Research map / Adversarial robustness and security / Backdoor and poisoning
Backdoor Mitigation via Invertible Pruning Masks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IMS, a pruning-based backdoor defense using a learned selection mechanism and an invertible channel mask, optimized via bi-level optimization with synthesized sample-specific perturbations, evaluated on BackdoorBench against pruning and fine-tuning defenses.
Problem
Backdoor mitigation in image classifiers with limited clean data; existing pruning defenses are inconsistent and fine-tuning defenses fail to restore correct predictions on triggered inputs.
Approach
An invertible pruning mask paired with a learned per-channel selection vector: the mask prunes selected components while its inverse prunes the complementary ones, with unselected components shared and preserved. A bi-level optimization synthesizes perturbations with the inverse mask and then updates the mask to suppress them.
Key results
- At SPC=2, IMS median ASR 5.6 and RDR 38.9 versus best pruning baseline ANP-free FP RDR 66.5 and ANP ASR 51.4 (pruning baselines), with ARR 17.3 versus 0.0 for ANP.
- At SPC=10, IMS achieves median RDR 28.5, outperforming all listed fine-tuning baselines (BTI-DBF 45.2, FT-SAM 33.7, SAU 42.1) and pruning baselines.
- IMS shows higher ARR (e.g., 17.3 at SPC=2) than pruning baselines such as ANP and AWN (0.0), and SAU attains lower median ASR (1.9) at SPC=2; the paper says IMS is competitive rather than universally superior.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use IMS rather than pruning baselines | Backdoor mitigation · BackdoorBench across 2, 10, and 100 SPC | RDR | Helped |
| Use IMS rather than fine-tuning baselines | Backdoor mitigation · BackdoorBench, 2 and 10 SPC | RDR | Helped |
| Use IMS rather than fine-tuning baselines | Backdoor mitigation · BackdoorBench, 100 SPC | RDR | Mixed |
| Add mask initialization to IMS (ablation) | IMS · GTSRB, IAB, ResNet, 10% poisoning, 10 SPC | ASR: 56.1 -> 1.1 | Helped |
| Add mask initialization to IMS (ablation) | IMS · GTSRB, WaNet, ResNet, 10% poisoning, 10 SPC | RDR: 21.7 -> 1.9 | Helped |
| Add mask initialization to IMS (ablation) | IMS · GTSRB, SSBA, ResNet, 10% poisoning, 10 SPC | RDR: 27.5 -> 26.0 | Helped |
| Add mask initialization to IMS (ablation) | IMS · GTSRB, BadNet, ResNet, 10% poisoning, 10 SPC | ASR: 0.3 -> 0.1 | No clear effect |
| Vary sparsity weight λ (ablation) | IMS · GTSRB, BadNet, ResNet, 10% poisoning, 10 SPC | ASR: 0.0 -> 13.5 | Hurt |
| Vary sparsity weight λ (ablation) | IMS · GTSRB, BPP, ResNet, 10% poisoning, 10 SPC | ASR: 0.0 -> 0.0 | No clear effect |
| Vary sparsity weight λ (ablation) | IMS · GTSRB, IAB, ResNet, 10% poisoning, 10 SPC | ASR: 0.2 -> 87.9 | Hurt |
| Vary sparsity weight λ (ablation) | IMS · GTSRB, SSBA, ResNet, 10% poisoning, 10 SPC | ASR: 0.7 -> 85.2 | Hurt |
| Vary selection sharpness k below 10 (ablation) | IMS · GTSRB, ResNet, 10% poisoning, 10 SPC | ASR | Hurt |
Surprising findings
- Under backdoor reactivation attack, IMS shows higher reactivation ASR than SAU (mean difference 20.08 points), with vulnerability comparable to FT-SAM.
- Pruning-based FP outperforms many later pruning approaches in ASR and RDR at some settings, consistent with prior observations.
Limitations
- Results are not universally superior; IMS underperforms some fine-tuning baselines in ASR, particularly against Blended and SSBA attacks.
- Does not improve robustness against backdoor reactivation attacks.
- No formal theoretical guarantees for non-convex pruning masks on CNNs; invertibility analysis holds only in the limit s->0, k->infinity.
Experimental setup
Datasets: CIFAR-10 GTSRB Tiny-ImageNet ImageNette
Benchmarks: BackdoorBench CIFAR-10 BackdoorBench GTSRB BackdoorBench Tiny-ImageNet ImageNette
Metrics: ARR ASR RDR
Baselines: FP ANP AWN RNP NFT FMP BTI-DBF FT-SAM SAU
Builds on: ANP SAU BTI-DBF BackdoorBench
Closest papers by meaning
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.90)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.89)
- Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · similarity 0.88)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.88)
- LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioning (CVPR 2024 · similarity 0.88)
- Adversarial Feature Map Pruning for Backdoor (ICLR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.