SlowGuess/NeurIPS_2023_OCR huggingface dataset:
According to Corollary 3.2.1, our final purified image contains three parts: the ideally purified image  $\mathbf{x}_0$ , the altered trigger pattern  $\mathbf{A}^{\dagger}\mathbf{A}\mathbf{p}$ , and an approximation error  $\delta_0'$ . Therefore, compared with the original poisoned image  $\mathbf{x}^P = \mathbf{x} + \mathbf{p}$  or the transformed image  $\mathbf{x}^A = \mathbf{A}(\mathbf{x} + \mathbf{p})$ , our purified image  $\hat{\mathbf{x}}_0$  reduces the effect of the trigger pattern  $\mathbf{p}$  and preserves the high fidelity of the image. This is critical for achieving good performance in the downstream image classification task. The proofs can be found in Supplementary Material A.
3.3.3 Improving ZIP with Theoretical Insights
Based on the above theoretical analysis, we propose two further improvements to our guided image purification framework to enhance its effectiveness, which include (1) adding a confidence score to the rectified estimation, and (2) introducing multiple transformations.
Confidence Score. The effectiveness of our framework depends on the confidence of the proposed rectified estimation. As the reverse process proceeds, the  $\sqrt{\overline{\alpha}_t}$  value increases, making it difficult for  $\sqrt{\overline{\alpha}_t}\mathbf{A}^\dagger\mathbf{A}\mathbf{p}$  to be neglected. Simply omitting this pattern would weaken the confidence in our proposed estimation.
To address this issue, we re-formulate the rectified estimation at step  $t$  as:  $\tilde{\mathbf{x}}_t = (1 - \bar{\alpha}_t^\lambda)\hat{\mathbf{x}}_t + \bar{\alpha}_t^\lambda \mathbf{x}_t$ , where  $\mathbf{x}_t$  denotes the result of a pure diffusion model (e.g., DDPM) at step  $t + 1$ , and  $\lambda \geq 0$  is a hyper-parameter. Since  $0 < \bar{\alpha}_t < 1$ , when  $\lambda = 0$ , we obtain a pure reverse diffusion process without any rectification; when  $\lambda = +\infty$ , the reverse process reduces to ZIP. A nice property of  $\tilde{\mathbf{x}}_t$  is that,  $\bar{\alpha}_t$  increases as the reverse process proceeds ( $t$  decreases), making the contribution of  $\mathbf{x}_t$  larger. This is reasonable because the intermediate image becomes increasingly informative over time, reducing the reliance on  $\hat{\mathbf{x}}_t$  in reverse diffusion. We set  $\lambda$  value to achieve desirable fidelity scores (e.g., PSNR [29, 58]) for the resultant purified images. Finally, our revised reverse process is defined as:
$$
\mathbf {x} _ {t - 1} \leftarrow \frac {1}{\sqrt {\alpha_ {t}}} \left(\tilde {\mathbf {x}} _ {t} - \frac {1 - \alpha_ {t}}{\sqrt {1 - \bar {\alpha} _ {t}}} \boldsymbol {\epsilon} _ {t}\right) + \sigma_ {t} \boldsymbol {\epsilon}. \tag {10}
$$
Multiple Transformations. To improve the effectiveness of our approach in removing the poisoning effect, we propose including multiple transformations to more effectively destroy the unknown trigger pattern in a zero-shot setting. Specifically, given  $N$  transformations, the intermediate image  $\mathbf{x}_t$  and estimated noise  $\epsilon_t$  should all satisfy:
$$
\hat {\mathbf {x}} _ {t} ^ {n} = \sqrt {\bar {\alpha} _ {t}} \mathbf {A} _ {n} ^ {\dagger} \mathbf {x} ^ {A _ {n}} + (\mathbf {I} - \mathbf {A} _ {n} ^ {\dagger} \mathbf {A} _ {n}) \mathbf {x} _ {t} + \mathbf {A} _ {n} ^ {\dagger} \mathbf {A} _ {n} \sqrt {1 - \bar {\alpha} _ {t}} \boldsymbol {\epsilon} _ {t}, n = 1, 2, \dots , N. \tag {11}
$$
Finally, we have  $\hat{\mathbf{x}}_t = \frac{1}{N} (\hat{\mathbf{x}}_t^1 +\hat{\mathbf{x}}_t^2 +\dots +\hat{\mathbf{x}}_t^N)$ . We provide our proposed algorithm in Algorithm 1. We focus on two types of transformation pairs in this paper: blurring, represented by  $\mathbf{A}_1^\dagger \mathbf{A}_1$ , and gray-scale conversion, represented by  $\mathbf{A}_2^\dagger \mathbf{A}_2$ .
