SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Unified Improvement for Previous Tuning Methods. We discuss the connections between FST and our previous FE-tuning and FT-init to interpret why FST could achieve unified improvements on backdoor robustness and clean accuracy. Our objective function Eq.1 could be decomposed into three parts, by minimizing  $\mathbb{E}_{(x,y)\sim \mathcal{D}_T}\mathcal{L}(f(\boldsymbol {w};\phi (\boldsymbol {\theta};\boldsymbol {x})),\boldsymbol {y})$  over  $\pmb{w}$  and  $\pmb{\theta}$  respectively, and  $\alpha \langle \pmb {w},\pmb{w}^{ori}\rangle$  over  $\pmb{w}$ . Compared with FE-tuning, FST brings an extra loss term on  $\min_{\pmb{w}}\mathbb{E}_{(x,y)\sim \mathcal{D}_T}\mathcal{L}(\pmb {f}(\pmb {w};\phi (\pmb {\theta};\pmb {x})),\pmb {y}) + \alpha \langle \pmb {w},\pmb{w}^{ori}\rangle$  to update linear classifier  $\pmb{w}$ . In other words, while encouraging feature shifts, FST updates the linear classifier with the original loss term to improve the models' clean performance. Compared with the FT-init, by adopting  $\alpha \langle \pmb {w},\pmb{w}^{ori}\rangle$ , FST encourages discrepancy between tuned  $\pmb{w}$  and original  $w^{ori}$  to guide more shifts on learned features.
Weights of Linear Classifier Could Be Good Proxy of Learned Features. Here, we discuss why we choose the discrepancy between linear classifiers as our regularization in FST. Recalling that our goal is to introduce more shifts in learned features, especially for backdoor features. Therefore, the most direct approach is to explicitly increase the difference between backdoor and clean feature distributions. However, we can not obtain backdoor features without inputting backdoor triggers. We consider that weights of the original compromised linear classifier could be a good proxy of learned features. Therefore, we encourage discrepancy between tuned  $\pmb{w}$  and original  $\pmb{w}^{ori}$  rather than trying to explicitly promote discrepancy between feature distributions.
Datasets and Models. We conduct experiments on four widely used image classification datasets, CIFAR-10 [15], GTSRB [32], Tiny-ImageNet [8], and CIFAR-100 [15]. Following previous works [13, 20, 24, 36], we implement backdoor attacks on ResNet-18 [11] for both CIFAR-10 and GTSRB and also explore other architectures in Section 5.3. For CIFAR-100 and Tiny-ImageNet, we adopt pre-trained SwinTransformer [21] (Swin). For both the CIFAR-10 and GTSRB, we follow the previous work [41] and leave  $2\%$  of original training data as the tuning dataset. For the CIFAR-100 and Tiny-ImageNet, we note that a small tuning dataset would hurt the model performance and therefore we increase the tuning dataset to  $5\%$  of the training set.
Attack Settings. All backdoor attacks are implemented with BackdoorBench<sup>1</sup>. We conduct evaluations against 6 representative data-poisoning backdoors, including 4 dirty-label attacks (BadNet [10], Blended attack [6], WaNet [24], SSBA[18]) and 2 clean-label attacks (SIG attack [1], and Label-consistent attack (LC) [33]). For all the tasks, we set the target label  $y_{t}$  to 0, and focus on low poisoning rates, 5%, 1%, and 0.5% in the main experimental section. We also contain experiments of high poisoning rates, 10%, 20%, and 30%, in Appendix C.2. For the GTSRB dataset, we do not include LC since it can not insert backdoors into models (ASR < 10%). Out of all the attacks attempted on Swin and Tiny-ImageNet, only BadNet, Blended, and SSBA were able to successfully insert backdoor triggers into models at low poisoning rates. Other attacks resulted in an ASR of less than 20%. Therefore, we only show the evaluations of these three attacks. More details about attack settings and trigger demonstrations are shown in Appendix B.2.
