Research map / Adversarial robustness and security / Backdoor and poisoning
Training-time backdoor defense
Train clean models on poisoned data by splitting data and decoupling features.
40 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2021–2026) · an approach in Backdoor and poisoning, keyword cluster “backdoor defense · backdoored · clean”
State History Tried Baselines Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
19 papers in 2023–24 and 11 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 17.8% to 7.4%.
Open questions the data points to
- Papers report DBD on CIFAR-10, six-attack average (ASR) anywhere from 4.53 to 17: comparisons against it depend on whose number you take.
- Papers report NAD on CIFAR10, 12 attacks average (ASR) anywhere from 6.7 to 13.65: comparisons against it depend on whose number you take.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2021 · Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks (ICLR 2021 · 142 citations)
- 2022 · Few-Shot Backdoor Defense Using Shapley Estimation (CVPR 2022 · 39 citations)
- 2023 · Backdoor Defense via Adaptively Splitting Poisoned Dataset (CVPR 2023 · 60 citations)
- 2024 · Progressive Poisoned Data Isolation for Training-Time Backdoor Defense (AAAI 2024 · 14 citations)
- 2025 · Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · 9 citations)
- 2026 · Statistically Undetectable Backdoors in Deep Neural Networks (ICML 2026 · 0 citations)
Earliest papers here
- Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks (ICLR 2021 · 142 citations)
- Anti-Backdoor Learning: Training Clean Models on Poisoned Data (NeurIPS 2021 · 35 citations)
- Adversarial Neuron Pruning Purifies Backdoored Deep Models (NeurIPS 2021 · 27 citations)
What has been tried
34 papers here report 377 measured changes (a component added, removed or swapped, compared with a baseline): helped 55%, no clear effect 9%, hurt 28%, mixed 8%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Increase progressive isolation iterations from T=1 to T=5 | CIFAR-10 BadNets · ASR | 99.81 -> 0.52 | Helped | Progressive Poisoned Data Isolation for Training-Time Backdoor Defense (AAAI 2024 · 14 citations) |
| replace isolated poison labels with adversarial labels rather than random labels | CIFAR-10, average over six attacks · ACC (%) | 83.24 -> 84.99 | Helped | Adversarial-Inspired Backdoor Defense via Bridging Backdoor and Adversarial Attacks (AAAI 2025 · 9 citations) |
| Select random samples instead of DDP-detected poisoned samples | CIFAR10, 7 attacks (average) · ASR | 2.32 -> 65.23 | Hurt | Backdoor Defense via Test-Time Detecting and Repairing (CVPR 2024 · 8 citations) |
| Add an L1 mask-size regularizer to BTI-DBF feature decoupling | CIFAR-10, BadNets detection · detection success accuracy | 25% -> 90% | Helped | BAN: Detecting Backdoors Activated by Adversarial Neuron Noise (NeurIPS 2024 · 4 citations) |
| reduce the reserved clean set to 400 or 200 samples | CIFAR10, Blend · AUROC | 95% or 90% | Hurt | BaDExpert: Extracting Backdoor Functionality for Accurate Backdoor Input Detection (ICLR 2024 · 3 citations) |
| increase the BN parameter scaling factor ω from its initial phase | CIFAR-10, BadNets, WaNet, and BATT · AUROC | Helped | IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency (ICML 2024 · 3 citations) | |
| Add Stage 2 OT-based fusion to the pruned model | CIFAR-10, BadNets · ACC | 84.98 -> 90.11 | Helped | Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · 2 citations) |
| Add mask initialization to IMS | GTSRB, IAB, ResNet, 10% poisoning, 10 SPC · ASR | 56.1 -> 1.1 | Helped | Backdoor Mitigation via Invertible Pruning Masks (NeurIPS 2025 · 1 citation) |
| Zero the highest-changing weights across selected neurons rather than zeroing all selected-neuron weights | CIFAR-10, BadNets · ACC | 69.53 -> 80.94 | Helped | Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · 1 citation) |
| Increase the path-aware step size rho | CIFAR-10, ResNet-18 · post-purification robustness | Helped | Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · 1 citation) | |
| Increase curve index t (up to 0.5) | Backdoor defense · ASR | Helped | Circumventing Backdoor Space via Weight Symmetry (ICML 2025 · 0 citations) | |
| add the hard-coded remapping function | CIFAR-10, BadNets · ASR | 70.76 -> 0.68 | Helped | REFINE: Inversion-Free Backdoor Defense via Model Reprogramming (ICLR 2025 · 0 citations) |
Baseline numbers that disagree
The same baseline on the same benchmark and metric, reported more than 5% apart by different papers here. Training budgets, data splits and reimplementations differ, so state which number you compare with.
| Baseline | Benchmark | Metric | Reported | Papers |
|---|---|---|---|---|
| DBD | CIFAR-10, six-attack average | ASR | 4.53 – 17 | 2 papers, e.g. CVPR 2023 and CVPR 2023 |
| NAD | CIFAR10, 12 attacks average | ASR | 6.7 – 13.65 | 2 papers, e.g. ICLR 2024 and ICML 2023 |
What reviewers will expect
Datasets and baselines named in the 7 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 6 of 7 papers
- GTSRB · 4 of 7 papers
- Tiny ImageNet · 2 of 7 papers
Baselines
- FP · 3 of 7 papers
- ANP · 3 of 7 papers
- NAD · 2 of 7 papers
- i-BAU · 2 of 7 papers
- RNP · 2 of 7 papers
- FT-SAM · 2 of 7 papers
- SAU · 2 of 7 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 30 papers; from OpenAlex and the papers' affiliations).
- Hong Kong University of Science and Technology · 5 papers
- The Chinese University of Hong Kong · 4 papers
- Stony Brook University · 2 papers
- Tsinghua University · 2 papers
- University of Science and Technology of China · 2 papers
- Zhejiang University · 2 papers
- Harbin Institute of Technology · 2 papers
- JD Explore Academy · 2 papers
Use it
Download BibTeX of 35 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Detecting poisoned samples (54 papers)
Elsewhere in the topic
- Trigger-based backdoor attacks (106 papers)
- Backdoors in large multimodal models (104 papers)
- Backdoors in federated learning (16 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).