REFINE: Inversion-Free Backdoor Defense via Model Reprogramming
Authors: Yukun Chen
Shuo Shao
Enhao Huang
Yiming Li
Pin-Yu Chen
Zhan Qin
Kui Ren
Venue: ICLR 2025 Poster (2025)
Keywords: Backdoor Defense
Model Reprogramming
Backdoor Learning
AI Security
Trustworthy ML
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Backdoor attacks on deep neural networks (DNNs) have emerged as a significant security threat, allowing adversaries to implant hidden malicious behaviors during the model training phase. Pre-processing-based defense, which is one of the most important defense paradigms, typically focuses on input transformations or backdoor trigger inversion (BTI) to deactivate or eliminate embedded backdoor triggers during the inference process. However, these methods suffer from inherent limitations: transformation-based defenses often fail to balance model utility and defense performance, while BTI-based defenses struggle to accurately reconstruct trigger patterns without prior knowledge. In this paper, we propose REFINE, an inversion-free backdoor defense method based on model reprogramming. REFINE consists of two key components: \textbf{(1)} an input transformation module that disrupts both benign and backdoor patterns, generating new benign features; and \textbf{(2)} an output remapping module that redefines the model's output domain to guide the input transformations effectively. By further integrating supervised contrastive loss, REFINE enhances the defense capabilities while maintaining model utility. Extensive experiments on various benchmark datasets demonstrate the effectiveness of our REFINE and its resistance to potential adaptive attacks.

Published as a conference paper at ICLR 2025
REFINE: INVERSION-FRED BACKDOOR DEFENSE VIA MODEL REPROGRAMMING
Yukun Chen Shuo Shao Enhao Huang".2, Yiming Lii.3,,, Pin-Yu Yu Chen',
Zhan Qin Kui Ren
State Key Laboratory of Blockehain and Data Security, Zhejiang University
Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security
3 Nanyang Technological University IBM Research
(yukunchen, shaoshuo_ss, huangenhao, qinzhan, kuiren)ezju. edu. en; 1i liyiming tech gmail. com; pin-yu. chen@ihm........ com
ABSTRACT
Backdoor attacks on deep neural networks (DNNs) have emerged as a sigmificant security threat, allowing adversaries to implant hidden malicious behaviors during the model training phase, ppopessiin-baseee defense, which is one of the most important defense paradigms, typically focuses input transformations back- door trigger inversion (BTI) to deactivate or eliminate embedded backdoor trig- gers during the inference process. However, these methods suffer from inherent limitations: transformation- based defenses often fail to balance model utility and defense performance, while BTI-based defenses struggle accurately reconstruct trigger patterns without prior knowledge, In this paper, we propose REFINE, an inversion-free backdoor defense method based model reprogramming. RE- FINE consists of two key components: (1) an input transformation module that disrupts both benign and backdoor patterns, generating new benign features; and (2) an output remapping module that redefines the model's 's output domain to guide the input transformations effectively. By further integrating supervised contrastive loss, REFINE enhances the defense capabilities while maintaining model utility. Extensive experiments on various benchmark datasets demonstrate the effective- ness of our REFINE and its resistance to potential adaptive attacks.
INTRODUCTION
Deep neural networks (DNNs) have been widely deployed across various domains (He al. 2023 Liu et al.) 2024 He et al.) 2024 Zhang et al. 2024). To develop a high-performance DNN, devel- opers necessitate
only high-quality data samples but also substantial computational resources. Consequently, developers frequently and directly rely on third-party models for follow-up develop- ment. However, the utilization of third party DNNs can introduce security threats, particularly with
regard to backdoor attacks (Gu et al.) 2019 Li et al.
2022b) Dong et al., 2023 Gao et al. 2024).
Backdoor attacks aim implant hidden backdoors into the model during training (Gu et al. 2019).
After the attack, the backdoored model functions normally on benign inputs. However, when specific trigger present, the model will produce intentionally incorrect outputs. Backdoor attacks pose severe threat to critical applications where model reliability is essential, highlighting the urgent need for effective backdoor defense strategies to safeguard Al systems (Li al. 2024c).
Currently, several backdoor defenses (Huang et al. 2022 Li et al. 2024a by Hou et al. 2024 have been developed to tackle the threat of backdoor attacks. Among these, pre- pro-prreesinn-baiee based de- fenses (Villarreal- Vasquez & Bhargava 2020 Qiu et al.] 2021) are particularly notable because they only apply certain modifications to input samples hefore model inference, without altering the original model structure and weights. Currently, there two main types of pre-processing-bate defenses. The first type of defenses relies on input transformations (Li et al. 2021c Sun et al.
"The first two authors contributed equally this work. Conrepoondigg author: Yiming Li. Our code is available httpt::t//// //gi tww.t com/ whi woliiooofeeeee fChen/ REF [NK and Hackdoorkox

---

Published as a conference paper at ICLR 2025
Input Transformation Module J
Output Mapping
Backdoored Model FF
Module M
Ground-truth Label (Dog)
Ground-truth Label (Dug)
Benign
Benign Sample
Transformed
Sample
Sample
Target I Label
Ground-rruth Label (Dog)
(Cat)
Polsoned
Polsoned
Transformed
Sample
No Defense
Sample
Sample
REFINE
Figure The defense process of our REFINE. The label remapping the model's output do- main significantly enhances the flexibility of input transformations while maintaining consistent sample predictions, effectively mitigating the trade-off often encountered in transformation-bast pre-processing defenses. During prediction, the input sequentially passes through the well-trained input transformation module, the fixed backdoored model, and the drf-nefined output mapping mod- ule, ultimately yielding the expected ground-truth (instead of the malicious target) label.
2023 Shi et al. 2023). These defenses aim to mismatch or eliminate potential trigger patterns by performing certain transformations to the input samples. The second type is based on backdoor trigger inversion (BTI) (Wang et al.) 2019 2023 Xu et al. 2024), which attempts reconstruct the attacker's s trigger patterns and remove them before the data is processed by the model.
In this paper, we revisit the aforementioned pre-processing- based backdoor defenses. We reveal that they both have intrinsic limitations. Specifically, transformation-base defenses face a trade-off' between model utility and defense performance: more extensive transformations can achieve lower attack success rates but may negatively impact the model's 's benign accuracy. This occurs because these defenses lack information about backdoor-relatee features, forcing them to modify all features indiscriminately, including those critical for benign accuracy. The close coupling of benign and backdoor features makes difficult to apply stronger transformations without significantly com- promising model utility. On the other hand, BTI-based defenses 'break' the trade-off by first obtaining the information of backdoor triggers via trigger inversion. However, due to the inherent difficulties of BTI (e.g., lack of prior knowledge about the implanted backdoor and poisoned sam- ples), existing BTI methods struggle to accurately invert trigger patterns. This limitation makes difficult to purify the backdoored input from the poisoned domain to the benign domain, leading to limited effectiveness of BTI-based defenses. Accordingly, an intriguing and important question arises: Could we break the curse of this trade-off without relying on backdoor trigger inversion?
To tackle the above challenge, we first provide a theoretical analysis showing that the effective- ness of backdoor defenses is bounded by the distance between output features before and after pre- processing, Accordingly, the ineffectiveness of existing defenses is mostly due to their underlying assumption of having fixed output domain. Based on the above understandings, inspired by model reprogramming (Chen] 2024), we propose REFINE, REprogramming based Inversion-Fire Free back- door defeNse mEthod, as shown in Figure [ By allowing changes the output domain, REFINE can significantly alter the input domain while largely maintaining model accuracy. Specifically, our REFINE involves an input transformation module and an output mapping module to reprogram the backdoored model and eliminate backdoor triggers. We utilize a trainable autoencoder as the input transformation module and redefine the model's output domain through a hard-coded remapping function. This adjustment to the output domain enables more extensive and effective input transfor- mations. Besides, we enhance our method by applying supervised contrastive loss (Khosla et al.) 2020), ensuring that transformed samples of the same class remain closely aligned.
We revisit existing pre-processing-bare based backdoor defenses and reveal their limitations. (2) Based on the empirical and theoretical analysis, we propose simple yet effective defense (i.e., REFINE). Our REFINE introduces trainable input transformation and output mapping modules for reprogramming and incorporates cross-entropy and supervised contrastive losses to enhance defense performance. (3) Extensive experiments on diverse benchmark datasets demonstrate the effectiveness of REFINE and its resistance to potential adaptive attacks.
Our contributions are three-fold. (1)
2 BACKGROUND
2.1 BACKDOOR ATTACKS
Backdoor attacks (Goo et al. 2020 Li et al. 2024c) involve embedding hidden malicious behaviors into model, typically by manipulating the training process with small subset of poisoned data
2

---

Published as a conference paper at ICLR 2025
containing cedversary-speciffers trigger patterns. Whenever the trigger appears in the input during inference, the model executes the attacker's intended behavior, such as misclassifying the imput to target label. In the absence of the trigger, the model functions normally, rendering the backdoor hard to detect. Backdoor attacks pose serious threats in Al-enpowered systems.
The formulation of backdoor attacks is typically presented as follows. Given training dataset D= (2; y N the attacker manipulates the training process of the model F by introducing a poisoned subset D = {(.,, ) where ã; = G(æ;) with G(-) as certain trigger injection func- tion and y, being the chosen target label, or by altering the training loss directly. During inference, the model behaves normally on benign samples, where yj F(ar)), while exhibiting backdoor behavior on poisoned samples, such as misclassifying to the target label y: = F(G(r)))
Generally, existing attacks can be classified into two types: (1) Visible backdoor attacks, which typically employ trigger patterns that are visible to humans, such as specific white-black squares (Gu et al. 2019), physical attacks (Li et al. (021c), or adaptive attacks (Qi et al. (202)). (2) Invisible backdoor attacks, which introduce imperceptible triggers to enhance the stealth and evasiveness of attacks (Chen et al.) 2017), including sample-speciff attacks (Li ct al. (021d), trainable noise
attacks (Doan et al. 2021). and sample rotation attacks (Xu et al. 2023)).
2.2 BACKDOOR DEFENSES
Currently, there are various backdoor defense methods designed mitigate backdoor threats. These methods can generally be divided into three main paradigms (Li et al. 2024cp: (1) pre-processing-
based defenses (Liu al. 2017 Li et al. 2021c Shi et al. 2023). (2) backdoor elimination (Li al., 2021b] Huang et al.) 2022 Xu et al.) 2024). which involves adjusting model parameters through fine-tuning, pruning or reconstruction to remove the backdoor. (3) trigger elimination, also known as testing sample filtering (Gao et al. 2019: Javaheripi et al.) 2020: Li et al.) (023b). In this paper, we focus on pre-processing-oee basedd defenses since we consider scenarios where only fixed third-party models accessible and defenders require to obtain the correct final results of all samples.
---prooessing-baseee Defenses. Generally, nre-proccssing-baseee defenses can be categorized into two types: (1) Transformation-buuse defenses. Classical methods (Liu et al. 2017 Li et al. 2021c
Qiu al. 2021) typically involve applying simple transformations to input, aiming to disrupt trigger patterns and prevent the model from exhibiting backdoor behavior. More Recently, many methods have leveraged the powerful reconstruction capabilities of generative models, such as diffusion mod- els (Shi et al. [2023 May et al.) 2023) and masked autoencoders (Sun al. (023), intending to retain the original benign features while minimizing the presence of backdoor-relatee features. However, there is a trade-off between removing backdoor patterns and restoring benign patterns, which re- mains a pressing issue to address. (2) BTI-based defenses (Wang et al., 2019 Xu et al.. (2024) Wang et al., 2023), which focus on inverting the pre-injected triggers and utilizing them to purify the input samples. However, these methods may face issues with inaccuracies in the inverted triggers, which may lead to suboptimal purification of the input. How to design an effective pre-processing-bet defense is still an important open question.
2.3 MODEL REPROGRAMMING
Model reprogramming [Kloberdanz et al. 2021 Neekhara et al. 2022: Jing et al. 2023) is a tech- nique that extends the application of a pre-trained model from source domain target domain. This technique involves adapting the input from the target domain to match that of the source do- main. Specifically, model reprogramming introduces an input transformation module T(= and an output mapping module M(y13), where O and /3 are the trainable parameters of these two mod- ules, respectively (Chen) 2024). Given a pre-trained model F(-) and an input sample æ. model reprogramming first transforms æ to å leveraging the input transformation module. Then input ä into the pre-trained model F(-) and get the output ğ = F()). Finally, the output mapping module is used map ÿ into the final output y. Through fine-tuning the input transformation module and the output mapping module (i.e., optimizing 0 and (), model reprogramming can efficiently turn the pre-trained model from the source domain to target domain. Compared to transfer learning, model reprogramming does not necessitate modifying the parameters of the pre-trate pre-trained model. As such, it is more efficient and flexible. More details about related work are in Appendix H
3