Baseline Defense Settings. We compare our FST with 4 tuning-based defenses including Fine-tuning with Sharpness-Aware Minimization (FT+SAM), a simplified version adopted from [42], Natural Gradient Fine-tuning (NGF) [14], FE-tuning and FT-init proposed in Section 3.2. We also take a comparison with 2 extra strategies including Adversarial Neural Pruning (ANP) [37] and Implicit Backdoor Adversarial Unlearning (I-BAU) [38] which achieve outstanding performance in BackdoorBench [37]. The implementation details of baseline methods are shown in the Appendix B.3. For our FST, we adopt SGD with an initial learning rate of 0.01 and set the momentum as 0.9 for both CIFAR-10 and GTSRB datasets and decrease the learning rate to 0.001 for both CIFAR-100 and Tiny-ImageNet datasets to prevent the large degradation of the original performance. We fine-tune the models for 10 epochs on the CIFAR-10; 15 epochs on the GTSRB, CIFAR-100 and Tiny-ImageNet. We set the  $\alpha$  as 0.2 for CIFAR-10; 0.1 for GTSRB; 0.001 for both the CIFAR-100 and Tiny-ImageNet.
5.2 Defense Performance against Backdoor Attacks
In this section, we show the performance comparison between FST with tuning-based backdoor defenses (FT+SAM [42], NGF [14], FE-tuning and FT-init) and current state-of-the-art defense methods, ANP [37] and I-BAU [38]. We demonstrate results of CIFAR-10, GTSRB, and TinyImageNet on Table 2, 3, and 4, respectively. We leave results on CIFAR-100 to Appendix C.3.
Experimental results show that our proposed FST achieves superior backdoor purification performance compared with existing defense methods. Apart from Tiny-ImageNet, FST achieves the best performances on CIFAR-10 and GTSRB. The average ASR across all attacks on three datasets are below  $1\%$ ,  $0.52\%$  in CIFAR-10,  $0.41\%$  in GTSRB, and  $0.19\%$  in Tiny-ImageNet, respectively. Regarding two tuning defense methods, FT+SAM and NGF, FST significantly improves backdoor robustness with larger ASR average drops on three datasets by  $34.04\%$  and  $26.91\%$ . Compared with state-of-the-art methods, ANP and I-BAU, on CIFAR-10 and GTSRB, our method outperforms with a large margin by  $11.34\%$  and  $32.16\%$  on average ASR, respectively. ANP is only conducted in BatchNorm layers of ConvNets in source codes. Therefore, it can not be directly conducted in SwinTransformer. Worth noting is that our method achieves the most stable defense performance across various attack settings with  $0.68\%$  on the average standard deviation for ASR. At the same time, our method still maintains high clean accuracy with  $93.07\%$  on CIFAR-10,  $96.17\%$  on GTSRB, and  $79.67\%$  on Tiny-ImageNet on average. Compared to ANP and I-BAU, FST not only enhances backdoor robustness but also improves clean accuracy with a significant boost on the clean accuracy by  $2.5\%$  and  $1.78\%$ , respectively.
<sup>1</sup>https://github.com/SCLBD/backdoorbench
Table 2: Defense results under various poisoning rates. The experiments are conducted on the CIFAR-10 dataset with ResNet-18. All the metrics are measured in percentage (\%). The best results are bold.
Attack	Poisoning rate	No defense	ANP	I-BAU	FT+SAM	NGF	FE-tuning (Ours)	FT-init (Ours)	FST (Ours)
C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)
