Research map / Adversarial robustness and security / Backdoor and poisoning
Progressive Poisoned Data Isolation for Training-Time Backdoor Defense
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PIPD, a training-time backdoor defense that progressively refines poisoned-sample isolation via iterative channel-discrepancy clustering and then trains with selective gradient updates, reaching near-zero ASR and high TPR/low FPR on CIFAR-10 and a 30-class ImageNet subset.
Problem
placeholder
Approach
placeholder
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use PIPD instead of the strongest baseline ASD | ResNet-18 backdoor defense · CIFAR-10 average | ASR: 1.66 -> 0.43 | Helped |
| Use PIPD instead of the strongest baseline NONE | ResNet-18 backdoor defense · CIFAR-10 average | CA: 93.71 -> 94.50 | Helped |
| Use PIPD instead of DBD | ResNet-18 backdoor defense · ImageNet average | ASR: 2.74 -> 0.14 | Helped |
| Use PIPD instead of ASD | ResNet-18 backdoor defense · ImageNet average | CA: 84.70 -> 85.87 | Helped |
| Use PIPD instead of DBALFA | poisoned-sample isolation · CIFAR-10 average | TPR: 97.83 -> 99.95 | Helped |
| Use PIPD instead of ABL | poisoned-sample isolation · CIFAR-10 average | FPR: 1.07 -> 0.06 | Helped |
| Increase progressive isolation iterations from T=1 to T=5 (ablation) | PIPD · CIFAR-10 BadNets | ASR: 99.81 -> 0.52 | Helped |
| Increase progressive isolation iterations from T=1 to T=5 (ablation) | PIPD · CIFAR-10 Blended | ASR: 98.73 -> 0.72 | Helped |
| Mix benign samples into the pre-isolation poisoned subset (ablation) | PIPD · CIFAR-10 BadNets | TPR: 100.00 across 20%, 40%, 60%, and 80% fault ratios | No clear effect |
| Mix benign samples into the pre-isolation poisoned subset (ablation) | PIPD · CIFAR-10 Trojan | FPR: 0.00 -> 0.62 | Hurt |
| Replace Fisher-Jenks with K-means clustering (ablation) | PIPD · CIFAR-10 Blended | FPR: 0.00 -> 0.65 | Hurt |
| Replace Fisher-Jenks with Bisecting K-Means (ablation) | PIPD · CIFAR-10 Blended | FPR: 0.00 -> 0.28 | Hurt |
Closest papers by meaning
- Backdoor Defense via Test-Time Detecting and Repairing (CVPR 2024 · similarity 0.89)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.89)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.88)
- Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attacks (ICLR 2025 · similarity 0.88)
- Efficient Backdoor Attacks for Deep Neural Networks in Real-world Scenarios (ICLR 2024 · similarity 0.88)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.