---

Published as a conference paper at ICLR 2025
Benign
NO Benign
Benign
High Benign
Potsoned
Polsoned
Polsoned
Polsoned
100
40
(a-1)
(a-2)
(a-3)
(a-4)
100
BA
ASR
ND Rm0.2 R-0.4 Rm0.6 Rm0.8
(b-1)
(b-2)
(b-3)
(b-4)
Figure 2: (a-1)&(b-1): The ASR and BA for ShrinkPad (the first row) and BDMAE (the second row) with different transformation intensities. (4+)))-(44)8(002))x))))))) The t-SNE plots of the features of benign and backdoor samples under no defense (dubbed "ND"), low transformation intensity (dubbed "Low"), and high transformation intensity (dubbed "High"). Squares and solid circles represent the centroids of benign sample distributions and backdoor sample distributions. As the transformation intensity increases, the features of benign samples deviate from the origin. The results demonstrate the tradeoff faced by the transformation-basse backdoor defense methods.
REVISITING EXISTING PRE-PROCESSSIGG-ASEE BACKDOOR DEFENSES
3.1
THREAT MODEL
This paper focuses on tackling the issue of pre-trained backdoored models via pre-processing-boe based backdoor defense. The defender may buy or acquire pre-trained model from third pardypprtty platforms. However, there exists threat that the pre-trained model backdoored. Due to the limitations of computational resources, the defender seeks to mitigate the backdoor in efficient and low-cost way (e.g., without altering the parameters of the pre-trained model). Following prior works (Liu et al., 2017 Li et al.) (021c), we make the following assumptions. For adversaries, they implant the backdoor into the pre-trained model in any way (e.g., by poisoning the training data or interven- ing in the training process). For defenders, assume that they have access to unlabeled dataset that is independent and identically distributed to the training dataset of the pre-trained model.
3.2 THE LIMITATIONS OF TRANSFORMATION BASED DEFANSES
Transformation-hann defenses aim to mismatch or eliminate triggers by applying specific transfor- mations to test samples. This type of defense method can be categorized into two types: random perturbations and generator reconstruction. Specifically, random perturbations involve the defender mismatching the trigger pattern through techniques such as scaling or rotation, while generator re- construction leverages pre-trained generative model to erase the trigger pattern. However, the transformation-buuell backdoor defense methods face trade-off between the utility of the model and the effectiveness of the backdoor elimination, making them ineffective in practice.
In this section, we present the empirical results to support the above claim. We implement two representative transformation-basse methods, ShrinkPad (Li al., (202cc) (dubbed "SP") and BD- MAE (Sun et al., 2023) (dubbed "BD"), to defend the BadNets attack (Gu et al. al.] 2019)) on CIFAR-10. Specifically, ShrinkPad applies simple spatial transformations to the input, while BDMAE employs a trained masked autoencoder for data cleansing. We use "Pad Size" (dubbed "S"), which refers to the padding size applied around shrunk images, and "Mask Ratio" (dubbed "R"), which represents the masking rate applied to images before reconstruction, to control the transformation intensity for ShrinkPad and BDMAF, respectively. We aim to analyze how these transformations impact the model's 's benign accuracy (BA) and attack success rate (ASR) of the backdoor. Additionally, we treat the original model as a feature extractor. We then visualize how transformation intensity affects the differences in feature distribution between benign and poisoned samples of the same class.
As shown in Figure 2 (a-1 1) and (b-1), increasing the intensity of input transformation, which en- larges the feature distance between the original and transformed samples, reduces the backdoor ASR. However, it also leads to a decline in the model's BA. As depicted in Figure 2 (a-2))-(a-4) and (b-2)>(b-4), higher transformation intensity causes greater changes in the feature distribution
4

---

Published as a conference paper at ICLR 2025
Poisoned (BadNets)
Inverted (BadNets)
Purified (BadNets)
Poisoned (Blended)
Inverted (Blended)
Purified (Blended)
Figure 3: The visualization BTI-DBF in inverting backdoor triggers under both BadNets and Blended attacks. We display the poisoned, inverted, and purified samples, respectively.
of backdoored samples within the same class, indicating that higher transformation levels effectively mismatch or remove trigger patterns. Nevertheless, the difficulty of decoupling benign patterns from backdoor patterns in the input domain results in that such transformations inevitably affect the be- nign features. It causes shift in the centroid of the benign sample feature distribution (visualized as solid circles in Figure 2p. The primary cause of this trade-off is the consistent output domain of the DNN before and after defenses, which forces the input transformation module achieve two conflicting goals: (1) removing trigger patterns effectively and (2) maintaining benign patterns of samples while ensuring their correct classification. This conflict inspires us consider that adjusting the model's output domain may help mitigate this issue.
3.3 THE LIMITATIONS OF BTI-BASED DEFENSES
BTI-based defenses can 'break' the trade-off between model utility and defense performance by incorporating the information of backdoor attacks via trigger inversion. In the prepprcesssin-
defense paradigm, BTI-based defenses typically involve two steps: trigger inversion and input pu- rification. Specifically, the defender first exploits several data to invert the pre-injected trigger, then trains generator to purify the input samples using the inverted trigger. The effectiieness of BTI-based defenses highly relies on the quality of the inverted trigger. However, we argue that the inherent challenge of achieving high-quality trigger inversion, due the lack of prior knowledge, hinders effective input purification, ultimately limiting the performance BTI-based defenses.
We implement the state-of- state-of-the-art are-art BTI-based defense, BTI-DBF (Xu et al. 2024), invert the backdoor triggers of BadNets (Gu et al., 2019) and Blended (Chen et al. (017) on CIFAR-10. As shown in the Figure 3 BTI-DBF effectively reverses the trigger pattern of the BadNets attack and purifies the poisoned sample. However, for the Blended attack, the trigger pattern reversed by BTI- DBF significantly differs from the pre-injected one, leading to poor purification of the poisoned sample. This illustrates that the effectiveness of BTI-based defenses largely depends on the quality of trigger inversion, which is the inherent challenge of such defenses. Moreover, BTT-based defenses often identify "pseudo-triggen" model's vulnerability to adversarial perturbations. When defenders attempt to use such triggers to train purification generators, they may disrupt the benign features of the samples, while leaving the backdoor patterns largely unaffected. If the quality and authenticity the inverted trigger patterns cannot be guaranteed, BTI-based defenses may potentially yield adverse outcomes.
inherent in DNNs Ya et al.) 2023), which usually arise from the
In conclusion, achieving BTI is a challenging endeavor due to the lack prior knowledge about the implanted backdoor and poisoned samples, highlighting the need for inversion- -fre backdoor defense to resolve this trf
4
METHODOLOOGY
4.1
MOTIVATION AND INSPIRATION
In Section 3 we empirically evaluate existing pre- pe-pprssiing-aasee defenses and analyze why they ineffective. In this section, present theoretical analysis and the inspiration design an effective and efficient backdoor defense method. Given pre-psscssiing method T(-) and pre- trained model F(.), have the following theorem.
5

---

Published as a conference paper at ICLR 2025
Input Transformation Module
Output Mapping
Trained Fixed
Backdoored Model
Module M
Pscudo-Labels
(
Unlabeled Benign Samples
Leup (X.
e (ee(P,))
Mapped Logits (F)
Unlabeled Benign Samples
Trunsformed Sumples
(X)
Optimiize T
(X)
The main optimization pipeline of our REFINE. There two main components: input transformation module T and output mapping module M. Specifically, after obtaining the fixed pre- trained model, the defender first specifies particular hard-coded mapping M and then optimizes T guided by the loss function L, using the unlabeled benign dataset. The loss function L consists of the entssyyntropy loss Lee which aims to maintain the model's utility, and the supervised contrastive loss Sup to enhance the defense capability via forcing orderly sample aggregation.
Figure 4:
Theorem 1. Given K-class pre-trained deep learning model F(.) s(f(.)) where s(-) is the softmax function and f(.) is the feature extractor, and a pre proppscessinng method (.), x is the data
from a specific domain D (i.e., ac ~ DD and ã = Tax)) ~ D. Let (x)) and $ (x))) denotes the probability density function of D and D. we have
E BaND D [F(x) F(ō)112 S 20vK (M.
(I)
where Wi (1, (1) is the Wasserstein-I distance between μ and and are the probability measures of the representations fxx and fā)), and a = max[4 x))
Theorem T indicates why existing defenses are ineffective. Assuming æ the poisoned sample, the left part of Eq. (1) means the distance between the prediction of the transformed poisoned sam- ple and the original poisoned sample. Theorem demonstrates that the distance is bounded by the Wasserstein-1 distance between the probability measures μ., fá of the output representations. Thus, to maintain model utility, existing pre- nre-processing-beee based defenses tend to retain the output representa- tions, limiting their effectiveness against backdoors. Otherwise, they have to compromise the model utility to achieve greater backdoor defense performance. The proof is in Appendix [A]
Following the above theorem, tween j.. Inspired by model reprogramming techniques (Chen) (024), we propose REFINE, reprogramming-born
enhance the upper bound by increasing the distance be-
inversion-free backdoor defense method. Our REFINE can significantly transform the input domain to destroy trigger patterns while maintaining model utility for it also changes the output domain. Specifically, we introduce an input transformation module to modify puts, and an output mapping module to remap original classes to new shuffled ones. We also employ a supervised contrastive loss to further enlarge the distances among different classes. The technical details of our REFINE are illustrated in the following parts.
4.2 REFINE:
INVERSION- EVERRSOO-FREE BACKDOOR DEFENSE METHOD
In general, REFINE consists of two essential components: (1) the input transformation module T. which disrupts the benign and backdoor patterss of input samples through transformations and generates new benign features; (2) the label mapping module M, which formulates the specified source-target hard-coded label remapping function and maps the original classes new shuffled classes. Additionally, we integrate the cross-entropy loss Loe and the supervised contrastive loss Loup to steer the optimization of T. The illustration of our REFINE is shown in Figure 4
4.2.1 INPUT TR TRAANFFORMATION MODULE
To effectively alter potential trigger patterns in the input samples, need modify the input domain of the original model. Traditional model reprogramming methods (Elsayed et (0199 Tsai al. 2020) add the optimized universal adversarial perturbation around the input samples, while

