Research map / Adversarial robustness and security / Backdoor and poisoning

RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance

NeurIPS 2026 · Adversarial robustness and security › Backdoor and poisoning · approach: Trigger-based backdoor attacks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes RPP, a black-box, certified poisoned-sample detector that scores each training sample by the stability of its output probability vector under Gaussian noise and calibrates thresholds with split conformal prediction, and shows backdoors are more effective and defenses weaker under dataset imbalance.

Problem

Backdoor defenses for poisoned-sample detection are designed for balanced data and degrade under class imbalance, which also makes backdoor attacks more effective; existing defenses also lack formal guarantees.

Approach

Measure per-sample RPP (expected L-infinity change in predicted probability vector under isotropic Gaussian noise), flag low-RPP samples as poisoned, and set the threshold via split conformal prediction on a clean calibration set, giving within-domain certified detectability conditions and an FPR bound.

Key results

• On CIFAR-10 with BadNets (alpha=0.05), RPP certifies 90.4% to 99.9% of poisoned samples across balance ratios with FPR 5.9% to 29.6%.
• On CIFAR-10 at rho=100, RPP achieves TPR 100.0% on BadNets versus 0-43% for several baselines, though with FPR 9.2%.
• Under a defense-aware small-norm trigger attack on CIFAR-10, RPP TPR drops from 99.7% (rho=1) to 46.5% (rho=200) with FPR around 23%.

Surprising findings

• Imbalance raises backdoor attack success at a fixed number of poisoned samples, and balanced-data defenses such as AC, ASSET and SCALE-UP degrade as imbalance grows.

Limitations

• Certification relies on assumption (A.1) and Gaussian-perturbation model; the paper does not claim robustness to all adaptive attacks.
• Stronger adaptive attacks, such as poisoning the clean calibration set, are not evaluated.
• FPR can reach 20-30% on several settings and the detector shows degraded TPR under extreme imbalance (rho=200).

Experimental setup

Datasets: MNIST SVHN CIFAR-10 TinyImageNet ImageNet10 iNaturalist-2018

Benchmarks: MNIST SVHN CIFAR-10 TinyImageNet ImageNet10 iNaturalist-2018

Metrics: TPR FPR ASR AUC

Baselines: SS AC RE ABL CT ASSET SCALE-UP MSPC BBCaL STRIP TED IBD-PSC

Builds on: Conformal prediction CBD Randomized smoothing

Closest papers by meaning

• Activation Gradient based Poisoned Sample Detection Against Backdoor Attacks (ICLR 2025 · similarity 0.89)
• Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.89)
• Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency (ICLR 2024 · similarity 0.88)
• BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.88)
• UFID: A Unified Framework for Black-box Input-level Backdoor Detection on Diffusion Models (AAAI 2025 · similarity 0.88)
• Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.88)