BadNet	5%	94.09	99.99	91.62	0.52	91.72	1.84	91.71	2.99	90.60	2.58	91.54	3.70	93.24	20.02	93.17	0.00
1%	94.52	100	92.38	0.78	92.01	2.93	91.94	23.72	90.91	6.69	91.56	3.18	93.37	16.72	92.81	0.01
0.5%	94.79	100	84.81	12.12	91.14	10.01	92.58	43.04	91.18	10.16	92.37	7.41	93.9	79.32	93.63	0.02
Blended	5%	94.91	99.76	91.68	5.31	90.9	43.51	92.24	40.80	91.42	21.24	91.08	11.19	93.28	60.94	92.87	3.07
1%	95.13	98.12	90.31	1.18	90.05	24.57	91.72	14.59	91.50	10.73	92.03	8.50	93.88	61.23	93.59	0.19
0.5%	94.45	92.46	90.93	7.92	90.91	15.73	91.50	29.32	91.14	10.03	91.84	6.48	93.71	49.80	93.15	0.06
WaNet	5%	91.14	96.18	91.43	0.63	90.84	1.20	91.02	1.51	90.36	1.12	90.17	1.12	92.01	0.86	91.56	0.26
1%	90.71	70.13	91.02	0.64	91.63	0.39	91.17	1.10	89.88	1.07	89.59	1.20	92.06	0.67	91.83	0.51
0.5%	90.75	16.56	90.28	0.43	90.38	1.22	91.22	0.67	90.31	1.04	89.70	1.13	92.21	0.69	91.70	0.78
SSBA	5%	94.54	97.39	91.64	1.17	90.68	6.76	92.64	2.69	91.05	2.57	91.49	11.21	93.38	43.67	93.48	0.27
1%	94.83	79.54	90.21	0.59	89.69	4.66	92.35	2.35	91.02	4.99	91.99	5.58	93.51	21.04	93.32	0.56
0.5%	94.50	50.20	90.00	0.87	90.19	1.62	92.15	1.98	91.11	2.29	91.31	2.50	93.41	6.69	92.97	0.04
SIG	5%	94.62	99.42	94.36	1.89	90.99	84.97	92.05	1.96	91.18	25.53	91.59	21.66	93.61	55.76	93.24	0.02
1%	94.91	92.74	89.73	3.68	92.23	18.33	92.33	17.27	91.12	3.23	91.77	1.73	93.92	52.96	93.09	0.03
0.5%	94.69	93.76	89.77	1.44	90.29	37.80	92.56	61.93	91.22	17.10	91.53	3.01	93.61	69.08	93.18	0.01
LC	5%	94.45	99.97	88.48	4.77	93.92	42.27	92.07	19.34	91.27	25.02	91.96	35.68	93.75	60.01	93.47	0.68
1%	94.33	99.16	87.97	4.18	93.01	10.33	92.00	27.88	91.57	59.08	91.7	64.97	93.54	89.86	93.51	0.30
0.5%	94.89	100	92.45	98.17	91.40	81.94	92.39	84.37	91.07	51.96	91.65	22.66	93.83	96.16	93.44	1.71
Adaptive-Blend	0.3%	94.86	83.03	92.89	3.85	91.95	15.49	93.61	42.25	93.24	28.52	93.68	10.34	94.93	48.67	94.35	1.37
Average	94.06	87.81	90.63	7.90	91.26	54.46	90.07	22.09	91.11	15.00	91.50	11.75	93.43	43.90	93.07	0.52
Standard Deviation	1.44	21.59	2.07	22.07	1.06	143.15	0.61	22.69	0.67	16.95	0.92	15.74	0.70	30.43	0.70	0.78
Table 3: Defense results under various poisoning rates. The experiments are conducted on the GTSRB dataset with ResNet-18. All the metrics are measured in percentage (\%). The best results are bold.
Attack	Poisoning rate	No defense	ANP	I-BAU	FT+SAM	NGF	FE-tuning (Ours)	FT-init (Ours)	FST (Ours)
C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)
BadNet	5%	98.85	100	98.79	0.00	98.28	0.00	97.37	0.00	97.39	0.27	98.10	7.41	98.59	33.64	94.05	0.00
1%	98.56	100	98.58	0.00	97.71	0.18	99.05	0.68	98.18	0.00	96.1	0.02	98.80	99.88	96.31	0.00
0.5%	98.35	100	98.34	0.00	97.81	0.14	98.73	0.10	96.99	0.00	98.23	0.94	98.31	100	96.60	0.00
Blended	5%	98.71	99.71	97.12	0.00	94.73	8.42	98.86	41.91	97.95	50.45	96.67	96.10	98.43	98.19	97.02	0.02
1%	96.60	97.12	91.12	40.97	97.43	73.43	97.04	76.35	96.97	61.46	97.83	88.66	98.56	93.25	97.43	3.24
0.5%	94.92	86.10	87.43	45.07	96.57	63.11	97.72	73.59	96.82	49.38	98.59	81.93	98.61	91.16	94.34	0.04
WaNet	5%	96.20	96.89	97.55	0.02	93.86	0.00	87.41	0.70	98.50	1.70	84.17	0.68	91.49	3.04	95.00	0.02
1%	96.82	56.66	95.97	0.02	93.19	0.43	88.74	0.53	98.31	18.14	85.89	0.61	90.70	0.48	95.55	0.03
0.5%	97.46	28.86	97.74	0.03	94.62	0.02	88.62	0.14	97.87	0.17	81.28	0.31	93.44	2.15	97.17	0.00