---

Published as a conference paper at ICLR 2025
trigger patterns still remain intact on backdoored images to extent. In contrast, utilize trainable autoencoder (e.g., UNet) as the foundational structure for our imput transformation module. Arguably, this module not only preserves the consistency of sample dimension before and after transformation, but also affords greater flexibility in sample manipulation compared to conventional reprogramming methods. Upon inputting batch of data, the input transformation module will encode the pixel features from the images and then decode them to produce new samples. The transformed samples X can be described as follows:
X = T
where X is a batch of input samples, and T(:,0) is the input transformation module with 0 as its trainable parameters. During this transformation process, both benign and backdoor patterns are disarranged, effectively removing potential triggers and causing the generation of new benign features orderly clustered by their respective classes.
4.2.2 OUTPUT MAPPING MODULE
Once the input samples are transformed into samples via the input transformation module, they are subsequently processed by the original backdoored model, which generates confidence scores for each class, expressed below:
Y = =(X),,
(3)
where F(.) is the original backdoored model. As demonstrated in Section 3.2 fixing the model's output domain leads to trade-off between model utility and defense performance. To address this issue, we introduce an output mapping module at the model's output end, aiming to alter the output domain and mitigate the aforementioned challenges. Specifically, the output mapping module redefines the class order of the model's s output layer, which hard-codes one-to-one label remapping function ft I ++ I, where 1,l E L. # I, L is the set of labels. The confidence scores generated by the original model can be remapped into new scores through M, as follows:
Y= (Y).
(4)
The final predictions for the samples can be derived from the confidence scores outputted by M.
4.2.3 OPTIMIZING REFINE MODULES
To maximize the flcxibility of input transformations for removing trigger patterns while maintaining the original model's accuracy, we incorporate two crucial loss functions, the cross-entropy loss and the supervised contrastive loss, to guide the optimization of the input transformation module. The formulation of the combined loss function can be expressed as follows:
min Lrefine Loe + XLeup-
(5)
In Eq. (5). Lee and Loup indicate the cross-entropy loss and the supervised contrastive loss, re- spectively. À is a scalar temperature parameter, and represents the set of parameters in the input transformation module to be optimized during training. Since Theorem ] does not guarantee the model performance on clean samples, adding Lee to maintain the utility of the model is necessary.
In our threat model, the dataset available to the defender is unlabeled. Therefore, before calculating these loss functions, is necessary obtain the pseudo-labels Y for the current batch of unlabeled samples X, predicted by the original model (without any additional modules), as follows:
Y
arg max ((X)).
Leveraging Cross-entropy Loss to Maintain the Utility. Due to the substantial modification of the original model's output domain facilitated by the output mapping module, the input transforma- tion module is no longer constrained by the requirement to preserve the original benign features of the samples. Nevertheless, the model must retain its original performance within the new output domain, which necessitates the employment of cross-entropy loss to effectively guide the sample transformation process. The cross-entropy loss is typically formalized as follows:
N
Lce =
Te log(y:),
(7)
N
7

---

Published as a conference paper at ICLR 2025
where N represents the number of samples in the current data batch X. y, Y denotes the pseudo- label for sample æ; E X (typically a one-hot encoded vector), and yı E Y indicates the predicted probability remapped by the output mapping module for sample z;,
Utilizing Supervised Contrastive Loss to Enhance Backdoor Defense. Arguably, relying solely on cross-entropy loss is insufficient to maintain the original model's benign aceuracy and mitigate the backdoor. Therefore, we introduce supervised contrastive loss (Khosla et al.] (020), where "supervised" refers the original model the supervisor. Specifically, the supervised contrastive loss aims to ensure that features of transformed samples from the same class are more similar, while those from different classes are further apart. It can be defined as follows.
exp (ā; #PpT)
Suup Σ SEI
Σ PEP(()
log EaEA(o) exp (i:: $a/T)"
(8)
where / (1. ]) represents indices of all samples in current data batch, ã; - T(;;; 0) E X. the symbol denotes the inner (dot) product, is a scalar temperature parameter, and A(i) (i). The set P(i) = {p E A(i) ypp = yi contain indices of all positives in the batch distinct from i. and [P()) is its cardinality. The pseudo-code for the optimization process can be found in Appendix B
4.2.4 UTILIZING REFINE FOR MODEL INFERENCE
During the model inference phase, we apply the aforementioned well-trained modules to achieve high-performanne and secure predictions. The input samples are sequentially processed through the input transformation module T(., 0), the original pre-trained model F(-). and the output mapping module M(-). This process ultimately yields the predicted confidence scores, with all parameters remaining constant. The inference process can be formally expressed follows.
y MMF(TTTx 0)))
where æ represents the sample to be predicted. The detailed process is illustrated in Figure
5 EXPERIMENTS
In this section, we evaluate the effectiveness of our REFINE compared with different existing back- door defenses. We also conduct ablation study and evaluate the resistance to potential adaptive attacks. The analysis of the overhead of REFINE in Appendix F and the implementation of RE- FINE in the black-bor scenario is in Appendix E
5.1 EXPERIMENTAL SETTINGS
Datasets and Models. We conduct experiments on two classical benchmark datasets, including CIFAR-10 (Krizhevsky al., 2009) and (a subset of) ImageNet (Deng al. 2009) containing 50 classes. We evaluated our method with ResNet-18 (He et al.] 2016) on both datasets. We also vali- date the effectiveness of REFINE on other models in Appendix D Note that our goal evaluate the effectiveness of backdoor defense methods instead of training SOTA model. Therefore, the be- nign accuracies of our models may be lower than the SOTA models. We exploit U-Net (Ronneberger 2015) as the structure of the input transformation module. et al.
Attack Setup. We utilize 7 representative advanced backdoor attacks, including (1) BadNets (Gu et al. 2019), (2) Blended (Chen et al. 2017), (3) WaNet (Nguyen & Tran 2021), (4) PhysicalBA (dubbed 'Physical') (Li et al. 202 (5) BATT (Xu et al. (203),, (6) LabelConsistent (dubbed 'L.C") (Turner et al. (2119). and (7) Adaptive-Patel (dubbed 'Adaptive") (Qi et al. 2023), to com-
prehensively evaluate the performance of different defenses.
Defense Setup. We compare the defense performance of REFINE with both types of pre-procsssing- based defenses. For transformation- based defenses, we utilize three advanced methods, including
(1) ShrinkPad (Li et al.) (021c), (2) BDMAE (Sun al., 2023), (3) ZIP (Shi et al.] 2023). For BTI-based defenses, we employ three methods as baseline, including (1) Neural Cleanse (dubbed 'NC") (Wang al. 2019), (2) UNICORN (Wang et al. (023). (3) BTI-DBF(P) (Xu et al. 2024
Evaluation Metrics. Consistent with the standard evaluation metrics in mackdoor-relatedd studies LLi et al. 2024c), we utilize benign accuracy (BA) and attack success rate (ASR) assess all defense
8

---

Published as a conference paper at ICLR 2025
Table 1: The performance (%) of REFINE and the transformation-base backdoor defenses. The best results are boldfaced, while all failed cases (BA drop or ASR > 10%) are marked in red.
Defense
No Defense
ShrinkPad
BDMAE
ZIP
REFINE
Dutaset
Attack
BA
ASR
BAT
ASR.
BAT
ASR
BAT
ASR
BAT
ASR
BadNets
84.51
13.37
Blended
91,04
100
83.95
5,94
89.08
84.80
81.54
3.72
89.85
1.73
WaNet
91.15
99.97
84.45
34.79
87.45
99.92
81.79
7.58
90.33
0.97
CIFAR-10
Physical
93.77
99.99
90.07
13.67
93.07
3.76
78.32
25.24
90.82
BATT
92.48
100
86.13
100
91.71
100
82.27
98.89
90.54
1.21
ICC
92.12
95,95
85.87
9.61
90.18
4.62
81.93
90.08
90.97
0.80
Adaptive
91.34
97.17
84.42
9.34
89.14
10.30
81.65
78.49
90.30
BadNets
65.42
99.55
61.44
2.65
53.64
3.51
59.12
11.43
66.27
Blended
66.15
98.93
19.84
24.53
54,80
96.08
59.32
92.98
66.59
1.11
WaNet
67.11
98.81
59.44
40.12
52.12
94.82
57.92
0.82
66.23
1,36
ImageNet
Physical
71.64
99.80
71.80
56.73
58.40
8.98
64,00
17.63
67.11
BATT
67.76
100
70,40
100
58.88
100
65.92
98.57
66.19
2.71
LC
67.44
80,96
61.48
0.86
54.84
10.65
60.24
77.02
66.43
Adaptive
66.76
93.20
62.44
6.37
56.16
69,40
61.28
94.57
66.99
1.48
Table 2: The performance (%) of REFINE and the BTI-based backdoor defenses. are boldfaced, while all failed cases (BA drop or ASR 10%) are marked in red.
The best results
Defense
No Defense
NC
UNICORN
BTI-DBF(P)
REFINE
Dataset
Attack
BA
ASR
BAT
ASR
BAT
ASR
BA1
ASR
BAT
ASR
BadNers
91,24
100
76.44
37.40
86,08
22.96
89.14
5.60
90.43
0.78
Blended
91.04
100
87.28
89.47
84.09
53.46
87.44
61.52
89.85
1.73
WaNet
91.15
99.97
83.81
6.24
85.59
6.67
90.33
CIFAR-10
Physical
93.77
99.99
89.00
52.36
90.04
41.04
91.74
9.53
90.82
1.69
BATT
92.48
100
72.28
5.88
74.99
0.87
89.89
4,80
90.54
1.21
LC
92.12
95.95
83.60
38,66
75.10
1.89
89,52
88.92
90.97
Adaptive
91.34
97.17
85.45
31.49
68.79
9.59
88.94
45,99
90,30
0.81
BadNets
65.42
99.55
63.44
61.93
$1.96
88.90
64,32
6.17
66.27
1.81
Blended
66.15
98.93
62.68
96.90
60.64
98.00
65.44
97.67
66.59
1.11
WaNet
67.11
98.81
62.20
91.80
61.64
94.86
65.56
92.17
66.23
ImageNet
Physical
71.64
99.80
71.00
98.74
67.00
56.26
73.60
7.60
67.11
BATT
67.76
100
62.92
0.65
68.56
41.86
72.00
6.94
66.19
2.71
LC
67.44
80.96
62.88
66.99
58.92
28.52
65.96
73.81
66.43
Adaptive
66.76
93.20
62.80
91.92
61.04
90.13
67.32
93.35
66.99
1.48
methods. BA and ASR are the accuracies of the benign samples and the poisoned samples, respec- tively. An effective defense indicated by a higher BA and lower ASR.
5.2
MAIN RESULTS
As shown in Tables preserving high benign accuracy. Specifically, the ASRs of our method are lower than 3% (< 2% in most cases). For the BA, the models under REFINE experience less than 3% drop the CIFAR-10 dataset compared to the undefended models. On the ImageNet dataset, the BA even improves, due the increased depth of the original models introduced by the input transformation module. In contrast, other baseline defenses may fail in certain cases, with BA drop or ASR > 10%.
REFINE successfully mitigates backdoor threats in all cases while
5.3 ABLATION STUDY
There are three important components in our methods, including (1) input transformation method, (2) hard-coded remapping function (HRF for short) in the output mapping module, and (3) super- vised contrastive loss (SCL for short) of transformed samples. In this section, we present an ablation study on the former two modules and verify their effectiveness. We also test different architectures of the input transformation module and conduct additional ablation studies Appendix D
As shown in Table 3 we evaluate the defense performance of REFINE without the hard-coded remapping function (w/o HRF) or without the supervised contrastive loss (w/o SCL). Experimental results indicate that without the hard-coded remapping function, REFINE successfully preserves the BA of the original model, but struggles to reduce the ASR the backdoor. This is because, without the hard-coded remapping function, the output domain of the model remains unchanged. Subsequently, it encounters the same trade-off problem as other transformation. based defenses, and difficult to find balance between transformation intensity and defense performance. Also, in

