Research map / Adversarial robustness and security / Backdoor and poisoning
BAN: Detecting Backdoors Activated by Adversarial Neuron Noise
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes BAN, a feature-space backdoor detector that adversarially perturbs neuron weights to maximize clean loss and uses a learned feature mask to expose backdoored models, plus a noise-based fine-tuning defense.
Problem
Trigger-inversion backdoor detectors are computationally expensive and rely on prominent backdoor features, so they fail to detect weaker or input-space backdoors such as BadNets.
Approach
Adversarial neuron noise (PGD on multiplicative weight/bias perturbations) activates backdoor neurons, and a feature decoupling mask on the latent features amplifies the difference between backdoored and clean models, enabling detection without iterating over all target classes; a noise-based fine-tuning then removes the backdoor.
Key results
- On CIFAR-10 detection, BAN reaches 97.22% average detection success accuracy versus 86.39% for BTI-DBF*, the best baseline.
- BAN is 1.37x faster than BTI-DBF on CIFAR-10 with ResNet18 and 5.11x faster on ImageNet200.
- Noise-based fine-tuning reduces average ASR to 2.21% on CIFAR-10 ResNet18 with BA of 92.43%, versus 38.76% for plain fine-tuning.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use adversarial neuron noise and feature masking for backdoor detection | BAN versus detection baselines · CIFAR-10, detection average | detection success accuracy: 86.39% -> 97.22% | Helped |
| Use BAN instead of BTI-DBF for detection | ResNet18 · CIFAR-10 | detection time: 76.90s -> 55.95s | Helped |
| Use BAN instead of BTI-DBF for detection | ResNet18 · ImageNet200 | detection time: 5,792.51s -> 1,132.85s | Helped |
| Fine-tune using optimized neuron noise | Backdoored ResNet18 models · CIFAR-10, five attacks average | ASR: 24.47 -> 2.21 | Helped |
| Fine-tune using optimized neuron noise | Backdoored ResNet18 models · CIFAR-10, all-to-all attacks average | ASR: 2.49 -> 1.21 | Helped |
| Add an L1 mask-size regularizer to BTI-DBF feature decoupling (ablation) | BTI-DBF · CIFAR-10, BadNets detection | detection success accuracy: 25% -> 90% | Helped |
| Remove the L1 mask-norm regularizer (ablation) | BAN feature-mask analysis · CIFAR-10, BadNets | negative feature loss: 0.26 -> 2.17 | Mixed |
| Remove the L1 mask-norm regularizer (ablation) | BAN feature-mask analysis · CIFAR-10, Bpp | negative feature loss: 2.80 -> 2.78 | No clear effect |
| Set lambda2 to 0.2 instead of 0.5 (ablation) | BAN fine-tuning · CIFAR-10, Bpp | ASR: 2.28 ± 0.72 -> 2.53 ± 0.93 | Mixed |
| Set lambda2 to 0.8 instead of 0.5 (ablation) | BAN fine-tuning · CIFAR-10, Bpp | ASR: 2.28 ± 0.72 -> 2.89 ± 0.94 | Hurt |
| Fine-tune for 10 instead of 25 epochs (ablation) | BAN fine-tuning · CIFAR-10, Bpp | ASR: 2.28 ± 0.72 -> 2.62 ± 0.44 | Hurt |
| Fine-tune for 50 instead of 25 epochs (ablation) | BAN fine-tuning · CIFAR-10, Bpp | ASR: 2.28 ± 0.72 -> 2.80 ± 0.73 | Hurt |
Surprising findings
- Recent feature-space detectors (FeatureRE, Unicorn, BTI-DBF) perform worse than NC on simple BadNets and Blend attacks, since their objectives favor prominent backdoor features.
- BTI-DBF's decoupling without a mask-norm regularizer yields a dense all-ones mask, which the authors identify as a flaw they patch in BTI-DBF*.
Limitations
- Assumes the defender has a small set of local clean samples (1% of training data).
- Fixed feature mask may not align with benign and backdoor features; the authors note this as future work.
- Fine-tuning with neuron noise may slightly reduce benign accuracy.
Experimental setup
Datasets: CIFAR-10 GTSRB Tiny-ImageNet ImageNet200
Benchmarks: CIFAR-10 GTSRB Tiny-ImageNet ImageNet200
Metrics: detection success accuracy number of models detected as backdoored benign accuracy (BA) attack success rate (ASR) running time
Baselines: Neural Cleanse Tabor FeatureRE Unicorn BTI-DBF ANP
Builds on: Neural Cleanse BTI-DBF FeatureRE ANP PGD
Closest papers by meaning
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.90)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.90)
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · similarity 0.89)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.89)
- Inspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks (AAAI 2024 · similarity 0.89)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.