Research map / Adversarial robustness and security / Backdoor and poisoning
UMA: Facilitating Backdoor Scanning via Unlearning-Based Model Ablation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes UMA, which unlearns a target class's inherent features in a model, then reverses triggers on the ablated model and filters candidates by transferability, to scan for advanced backdoors.
Problem
Backdoor scanning of DNNs becomes hard when attacks use complex triggers or stealthy implanting that entangles backdoor features with the target class's inherent features, making triggers indistinguishable from universal adversarial patches.
Approach
Ablate the target class's inherent features via constrained unlearning (while preserving potential backdoor features and freezing early layers) before trigger inversion, so that backdoor triggers become easier to reverse than universal adversarial patches; then filter with a transferability test against a coarsely retrained clean model.
Key results
- On TDC datasets, UMA achieves 91% average AUC-ROC and 86.6% detection accuracy, versus 71.8% AUC-ROC for Neural Cleanse, 50% for K-Arm, 52.2% for ABS+Ex-Ray, and 62.5% for MNTD.
- On advanced attacks, UMA reaches 91.2% AUC-ROC and 89.4% accuracy on CIFAR-10 and 97% AUC-ROC and 96.2% accuracy on GTSRB.
- Removing model ablation drops CIFAR-10 average AUC-ROC from 89.6% to 65.6%, notably for composite and frequency attacks.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use UMA rather than Neural Cleanse | Backdoor scanning on TDC detection datasets · TDC detection datasets (average) | AUC-ROC: 71.8 -> 91% | Helped |
| use UMA rather than MNTD | Backdoor scanning on TDC detection datasets · TDC detection datasets (average) | AUC-ROC: 62.5 -> 91% | Helped |
| use UMA rather than K-Arm | Backdoor scanning on TDC detection datasets · TDC detection datasets (average) | AUC-ROC: 50 -> 91% | Helped |
| use UMA rather than ABS+Ex-Ray | Backdoor scanning on TDC detection datasets · TDC detection datasets (average) | AUC-ROC: 52.2 -> 91% | Helped |
| use UMA for advanced backdoor scanning | Backdoor scanning on CIFAR-10 · CIFAR-10 (five advanced attacks) | detection accuracy: 89.4% | Helped |
| use UMA for advanced backdoor scanning | Backdoor scanning on GTSRB · GTSRB (five advanced attacks) | detection accuracy: 96.2% | Helped |
| remove the transferability-based filter (ablation) | UMA on CIFAR-10 advanced attacks · CIFAR-10 (five advanced attacks) | detection accuracy: 89.4 -> 84.2 | Hurt |
| remove the transferability-based filter (ablation) | UMA on GTSRB advanced attacks · GTSRB (five advanced attacks) | detection accuracy: 96.2 -> 89.4 | Hurt |
| remove the transferability-based filter (ablation) | UMA on CIFAR-10 advanced attacks · CIFAR-10 (five advanced attacks) | AUC-ROC: 91.2 -> 89.6 | Hurt |
| remove the transferability-based filter (ablation) | UMA on GTSRB advanced attacks · GTSRB (five advanced attacks) | AUC-ROC: 97 -> 96 | Hurt |
| remove model ablation and the transferability-based filter (ablation) | UMA on CIFAR-10 · CIFAR-10 (composite and frequency-domain attacks) | AUC-ROC: 38.7% and 36.4% | Hurt |
Surprising findings
- Removing the transferability filter barely changes AUC-ROC (only 1-1.6% gain) but raises false positive rates substantially.
Limitations
- Model ablation approximates feature ablation, leaving residual inherent features that can yield false positives.
- Cost grows with the number of classes, and performance is better on fewer-class datasets (GTSRB vs CIFAR-10).
- Evaluation uses a limited set of attacks and datasets (CIFAR-10, GTSRB, and TDC datasets).
Experimental setup
Datasets: TDC 2022 detection datasets (MNIST, CIFAR-10, CIFAR-100, GTSRB) CIFAR-10 GTSRB
Benchmarks: TDC 2022 detection track datasets CIFAR-10 and GTSRB advanced backdoor models (composite, reflection, frequency, filter, BadNets)
Metrics: AUC-ROC detection accuracy false positive rate false negative rate
Baselines: Neural Cleanse K-Arm ABS+Ex-Ray MNTD
Builds on: Neural Cleanse ABS K-Arm MNTD
Closest papers by meaning
- Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.88)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.86)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.86)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.86)
- LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioning (CVPR 2024 · similarity 0.86)
- Backdoor Attacks via Machine Unlearning (AAAI 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.