---

Published as a conference paper at ICLR 2025
Table 3: The performance (%) of REFINE with/without the hard-coded remapping function (HRF) or with/without the supervised contrastive loss (SCL).
Defense
No Defense
w/o HRF
w/o SCL
REFINE
Attack
BA
ASR
BAT
ASR,
BAT
ASR
BA
ASR
BadNets
91.70
100
91.23
70.76
89.26
1.43
90.92
0.68
Blended
91.10
98.76
90.59
75.30
90.38
0.10
90.65
0.51
WaNet
91.09
99.98
91.03
99.53
89.08
1.45
90.45
0.88
Physical
93.59
100
92.86
1.60
88.63
1.97
90.92
1,36
BATT
92.43
99.91
91.67
72.46
88.82
5.87
90.89
1.97
LC
92.30
99.74
91.88
69.15
90.37
0.59
90.57
1.25
Adaptive
90.54
100
89.77
62.94
88.06
0.32
90.17
0.27
Table 4: The performance (%) of REFINE against potential adaptive attacks.
Setting
Normal Attack
Adaptive Attack
Defense
No Defense
REFINE
No Defense
REFINE
Dataset
BA
ASR
BAT
ASR
BA
ASR
BA1
ASR
CIFAR-10
91.74
100
90.71
1.07
84.53
100
83.05
0.98
ImageNet
66.94
99.59
69.00
0.70
58.39
100
60.53
1.09
the absence of supervised contrastive loss, REFINE effectively reduce ASR with the help of the hard-coded remapping function. However, it encounters difficulties in restoring the BA of the original model, which may adversely affect the model's inference capabilities.
5.4 RESISTANCE TO POTENTIAL ADAPTIVE ATTACKS
In this section, we examine whether the adversary can circumvent our defenses if they have full knowledge of the process of our REFINE. After training the original backdoored model, the ad- versary can fine-tune it utilizing an input transformation module, along with randomly initialized hard-coded output mapping module, to simulate our REFINE. During fine-tuning, the loss function for model optimization can be expressed as follows:
min Lodop = Ls + /reffine
(10)
8
where Cs indicates the cross-entropy loss function in the original training phase of the backdoored model, and Crefine represents the loss function of REFINE. y is a scalar temperature parameter, and 8 denotes the trainable parameters of the backdoored model. Ideally, the adversary achieve the backdoor target with a low value of Lrefine by optimizing Eq. (10). Consequently, the REFINE may not work well since the frefine is already low.
As shown in Table REFINE is still highly effective with high BAs (BA drop < 1.5%) and low ASRs (< 1.5%). It mostly because defenders can arbitrarily specify the output mapping function and train an input transformation module that may entirely differ from the attacker's. Besides, the original backdoored model experiences a decrease in BA after undergoing adaptive attack training, due to the inherent difficulty of optimizing multiple loss functions simultancously. As such, these results demonstrate that our REFINE is resistant adaptive attacks.
CONCLUSION
In this paper, we revisited existing pre- pr--epssiinn-eeeee based backdoor defense methods, including backdoor-trigee tia.orttriigr--eesiiooonooo based (BTi-based) defenses and transformation-base defenses. We re- vealed the limitations of the two defense methods. Subsequently, according to the empirical and theoretical analysis, proposed REFINE, a reprogramming- method. This method was motivated by the insight that increasing the distances of the feature repre- sentations before and after the transformation may lead a better effectiveness of backdoor defense. Specifically, we introduced an input transformation module and an output mapping module. We also utilized the supervised contrastive loss enhance the defense performance. Results benchmark datasets verified the effectiveness of our REFINE and the resistance to the adaptive attack. We hope REFINE can provide new angle to facilitate the design of more effective backdoor defenses.
inversion-free backdoor defense
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGEMENTS
This research is supported in part by the National Key Research and Development Program of China under Grant 2021 100300 and the National Natural Science Foundation of China under Grants (62441238, 62072395, and U20A20178), Pin- Yu Chen is not supported by any external fundings. This work was mostly done when Yiming Li was Research Professor the State Key Laboratory of Blockchain and Data Security, Zhejiang University, China. He is currently at College of Computing and Data Science, Nanyang Technological University, Singapore.
ETHICS STATEMENT
This paper proposes an inversion-free backdoor defense method, REFINE. Our method can uti- lized to mitigate the effect of the backdoor. Therefore, our REFINE defensive method and our work does not discover any new threat. Our research also does not include any human subjects. Accordingly, this paper does not raise ethical issues.
REPRODUCIBILITY STATEMENT
The details of our implementations and experiments can be found in Appendix C We provide the official implementation of REFINE at http::t::////tttt https://github. com/ Whitolli FeeefhhhenRe.. INE Ad- ditionally, we also integrate REFINE into BackdoorBox for easy access and usage.
REFERENCES
Hanbo Cai, Pengcheng Zhang, Hai Dong, Yan Xiao, Stefanos Koffas, and Yiming Li. Towards stealthy backdoor attacks against speech recognition via elements of sound. IEEE Transactions on Information Forensics and Security, 2024.
Pin-Yu Yu Chen. Model reprogramming: Resource-efficient cross-domain machine learning. In AAAI, 2024.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017.
Sheng-Yer Yen Chou, Pin-Ya Yu Chen, and and Tsung-Yr Yi Ho. Villandiffusion: unified backdoor attack frame- work for diffusion models. NewrIPS, 2024.
Luke N Darlow, Elliot Crowley, Antreas Antoniou, and Amos Storkey. Cinic- (0 is not imagenet or cifar-10. arXiv preprint 180.0355 2018.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hicrarchical image database. CVPR, 2009.
Sharmita Dey and Sarath R Nair. Enhancing joint motion prediction for individuals with limb loss through model reprogramming. arXiv preprint 2xXi:22403306566 2024.
Bao Gia Doan, Ehsan Abbasnejad, and Damith C Ranasinghe. Februus: Imput purification defense against trojan attacks on deep neural network systems. In ACSAC, 2020.
Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In ICCV, 2021.
Jianshuo Dong, Han Qiu, Yiming Li, Tianwei Zhang, Yuanjie Li, Zeqi Lai, Chao Zhang, and Shu- Tao Xia. One-bit flip all you need: When bit-flip attack meets model training. In ICCV, 2023.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszko- reit, and Neil Houlsby. An image worth 16x16 words: Transformers for image recognition at scale. In ICLR, 2021.
11

---

Published as a conference paper at ICLR 2025
Min Du, Ruoxi Jia, and Dawn Song. Robust anomaly detection and backdoor attack detection via differential privacy. In ICLR, 2020.
Gamaleldin F Elsayed, Ian Goodfellow, and Jascha Sohl-Dickstein, Adversarial reprogramming of neural networks. ICLR, 2019.
Bolin Gao and Lacra Pavel. On the properties of the softmax function with application in game theory and reinforcement learning. arXiv preprint arXiv: (.tiv:1004..0 1704.00805, 2017.
Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. ACSAC, 2019.
Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim. Backdoor attacks and countermeasures on deep learning: A comprehensive review. arXiv preprint arXiv:2007. 10760, 2020.
Yinghua Gao, Yiming Li, Linghui Zhu, Dongxian Wu, Yong Jiang, and Shu-Tao Xia. Not all samples are born equal: Towards effective clean-label backdoor attacks. Puttern Recognition, 139:109512.
2023.
Yinghua Gao, Yiming Li, Xueluan Gong, Zhifeng Li, Shu-Thuhr Xia, and Qian Wang. Backdoor attack with sparse and invisible trigger. IEEE Transactions on Information Forensics and Security, 2024.
Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 1442230-47244 2019.
Junfeng Guo, Yiming Li, Lixu Wang, Shu-Tao Xia, Heng Huang, Cong Liu, and Bo Li. Domain watermark: Effective and harmless dataset copyright protection is closed at hand. In NeurlPS, 2023.
Junfeng Guo, Yiming Li, Ruibo Chen, Yihan Wu, Chenxi Liu, and Heng Huang. Zeromark: Towards dataset ownership verification without disclosing watermarks. In NeurIPS, 2024.
Jonathan Hayase and Weihao Kong. Spectre: Defending against backdoor attacks using robust covariance estimation. In ICML, 2020.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In CVPR, 2016.
Yiling He, Jian Lou, Zhan Qin, and Kui Ren. Finer: Enhancing state-of-the--ar classifiers with feature attribution to facilitate security analysis. CCS, 2023.
Yu He, Boheng Li, Yao Wang, Mengda Yang, Juan Wang. Hongxin Hu, and Xingyu Zhao. Is difficulty calibration all need? towards more practical membership inference attacks. In CCS, 2024.
Linshan Hou, Ruili Feng, Zhongyun Hua, Wei Luo, Leo Yu Zhang, and Yiming Li. Ibd-psc: Input- level backdoor detection via parameter-oriented scaling consistency. In ICML, 2024.
Gao Huang, Zhuang Liu, Laurens Van Der Maaten, and Kilian Q Weinherger. Densely connected convolutional networks, In CVPR, 2017.
Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. In ICLR, 2022.
Mojan Javaheripi, Mohammad Samragh, Gregory Fields, Tara Javidi, and Farinaz Koushanfar. Cleann: Accelerated trojan shield for embedded neural networks. In ICCD, 2020.
Yongcheng Jing, Chongbin Yuan, Li Ju, Yiding Yang, Xinchao Wang, and Dacheng Tao. Deep graph reprogramming. In CVPR, 2023.
Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sama, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan. Supervised contrastive learning. In NeurlPS, 2020.
12