3.4 Purification Speed-up
The purification speed is crucial when performing defense at inference time. Our framework leverages pre-trained diffusion models, and conducts purification on each test image. Hence, we propose several techniques to speed up purification and reduce costs.
3.4.1 Diffusion Model Inference Speed-up
Algorithm 1 requires a large number of steps to generate a single sample. Each step involves computing the estimated noise and diffusion process, which can be computationally expensive. To address this issue, we leverage the power of the denoising diffusion implicit model (DDIM) [50] to improve the inference speed of our reverse process as below:
$$
\mathbf {x} _ {t - 1} \leftarrow \sqrt {\bar {\alpha} _ {t - 1}} \tilde {\mathbf {x}} _ {0 | t} + \sqrt {1 - \bar {\alpha} _ {t - 1} - \sigma_ {t} ^ {2}} \boldsymbol {\epsilon} _ {t} + \sigma_ {t} \boldsymbol {\epsilon}, \tag {12}
$$
where  $\tilde{\mathbf{x}}_{0|t}$  is also an estimated image based on  $\tilde{\mathbf{x}}_t$  and we have  $\tilde{\mathbf{x}}_{0|t} = \frac{1}{\sqrt{\bar{\alpha}_t}} (\tilde{\mathbf{x}}_t - \sqrt{1 - \bar{\alpha}_t}\pmb {\epsilon}_t)$ . By using
In this speed-up inference method, we can obtain a high-fidelity purified image by sampling only a few steps instead of conducting sampling in thousands of steps. The modified algorithm based on DDIM is provided in the Supplementary Material D.
Algorithm 1 Zero-shot Image Purification
Require: Test image for purification  $\mathbf{x}^P$ ; linear transformation  $\mathbf{A}_1, \mathbf{A}_2, \dots, \mathbf{A}_n$  and their pseudo-inverse  $\mathbf{A}_1^\dagger, \mathbf{A}_2^\dagger, \dots, \mathbf{A}_n^\dagger$ ; diffusion model  $g$ ; hyperparameter  $\lambda$ .
Ensure:  $\mathbf{x}^{A_n} = \mathbf{A}_n\mathbf{x}^P$ $n = 0,1,\dots,N$
1:  $\mathbf{x}^T\sim \mathcal{N}(\mathbf{0},\mathbf{I})$
2: for  $t = T, T - 1, \dots, 1$  do
3:  $\epsilon \sim \mathcal{N}(\mathbf{0},\mathbf{I})$  if  $t > 1$ , else  $\epsilon = \mathbf{0}$
4:  $\pmb{\epsilon}_{t} = g_{\phi}(\mathbf{x}_{t},t)$
5: for  $n = 1,2,\dots,N$  do
6:  $\hat{\mathbf{x}}_t^n = \sqrt{\bar{\alpha}_t}\mathbf{A}_1^\dagger\mathbf{x}^{A_n} + (\mathbf{I} - \mathbf{A}_n^\dagger\mathbf{A}_n)\mathbf{x}_t + \mathbf{A}_n^\dagger\mathbf{A}_n\sqrt{1 - \bar{\alpha}_t}\pmb{\epsilon}_t$
7: end for
8:  $\hat{\mathbf{x}}_t = \frac{1}{N} (\hat{\mathbf{x}}_t^1 +\hat{\mathbf{x}}_t^2 +\dots , + \hat{\mathbf{x}}_t^N)$
9:  $\tilde{\mathbf{x}}_t = (1 - \bar{\alpha}_t^\lambda)\hat{\mathbf{x}}_t + \bar{\alpha}_t^\lambda \mathbf{x}_t$
10:  $\mathbf{x}_{t - 1}\gets \frac{1}{\sqrt{\alpha_t}} (\tilde{\mathbf{x}}_t - \frac{1 - \alpha_t}{\sqrt{1 - \tilde{\alpha}_t}}\pmb {\epsilon}_t) + \sigma_t\pmb {\epsilon}$
11: end for
12: return  $\mathbf{x}_0$
3.4.2 Framework Speed-up
Batch Data Speed-up. We introduce an acceleration method for purification, when images can be processed in batch during inference. For instance, if the pre-trained model accepts images of size  $L \times L$  as input, and we wish to purify  $l \times l$  images, we can first combine  $(L / l)^2$  images into a single  $L \times L$  image by tiling. We then apply our purification method to the tiled image, and split the purified image back to the original images afterwards. Larger images could be resized into  $l \times l$  to apply this method. In this way, our defense approach can handle images of various sizes and significantly improve the purification speed.
