Research map / Adversarial robustness and security / Backdoor and poisoning
REFINE: Inversion-Free Backdoor Defense via Model Reprogramming
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes REFINE, an inversion-free backdoor defense that reprograms a fixed backdoored classifier with a trainable U-Net input transformer, a hard-coded output label remapping, and cross-entropy plus supervised contrastive losses on unlabeled benign data.
Problem
Pre-processing backdoor defenses either trade off model utility against defense strength (input transformations) or fail to accurately invert triggers (backdoor trigger inversion), leaving third-party backdoored DNNs hard to secure without modifying model weights.
Approach
Model reprogramming with a trainable autoencoder input transformer and a hard-coded, shuffled output label remapping, so the input transformation can aggressively disrupt trigger and benign patterns without being constrained to preserve the original output domain; supervised contrastive loss tightens same-class clusters. No trigger inversion is needed.
Key results
- On CIFAR-10 with ResNet-18, REFINE reduces ASR to below 3% across seven attacks (e.g., BadNets 0.78%) while keeping BA within about 3% of the undefended model.
- REFINE outperforms transformation-based (ShrinkPad, BDMAE, ZIP) and BTI-based (NC, UNICORN, BTI-DBF(P)) baselines, which show BA drops or ASR above 10% in many cases.
- Under an adaptive attack that simulates REFINE, REFINE keeps ASR around 1% (0.98% on CIFAR-10, 1.09% on ImageNet).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply REFINE instead of the strongest listed baseline | ResNet-18 backdoor defense · CIFAR-10, BadNets | ASR: 3.18 -> 0.78 | Helped |
| Apply REFINE instead of the strongest listed baseline | ResNet-18 backdoor defense · CIFAR-10, Blended | ASR: 3.72 -> 1.73 | Helped |
| Apply REFINE instead of the strongest listed baseline | ResNet-18 backdoor defense · ImageNet, BadNets | ASR: 2.65 -> 1.81 | Hurt |
| Apply REFINE instead of the strongest listed baseline | ResNet-18 backdoor defense · ImageNet, WaNet | ASR: 0.82 -> 1.36 | Hurt |
| add the hard-coded remapping function (ablation) | REFINE · CIFAR-10, BadNets | ASR: 70.76 -> 0.68 | Helped |
| add the hard-coded remapping function (ablation) | REFINE · CIFAR-10, Blended | ASR: 75.30 -> 0.51 | Helped |
| add the hard-coded remapping function (ablation) | REFINE · CIFAR-10, WaNet | ASR: 99.53 -> 0.88 | Helped |
| add supervised contrastive loss (ablation) | REFINE · CIFAR-10, BadNets | BA: 89.26 -> 90.92 | Helped |
| add supervised contrastive loss (ablation) | REFINE · CIFAR-10, Blended | BA: 90.38 -> 90.65 | Helped |
| add supervised contrastive loss (ablation) | REFINE · CIFAR-10, WaNet | BA: 89.08 -> 90.45 | Helped |
| vary the unlabeled benign dataset proportion from 100% to 20% (ablation) | REFINE · CIFAR-10, BadNets | BA: 91.20 -> 83.93 | Hurt |
| vary the unlabeled benign dataset proportion from 100% to 20% (ablation) | REFINE · CIFAR-10, BadNets | ASR: 0.86 -> 2.21 | Mixed |
Surprising findings
- On ImageNet subset, REFINE slightly improves benign accuracy over the undefended model (e.g., 66.94% to 69.00%), which the authors attribute to the added depth from the input transformation module.
Limitations
- Benign accuracy of the backdoored models is lower than SOTA because the goal is evaluating defenses rather than SOTA training.
- Black-box extension relies on a distilled surrogate model; evaluation is limited to image classification with BadNets-style attacks.
- Theoretical bound does not guarantee clean accuracy, so the cross-entropy term is needed as a heuristic.
Experimental setup
Datasets: CIFAR-10 ImageNet (50-class subset) CINIC10
Benchmarks: CIFAR-10 ImageNet (50-class subset)
Metrics: benign accuracy attack success rate
Baselines: ShrinkPad BDMAE ZIP Neural Cleanse UNICORN BTI-DBF(P) T-MR
Builds on: model reprogramming supervised contrastive loss ShrinkPad BDMAE BTI-DBF
Closest papers by meaning
- BAN: Detecting Backdoors Activated by Adversarial Neuron Noise (NeurIPS 2024 · similarity 0.90)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.90)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.89)
- BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · similarity 0.89)
- Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · similarity 0.89)
- Trap-MID: Trapdoor-based Defense against Model Inversion Attacks (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.