Research map / Adversarial robustness and security / Backdoor and poisoning
Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TSBD, a two-stage post-training backdoor defense that uses neuron weight changes from clean unlearning to zero-reinitialize backdoor-related subweights, then fine-tunes with gradient-norm (activeness) regularization.
Problem
Post-training backdoor removal with only a small clean dataset (5%); clean unlearning is under-explored and vanilla fine-tuning can reactivate the backdoor (raising ASR).
Approach
Observes that neuron weight changes during clean unlearning correlate positively with those during poison unlearning, so clean unlearning can locate backdoor neurons without poisoned data; backdoored neurons are more gradient-active, so fine-tuning adds a gradient-norm penalty (activeness-aware fine-tuning) to suppress backdoor reactivation.
Key results
- On CIFAR-10 with PreAct-ResNet18 (10% poisoning), TSBD achieves average ASR 2.18% and DER 97.09% with ACC 91.70%, versus 91.34% for no defense.
- On Tiny ImageNet, TSBD reaches average DER 97.89% and ASR 1.01%, the best DER among compared defenses.
- On GTSRB, TSBD achieves average ASR 0.93% and DER 95.10%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use TSBD instead of i-BAU | CIFAR-10, PreAct-ResNet18 defense · CIFAR-10, 10% poisoning (average) | ASR: 17.44 -> 2.18 | Helped |
| Use TSBD instead of i-BAU | CIFAR-10, PreAct-ResNet18 defense · CIFAR-10, 10% poisoning (average) | DER: 88.11 -> 97.09 | Helped |
| Replace RNP with TSBD | Tiny ImageNet, PreAct-ResNet18 defense · Tiny ImageNet, 10% poisoning (average) | DER: 87.59 -> 97.89 | Helped |
| Zero the highest-changing weights across selected neurons rather than zeroing all selected-neuron weights (ablation) | TSBD reinitialization · CIFAR-10, BadNets | ACC: 69.53 -> 80.94 | Helped |
| Zero the highest-changing weights across selected neurons rather than zeroing top weights separately per neuron (ablation) | TSBD reinitialization · CIFAR-10, BadNets | ACC: 68.20 -> 80.94 | Helped |
| Omit fine-tuning after reinitialization (ablation) | TSBD · CIFAR-10, BadNets | ACC: 80.94 -> 90.72 | Hurt |
| Replace activeness-aware fine-tuning with vanilla fine-tuning (ablation) | TSBD · CIFAR-10, Blended | ASR: 2.61 -> 6.39 | Hurt |
| Replace activeness-aware fine-tuning with vanilla fine-tuning (ablation) | TSBD · CIFAR-10, BadNets | ACC: 90.72 -> 90.66 | No clear effect |
| Use clean-unlearning NWC order instead of the compared neuron-selection metrics (ablation) | Backdoor neuron identification · CIFAR-10, TAC neuron coverage across tested neuron ratios | neuron coverage ratio | Helped |
| Replace FP neuron activation ranking with NWC ranking (ablation) | Fine-pruning (FP) · CIFAR-10, eight attacks | ASR | Helped |
| Use activeness-aware fine-tuning rather than no fine-tuning (ablation) | TSBD reinitialized model · CIFAR-10, BadNets | ACC: 80.94 -> 90.72 | Helped |
Surprising findings
- Vanilla fine-tuning on clean data raises ASR back substantially (e.g., Blended ASR 6.39% after vanilla FT vs 2.61% with activeness-aware FT on CIFAR-10 ablation).
Limitations
- Performance drops on 1% poisoning ratio, since weight changes of backdoor neurons are less obvious for weak attacks.
- Requires access to a small clean dataset (5% of training data); defense without clean data is left as future work.
- Blended attack ASR on Tiny ImageNet remains non-trivial relative to other attacks (ASR 2.30%).
Experimental setup
Datasets: CIFAR-10 Tiny ImageNet GTSRB
Benchmarks: CIFAR-10 Tiny ImageNet GTSRB
Metrics: ACC ASR DER
Baselines: FT FP NAD NC ANP CLP i-BAU RNP
Builds on: RNP FP ANP BackdoorBench Fine-grained gradient norm regularization (sharpness-aware-style approximation)
Closest papers by meaning
- Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · similarity 0.91)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.91)
- BAN: Detecting Backdoors Activated by Adversarial Neuron Noise (NeurIPS 2024 · similarity 0.90)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.90)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.90)
- Backdoor Mitigation via Invertible Pruning Masks (NeurIPS 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.