Streaming Data Speed-up. In the streaming data scenarios, defenders may only have access to a single test image at a time. In such cases, we can use a fast zero-shot detection method such as [19] to quickly assess whether the image is likely to be poisoned. If the detection result indicates a potential poisoning, we can apply our purification method to remove the trigger pattern. This approach allows us to quickly and effectively defend against poisoned images without applying our purification on every image, thus saving the average processing time.
For defense evaluation, we conducted experiments on three types of backdoor attacks: BadNet [15], Attack in the physical world (PhysicalBA) [34], and Blended [8]. The first two attacks are representatives of patch-based attacks, while the last one represents a non-patch-based backdoor attack. To configure these attack algorithms, we follow the benchmark setting in [33] and use the provided codes. We evaluate the effectiveness of our defense framework ZIP on three datasets: CIFAR-10 [30], GTSRB [52], and Imagenette [24]. The poisoned classification network is based on ResNet-34 [21]. Specifically, for the CIFAR-10 dataset, we apply both blur and gray-scale conversion as linear transformations. For the GTSRB and Imagenette datasets, we solely apply blur as the linear transformation. The additional experiment details are in the Supplementary Material E.
Defense methods available for black-box purification in zero-shot are rare. To fairly assess the effectiveness of our proposed method, we conduct a comparative evaluation against two baseline approaches: ShrinkPad [35] and image blurring (referred to as Blur). The former is a state-of-the-art image transformation-based defense method that can work on black-box models in the zero-shot setting. The latter uses blurred images  $\mathbf{A}_1^\dagger \mathbf{x}^{A_1}$  as purified images. We apply defense methods to all test samples, and then evaluate the output using a poisoned classification network. In addition to the clean accuracy (CA) and attack success rate (ASR) metrics for assessing defense effectiveness, we introduce a new metric called poisoned accuracy (PA). It measures the classification performance of the purified poisoned samples. A higher value of PA indicates that the purified poisoned samples are more likely to be correctly classified, even when using an attacked classification model.
4.2 Qualitative Results of Purification
We conduct qualitative case studies (see Figure 2) of our method in purifying poisoned images created by the Blended and BadNet attacks. We show examples of poisoned images  $\mathbf{x}^P$  and purified image  $\mathbf{x}_0$ , where the trigger pattern is clearly visible in the poisoned images but has been altered/removed in the purified images. For comparison, we also show the blurred image  $\mathbf{A}_1^\dagger \mathbf{x}^{A_1}$  and the grayscale images  $\mathbf{A}_2^\dagger \mathbf{x}^{A_2}$ . The transformed images can destruct the trigger pattern, but they also alter a lot of semantic information. These results demonstrate the effectiveness of ZIP in removing the effect of trigger patterns from images while maintaining semantic information. More qualitative results for different attacks are in the Supplementary Material B.
4.3 Quantitative Results of Defense
We conduct quantitative experiments where the results are in Table 1. Our observations are as follows: (1) Our method effectively defends against different backdoor attacks. This is because the transformations in our framework, which are independent of specific attacks, break the connection between backdoor triggers and backdoor labels. (2) Our method achieves overall better classification
$\mathbf{X}^{P}$
Figure 2: Qualitative analysis of purification. (Row 1-2: Blended; Row 3-4: BadNets. More qualitative results are listed in Supplementary Material B)
A\*xA1
$\mathbf{A}_2^\dagger \mathbf{x}^{\mathbf{A}_2}$
$\mathbf{x}_0$
Table 1: The clean accuracy (CA %), the attack success rate (ASR %), and the poisoned accuracy (PA %) of defense methods against different backdoor attacks. None means no attacks are applied.
