Research map / Adversarial robustness and security / Backdoor and poisoning
Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AGPD, a three-stage poisoned sample detector that uses the dispersion and separation of activation-gradient circular distributions (GCD) to find target classes and filter poisoned samples.
Problem
Poisoned sample detection for data-poisoning backdoor attacks on untrustworthy training sets, where the trigger type, target classes, and poisoning ratio are unknown and activation-based separation can fail under adaptive attacks.
Approach
Measures the angular distribution of per-sample channel-wise activation gradients (relative to clean reference samples) as a gradient circular distribution; target classes show a more dispersed GCD (CVBT metric), and poisoned samples separate from clean ones within the target-class GCD (closeness score), enabling iterative filtering.
Key results
- On CIFAR-10 with Preact-ResNet18, AGPD reaches average TPR 96.66%, FPR 0.17%, F1 97.44%, versus runner-up ~78% TPR for baselines.
- On Tiny ImageNet, AGPD averages TPR 99.92% and FPR 0.14%, exceeding the runner-up by 11.8% TPR.
- Silhouette scores of target-class separation are higher in activation-gradient space than in activation space for all eight reported attacks.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use AGPD instead of the strongest reported baseline | Poisoned-sample detection on CIFAR-10 · CIFAR-10, all-to-one and all-to-all attacks | TPR: exceeding the runner-up by 18.23% | Helped |
| Use AGPD instead of the strongest reported baseline | Poisoned-sample detection on Tiny ImageNet · Tiny ImageNet, all-to-one attacks | TPR: exceeding the runner-up by 11.8% | Helped |
| Use AGPD instead of compared detectors | Multi-target poisoned-sample detection · CIFAR-10, single-trigger and multi-trigger attacks | TPR | Helped |
| Use AGPD instead of compared detectors | Poisoned-sample detection · DTD | TPR | Helped |
| Use AGPD instead of compared detectors | Poisoned-sample detection · GTSRB | TPR | Helped |
| Use activation gradients rather than activations to represent samples | Poisoned-clean sample separation · Eight backdoor attacks | Silhouette score | Helped |
| Evaluate AGPD with VGG19-BN rather than Preact-ResNet18 | AGPD · CIFAR-10 and Tiny ImageNet, all-to-one and all-to-all attacks | TPR | No clear effect |
| Reduce the additional clean set to one sample per class | AGPD · Multiple attacks | TPR: above 90% | No clear effect |
| Use out-of-distribution additional clean samples | AGPD · CIFAR-10 | TPR | No clear effect |
| Increase filtering threshold tau_s | AGPD poisoned-sample filtering · Varying tau_s from 0.01 to 0.1 | TPR: 100% | Helped |
| Use activation gradients rather than activations | Poisoned-clean separation · BadNets, Blended, LF, SSBA, WaNet, Input-Aware, TaCT, and Adap-Blend | Silhouette score | Helped |
Surprising findings
- Activation-based detectors such as SCAn and Beatrix fail on attacks where poisoned and clean samples are not separated in activation space, e.g. CTRL.
- Loss-based ABL performs poorly on dynamic triggers (WaNet, Input-Aware, Adap-Blend) that need more epochs to learn.
Limitations
- Scanning all layers to find the most separable one is computationally costly on large datasets.
- Relies on a small set of clean reference samples (10 per class) and tuned thresholds (tau_z = e^2, tau_s = 0.05).
- Target-class identification via z-score is not applicable to all-to-all attacks, which need a boundary threshold instead.
Experimental setup
Datasets: CIFAR-10 Tiny ImageNet ImageNet subset (200 classes) GTSRB DTD CIFAR-5m
Benchmarks: CIFAR-10 Tiny ImageNet ImageNet-200 GTSRB DTD
Metrics: TPR FPR F1 ACC ASR silhouette score
Baselines: AC Beatrix SCAn Spectral STRIP ABL CD ASSET
Builds on: activation clustering STRIP SCAn BackdoorBench
Closest papers by meaning
- RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance (NeurIPS 2026 · similarity 0.89)
- Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.89)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.89)
- DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models (AAAI 2024 · similarity 0.88)
- A Set of Generalized Components to Achieve Effective Poison-only Clean-label Backdoor Attacks with Collaborative Sample Selection and Triggers (NeurIPS 2025 · similarity 0.87)
- Universal Backdoor Attacks (ICLR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.