SSBA	5%	97.32	97.15	91.39	0.42	97.04	0.95	96.69	7.01	97.08	6.06	97.39	91.11	98.40	92.17	95.94	0.00
1%	96.75	92.27	93.60	0.06	92.60	1.88	98.07	62.05	96.76	14.06	97.62	77.68	97.96	82.78	96.39	0.12
0.5%	97.46	90.16	94.68	3.54	93.66	8.92	98.05	30.61	97.04	13.25	97.99	59.39	98.44	65.94	95.28	0.00
SIG	0.4%	97.26	63.87	91.17	57.61	93.51	2.90	98.72	5.35	97.58	45.28	98.30	26.18	98.88	93.14	95.76	0.45
0.25%	98.56	64.23	96.18	29.41	97.50	5.37	97.41	2.82	96.72	29.16	97.79	68.89	98.39	84.07	96.31	0.87
0.15%	98.01	49.25	98.01	49.25	97.56	3.80	97.98	2.71	96.43	5.71	98.44	50.75	98.84	63.37	98.00	1.04
Adaptive-Bland	0.3%	96.58	92.43	91.76	25.50	91.70	0.25	98.60	60.79	98.95	50.22	98.89	51.68	98.89	69.49	97.63	0.68
Average	97.40	82.13	94.98	15.71	95.50	10.77	96.18	22.68	97.47	21.47	95.19	43.87	97.29	67.04	96.17	0.41
Standard Deviation	1.05	21.57	3.36	20.94	2.14	22.06	3.88	28.77	0.72	21.66	5.59	36.72	2.66	36.47	1.11	0.81
Following the experimental setting in Section 3.2, we also conduct feature visualization of FST in Figure 3. It can be clearly observed that our FST significantly shifts backdoor features and makes them easily separable from clean features of the target class like FE-tuning. Combined with our outstanding performance, this further verifies that actively shifting learned backdoor features can effectively mitigate backdoor attacks. We also evaluate two initial methods, FE-tuning and FT-init. FE-tuning performs best on Tiny-ImageNet, leading to a little ASR drop by  $0.18\%$  compared with FST. However, it also significantly sacrifices clean accuracy, leading to a large C-ACC drop by  $8.1\%$  compared with FST. FST outperforms them by a large margin for backdoor robustness on CIFAR-10 and GTSRB. As we expected, FST achieves stable improvements in robustness and clean accuracy compared with FE-tuning and FT-init.
Adaptive Attacks. To further test the limit of FST, we conduct an adaptive attack evaluation for it. To bypass defense methods based on latent separation property, adaptive poisoning attacks [26] actively suppress the latent separation between backdoor and clean features by adopting an extremely low poisoning rate and adding regularization samples. Their evaluations also show that these attacks successfully bypass existing strong latent separation-based defenses. Hence, we believe it is also equally a powerful adaptive attack against our FST method. We evaluate our method against adaptive attacks. The results of the Adaptive-Blend attack are shown in Table 2, 3. The results of more adaptive attacks and various regularization samples are shown in Appendix C.4. We could observe that FST could still effectively purify such an adaptive
Figure 4: The T-SNE visualizations of Adaptive- Blend attack (150 payload and 150 regularization samples). Each color denotes each class, and Black points represent backdoored samples. The targeted class is 0 (Red). The left figure represents the original backdoored model and the right represents the model purified with FST.
attack achieving an average drop in ASR by  $81.66\%$  and  $91.75\%$  respectively for the CIFAR-10 and GTSRB.
Table 4: Defense results under various poisoning rate settings. The experiments are conducted on the TinyImageNet dataset. All the metrics are measured in percentage (\%). The best results are bold.
