Research map / Adversarial robustness and security / Backdoor and poisoning
Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examples
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use SAU instead of i-BAU | Backdoor defense on CIFAR-10 · CIFAR-10, PreAct-ResNet18, average over attacks | ASR: 15.32 -> 2.51 | Helped |
| Use SAU instead of the strongest ACC baseline | Backdoor defense on CIFAR-10 · CIFAR-10, PreAct-ResNet18, average over attacks | ACC: 91.81 -> 90.41 | Hurt |
| Use SAU instead of ANP | Backdoor defense on Tiny ImageNet · Tiny ImageNet, PreAct-ResNet18, average over attacks | ASR: 20.83 -> 14.62 | Helped |
| Use shared adversarial-example generation (component A) rather than vanilla adversarial-example generation (ablation) | SAU · Tiny ImageNet, PreAct-ResNet18, Blended | ASR: 69.22 -> 0.02 | Helped |
| Use shared adversarial-example generation (component A) rather than vanilla adversarial-example generation (ablation) | SAU · Tiny ImageNet, PreAct-ResNet18, BadNets | ASR: 28.57 -> 0.27 | Helped |
| Use shared adversarial-example generation (component A) rather than vanilla adversarial-example generation (ablation) | SAU · Tiny ImageNet, PreAct-ResNet18, LF | ASR: 68.65 -> 0.72 | Helped |
| Use the shared-risk minimization step (component B) rather than vanilla AT minimization (component D) (ablation) | SAU · Tiny ImageNet, PreAct-ResNet18, BadNets | ACC: 37.21 -> 50.60 | Helped |
| Use the shared-risk minimization step (component B) rather than vanilla AT minimization (component D) (ablation) | SAU · Tiny ImageNet, PreAct-ResNet18, Blended | ACC: 38.35 -> 51.47 | Helped |
| Use the shared-risk minimization step (component B) rather than vanilla AT minimization (component D) (ablation) | SAU · Tiny ImageNet, PreAct-ResNet18, LF | ACC: 36.68 -> 51.31 | Helped |
| Replace both SAU components with vanilla adversarial training (ablation) | SAU · Tiny ImageNet, PreAct-ResNet18, Blended | ASR: 0.02 -> 38.03 | Hurt |
| Constrain PGD perturbations to L∞ norm bound 0.2 against a WaNet trigger with average L∞ norm 0.348 | SAU · Tiny ImageNet, WaNet | ASR | Hurt |
Closest papers by meaning
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.89)
- Backdoor Attacks via Machine Unlearning (AAAI 2024 · similarity 0.89)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.89)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.89)
- Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models (AAAI 2025 · similarity 0.88)
- Adversarial Machine Unlearning (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.