---

Published as a conference paper at ICLR 2025
Eliska Kloberdanz, Jin Tian, and Wei Le. An improved (adversarial) reprogramming technique for neural networks. In ICANN, 2021.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Technical report, 2009.
Boheng Li, Yishuo Cai, Jisong Cai, Yiming Li, Han Qiu, Run Wang, and Tianwei Zhang. Puri- fying quantization-conniiionee backdoors via layer-wise activation correction with distribution approximation. In ICML, 2024a.
Boheng Li, Yishuo Cai, Haowei Li, Feng Xue, Zhifeng Li, and Yiming Li. Nearest is not dearest: Towards practical defense against quantization
quantiztiion-conditoneed conditioned backdoor attacks. In CVPR, 2024b.
Boheng Li, Yanhao Wei, Yankai Fu, Zhenting Wang, Yiming Li, Jie Zhang, Run Wang, and Tianwei Zhang. Towards reliable verification of unauthorized data usage in personalized text-to-image diffusion models. JEEE S&P, 2025.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learn- ing: Training clean models on poisoned data. In NeurlPS, 2021a.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In ICLR, 2021b.
Yiming Li, Tongqing Zhai, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor attack in the physical world. In ICLR Workshop, 2021c.
Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li. Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. In NeurIPS, 2022a.
Yiming Li, Haoxiang Zhong, Xingjun Ma, Yong Jiang, and Shu-Tao Xia. Few-shot backdoor attacks on visual object tracking. In ICLR, 2022b.
Yiming Li. Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, and Shu-Tao Xia. Black-box dataset ownership verification via backdoor watermarking, IEEE Transactions Information Forensics and Security, 18:2318 1223228-,3,,,, 2023a.
Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE transac- tions on neural networks and learning systems, 35(1):5-22, 2024c.
Yinshan Li, Hua Ma, Zhi Zhang, Yansong Gao, Alsharif Abuadbba, Minhui Xue, Anmin Fu, Yifeng Zheng, Said F Al-Sarawi, and Derek Abbott. Ntd: Non-transserrabiliy enabled deep learning backdoor detection. IEEE Transactions on Information Forensics and Security, 2023b.
Yizhe Li, Yu-Lin Tsai, Chia-Mu Yu, Pin-Yu Chen, and Xuebin Ren. Exploring the benefits of visual prompting in differential privacy. In ICCV, 2023c.
Yuezun Li, Yiming Li. Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In ICCV, 2021d.
Yuntao Liu, Yang Xie, and Ankur Srivastava. Neural trojans. In ICCD, 2017.
Zhihao Liu, Jian Lou, Wenjie Bao, Yuke Hu, Bo Li, Zhan Qin, and Kui Ren. Differentially private zeroth-order methods for scalable large language model finetuning. arXiv preprint arXiv:2402.078//8 2024.
Brandon B May. N Joseph Tatro, Dylan Walker, Piyush Kumar, and Nathan Shnidman. Salient conditional diffusion for defending against backdoor attacks. arXiv preprint arXiv:2301.13862. 2023.
Paarth Neckhara. Shehzeen Hussain, Jinglong Du, Shlomo Dubnov, Farinaz Koushanfar, and Julian McAuley. Cross-modal adversarial reprogramming, In WACV, 2022.
Anh Nguyen and Anh Tran. Wanet-imperceptibble warping-based backdoor attack. In ICLR, 2021.
13

---

Published as a conference paper at ICLR 2025
Xiangyu Qi, Tinghao Xie, Yiming Li, Saced Mahloujifar, and Prateek Mittal. Revisiting the sumption of latent separability for backdoor defenses. In ICLR, 2023.
Han Qiu, Yi Zeng, Shangwei Guo, Tianwei Zhang, Meikang Qiu, and Bhavani Thuraisingham. Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmenta- tion. In AsiaCCS, 2021.
Olaf Ronneherger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedi- cal image segmentation. In MICCAI, 2015.
Shuo Shao, Wenyuan Yang, Hanlin Gu, Zhan Qin, Lixin Fan, and Qiang Yang. Fedtracker: Furnish- ing ownership verification and traceability for federated learning model. IEEE Transactions on Dependable and Secure Computing. 2024.
Shuo Shao, Yiming Li, Hongwei Yao, Yiling He, Zhan Qin, and Kui Ren. Explanation as a wa- termark: Towards harmless and multi-bit model ownership verification via watermarking feature attribution. In NDSS, 2025.
Yucheng Shi, Mengnan Du, Xuansheng Wu, Zihan Guan, Jin Sun, and Ninghao Liu. Black-box backdoor defense via zero-shot image purification. In NeurIPS, 2023.
Karen Simonyan. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409. 1556, 2014.
Tao Sun, Lu Pang, Chao Chen, and Haibin Ling. Mask and restore: Blind backdoor defense at test time with masked autoencoder. arXiv preprint arXiv:2303. 2023.
Ruixiang Ryan Tang, Jiayi Yuan, Yiming Li, Zirui Liu, Rui Chen, and Xia Hu. Setting the trap: Capturing and defeating backdoors in pretrained language models through honeypots. In NeurlPS, 2023.
Yun-Yur Tsai, Pin- Yu Chen, and Tsung- Yi Ho. Transfer learning without knowing: Reprogramming black-box machine learning models with scarce data and limited resources. In JCML, 2020.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks.
arXiv preprint arXiv: arXiv: 1912.0277, 2019.
Miguel Villarrel--Vasquez and Bharat Bhargava. Confoc: Content-focus protection against trojan attacks on neural networks. arXiv preprint arXiv:2007.007/1 2020.
Ria Vinod, Pin-Yu Chen, and Payel Das. Reprogramming pretrained language models for protein sequence representation learning. arXiv preprint arXiv:2301.02120. 2023.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE S&P. 2019.
Lixu Wang, Shichao Xu, Ruiqi Xu, Xiao Wang, and Qi Zhu, Non-transferable learning: A new approach for model ownership verification and applicability authorization. In ICLR, 2022.
Ren Wang, Gaoyuan Zhang, Sijia Liu, Pin- Yu Chen, Jinjun Xiong, and Meng Wang. Practical detection of trojan neural networks: Data-limited and data-free cases. ECCV, 2020.
Zhenting Wang, Kai Mei, Juan Zhai, and Shiqing Ma. Unicorn: A unified backdoor trigger inversion framework. In ICLR, 2023.
Cheng Wei, Yang Wang. Kuofeng Gao, Shuo Shao, Yiming Li, Zhibo Wang, and Zhan Qin. Point- ncbw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark. IEEE Transactions on Information Forensics and Security. 2024.
Tinghao Xie, Xiangyu Qi, Ping He, Yiming Li. Jiachen T Wang, and Prateck Mittal. Badexpert: Extracting backdoor functionality for accurate backdoor input detection. In ICLR, 2024.
Tong Xu, Yiming Li, Yong Jiang, and Shu-Tao Xia. Batt: Backdoor attack with transformation- based triggers. In ICASSP, 2023.
14

---

Published as a conference paper at ICLR 2025
Xiong Xu, Kunzhe Huang, Yiming Li, Zhan Qin, and Kui Ren. Towards reliable and efficient backdoor trigger inversion via decoupling benign features. ICLR, 2024.
Mengxi Ya, Yiming Li, Tao Dai, Bin Wang, Yong Jiang, and Shu-Tao Xia. Towards faithful xai evaluation via generalization-limited backdoor watermark. In ICLR, 2023.
Chao-Han Huck Yang, Yun- Yun Tsai, and Yu Chen. Voice2series: Reprogramming acoustic models for time series classification. In ICML, 2021.
Sheng Yang. Yiming Li, Yong Jiang, and Sau-Tao Xia. Backdoor defense via suppressing model shortcuts. ICASSP, 2023.
Sheng Yang, Jiawang Bai, Kuofeng Gao, Yong Yang. Yiming Li, and Shu-Tao Xia. Not all prompts secure: switchable backdoor attack against pre-trained vision transfomers. In CVPR, 2024a.
Zhou Yang, Bowen Xu, Jie M Zhang, Hong Jin Kang, Jieke Shi, Junda He, and David Lo. Stealthy backdoor attack for code models. IEEE Transactions on Software Engineering, 2024b.
Biao Yi, Tiansheng Huang, Sishuo Chen, Tong Li, Zheli Liu, Chu Zhixuan, and Yiming Li. Probe before you talk: Towards black-box defense against backdoor unalignment for large language models. In ICLR, 2025.
Yi Zeng, Won Park, Z Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks' triggers: A frequency perspective. In ICCV, 2021.
Yi Zeng, Si Chen, Won Park, Zhuoging Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient. ICLR, 2022.
Tongqing Zhai, Yiming Li, Ziqi Zhang, Baoyuan Wu, Yong Jiang, and Shu-Tao Xia. Backdoor attack against speaker verification. In ICASSP, 2021.
Xinyu Zhang, Hanbin Hong, Yuan Hong, Peng Huang, Binghui Wang, Zhongjie Ba, and Kui Ren. Text-crs: A generalized certified robustness framework against textual adversarial attacks. In IEEE S&P, 2024.
Pu Zhao, Pin- Yu Chen, Payel Das, Karthikeyan Natesan Ramamurthy, and Xue Lin. Bridging mode connectivity in loss landscapes and adversarial robustness. In ICLR, 2020.
Jiachen Zhou, Peizhuo Lv, Yibing Lan, Guozhu Meng, Kai Chen, and Hualong Ma. Dataclixir: Purifying poisoned dataset to mitigate backdoor attacks via diffusion models. In AAAI, 2024.
Mingli Zhu, Shaokui Wei, Hongyuan Zha, and Baoyuan Wu. Neural polarizer: a lightweight and effective backdoor defense via purifying poisoned features. In NeurlPS, 2023.
15

---

Published as a conference paper at ICLR 2025
APPENDIX
A THE PROOF OF THEOREM
Theorem 1. Given a K-class pre-trained deep learning model F(-) s(f(-)) where s(-) is the
softmax function and f(-) is the feature extractor, and a pre-pree pree-rocessing method T-)) a is the data
from specific domain 'D (i.e., x D) and i T(x) D. Let @D(()) and ④ (ō:) denotes the probability density function of D and D, we have
ER-D.a F(x) - F(i)ll2 I 20V ().
(1)
where Wi Wi(u, (2) is the Wasserstein- distance between and j.. and j are the probability measures of the representations fxx and (3), and a max[ p x) [
Following similar approaches in Yang al. 2021). the proof of Theorem Lis follows.
Proof. Let [ represents the set of the first K positive integers, i.e., [K] = f1, 3, K}. Ac-
cording the definition of mathematical expectation, we have
E Sa F(x)) F())l12
J
[F(xx) F( D. ( (0, dddd
DNDDAND
| JEND.aND
(2)
[F(x))
x 4 ( dadd
s LND,OND
[((x) - F(
drda
where a ( / ( Assuming æ E Rdd is a d-dimension vector and æ; denotes the i-th element of æ, we have
Σ o
d max xii sEld
vdl max|
(3)
sE[d]
Since F()) is a K-class pre-trained model, we have
a
[F(x) - (())1120(zz)) dadd
IND
S avK
max K
[F(x)]ı [F(T)|a -
(4)
= avk
max [s(f(=))) - [ 2n(x) dxdd.
2- D KE[K]
After that, define k+ and k as the following equations.
k+ arg max [s([(z))] [s([())))
ke(k]
(5)
k arg max (s(f()))) [s(f(x))] kE
Because the output of s(.) ( a probability logit and the sum total is 1, there exist at least one k such that [s([(=)))& (()((())) (l))) 2 0 and also at least one k2 leading to [s(f()))) (s(f(m))) 2 0. Therefore,
max [[s[{()))] (<({=)))))(({((())))) (=((())))
kE[K]
= Is((())))) - [s(f(=))le
= max
(6)
ke[k]
+s) - |s(f(=))]a-
16

