This paper formulate this defense strategy as a coreset selection problem, giving rise to so-called anti-Backdoor Coreset Selection, and uses the Cumulative Entropy as selection criterion to further facilitate this effect.
Abstract
Recent training-time defenses against neural backdoors isolate a benign subset from poisoned training data, to learn a backdoor-free model from it. In this paper, we formulate this defense strategy as a coreset selection problem, giving rise to so-called"Anti-Backdoor Coreset Selection."Since poisonous samples have (a) lower prediction uncertainty and are (b) less frequent than benign samples, coreset selection naturally focuses more on samples associated with benign functionality than the backdoor functionality. We use the Cumulative Entropy as selection criterion to further facilitate this effect. The metric tracks the learning dynamics of training samples and allowing us to select benign samples with high informativeness for the coreset. Additionally, we unlearn the chosen samples in each epoch to facilitate the separability between benign and poisonous samples. Together, this yields an exceptionally effective training-time defense that constructs a benign coreset to train a backdoor-free model. Unlike prior defenses that compromise natural accuracy and fail against certain attacks, our method mitigates backdooring attacks consistently with a negligible impact on natural performance.
This work reveals that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network, and proposes Trapping and Removing (TR), a simple yet effective training-time defense that introduces a lightweight shortcut branch as a "honeypot" to trap backdoor knowledge.
Zixuan Zhu, Rui Wang, Lihua Jing et al.· 0 citations
Backdoor attacks compromise training data so that a model retains clean accuracy but predicts an attacker-chosen target on triggered inputs. At very low poisoning rates, only a few samples convey the trigger--target association, making poison-sample selection critical. Existing methods typically rank candidates using per-sample scores, which can select redundant samples from similar semantic regions, and many require task-specific surrogate training. We propose Distributional Feature Coverage Sample Selection (DFCS), a training-free, trigger-agnostic method that clusters fixed pretrained features into one region per poisoning slot and selects the centroid-nearest sample from each region. A local first-order analysis relates this allocation to feature-coverage and representative-mass terms. Across BadNets and Blended attacks on CIFAR-10, Tiny-ImageNet, and Imagenette, DFCS achieves the highest mean attack success rate among seven selectors in all six dataset--attack settings, averaging $96.30\%$ and exceeding the strongest comparator in each setting by 4.60 percentage points on average while preserving clean accuracy. These results support distributional feature coverage as an effective selection principle for low-budget dirty-label backdoor attacks.
Yi Yang, Xiaoke Chen, Jinyang Huang et al.· 0 citations
Knowledge distillation enables an adversary to replicate a proprietary classifier by querying its prediction interface and training a surrogate on the returned probability vectors. Antidistillation sampling, proposed for large language models, counters this threat with an input-dependent, gradient-directed perturbation of the served distribution; its transfer to classification has not been studied. Adapting the defense to classification, we show its behavior is governed by the distribution of the teacher's per-input confidence margins. Because well-trained classifiers are severely overconfident, the direct transfer exhibits an inert window: below a closed-form-predictable threshold, it affects neither attacker nor defender; beyond it, the defense undergoes a phase transition and degrades the teacher faster than the attacker's student. Temperature softening rescales the transition in closed form, and every temperature configuration lies on the same unfavorable trade-off curve. Our method, ADS-C, composes the perturbation under a closed-form, per-input margin budget that provably preserves every served top-1 prediction, so the defended teacher's accuracy equals the undefended teacher's identically. Under this guarantee the distilled student still loses 17.4 percentage points on CIFAR-100, 29.6 on CIFAR-10, and 13.3 on Tiny-ImageNet; matching this degradation with the unmodified defense costs 27.5, 32.9, and 22.2 points of teacher accuracy. Because served labels are unchanged, a hard-label attacker gains nothing, while the defended soft output trains a student up to 29.7 points below that floor: the incentive to distill served probabilities is not merely removed but reversed. To our knowledge, ADS-C is the first antidistillation defense for classification whose utility cost is exactly zero.