Dataset	Attack	No Defense	ShrinkPad (defense)	Blur (defense)	ZIP (Ours)
CA ↑	ASR ↓	PA ↑	CA ↑	ASR ↓	PA ↑	CA ↑	ASR ↓	PA ↑	CA ↑	ASR ↓	PA ↑
CIFAR-10 (32 × 32) (10 classes)	None	80.15	—	—	—	—	—	—	—	—	—	—	—
BadNet	82.31	99.98	10.00	62.89	9.34	63.12	58.19	21.78	53.47	78.97	5.53	79.10
Blended	80.26	99.96	10.03	58.97	2.28	40.22	55.91	3.04	49.91	72.62	7.75	57.98
PhysicalBA	85.30	98.73	11.20	82.84	90.50	18.37	41.84	1.09	41.37	80.10	4.33	80.33
Average	82.62	99.56	10.41	68.23	34.04	40.57	51.98	8.64	48.25	77.23	5.87	72.47
GTSRB (32 × 32) (43 classes)	None	96.95	—	—	—	—	—	—	—	—	—	—	—
BadNet	96.53	99.99	5.70	78.33	5.81	78.82	95.98	7.33	95.11	96.18	6.19	96.03
Blended	96.58	99.89	5.79	76.76	10.54	56.41	93.68	11.07	73.91	95.74	8.53	81.27
PhysicalBA	96.83	100.00	5.70	97.41	100.00	5.70	91.00	5.53	90.53	95.44	6.57	94.91
Average	96.65	99.96	5.73	84.17	38.78	46.98	93.55	7.98	86.52	95.79	7.10	90.74
Imagenette (256 × 256) (10 classes)	None	84.58	—	—	—	—	—	—	—	—	—	—	—
BadNet	84.99	94.53	14.98	71.23	8.56	70.72	81.47	16.45	79.94	84.05	7.55	83.97
Blended	86.14	99.85	10.19	74.06	20.63	36.10	78.95	79.41	25.57	81.42	8.35	78.36
PhysicalBA	90.67	72.94	34.29	90.21	96.81	13.07	84.84	32.40	74.87	87.26	10.91	86.54
Average	87.27	89.11	19.82	78.50	42.00	39.96	81.75	42.75	60.13	84.24	8.94	82.96
accuracy (CA) compared to baseline methods because our formulation successfully recovers semantic information to ensure accurate downstream classification. For example, on the Imagenette dataset, ZIP reduces the ASR of the BadNet attack from  $94.53\%$  (no defense) to just  $7.55\%$ , with only a  $0.94\%$  drop in CA. Similarly, on the GTSRB dataset, our approach reduces the success rate of the PhysicalBA attack from  $100\%$  (no defense) to  $6.57\%$ , with only a  $1.39\%$  drop in CA. (3) Our method outperforms the baselines in poisoned accuracy (PA), indicating that poisoned samples can still be used for classification even when using an attacked black-box classifier. It demonstrates the robustness and usability of ZIP in real-world scenarios. (4) ShrinkPad performs poorly on the PhysicalBA attack, which is consistent with the findings in [34]. This is because PhysicalBA is specifically designed to evade defense methods such as ShrinkPad [34]. On the other hand, our method successfully defends against this attack, demonstrating its superior performance. We include additional experiment results of defenses in Supplementary Material H.
Table 2: ZIP with different transformations (CA↑/ASR↓/PA↑).
Attack	\( \mathbf{Blur_2} \)	\( \mathbf{Blur_4} \)	\( \mathbf{Blur_8} \)	Grayscale
BadNets	84.05/7.55/83.97	82.77/7.15/82.39	72.38/13.41/72.50	70.52/10.79/68.61
Blended	84.05/26.11/63.46	81.42/8.35/78.36	71.03/7.69/67.13	79.79/99.40/10.59
PhysicalBA	90.24/22.88/79.89	87.26/10.91/86.54	76.58/19.43/76.43	76.66/17.51/74.87
4.4.1 Evaluation on Transformations
Comparison of Different Transformations. Image transformation plays a crucial role in our defense. We evaluate the effectiveness of ZIP on the Imagenette dataset using four distinct types of transformations:  $\mathrm{Blur}_2$ ,  $\mathrm{Blur}_4$ ,  $\mathrm{Blur}_8$ , and Grayscale (the results are in Table 2). The subscript of "Blur" represents the kernel size of average pooling, where a larger number indicates a stronger transformation. We have the following observations: (1) The blur operation is more effective than grayscale conversion in reducing the ASR while maintaining good CA and PA. (2) Generally, stronger transformations are more effective in destructing the trigger pattern, resulting in a lower ASR. However, they also destroy more semantic information, leading to lower classification accuracy.
