Research map / Adversarial robustness and security / Backdoor and poisoning
Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PDB, which defends against data-poisoning backdoors by proactively injecting a secret defensive backdoor (with a reversible label mapping) during training and reversing its label at inference.
Problem
In-training defense against data-poisoning backdoor attacks: train a clean model from a potentially poisoned dataset without relying on detecting and removing poisoned samples.
Approach
Instead of detecting and unlearning poisoned samples, the defender injects its own defensive backdoor using a secret out-of-range patch trigger and a bijective label mapping h(y)=(y+1) mod K trained on a small reserved clean set; at inference, every input gets the defensive trigger and the prediction is mapped back by h^{-1}, so the malicious backdoor is overridden while clean accuracy is kept.
Key results
- On CIFAR-10 with PreAct-ResNet18 at 5% poisoning, PDB reaches 91.36% average ACC and 0.71% average ASR, versus 95.03% ASR with no defense.
- On Tiny ImageNet with ViT-B-16, PDB achieves 0.00% ASR on most attacks with average ACC 73.03% and DER 98.94%, while NAB averages 30.19% ACC.
- PDB's runtime (1573 s on GTSRB) is much lower than DBD (7495 s) and NAB (3081 s), though higher than AC.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Inject a reversible defensive backdoor during training | PDB versus the strongest baseline by metric · CIFAR-10, 5.0% poisoning; PreAct-ResNet18; average over attacks | ASR: 42.17 -> 0.71 | Helped |
| Inject a reversible defensive backdoor during training | PDB versus the strongest baseline by metric · CIFAR-10, 5.0% poisoning; PreAct-ResNet18; average over attacks | ACC: 90.90 -> 91.36 | Helped |
| Inject a reversible defensive backdoor during training | PDB versus the strongest baseline by metric · CIFAR-10, 5.0% poisoning; PreAct-ResNet18; average over attacks | DER: 88.51 -> 96.39 | Helped |
| Inject a reversible defensive backdoor during training | PDB versus the strongest baseline by metric · Tiny ImageNet, 5.0% poisoning; ViT-B-16; average over attacks | ASR: 98.25 -> 0.00 | Helped |
| Inject a reversible defensive backdoor during training | PDB versus the strongest baseline by metric · Tiny ImageNet, 5.0% poisoning; ViT-B-16; average over attacks | DER: 50.63 -> 98.94 | Helped |
| Inject a reversible defensive backdoor during training | PDB versus the strongest baseline by metric · Tiny ImageNet, 5.0% poisoning; ViT-B-16; average over attacks | ACC: 78.16 -> 73.03 | Hurt |
| Inject a reversible defensive backdoor during training | PDB versus the strongest baseline by metric · GTSRB, 5.0% poisoning; PreAct-ResNet18; average over attacks | ASR: 33.23 -> 0.01 | Helped |
| Inject a reversible defensive backdoor during training | PDB versus the strongest baseline by metric · GTSRB, 5.0% poisoning; PreAct-ResNet18; average over attacks | DER: 57.22 -> 95.33 | Helped |
| Inject a reversible defensive backdoor during training | PDB versus the strongest baseline by metric · GTSRB, 5.0% poisoning; PreAct-ResNet18; average over attacks | ACC: 97.23 -> 97.24 | No clear effect |
| Inject a reversible defensive backdoor during training | PDB · CIFAR-10, 5.0% poisoning; PreAct-ResNet18; BadNets | training time (s): 919 -> 1853 | Hurt |
| Inject a reversible defensive backdoor during training | PDB · Tiny ImageNet, 5.0% poisoning; ViT-B-16; BadNets | training time (s): 2938 -> 4913 | Hurt |
| Inject the defensive backdoor against an ALL2ALL attack | PDB · CIFAR-10; PreAct-ResNet18; ALL2ALL BadNets | ASR: 61.33 -> 2.72 | Helped |
Surprising findings
- PDB's clean accuracy on Tiny ImageNet with ViT-B-16 is reported as 73.03% against 71.07% with no defense, despite the defensive backdoor being injected.
- Defense effectiveness is reported on the 5% setting, with some baselines like ABL reaching lower ASR but with large ACC drops.
Limitations
- Relies on a small clean reserved dataset (10% of training data), which the authors call a practical challenge.
- Only evaluated on image classification.
- Adaptive attacks considered only by scaling malicious trigger size and poisoning ratio.
Experimental setup
Datasets: CIFAR-10 Tiny ImageNet GTSRB
Benchmarks: CIFAR-10 Tiny ImageNet GTSRB
Metrics: ACC ASR DER
Baselines: AC Spectral Signatures ABL DBD NAB
Builds on: BackdoorBench ABL DBD NAB
Closest papers by meaning
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.90)
- Data Free Backdoor Attacks (NeurIPS 2024 · similarity 0.89)
- Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · similarity 0.89)
- Inspecting Prediction Confidence for Detecting Black-Box Backdoor Attacks (AAAI 2024 · similarity 0.88)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.88)
- Protecting against simultaneous data poisoning attacks (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.