Backdoor attacks are critical threats to deep neural networks (DNNs). However, most of the studied attacks employ a single type of trigger, as proposed backdoor defenders often rely on the assumption that triggers would appear in a unified manner. In this paper, we show that this naive assumption can create a loophole that allows more sophisticated backdoor attacks to bypass. We design a novel backdoor attack mechanism that incorporates multiple types of backdoor trigger, focusing on stealthiness and effectiveness. Our investigation starts with the intriguing observation that the performance of a backdoor attack in deep learning models, as well as its detectability and removability, are all proportional to the magnitude of the trigger. Based on this correlation, we propose reducing the magnitude of each trigger type and combining them to achieve a strong backdoor relying on the combined trigger while still staying safely under the radar of defenders. Extensive experiments on three standard datasets demonstrate that our method can achieve high attack success rates (ASRs) and can bypass state-of-the-art defenses in a utility-preserving sense: a defense either fails to remove the backdoor or removes it only by severely damaging the clean accuracy (ACC) of the protected model. Thus, reducing ASR by making the model unusable is not considered a successful defense.
Duc Anh Vu, Vuong Quoc Anh Pham, Le Hoang Nguyen et al.· IEEE Access· 0 citations
Deep neural network (DNN) backdoor attacks implant hidden malicious behaviors during model training so that inputs containing a trigger are misclassified to an attacker-specified target. While prior studies have explored pruning as a defense, the impact of conventional compression-oriented pruning, which is primarily used for model size reduction and efficiency, on the effectiveness of existing general backdoor attacks has not been fully examined. We show that many existing attacks are fragile under such pruning. To this end, we propose Mask2Keep (M2K), an attack-enhancement training framework that improves backdoor robustness under compression-oriented pruning by encouraging the model to encode both task- and backdoor-related information into parameters that are less likely to be removed. M2K suppresses pruning-prone parameters and redistributes critical information into more stable ones. M2K consists of three stages: (1) training a base backdoor model and learning a soft mask to estimate parameters likely to be pruned; (2) applying targeted regularization to encourage the redistribution of critical information into preserved parameters; and (3) fine-tuning by freezing likely-to-be-pruned parameters while distilling knowledge into the retained ones. Experiments across multiple attack types, datasets, and pruning strategies show that M2K maintains high attack success rates and competitive clean accuracy after aggressive compression, demonstrating its robustness to compression-oriented pruning.
Jing Shang, Jian Wang, Kailun Wang et al.· Neural Networks· 0 citations
Federated Learning (FL) is vulnerable to backdoor attacks, where adversaries can stealthily manipulate the global model. Most existing defense methods are developed under IID assumptions, an assumption that rarely holds in practice. In highly non-IID settings, heterogeneous data distributions across clients make it difficult to distinguish malicious updates from benign ones, particularly when benign clients exhibit atypical patterns due to minority-class data. To address this challenge, existing defenses operate at different levels of granularity. Coarse-grained methods perform client-level filtering, which often mistakenly excludes benign clients under non-IID conditions. Fine-grained methods instead analyze data at the sample level for more precise detection, but typically rely on explicit per-sample gradient analysis, leading to substantial memory and computational overhead. As a result, defending against backdoor attacks in non-IID environments involves a fundamental trade-off between robustness and computational efficiency. To address this challenge, we propose FedRGD, a federated risk-guided dynamic defense framework that enables efficient fine-grained protection. FedRGD maps sample-level risks into structured parameter masking without requiring explicit per-sample gradient storage. It combines feature inconsistency detection with lightweight masking and robust aggregation to achieve both accuracy and efficiency. Extensive experiments on CIFAR-10 and Fashion-MNIST demonstrate that FedRGD consistently reduces the attack success rate while maintaining high main-task accuracy, achieving a favorable security-utility balance with low computational overhead.
Ruiying Wang· Poster Volume 0008 The 2026...· 0 citations