---

Published as a conference paper at ICLR 2025
According to Eq. ( have
max [[{((()))] (((()))))(((((())))))) (
BNDD kE[K]
- - 11
(aa_((]))(--(((((()]]) [s([())] P (f) dæda
E (e>ol(s(f(x) - -e(ffa))l------plfffffllllll (oalll---((((@)))))) [+(f()))la+
Based on the fact that [s(:)] is 1-I.ipschitz continuous for any l E [K] (Gao & Pavel 2017 and thus [s(+)l++ |s(-)la 2-Lisshhitz continuous, we have
[=(f()))] E Ee>=ll>(((t)) [s((())) E (f BewDig((f E (=-rl)((( < 2 sup goRk R.,())
Following the Kuntorovich-Rubinstenn Rubinstein theorem of the dual representation of the Wasserstein-1 dis- tance, finally, have
E D. (l F(xx) F(
S 2avK. K
sup g: -R.i(e))
E BE (I(((=)))) - -aablo(((a))
(9)
2av Wi
where μ and f are the probability measures of the representations f(x) and f(Ø).
B THE PSEUDO-CODE OF REFINE
The pseudo-code of our REFINE optimization process shown in Algorithm |
Algorithm REFINE Optimization Process
The backdoored model F, the unlabeled benign dataset D = (æx; M the randomly initialized input transformation module T(, 0), the specified output mapping module M(-)..
Input:
Output: The input transformation module parameters 0.
for data batches X {x:) D do
2: Obtain the transformed input = T(X,(XX 0).
3: Obtain the original model output Y = F(X).
4: Obtain the mapped output Y M(Y).
5: Obtain the predicted labels arg max (Fx()
6: Compute the supervised contrastive loss Coup (X, Y).
7: Compute the cross-entropy loss Loe(Y, Y).
8: Optimize with the composite loss: arg min L Lee ALsup-
9: return
C IMPLEMENTATION DETAILS
C.I DETAILS OF THE EXPERIMENTAL SETTINGS
Details of Datasets. (1) CIFAR-10. The CIFAR- 10 dataset (Krizhevsky et al. 2009) contains 50,000 training samples and 10,000 testing samples in total. The dataset has 10 classes and each class has 5,000 training samples and 1,000 testing samples. Tbe size each image sample is 3x32x32. (2) ImageNet. The ImageNet dataset (Deng et al., 2009) consists of 1,000 classes containing 14 million manually annotated images. this paper, we select a subset with 50 different classes and each class contains 500 training samples and 100 testing samples with size x22 224.
17

---

Published as a conference paper at ICLR 2025
Benign
BadNets
Blended
WaNet
Physical
BATT
LC
Adaptive
Figure The illustration of the adopted backdoor attacks.
Details of Training Backdoored Models. We utilize the SGD with a momentum of 0.9 and a weight decay of 5 x 10m 4 as the optimizer for training all backdoored DNNs. The batch size is set to 128 on both of CIFAR-10 and ImageNet. We set the initial learning rate as 0. and train all models for 1550 epochs, with the learning rate reduced by factor of 0.1 the 100-th and 130-th epoch.
Details of Optimization. For training the input transformation module, we employ SGD with a momentum of 0.9 and weight decay of 5 10-4 as the optimizer. The initial learning 0.01, and the batch size is set to 256 for CIFAR-I0 and 64 for ImageNet. The input transformation module is trained for 150 epochs, with the learning rate decayed by factor of 0.8 the 100-th and 130-th epochs. For the training loss function, we set the temperature parameter as 0.1. For the output mapping module, we randomly assign hard-coded remapping function before each defense.
to
Computational Resources. In our implementations. we utilize PyTorch as the deep learning frame- work. All our experiments are implemented with RTX 3090 GPUs.
C.2 DETAILS THE ADOPTED BACKDOOR ATTACKS
In experiments, adopt representative backdoor attacks evaluate the defense performance of our REFINE and other baseline backdoor defense methods. We implement all 7 backdoor attacks using BackdoorBox (Li et al. 2024c). We hereby provide detailed introduction to these backdoor attacks, as follows.
Gu al. (219) introduced the earliest poisoning- based backdoor attack that aims to poison the training dataset using visible, distinctive pixel pattern. In this paper, we utilize a a 3 random square as the trigger pattern on the bottom right of samples CIFAR-10 and a 20x20 square on ImageNet. The poisoning rate is set to 0.1.
BadNets:
Blended: evade human visual detection of poisoned samples, Chen al. (2017) designed
covert data poisoning method known as Blended, which attempts embed triggers implicitly within the samples. this paper, we utilize an image of Hello Kitty as the trigger pattern and set the blending rate and poisoning rate to 0.1 across both datasets.
WaNet: WaNet (Nguyen & Tran 202T) is another type invisible attacks that employs warp- based trigger. We follow its default settings and set the poisoning rate to 0.I.
PhysicalBA: Li et al. (202Ic) demonstrated that DNNs applied in physical scenarios could also be vulnerable to backdoor threats and proposed backdoor attacks that simulate physical transfor- mations. We follow its default settings and set the poisoning rate to 0.1.
BATT: Xu et al. (022) noted that simple transformations specific to samples can pose signifi- cant backdoor threats to models and introduced the Backdoor Attack with Transformation-a Triggers (BATT). We follow its default settings and set the poisoning rate 0.1.
18

---

Published as a conference paper at ICLR 2025
Table 5: The performance (%) of REFINE and two baseline defenses different model architec- tures. The best results are boldfaced.
Defense
No Defense
BDMAE
(TI-DBE(P)
REFINE
Model
Attack
BA
BAt
ASR
BAT
ASR
BAT
ASR.
BadNets
86.47
99.53
84.87
2.83
84.95
4.44
87.62
1.47
Blended
86.45
98.70
84.29
82.95
83.90
36.97
87.34
2.30
WaNet
87.12
99.77
84.33
97.34
84.71
2.91
87.57
1.50
VGG16
Physical
87.85
99.98
88.79
6.15
88.09
9.15
89.62
1.69
BATT
88,40
99.99
87.28
99.99
86.07
13.13
89.24
0.81
LC
87.46
72.87
85.24
10.19
85.26
42.06
88.60
1.77
Adaptive
86.49
87.57
83.76
27.17
83.94
33.05
87.70
2.30
BadNets
86.36
99.99
84,81
1.44
85.04
2.76
88.51
0.96
Blended
86.90
99.90
84.92
51.03
84.74
74.51
88.58
1.09
WaNet
86.34
99.34
83.92
96.93
84.29
0.86
88.04
1.72
DenseNet121
Physical
86.69
97.89
85.66
3.64
83.96
9.20
87.33
1.84
BATT
86.45
100
85.63
100
84.04
3.63
88.45
0.11
LC
86.79
57.72
85.42
12.01
84.88
21.98
88.82
1.23
Adaptive
86.70
54.19
85.07
25.05
84.83
25.33
88.74
1.10
BadNets
66.98
99.97
64.16
6.13
64.18
6.84
75.97
1.89
Blended
66.01
99.57
63.30
96.17
63.74
98.67
76.23
2.23
WaNet
66.17
98.03
61.44
43.71
63.63
4.17
76.15
2.51
VIT
Physical
67.09
99.92
63.91
6.25
62.66
8.00
76.28
2.40
BATT
68.66
67.01
99.97
66.33
98.73
72.75
3.35
L.C. 67.39
92.25
63.75
5.85
74.16
80.36
1.60
Adaptive
66.38
83.01
63.85
14.67
64.48
45.72
77.16
2.51
Label-consistent Attack (LC): To address the issue of casily identifiable mislabeled poisoned data in poisoning datasets, Turner et al. (2019) proposed clean-label backdoor attacks, which aim poison samples of specific classes to inject backdoors. We employ projected gradient descent (PGD) to generate adversarial samples, setting the maximum perturbation size to = 8. The trigger patterns utilized identical those employed in BadNets. The poisoning rate is set to 0.25 on the CIFAR-10 dataset and 1.0 on the ImageNet dataset.
Adaptive-Patch: Qi et al. (2023) observed that models trained on poisoned datasets often learn distinct latent representations for poisoned and clean samples, and they proposed adaptive back- door attacks to mitigate this separation phenomenon. In this paper, we follow the default settings utilized in its original paper. For CIFAR-10 10, the poisoned rate and covered rate are set to 0.01 and 0.02, respectively; for ImageNet, they are set to 0.03 and 0.06, respectively.
The poisoned samples of these backdoor attacks are depicted in Figure
C.3 DETAILS OF THE ADOPTED BACKDOOR DEFENSES
In experiments, compare REFINE with two types of pre-processing-base defense meth- ods, namely transformation-basse defenses and BTI-based defenses. Each type of defense includes three specific baseline defenses. Specifically, for transformation-basee defenses, we utilize three representative and advanced methods. including (1) ShrinkPad (Li et al.) (2021c), (2) BDMAE (Sun) al. 2023). (3) ZIP (Shi et al. 2023). We implement this type of defenses using their open-source codes. For BTT-based defenses, we employ three methods as baseline, including (1) Neural Cleanse (dubbed 'NC") (Wang et al. 2019), (2) UNICORN (Wang et al. 2023). (3) BTI-DBF(P) (Xu et al.) 2024). For NC and UNICORN, we utilize their open-source code implement the first step of the BTI-based defense, which is trigger inversion. Then, following the method outlined in BTI-DBF. utilize the trigger patterns inverted by NC or the backdoor image generator inverted by UNI- CORN to train a purification generator, thereby completing the second step the defense, input purification. For BTI-DB((P), implement using open-source code.
19

