Research map / Adversarial robustness and security / Backdoor and poisoning
Detecting Backdoor Samples in Contrastive Language Image Pretraining
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that CLIP backdoor-poisoned samples form sparse local neighborhoods, so classic local outlier detectors (k-dist, SLOF, DAO) detect them far better than existing supervised-learning backdoor detectors, enabling efficient purification of CC3M and revealing a natural backdoor in an OpenCLIP model.
Problem
Detecting poisoned (backdoor) image-text samples in web-scale CLIP pretraining data, which existing supervised-learning backdoor sample detectors handle poorly at very low poisoning rates (e.g., 0.01%).
Approach
Backdoor-poisoned CLIP samples cluster tightly in representation space yet are far from clean data, so their local neighborhoods are sparse; density-ratio local outlier detectors (k-th NN distance, SLOF, DAO) using minibatch reference points detect them accurately and cheaply.
Key results
- Local outlier detectors (k-dist, SLOF, DAO) reach 97%-99.9% AUC across patch, clean-label, Nashville, WaNet, Blend, SIG, BLTO, multi-trigger and TDPA attacks on RN50, versus e.g. 27.86%-97.17% for ABL/CD on the patch trigger.
- Filtering 10% of poisoned CC3M with DAO reduces patch attack success rate from 100% to 0.0% while clean zero-shot ImageNet accuracy stays around 16.2%.
- A 'birthday cake' image appears 798 times in CC3M (~0.03%) and a trigger recovered from it achieves 98.92% ASR on an OpenCLIP RN50 model, suggesting an unintentional natural backdoor.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use local density detectors (DAO/SLOF) instead of supervised backdoor detector ABL | CLIP RN50 backdoor detection · CC3M, tested trigger attacks | AUC (%): 27.86 -> 99.86 | Helped |
| Use DAO rather than SafeCLIP detection | CLIP backdoor detection · CC3M, varied triggers and encoders | AUC (%): 83.42 -> 99.86 | Helped |
| Use local outlier detection rather than CD | CLIP RN50 clean-label backdoor detection · CC3M Clean Label STBA | AUC (%): 48.68 -> 97.10 | Helped |
| Remove the top 10% DAO outliers before retraining | CLIP RN50 · ImageNet validation, patch attack | attack success rate (%): 100.0 -> 0.0 | Helped |
| Remove the top 10% DAO outliers before retraining | CLIP RN50 · ImageNet validation, Nashville attack | attack success rate (%): 78.7 -> 9.6 | Helped |
| Remove the top 10% DAO outliers before retraining | CLIP RN50 · ImageNet validation, MT-M attack | attack success rate (%): 74.7 -> 15.00 | Helped |
| Remove 10% of DAO-ranked samples | CLIP RN50 · ImageNet zero-shot accuracy across attacks | accuracy (%): 17.0 -> 16.2 | No clear effect |
| Add nearest-neighbor self-supervised objectives during retraining on purified data (ablation) | CLIP+NN · ImageNet validation, purified CC3M across attacks | clean zero-shot accuracy (%): 16.2 -> 17.4 | Helped |
| Increase locality from k=16 to k=256 (ablation) | DAO backdoor detector · CC3M Patch STBA, 10% poisoning | AUC (%): 64.88 -> 99.98 | Helped |
| Increase locality from k=16 to k=256 (ablation) | k-dist backdoor detector · CC3M Patch STBA, 10% poisoning | AUC (%): 95.39 -> 100.00 | Helped |
| Increase locality from k=16 to k=256 (ablation) | SLOF backdoor detector · CC3M Patch STBA, 10% poisoning | AUC (%): 63.00 -> 99.99 | Helped |
| Increase poisoning rate from 0.01% to 10% while keeping k=16 (ablation) | LID backdoor detector · CC3M Patch STBA | AUC (%): 99.29 -> 1.18 | Hurt |
Surprising findings
- Classic general-purpose outlier detectors (kNN distance, iForest) outperform dedicated backdoor sample detectors like ABL, CD and SafeCLIP for CLIP.
- LID detection is highly unstable: its AUC drops to near 0 at 10% poisoning rate while it is ~99% at 0.01%.
Limitations
- Relies on minibatch reference points, and detection of high poisoning rates (10%) requires increasing k.
- Clean accuracy reproduction is limited because only 2.3M of CC3M image-text pairs were obtainable due to expired URLs.
- Adaptive attacks were only tested in a limited white-box setting with a single regularizer.
Experimental setup
Datasets: CC3M CC12M ImageNet CIFAR10 CIFAR100 Food101 GTSRB StanfordCars STL10
Benchmarks: ImageNet CIFAR10 CIFAR100 Food101 GTSRB StanfordCars STL10
Metrics: AUC clean accuracy attack success rate FPR@95
Baselines: ABL Cognitive Distillation SafeCLIP LID iForest RoCLIP
Builds on: CLIP Local Outlier Factor Dimensionality-Aware Outlier Detection Anti-Backdoor Learning Cognitive Distillation
Closest papers by meaning
- Better Safe than Sorry: Pre-training CLIP against Targeted Data Poisoning and Backdoor Attacks (ICML 2024 · similarity 0.91)
- Test-Time Multimodal Backdoor Detection by Contrastive Prompting (ICML 2025 · similarity 0.90)
- ToxicTextCLIP: Text-Based Poisoning and Backdoor Attacks on CLIP Pre-training (NeurIPS 2025 · similarity 0.89)
- BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIP (CVPR 2024 · similarity 0.88)
- A Closer Look at Backdoor Attacks on CLIP (ICML 2025 · similarity 0.88)
- BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning (CVPR 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.