Attack	Poisoning rate	No defense	I-BAU	FT+SAM	NGF	FE-tuning (Ours)	FT-init (Ours)	FST (Ours)
C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)	C-Acc(↑)	ASR(↓)
BadNet	5%	85.17	100	76.33	80.45	81.17	81.93	78.29	55.39	71.19	0.00	80.20	15.21	79.23	1.41
1%	85.19	100	81.51	95.49	82.24	98.38	78.63	34.57	71.67	0.00	80.66	1.24	79.88	0.07
0.5%	85.42	99.97	81.03	84.19	80.06	60.50	79.04	27.02	72.16	0.00	80.79	0.03	79.82	0.00
Blended	5%	85.30	99.88	76.82	86.74	81.88	91.37	78.85	86.99	71.96	0.00	80.58	0.00	79.78	0.00
1%	85.44	98.46	82.55	73.41	81.78	92.12	78.8	84.47	71.85	0.00	80.41	0.00	79.89	0.00
0.5%	85.49	95.49	79.19	71.37	80.96	76.10	78.85	76.57	71.78	0.00	80.61	0.00	80.02	0.00
SSBA	5%	84.27	99.27	82.16	66.25	78.55	0.02	77.83	21.41	70.37	0.05	79.50	0.50	78.94	0.10
1%	85.11	89.05	82.60	68.51	82.14	21.51	78.56	13.24	71.46	0.01	80.35	0.07	79.73	0.06
0.5%	85.60	76.55	82.35	48.80	82.43	4.29	78.77	8.89	71.13	0.02	80.35	0.04	79.77	0.04
Average	85.22	95.41	80.50	70.02	81.25	58.47	78.62	45.39	71.51	0.01	80.38	1.90	79.67	0.19
Standard Deviation	0.39	7.93	2.47	13.66	1.26	39.36	0.37	31.08	0.55	0.02	0.38	5.01	0.35	0.46
Figure 5: The experimental results with and without projection constraint (w/ C and w/o C, respectively). We demonstrate two types of backdoor attacks, namely the BadNet and Blended, with three different poisoning rates (5%, 1%, and 0.5%). The experiments are conducted with varying tuning epochs.
To explain why adaptive attacks fail, we provide TSNE visualizations of learned features from backdoors models. We show the results in Figure 4. We can first observe that adaptive attacks significantly reduce latent separability. Clean and backdoor features are tightly tangled. FST effectively shifts backdoor features and makes them easily separable from the clean features of the target class. Therefore, the feature extractor will no longer confuse backdoor features with clean features of the target class in the feature space. This leads to the subsequent simple linear classifier being difficult to be misled by backdoor samples, resulting in more robust classification.
5.3 Ablation Studies of FST
Below, we perform ablation studies on our proposed FST to analyze its efficiency and sensitivity to hyperparameters, tuning sizes, and architectures. This further demonstrates the effectiveness of FST in practical scenarios.
Efficiency analysis. we evaluate the backdoor defense performance of our method and 4 tuning strategies (FT+SAM, NGF, FE-tuning, and FT-init) across different tuning epochs. We test against 4 types of backdoor attacks including (BadNet, Blended, SSBA, and LC) with  $1\%$  poisoning rate and take experiments on CIFAR-10 and ResNet-18 models (see Figure 6). Notably, FST can effectively purify the backdoor models with much fewer epochs, reducing backdoor ASR below  $5\%$ . This demonstrates that our method also significantly improves tuning efficiency. We also find that added projection constraint also helps FST converge. We offer the performance of FST's entire tuning process on CIFAR-10 and ResNet-18, with or without the projection term. The results of the BadNet and Blended are shown in Figure 5. We could clearly observe that the projection stabilizes the tuning process of FST. The projection term helps FST quickly converge, particularly in terms of accuracy. We leave the analysis with more attacks in Appendix C.5.
Sensitivity analysis on  $\alpha$ . We evaluate the defense performance of FST with various  $\alpha$  in Eq 1. We conduct experiments on CIFAR-10 and ResNet-18 and test against BadNet and Blended attacks with  $5\%$  and  $1\%$ . The results are shown in (a) and (b) of Figure 7. We can observe that as the  $\alpha$  increases from 0 to 0.1, the backdoor ASR results rapidly drop below  $5\%$ . As we further increase the  $\alpha$ , our method maintains a stable defense performance ( $ASR < 4\%$ ) with only a slight accuracy degradation ( $< 1.5\%$ ). It indicates that FST is not sensitive to  $\alpha$ . The results further verify that FST could achieve a better trade-off between backdoor robustness and clean accuracy.
Sensitivity analysis on tuning dataset size. Here, we evaluate the FST under a rigorous scenario with limited access to clean tuning samples. We test our method on the CIFAR-10 using tuning datasets of varying sizes, ranging from  $0.1\%$  to  $2\%$ . Figure 7 shows that FST consistently performs
Figure 6: The ASR results of four backdoor attacks with varying tuning epochs of tuning methods.