Comparison to Masking and Reconstruction.
Linear transformations are more effective than masking in removing poisoned effects, particularly in cases like the Blended attack where the backdoor pattern is distributed across the image. We compare ZIP with a recently proposed purification method BDMAE [53] on CIFAR-10.
Table 3: Comparison to BDMAE (CA↑/ASR↓).
Attack	No Defense	BDMAE	ZIP
BadNet	82.31/99.98	81.44/1.12	78.97/5.53
Blended	80.26/99.96	78.57/99.88	72.62/7.75
BDMAE first identifies the trigger region on a test image, masks the region, and then uses a masked autoencoder to restore the image. To ensure a fair comparison, we apply the defense stage of BDMAE to our benchmarks using its official code. Table 3 shows that BDMAE effectively defends against the BadNet attack, but it fails to defend against the Blended attack. This is because the trigger pattern in Blended attacks is not located in a local region, making it difficult for BDMAE to identify an appropriate mask. In contrast, our ZIP framework does not make assumptions about trigger patterns thus successfully defends against both attacks.
4.4.2 Evaluation on Enhanced Attacks
We consider a more challenging scenario, where we assume the attacker is aware of our defense and has access to the purified backdoor images, which are then used as enhanced poisoned images to attack a classifier. To demonstrate the effectiveness of our proposed method in defending against such enhanced attacks, we apply our method to BadNet and Blended as examples and choose blurring and grayscale conversion together as the transformations of ZIP. Other settings remain the same as the original attack, and more details about the settings are in the Supplementary Material F.1.
Table 4: Defense against enhanced attacks (CA↑/ASR↓/PA↑).
Attack	Original Trigger	ShrinkPad	Blur	ZIP (Blur+Grayscale)	ZIP (Blur)	ZIP (Grayscale)
BadNets	82.36/24.00/76.05	69.32/10.34/70.44	80.58/31.41/70.70	58.01/79.89/28.02	82.39/18.47/77.29	63.26/73.52/32.91
Blended	85.42/21.83/48.30	75.10/11.71/47.13	78.47/63.61/37.04	75.79/75.21/33.01	81.63/28.83/51.32	73.80/40.71/36.22
During the inference stage, we continue to use the original trigger pattern for attacks. From the experimental results in Table 4, we observe that the original trigger pattern no longer triggers the attack, but if the purification (Blur+Grayscale) we use has the same transformation as the attacker, the attacks can still be triggered. However, by switching to a different transformation, such as solely Blur or Grayscale, the attacks can be effectively mitigated. It is important to note that in practical scenarios, the attacker may not know which transformation the defender is using, therefore the defender should consider using diverse transformations to enhance the defense ability.
4.4.3 Evaluation on Purification Speed
We analyze the computational costs of classification and purification before and after applying speed-up strategies. Figure 3 presents the average time required per image in CIFAR-10. Our defense method's efficiency can be enhanced with the introduction of our proposed tiling and detection-based strategies, resulting in a  $33 \times$  and  $39 \times$  speedup, respectively. The results also show that ZIP can complete the purification step faster than the classification step under various scenarios, highlighting its efficiency. In addition, our method is three times faster than another inference time purification model BDMAE [53]. More details about the speed-up settings are provided in the Supplementary Material F.2.
Figure 3: Inference time with different purification on CIFAR-10.
5 Related Work: Backdoor Defense
In this section, we briefly review backdoor defenses here and provide a more detailed discussion in the Appendix G. Existing backdoor defense methods are mainly designed for white-box models [32, 61]. However, these methods [47, 10] often require access to model parameters or original training data, which is not always feasible in real-world scenarios. To address this challenge, existing black-box defense methods are proposed and can be roughly divided into backdoor detection and backdoor purification. Detection models [18, 19, 65, 12, 38, 14, 56, 16] aim to identify and reject any detected poisoned images for further inference as a defense mechanism. However, this approach can limit the usefulness of these methods in practical settings where users expect results for all of their test samples. On the other hand, backdoor purification methods aim to remove the poison effect from the image to defend against attacks. Some methods [42, 53] in this category involve masking the potentially poisoned region and then reconstructing the masked image to obtain a poison-free image. However, these strategies may fail when the trigger patterns are distributed throughout the image, rather than in a specific patch-based location [1, 43, 68, 37]. Another approach [35] involves applying strong image transformations to the test image to destruct the trigger pattern. While such methods can defend against more advanced attacks, they typically result in a decrease in classification accuracy.
