Research map / Adversarial robustness and security / Backdoor and poisoning
Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes OTBR, a data-free backdoor defense that prunes neurons ranked by weight changes under random-noise unlearning and then fuses the pruned model with the backdoored model via NWC-informed optimal transport alignment.
Problem
Post-training backdoor defense without any clean or poisoned data; existing data-free methods (e.g., CLP) have much lower success rates than data-dependent defenses, and pruning alone drops clean accuracy substantially.
Approach
Shows that neuron weight changes (NWCs) from random-noise unlearning correlate with those from poison unlearning, uses them to prune backdoor-related neurons, then repairs accuracy by OT-based layer-wise alignment of the pruned model to the backdoored model (NWC-informed target distribution) and weight averaging.
Key results
- OTBR successfully defends all 16 attack-dataset settings (ASR below 20%), reducing average ASR by 93.66 points with a 2.97-point average ACC drop.
- CLP, the only other data-free baseline, succeeds in only 2 of 16 settings, with average ASR of 75.02% on CIFAR-10.
- Ablation on CIFAR-10 shows vanilla fusion keeps ACC but leaves high ASR (e.g., BadNets 81.13%), while OT-based fusion reaches 1.08% ASR on BadNets.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add Stage 2 OT-based fusion to the pruned model (ablation) | OTBR · CIFAR-10, BadNets | ACC: 84.98 -> 90.11 | Helped |
| Add Stage 2 OT-based fusion to the pruned model (ablation) | OTBR · CIFAR-10, BadNets | ASR: 1.56 -> 1.08 | Helped |
| Replace OT alignment with direct weight averaging (ablation) | OTBR · CIFAR-10, BadNets | ASR: 1.08 -> 81.13 | Hurt |
| Replace OT alignment with direct weight averaging (ablation) | OTBR · CIFAR-10, BadNets | ACC: 90.11 -> 91.3 | Helped |
| Use NWC-informed target distribution instead of uniform or random target distributions (ablation) | OT-based fusion · CIFAR-10, different attacks | defense performance | Helped |
| Vary the target OT distribution from NWC-informed to uniform or random (ablation) | OT-based fusion · CIFAR-10, different attacks | defense performance | Hurt |
| Increase pruning ratio while holding random-unlearning steps fixed (ablation) | OTBR · CIFAR-10, BadNets | defense performance | Mixed |
| Vary the balance coefficient λ (ablation) | OTBR · CIFAR-10, BadNets | ACC | Mixed |
| Vary the largest random label G (ablation) | OTBR · CIFAR-10, BadNets | defense performance | Mixed |
| Use random-noise unlearning instead of clean-data unlearning to obtain NWCs | NWC pruning · backdoor mitigation | backdoor-related neuron identification | No clear effect |
| Apply OTBR instead of CLP | backdoor defense · CIFAR-10 average | ASR: 75.02 -> 5.82 | Helped |
| Apply OTBR instead of CLP | backdoor defense · Tiny ImageNet average | ASR: 80.82 -> 0.82 | Helped |
Surprising findings
- Vanilla fusion of pruned and backdoored models preserves accuracy but fails to remove the backdoor (e.g., 81.13% ASR on BadNets)
- RNP achieves 0.00% average ASR on Tiny ImageNet but with a large ACC drop
Limitations
- Relies on neuron weight changes, which apply only to the post-training scenario
- RNP needed a 0.5% clean data ratio instead of 5% to perform well
Experimental setup
Datasets: CIFAR-10 Tiny ImageNet CIFAR-100
Benchmarks: CIFAR-10 Tiny ImageNet CIFAR-100
Metrics: ACC ASR
Baselines: FP NAD ANP i-BAU RNP CLP
Builds on: OTFusion Intra-Fusion CLP Neural attention distillation / Fine-pruning as baselines context
Closest papers by meaning
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.91)
- REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · similarity 0.89)
- BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.88)
- Backdoor Mitigation via Invertible Pruning Masks (NeurIPS 2025 · similarity 0.88)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.88)
- From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.