Figure 7: (a) and (b) show C-ACC and ASR of FST with various  $\alpha$ . (c) and (d) show the C-ACC and ASR of various sizes of tuning datasets. Experiments are conducted on CIFAR-10 dataset with ResNet-18.
well across various tuning data sizes. Even if the tuning dataset is reduced to only  $0.1\%$  of the training dataset (50 samples in CIFAR-10), our FST can still achieve an overall ASR of less than  $2\%$ .
Analysis on model architecture. We extend the experiments on other model architectures including VGG19-BN [31], ResNet-50 [11], and DenseNet161 [12] which are widely used in previous studies [14, 37, 42]. Here we show the results of BadNet and Blended attacks with  $5\%$ ,  $1\%$ , and  $0.5\%$  poisoning rates on the CIFAR-10 dataset. Notably, the structure of VGG19-BN is slightly different where its classifier contains more than one linear layer. Our initial experiments show that directly applying FST to the last layer fails to purify backdoors. Therefore, we simply extend our methods to the whole classifier and observe a significant promotion. We leave the remaining attacks and more implementation details in the Appendix D.2. The results presented in Figure 8 show that our FST significantly enhances backdoor robustness for all three architectures by reducing ASR to less than  $5\%$  on average. This suggests that our approach is not influenced by variations in model architecture.
Figure 8: The purification performance against 3 different model architectures on the CIFAR-10 dataset, where Ba- is short for BadNet and Bl- is short for Blended.
In this work, we concentrate on practical Fine-tuning-based backdoor defense methods. We conduct a thorough assessment of widely used tuning methods, vanilla FT and LP. The experiments show that they both completely fail to defend against backdoor attacks with low poisoning rates. Our further experiments reveal that under low poisoning rate scenarios, the backdoor and clean features from the compromised target class are highly entangled together, and thus disentangling the learned features is required to improve backdoor robustness. To address this, we propose a novel defense approach called Feature Shift Tuning (FST), which actively promotes feature shifts. Through extensive evaluations, we demonstrate the effectiveness and stability of FST across various poisoning rates, surpassing existing strategies. However, our tuning methods assume that the defender would hold a clean tuning set which may not be feasible in certain scenarios. Additionally, they also lead to a slight compromise on accuracy in large models though achieving robustness. This requires us to pay attention to protect learned pretraining features from being compromised during robust tuning [7, 16, 19, 39].
[38] Yi Zeng, Si Chen, Won Park, Zhuoqing Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=MeeQkFYVbzW.1,2,5.1,5.2,B.1
[39] Jianyu Zhang and Léon Bottou. Learning useful representations for shifting tasks and distributions. In International Conference on Machine Learning, pages 40830-40850. PMLR, 2023. 6
[40] Lin Zhang, Li Shen, Liang Ding, Dacheng Tao, and Ling-Yu Duan. Fine-tuning global model via data-free knowledge distillation for non-iid federated learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10174-10183, 2022. 1
[41] Runkai Zheng, Rongjun Tang, Jianze Li, and Li Liu. Data-free backdoor removal based on channel lipschitzness. In Computer Vision-ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part V, pages 175-191. Springer, 2022. 1, 2, 5.1, B.1
[42] Mingli Zhu, Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. arXiv preprint arXiv:2304.11823, 2023. 2, 3, 5.1, 5.2, 5.3, B.3
A Social Impact
Deep Neural Networks (DNNs) are extensively applied in today's society especially for some safety-critical scenarios like autonomous driving and face verification. However, the data-hungry nature of these algorithms requires operators to collect massive amounts of data from diverse sources, making source tracing difficult and increasing the risk of potential malicious issues. For example, attackers can blend poisoned data into benign samples and embed backdoors into models without training control, posing a significant threat to model deployment. Therefore, to mitigate these risks, defenders must remove potential backdoors from models before real-world deployment, ensuring safety and trustworthiness. Our work focuses on a lightweight plug-and-play defense strategy applicable in real scenarios with minimal modifications to existing pipelines. We hope to appeal to the community to prioritize practical defensive strategies that enhance machine learning security.
B.1 Datasets and Models.
Following previous works [17, 36, 37, 38] in backdoor literature, we conduct our experiments on four widely used datasets including CIFAR-10, GTSRB, Tiny-ImageNet, and CIFAR-100.