Research map / Adversarial robustness and security / Backdoor and poisoning
Adversarial Neuron Pruning Purifies Backdoored Deep Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| ANP pruning instead of fine-tuning (lr=0.02) | backdoored ResNet-18 · CIFAR-10 Blend, 1% clean data | ACC: 88.98 -> 93.44 | Helped |
| ANP instead of fine-pruning | backdoored ResNet-18 · CIFAR-10 Blend, 1% clean data | ASR (%): 65.39 -> 0.46 | Helped |
| add adversarial neuron perturbation to mask optimization (alpha 1.0 -> 0.2, eps 0.4) (ablation) | neuron pruning defense · CIFAR-10 Badnets | ASR and ACC after pruning | Helped |
| increase ANP steps 1 to 10 at small budget eps=0.1 (ablation) | ANP · CIFAR-10 Blend | ASR (%): 65.19 -> 0.90 | Helped |
| increase ANP steps 1 to 10 at large budget eps=0.4 (ablation) | ANP · CIFAR-10 Blend | ASR (%): 0.46 -> 31.34 | Hurt |
| increase trade-off alpha above 0.6 (ablation) | ANP · CIFAR-10 Badnets | ASR: ASR < 4% when alpha <= 0.6 | Hurt |
| increase perturbation budget to very large values (ablation) | ANP · CIFAR-10 Badnets | ACC | Hurt |
| more mask optimization iterations (20 -> 2000) (ablation) | ANP · CIFAR-10 Badnets | ACC at same pruning fraction: 86.65% ACC at 4% pruned after 20 iterations | Helped |
| prune by threshold instead of fixed fraction (ablation) | ANP across ResNet-18/50, VGG-19, MobileNet-V2 · CIFAR-10 Badnets | ACC and ASR | Helped |
Closest papers by meaning
- Adversarial Feature Map Pruning for Backdoor (ICLR 2024 · similarity 0.88)
- Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · similarity 0.88)
- BAN: Detecting Backdoors Activated by Adversarial Neuron Noise (NeurIPS 2024 · similarity 0.88)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.87)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.87)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.