Research map / Label-efficient and robust learning / Semi-supervised learning
Lie Detector: Unified Backdoor Detection via Cross-Examination Framework
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Lie Detector, a cross-examination backdoor detection framework that reverse-engineers triggers from two independently trained third-party models using CKA and output-distribution losses, then confirms backdoors via fine-tuning sensitivity analysis, across supervised, self-supervised/contrastive, and autoregressive (VLM) paradigms.
Problem
Backdoor detection for models outsourced to semi-honest third-party providers; existing statistical detectors fail to generalize across learning paradigms (supervised, semi-supervised, autoregressive) and produce high false positive rates.
Approach
Compare two independently trained models from different providers: optimize a trigger mask and pattern to maximize CKA-based representational divergence and output-distribution loss, then flag a model as backdoored if fine-tuning on 10% clean data drops its ASR by more than 20 points.
Key results
- Across 20 clean and 20 backdoored ResNet-18 models, Lie Detector reaches 100% DSR with 0% FPR on CIFAR-10 BadNet, Blended, and ISSBA and on TinyImageNet BadNet and Blended (ISSBA 97.5% DSR, 5% FPR).
- On CLIP and LLaVA backdoor detection (10 clean and 10 backdoored models per attack), Lie Detector reports DSR of 90-100% with FPR mostly at or below 5%, compared with up to 60% DSR and 40-50% FPR for TED/MM-BD baselines on LLaVA.
- The abstract claims accuracy improvements of 5.4%, 1.6%, and 11.9% over SoTA baselines for supervised, semi-supervised, and autoregressive tasks respectively.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Lie Detector instead of the strongest reported baselines | Backdoor detection across supervised learning · Supervised learning tasks | detection accuracy: 5.4% | Helped |
| Use Lie Detector instead of the strongest reported baselines | Backdoor detection across semi-supervised learning · Semi-supervised learning tasks | detection accuracy: 1.6% | Helped |
| Use Lie Detector instead of the strongest reported baselines | Backdoor detection across autoregressive learning · Autoregressive learning tasks | detection accuracy: 11.9% | Helped |
| Add fine-tuning sensitivity analysis to Cross-Model Trigger Reverse (ablation) | Lie Detector · CIFAR10, Blended, 4×4 trigger, ResNet-18 | FPR: 10.0 -> 0.0 | Helped |
| Add fine-tuning sensitivity analysis to Cross-Model Trigger Reverse (ablation) | Lie Detector · Caltech101, BadEncoder, 32×32 trigger, CLIP | FPR: 20.0 -> 0.0 | Helped |
| Add fine-tuning sensitivity analysis to Cross-Model Trigger Reverse (ablation) | Lie Detector · Flickr8k, Shadowcast, 50×50 trigger, LLaVA | FPR: 20.0 -> 0.0 | Helped |
| Replace CKA with CCA, SVCCA, or cosine similarity (ablation) | Lie Detector · Backdoor detection across learning paradigms | detection accuracy | Hurt |
| Increase the number of optimization epochs (ablation) | Cross-model trigger reverse on ResNet-18 and CLIP · Backdoor detection across tested attacks | detection accuracy | Helped |
| Vary the model architecture (ablation) | Lie Detector · Supervised, contrastive, and vision-language tasks | DSR | No clear effect |
| Use deeper feature layers for CKA comparison (ablation) | Lie Detector on ResNet-18 and CLIP · Clean and backdoored models | CKA: 0.872 -> 0.427; 0.795 -> 0.314 | Mixed |
Surprising findings
- Cross-model trigger reverse alone yields high DSR but FPR up to 30%; adding fine-tuning sensitivity analysis drives FPR to 0% on all tested settings in the ablation.
Limitations
- Relies on the assumption that two independent providers are available and that at least one model may be clean; the verifier must have a clean dataset for fine-tuning.
- The fine-tuning ASR-drop threshold of 20% is a fixed heuristic not analyzed for sensitivity.
- Evaluation covers a limited set of attacks and models (e.g., ResNet-18, VGG16, CLIP, LLaVA, MiniGPT-4) with relatively small numbers of models per setting.
Experimental setup
Datasets: CIFAR-10 TinyImageNet ImageNet Caltech101 COCO Flickr-30k Flickr8k
Benchmarks: CIFAR-10 TinyImageNet Caltech101 ImageNet COCO Flickr-30k Flickr8k
Metrics: detection success rate (DSR) false positive rate (FPR) attack success rate (ASR) detection accuracy
Baselines: NC ABS NAD TED MM-BD DECREE SEER
Builds on: DECREE Centered Kernel Alignment Neural Cleanse
Closest papers by meaning
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.89)
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · similarity 0.88)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.88)
- Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models (NeurIPS 2024 · similarity 0.88)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.88)
- UMA: Facilitating Backdoor Scanning via Unlearning-Based Model Ablation (AAAI 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.