---

Published as a conference paper at ICLR 2025
Table 6: Performance (%) of REFINE under different sizes of the unlabeled benign dataset.
Proportion
No Defense
100%
80%
60%
40%
20%
Attack
BA
ASR
BAT
ASR
BAT
ASR
BAt
ASR
BAt
ASR
BAt
ASR
BadNets
92.31
100
91.20
0.86
90.22
1.05
89.53
1.21
87.81
1.11
83.93
2.21
Table Performance (%) of REFINE under different values of temperature parameters A.
No Defense
1.0
0.8
0.6
0.4
0.2
Attack
BA
ASR
BAt
ASR
BAT
ASR
BA
ASR.
BAT
ASR
BAT
ASR,
BadNets
91.74
100
90.83
0.92
90.87
0.76
90.60
0.60
91.03
0.51
90.69
1.27
D ADDITIONAL ABLATION STUDY
D.1 RESULTS ON ADDITIONAL MODEL. ARCHITECTURES
In this section, we conduct experiments on three additional model architectures, including VGG- 16 (Simonyan 2014), DenseNet- 121 (Huang et al.) 2017). and ViT (Dosovitskiy et al. 2021). We conduct experiments on the CIFAR- dataset. We compare the defense performance our RE- FINE with the most advanced transformation-basee defense (i.c., BDMAE) and the SOTA BTI- based defense (i.e., (TI)
As shown in Table 5 REFINE effectively defends against 7 representative attacks across 3 different model architectures, significantly outperforming baseline defenses. Specifically, under the REFINE defense, the benign accuracy shows a slight improvement, while the backdoor attack success rate is reduced to below 3.5%. The additional experimental results verify the effectiveness of REFINE.
D.2 EFFECT OF THE UNLABELED BENIGN DATASET SIZE
In this section, evaluate the defense performance of REFINE under different sizes of the unla- beled benign dataset. We train a backdoored classification model on CIFAR-10 using the BadNets attack on ResNet-18 architecture. For defense, we use different proportions (100% to 20%) of the CIFAR- 10 dataset as the unlabeled benign dataset. As shown in Table the results indicate that as the number of unlabeled samples decreases, the BA of REFINE experiences slight decline, while the ASR remains consistently low.
D.3 EFFECT OF THE SCALAR TEMPERATURE PARAMETER
In this section, we evaluate the defense performance of REFINE under different values of tempera- ture parameters A. The attack setup is consistent with that in Section D.2 During the defense, test various temperature parameters ranging from to 0.2. As shown in Table 7 the results indicate that the value of temperature parameter has minimal impact the defense performance of REFINE.
D.4 EFFECT OF THE NUMBER OF CHANNALS UNET HIDDEN LAYERS
We hereby evaluate the performance of REFINE using UNet models with varying numbers of hidden layer channels. Specifically, the dimensionality of the encoded features can be adjusted by altering the number of output channels in the first layer of the UNet encoder. The attack setup is consistent with that in Section D.2 For the defense, we tested different channel numbers, including 32, 48, 64, and 80. As shown in Table & the number of channels in the UNet hidden layers has minimal impact on the defense performance of REFINE, with both BA and ASR remaining at an optimal level.
D.5 EFFECT OF THE DATA DISTRIBUTION USED FOR DEFENSE
In main experiments, assume that the defender acquire independent and identically dis- tributed (i.id.) unlabeled datasets. In this section, we explore the defense performance under dif- ferent data distributions. We train ResNet-18 model the CIFAR10 dataset using the BadNets
20

---

Published as a conference paper at ICLR 2025
Table 8: Performance (%) REFINE under different number of channels in UNet hidden layers.
Channels
No Defense
32
48
64
80
Attack
BA
ASR
BAT
ASR
BAT
ASR
BAt
ASR,
BAT
ASR,
BadNets
91.74
100
89.49
1.09
90.61
0.64
90.18
1.43
91.07
0.78
Table The performance (%) of REFINE in scenarios with different data distribution.
Defense
No Defense
REFINE
Attack
BA
ASR
BAT
ASR!
BadNets
91.18
100.00
88.39
1.40
Table 10: The performance (%) of REFINE and T-MR. The best results are boldfaced.
Defense
No Defense
T-MR
REFINE
Attack
BA
ASR
BA1
ASR
BA
ASR!
BadNets
91.18
100.00
75.51
3.36
90.50
1.05
WaNet
91.29
99.91
74.49
25.76
90.64
Adaptive
92.54
99.93
75.49
5.87
90.87
1.76
attack. For defense, trained the input transformation module of REFINE using CINIC10 (Darlow et al. 2018), a dataset with the same categories as CIFARIO but a different data distribution.
As shown in Table 9 REFINE is still highly effective in reducing the attack success rate (ASR < 1.5%) while maintaining the model's 's benign accuracy (BA drop < 3%). This favorable result is due to the fact that REFINE first assigns pseudo-labels the unlabeled benign samples using the original model, and then trains the input transformation module based on these pseudo-labed
D.6 EFFECT OF IMPROVED TRANSFORMATION MODULE
In this section, we conduct additional defense experiments using traditional model reprogramming methods (Elsayed al.) 2019) (dubbed 'T-MR'). We select three representative types of backdoor attacks, including Badsets, WaNet, and BATT. We train backdoor ResNet-18 models on the CIFAR- 10 dataset. We compare the defense performance of REFINE with T-MR.
As shown in Table I0 the T-MR defense has a significant impact on the model's BA (BA drop 15%) but fails effectively reduce the ASR under the WaNet attack. This is because traditional model reprogramming methods only add a universal adversarial perturbation around the image, while the trigger pattern remains unchanged on the backdoor image some extent.
E REFINE IN THE BLACK-BOL SCENARIO
our main experiments, we assume that we can obtain white-box access to the pre-trained back- doored models. We hereby initially explore how implement REFINE in the black-box see- nario where defenders can only get black-box access to the backdoored model. In this scenario, only the class confidence scores are accessible and it is hard calculate the gradients to optimize the REFINE modules. To tackle the aforrementioned challenge, we leverage the surrogate model technique. Specifically,
distill surrogate model from the original black-box model using unlabeled dataset D. We employ the mean squared error (MSE) loss to align the output confidence scores between the black-box model F(-) and the surrogate model F, F.).. follows:
1 D
Laisstul
(10)
RED
The surrogate model is then leveraged to replace the pre-trained model in our REFINE and optimize the input transformation module. Subsequently, the trained input transformation and output mapping modules are subsequently applied to the original black-box model.
21

---

Published as a conference paper at ICLR 2025
Table 11: Performance (%) of REFINE in defending against attacks in black-box scenarios.
Defense
No Defense
REFINE
Model
Black-box
Surrogate
Surrogate
box
Attack
BA
ASR
BA
ASR
BAT
ASR
BAT
ASR
BadNets
90.60
100
91.20
1.24
88.21
0.92
88.17
0.36
Blended
91.08
96.94
90.69
2.23
88.34
0.62
87.75
0.18
WaNet
91.50
99.93
90.92
99.84
88.77
3.37
87.44
0.04
Physical
93.61
100
92.21
2.56
90.18
1.52
89.84
2.23
BATT
93.24
99.89
92.76
4.30
90.86
2.01
89.21
3.72
LC
91.95
93.06
91.53
1.11
89.04
0.87
1.05
Adaptive
90.15
100
90.36
1.57
88.41
0.32
87.91
0,44
Table 12: The overhead (minutes) of REFINE compared with BDMAE and BTI-DBF(P).
Defense
BDMAE
BTI-DBE(P)
REFINE
Overhead
39.67
15.49
36.70
To validate the feasibility of our REFINE in the black-box scenario, employ the backdoored ResNet-50 pre-trained on the CIFAR-10 10 dataset as the black-box model and ResNet-18 as the surro- gate model. As shown in Table II we evaluate both the black-box original model and the surrogate model in terms of BA and ASR before and after applying the REFINE defense. The ASRs of our REFINE all below 4%. The results indicate that though the input transformation module trained using the surrogate model, our REFINE is still capable of achieving high performance of backdoor defense for the black-hox original model.
F THE OVERHEAD OF OUR REFINE
In this section, we evaluate the overhead of our REFINE. Specifically, we measure the training time of the input transformation module and the model inference time the CIFAR-10 using the ResNet- 18 model. We employ a UNet with 32 hidden layer channels as the structure for the input transformation module. During training, we employ SGD with a momentum of 0.9 and a weight decay of 5 X 10-4 as the optimizer. The initial learning rate is set to 0.01, with batch size of 256. The input transformation module trained for 150 epochs, with the learning rate decaying by factor of 0.8 at the 100-th and 130-th epochs. For the training loss function, the temperature parameter set to 0. We conduct all training using a single RTX 3090 GPU. For the output mapping module, hard-coded remapping function is randomly assigned before each defense. Here, we compare REFINE'S time consumption with that of BDMAE and BTI-DBF(P), which are the representative of SOTA transformation-basee and BTI-based defenses, respectively.
As shown in Table 12 the overall time overhead of our REFINE is on par with SOTA baselines. Moreover, training the transformation module is one-time process and can be done offline, al- though the pre-processing and model inference happen online. Once training of our REFINE is complete, inference on 10,000 images from CIFAR-10 takes 6.31 seconds, with the cost per image being nearly O. Although REFINE introduces some additional overhead, we believe this cost is reasonable and acceptable.
G COMBINING REFINE WITH EXISTING DEFENSES
Arguably, method can be used in conjunction with existing (model reconstruction--ased de- fenses to further enhance their effectiveness. To demonstrate this, we first applied model fine-tuning defense (dubbed 'FT') to ResNet- 18 model subjected to the BadNets attack CIFAR-10, fol- lowed by the REFINE defense. As shown in Table 13] the FT+REFINE defense effectively reduces the backdoor ASR while maintaining the model's BA.
22

---

Published as a conference paper at ICLR 2025
Table 13: The performance (%) of FT and FT+REFINE on ResNet- 18.
Defense
No Defense
FT
FT+REFINE
Attack
BA
ASR
BA(1)
ASR(L)
BA(T)
ASR(L)
BadNets
91.18
100.00
91.89
91.67
90.42
0.87
H RELATED WORK
H.1 BACKDOOR ATTACK
Visible Backdoor Attacks. This type of attack typically employs patterns that are visible to humans as triggers. BadNets (Gu et al. 2019) is the first backdoor attack technique that injects samples with simple but visually noticeable patterns into the training data, such as white squares or specific marks. [i al. (2021c) then proposed transformation-basee enhancement that strengthens the attack's resilience and establishes its applicability to physical scenarios. To address the issue of latent feature separation in backdoor attacks, Qi et al. (2023) employed asymmetric trigger planting strategies and developed adaptive backdoor poisoning attacks. Besides, Gao et al. (2023) revealed that laben attacks were difficult due to the conflicting effects of 'robust features' in poisoned samples and proposed a simple yet effective method to improve these attacks by targeting 'hard' samples instead of random ones.
Invisible Backdoor Attacks.
To enhance the stealth of backdoor attacks, Chen et al. (2017) was the first to introduce the use of triggers that are imperceptible humans, aiming to evade detection by basic data filtering techniques or human inspection. They proposed blending strategy that generates poisoned images by subtly merging the backdoor trigger with benign images. After that, series of studies focused on designing invisible backdoor attacks. WaNet (Nguyen & Tran 2021 triggers and perturbation-ban
and ISSBA (Li et al., 2021d) employed warping- respectively, introducing sample-specifis trigger patterns during training; LIRA (Doan et al. 2021 formulated the learning of an optimal, stealthy trigger injection function as a non-convex constrained optimization problem, where the trigger generator function is trained manipulate inputs using imperceptible noise; BATT (Xu et al. 2023) utilized images rotated to a specific angle as triggers, representing a new attack paradigm where triggers extend beyond basic pixel-wise manipulations.
triggers,
A few existing literature also provided novel and comprehensive discussions on backdoor attacks from various domains and applications, such as diffusion models (Chou et al. 2024). 3D point clouds (Wei et al. 2024), ViTs (Yang et al. (2024)). code generation (Yang et al. 2024b), audio Zhai al. 2021] Cai al. 2024). and federated learning (Shao al. (0044). Moreover, some existing works also explore utilizing the backdoor attack for good purposes, such as copyright protection
al.
2022a
2023a Guo et al. 2023 2024
et al. 2025) and XAI evaluation (Ya al. 2023)
H.2
BACKDOOR DEFENSES
Currently, there various backdoor defense methods (Li 2024a b) designed to mitigate back-
door threats. These methods can generally be divided into three main paradigms (Li et al. 2024c):
(1) trigger-backdoor mismatch, which primarily refers pre-processing-basee
defenses (Liu al.
2017
Li et al. |021c Shi et al.) (0233). (2) backdoor elimination (Li et al. 202 lb] Zhao et al. 2020
Zeng el 2021 [202 Huang al. 2022 Xu al. 2024), such as model reconstruction
Wang
et al. 2020
Li et al. 2021b Zeng et al. (022)), poison suppression (Huang et al. 2022 Tang et al.,
2023). and training sample filtering (Hayase & Kong 2020
Zeng et al. 2021)) p. (3) trigger elimina-
tion, also known as testing sample filtering (Gao et al.
2019 Xie et al.
2024 Yi et al. 2025).
Pre-processing-base Defenses. These methods incorporate a pre-processing module prior to feed- ing samples into DNNs, altering the trigger patterns present in the samples. Consequently, the mod- ified triggers no longer align with the hidden backdoor, thereby preventing the backdoor activation. AutoEnnoderDeffense (Liu et al. 2017) is the first pre-processing-baseee backdoor defense by em- ploying a pre-trained autoencoder as the pre- prepprcessinng module. Based on the idea that trigger regions have the most significant impact predictions, Februus (Doan et al. 2020) effectively mit- igates backdoor attacks by removing potential trigger artifacts and reconstructing inputs, all while preserving performance for both poisoned and benign samples. Li et al. (202c) observed that
23

