Research map / Adversarial robustness and security / Backdoor and poisoning
Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that backdoor purification methods reach low ASR but quickly regain backdoor behavior under retuning or query-based reactivation, and proposes Path-Aware Minimization (PAM), a tuning defense that pushes purified models away from the backdoored model along the backdoor-connected path to improve post-purification robustness.
Problem
Current backdoor purification methods reach low attack success rate, but residual backdoor features remain and can be reactivated by a few poisoned samples (retuning) or by input perturbations (queries), so low ASR does not guarantee lasting safety.
Approach
Defines post-purification robustness, evaluates it with a retuning attack and a query-based reactivation attack, and uses linear mode connectivity to explain the failure. PAM updates the purified model using gradients from an interpolated model moved toward the backdoored model, using BTI-reversed backdoor samples as a proxy for real poisoned data.
Key results
- Retuning attack with a few poisoned samples restores ANP and FST purified models to about 82% and 85% ASR on average on CIFAR-10, while EP stays low.
- QRA raises P-ASR by 66.13% on average across five purification methods on CIFAR-10 and transfers with an average P-ASR of 32.1% across purification methods.
- PAM keeps average ASR after RA below 4.5% on CIFAR-10 (ResNet-18 5%: 4.55%) and 0.95% on CIFAR-100 and 7.48% on Tiny-ImageNet, with C-Acc drop of about 2%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply Retuning Attack to purified models | Existing purification methods · CIFAR-10 and other tested datasets and architectures | ASR: approximately 82% (ANP); 85% (FST) | Hurt |
| Apply Retuning Attack after Exact Purification | Exact Purification · CIFAR-10, ResNet-18 (5% poisoning), average | ASR: 1.34 -> 2.22 | No clear effect |
| Add Path-Aware Minimization | Backdoor purification · CIFAR-10, CIFAR-100, and Tiny-ImageNet | ASR after Retuning Attack: CIFAR-10: 4.55; CIFAR-100: 0.95; Tiny-ImageNet: 7.48 | Mixed |
| Use QRA-generated sample-specific perturbations | Purified models · CIFAR-10 | P-ASR: 66.13% | Helped |
| Transfer QRA perturbations across purification methods | Purified models using other purification techniques · CIFAR-10 | P-ASR: 32.1% | Helped |
| Add path-aware updates using interpolated-model gradients | PAM purification · CIFAR-10, ResNet-18 (5% poisoning), average P-Robustness | ASR: 2.22 -> 4.55 | Hurt |
| Increase the path-aware step size rho (ablation) | PAM · CIFAR-10, ResNet-18 | post-purification robustness | Helped |
| Increase rho (ablation) | PAM · CIFAR-10, ResNet-18 | C-Acc | Hurt |
Surprising findings
- Current purification methods with very low ASR quickly regain backdoor behavior after retuning on only a handful of poisoned samples, while a clean model does not.
- QRA perturbations derived from the retuned model also attack purified models but largely not clean models, suggesting they are not typical adversarial perturbations.
Limitations
- QRA transferability across purification methods is only moderate (average P-ASR 32.1%) and is acknowledged as an area to improve.
- Evaluation is limited to image classification with backdoor attacks in BackdoorBench and does not cover generative models such as LLMs or diffusion models.
- PAM's step size rho must be tuned to balance C-Acc and robustness, and larger rho reduces clean accuracy.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 Tiny-ImageNet ImageNet1K
Benchmarks: CIFAR-10 CIFAR-100 Tiny-ImageNet
Metrics: C-Acc ASR O-ASR P-ASR
Baselines: ANP I-BAU FT-SAM FST BTI-DBF Exact Purification (EP) Clean model
Builds on: BTI-DBF I-BAU FST Linear Mode Connectivity BackdoorBench
Closest papers by meaning
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.91)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.91)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.89)
- Backdoor Mitigation via Invertible Pruning Masks (NeurIPS 2025 · similarity 0.89)
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · similarity 0.89)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.