped |
| Set entropy weight α too small (α=0) (ablation) | MESA trigger generator · CIFAR-10 trigger-distribution modeling | coverage of valid trigger set | Hurt |
| Set entropy weight α too large (α=10) (ablation) | MESA trigger generator · CIFAR-10 trigger-distribution modeling | average ASR of generated triggers | Hurt |
| Vary β across 0.5, 0.8, and 0.9 and ensemble the sub-models (ablation) | MESA defense · CIFAR-10, 51 black-white 3×3 triggers | after-defense ASR: below 9.1% | No clear effect |
| Use the ensemble rather than a single MESA sub-model (ablation) | MESA defense · CIFAR-10 black-white and random-color triggers; CIFAR-100 random-color triggers | after-defense ASR | No clear effect |
| Apply the method to random-color triggers rather than the black-white trigger set (ablation) | MESA defense · CIFAR-10 and CIFAR-100 | average after-defense ASR: ~2% vs ~4% | Helped |
| Use MESA trigger distributions to identify the attack target class | MESA · CIFAR-10, 51 black-white 3×3 triggers | average ASR of reversed trigger distribution: above 94.3% for the true target class; below 5.8% for other classes | Helped |
Closest papers by meaning
- Elijah: Eliminating Backdoors Injected in Diffusion Models via Distribution Shift (AAAI 2024 · similarity 0.87)
- Rethinking Backdoor Attacks on Dataset Distillation: A Kernel Method Perspective (ICLR 2024 · similarity 0.87)
- A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives (AAAI 2024 · similarity 0.86)
- Conditional Backdoor Attack via JPEG Compression (AAAI 2024 · similarity 0.86)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.86)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.