We propose a novel framework called ZIP for defending against backdoor attacks in black-box settings. Our method involves applying strong transformations to the poisoned image to destroy the trigger pattern. It then leverages a pre-trained diffusion model to recover the removed semantic information while maintaining the fidelity of the purified images. The experiments demonstrate the effectiveness of ZIP in defending against various backdoor attacks, without requiring model internal information or any training samples. ZIP also enables end-users to utilize full test samples, even when using an attacked classification model. Some future directions include designing black-box defense for other data domains and exploring other types of diffusion models.
The work is, in part, supported by NSF (#2223768, #2310261). The views and conclusions in this paper are those of the authors and should not be interpreted as representing any funding agencies.
[56] Sakshi Udeshi, Shanshan Peng, Gerald Woo, Lionel Loh, Louth Rawshan, and Sudipta Chattopadhyay. Model agnostic defence against backdoor attacks in machine learning. IEEE Transactions on Reliability, 71(2):880-895, 2022.
[57] Haotao Wang, Junyuan Hong, Aston Zhang, Jiayu Zhou, and Zhangyang Wang. Trap and replace: Defending backdoor attacks by trapping them into an easy-to-replace subnetwork. arXiv preprint arXiv:2210.06428, 2022.
[58] Yinhuai Wang, Jiwen Yu, and Jian Zhang. Zero-shot image restoration using denoising diffusion null-space model. arXiv preprint arXiv:2212.00490, 2022.
[59] Zhenting Wang, Hailun Ding, Juan Zhai, and Shiqing Ma. Training with more confidence: Mitigating injected and natural backdoors during training. Advances in Neural Information Processing Systems, 35:36396-36410, 2022.
[60] Zhenting Wang, Kai Mei, Juan Zhai, and Shiqing Ma. *Unicorn: A unified backdoor trigger inversion framework.* arXiv preprint arXiv:2304.02786, 2023.
[61] Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. Backdoorbench: A comprehensive benchmark of backdoor learning. Advances in Neural Information Processing Systems, 35:10546-10559, 2022.
[62] Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models. Advances in Neural Information Processing Systems, 34:16913-16925, 2021.
[63] Zhen Xiang, David J Miller, and George Kesidis. Post-training detection of backdoor attacks for two-class and multi-attack scenarios. arXiv preprint arXiv:2201.08474, 2022.
[64] Yi Zeng, Si Chen, Won Park, Z Morley Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient. arXiv preprint arXiv:2110.03735, 2021.
[65] Yi Zeng, Won Park, Z Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks' triggers: A frequency perspective. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16473-16481, 2021.
[66] Tao Zhang, Qing Li, Chang-shui Zhang, Hua-wei Liang, Ping Li, Tian-miao Wang, Shuo Li, Yun-long Zhu, and Cheng Wu. Current trends in the development of intelligent unmanned autonomous systems. Frontiers of information technology & electronic engineering, 18:68-85, 2017.
[67] Zhiyuan Zhang, Lingjuan Lyu, Weiqiang Wang, Lichao Sun, and Xu Sun. How to inject backdoors with better consistency: Logit anchoring on clean data. arXiv preprint arXiv:2109.01300, 2021.
[68] Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. Clean-label backdoor attacks on video recognition models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14443-14452, 2020.
[69] Biru Zhu, Yujia Qin, Ganqu Cui, Yangyi Chen, Weilin Zhao, Chong Fu, Yangdong Deng, Zhiyuan Liu, Jingang Wang, Wei Wu, et al. Moderate-fitting as a natural backdoor defender for pre-trained language models. Advances in Neural Information Processing Systems, 35:1086-1099, 2022.
A Theoretical Justification
A.1 Proof on rectified estimation of  $\mathbf{x}_t$  in Equation 7