---

Published as a conference paper at ICLR 2025
poisoning- based attacks with static trigger patterns degrade sharply with slight changes in trigger appearance or location and proposed spatial transformations (c.g.. shrinking, flipping) as an efficient defense with minimal computational cost. Deepsweep (Qiu et al.] 2021) proposes unified defense that (1) fine-tunes the infected model using a data augmentation policy to remove backdoor effects and (2) pre-processes input samples with another augmentation poliey to disable triggers during inference. Recently, many pre-processing-baseee diffusion model and the masked autoencoder, to purify suspecious samples. ZIP (Shi et al. 2023) applies linear transformations, such as blurring, to poisoned images to disrupt backdoor patterns and subsequently employs pre-trained diffusion model to recover the semantic information lost during the transformation. BDMAE (Sun et al., 2023) detects potential triggers in the token space by eval- uating image structural similarity and label consistency between test images and MAE restorations, refines these results based on trigger topology, and finally adaptively fuses the MAE restorations into a purified image for prediction.
defenses utilize the generative model, such as the
Backdoor Elimination Defenses. In contrast to pre-processing -beseeecssiig defenses, backdoor elimina- tion methods typically mitigate backdoor threats by directly modifying model parameters or prevent backdoor injection by controlling the model training process. Li et al. (2021a) identified two key weaknesses of backdoor attacks: (1) models learn backdoored data significantly faster than clean data, and (2) the backdoor task is associated with specific target class. Consequently, they pro- posed Anti-Backdoor Learning (ABL), which introduces a two-stage gradient ascent mechanism: (1) isolating backdoor examples in the early training phase, and (2) breaking the correlation be- tween backdoor examples and the target class in the later training phase. Inspired by the phe- nomenon where poisoned samples tend to cluster together in the feature space of the attacked DNN model, Huang et al. (2022) proposed novel backdoor defense by decoupling the original end-to- end training process into three stages. |Yang et al.] (2023) removed backdoors by suppressing the skip connections in key layers identified by their method and fine-tuned these layers to restore high BA and further reduce the ASR. Neural Polarizer (Zhu et al. 2023) achieved effective defense by training an additional linear transformation, called neural polarizer, using only small portion of clean data without modifying the model parameters. DataElixir (Zhou et al. (024) detects target labels by quantifying distribution discrepancies, selects purified images based on pixel and feature distances, and determines their true labels by training a benign model. Xu et al. (2024) discovered that even in the feature space, the triggers generated by existing BTI methods differ significantly from those used by the adversary. Consequently, they proposed BTI-DBF, which decouples benign features instead of directly decoupling backdoor features. This method primarily involves two key steps: (1) decoupling benign features, and (2) triggering inversion by minimizing the differences between benign samples and their generated poisoned versions while maximizing the differences of the remaining backdoor features.
Trigger Elimination Defenses. These defenses filter out malicious samples during the inference process rather than during training. As result, the deployed model exclusively predicts benign test samples or purified attack samples, thereby preventing backdoor activation by removing trigger pat- terns. STRIP (Gao et al. 2019) perturbs the input samples and observes the randomness in predicted classes from the deployed model for these perturbed inputs. If the entropy of the predicted classes is low, this violates the input- deputdeeendeece characteristic of a benign model, indicating the presence of malicious features within the input. Du et al. (2020) demonstrated that applying differential privacy can enhance the utility of outlier detection and novelty detection, and further extended this approach for detecting poisoned samples in backdoor attacks. Besides, CleaNN (Javaheripi et al.) (0000) lever- ages dictionary learning and sparse approximation to characterize the statistical behavior of benign data and identify triggers, representing the first end-to-end framework capable of online mitigation against backdoor attacks in embedded DNN applications.
H.3 MODEL REPROGRAMMING
Elsayed et al. (2019) first proposed adversarial reprogramming, which aims to repurpose classifier trained on ImageNet- IK for tasks such as classifying CIFAR-10 and MNIST images and counting the number of squares in an image. BAR (Tsai et al. 2020) extended model reprogramming to black- box scenarios and applied to the bio-medical domain. Driven by advancements in deep speech processing models and the fact that speech data is a univariate time signal, Voice2Series (Yang (et al.) 202T) learns to reprogram acoustic models for time series classification and output label mapping through input transformations, Neekhara et al. 2022) analyzed the feasibility of adversar-
24

---

Published as a conference paper at ICLR 2025
airplane
automobile
CaE
deer
Before
After
Before
After
Before
After
Before
After
Before
After
Benign
Poisoned
dog
frog
ship
Before
After
Before
After
Before
After
Before
After
Before
After
Benign
Poisoned
Figure 6: The visualization of transformed samples ă. We display the benign and poisoned samples and transformed benign and poisoned samples for each class. For each class of small areas, the upper left corner represents the benign sample, the upper right corner represents the transformed benign sample, the bottom left corner represents the poisoned sample and the bottom right corner represents the poisoned sample after transformations.
Before
automobile
After
Before
bird
After
Figure 7: The visualization of transformed samples z for classes 'automobile' and 'bird' of CIFAR- 10. For each class, we display five input images and their transformed images.
ially repurposing image classification neural networks for natural language processing (NLP) and other sequence classification tasks. They developed an effective adversarial program that maps series of discrete tokens onto an image, which can then be classified into the desired category by an image classification model. [L et al. (2023c) found that combining Visual Prompting (VP) with PATE-a state-of-the-art differential privacy training method that utilizes knowledge transfer from team of teachers-achieves cutting-edge balance between privacy and practicality with minimal expenditure on privacy budget. More Recently, a novel application (Dey & Nair (024) of model reprogramming repurposed models originally designed for able-bodied individuals predict joint movements in amputees, significantly enhancing assistive technologies and improving mobility for amputees. Currently, model reprogramming has been shown outperform transfer learning and training from scratch many applications (Tssi et al. 2020 Yang et al. 2021 without altering the original model's parameters.
Vinod et al. 2023).
I THE VISUALIZATION OF THE TRANSFORMED SAMPLES
In this section, we visualize the transformed benign and poisoned samples E generated by the UNet of REFINE. We train backdoored ResNet-18 18 model CIFAR-10 using the BadNets attack
25

---

Published as a conference paper at ICLR 2025
Before
koalas
After
Before
golden retriever
After
Figure 8: The visualization of transformed samples 전 for classes 'koalas' and 'golden retriever' of ImageNet. For each class, we display five input images and their transformed images.
with a specified trigger patterns at the bottom right corner of images, and the hard-coded remapping function fr. of the output mapping module M is defined as follows:
fL. = =1+,
(11)
where
fairplane, automobile,, bird, cat, deer, dog, frog, horse, ship, truck),
(12)
and
1 1 feal, deer, aulomobile, ship, frog, bird, horse, truck, airplane, dog).
(13)
As shown in Figure 6 for both benign and poisoned samples, the transformed sample patterns very similar, and the transformed pattern of the poisoned sample effectively removes the trigger. This further illustrates the effectiveness of our REFINE in mitigating backdoor threats.
As shown in Figure [ samples from the same class exhibit visual similarities after transforma- tion. However, the transformed samples do contain any numaan-ecognizzbble information. This phenomenon occurs because the input transformation module maps the samples to new benign fea- ture space, and the constraint imposed by the supervised contrastive loss ensures that transformed samples from the same class exhibit more similar benign features.
J THE VISUALIZATION THE FEATURE DISTRIBUTION BEFORE AND AFTER REFINE
We hereby visualize the changes in the feature distribution of the input samples before and after REFINE. Specifically, we trained backdoor ResNet-18 model on CIFAR-10 using the BadNets attack and extracted the features from the input of the model's fully connected (FC) layer as the feature values the input samples.
As shown in Figure 9 before applying REFINE, the feature distributions of benign and poisoned samples are clustered in two distinct locations. After applying REFINE, the feature distributions of benign and poisoned samples are interwoven and clustered in the same new location. This indicates that REFINE effectively removes the trigger patterns from the poisoned samples and maps samples of the same class
benign distribution.
As shown in Figure 10 before applying REFINE, the benign samples of each class form distinct clusters in the feature space. After applying REFINE, the benign samples, adjusted by the input transformation module and output mapping module, form new clusters different positions. This empirically demonstrates that REFINE able maintain the model's benign accuracy.
26

---

Published as a conference paper at ICLR 2025
The feature distribution of samples in Class 1 before and after REFINE
ND, Beriign
ND Palson
Henign
RF Potson
Figure 9: The t-SNE plots of the feature distribution of samples in Class I before and after REFINE. ND_Benign and ND_Poison represent the features of benign and poisoned samples under the No Defense (ND) scenario, respectively. RF_Benign and RF_Poison represent the features of benign and poisoned samples after applying REFINE, respectively.
2
Figure 10: The t-SNE plots the feature distribution of benign samples from different classes, both before and after REFINE.
K SOCEITAL IMPACT
This paper aims design effective and efficient backdoor defense method and have positive societal impact. Specifically, we propose a novel nee-processing-aate -based backdoor defense method, REFINE, based model reprogramming. REFINE can mitigate the backdoor behaviors injected into the third-party pre-trained models. Therefore, our REFINE can assist in ensuring the stable and reliable operation of the AI models, mitigating the potential threat of backdoors, and facilitating the reuse and deployment of the models. Moreover, the application of our REFINE may also facilitate the emergence of new business models such as model trading.
On the other hand, in this paper, we propose to leverage the model reprogramming techniques to build the input transformation and output mapping modules to mitigate the backdoors. The insight of our method can also be applied to the use of the pre-trained model in unauthorized way. For instance, an adversary might use the model for an unauthorized task via model reprogramming, leading to copyright infringement (Shao et al. 2025 Wang et al. (022). However, argue that the negative societal impact negligible. The model developer can employ several existing protection methods, such non- non-transfer learning (Wang et al. 2022 to prevent such misbehaviors. Moreover, although we do not find effective adaptive attacks against our REFINE, an adversary may design more advanced adaptive attack to circumvent proposed method since its effectiveness lacks of
27

---

Published as a conference paper at ICLR 2025
Table 14: The performance (%) of REFINE in the 10% unlabeled data scenario on ResNet-18 18.
Defense
No Defense
REFINE
Attack
BA
ASR
BA1
ASR
BadNets
91.18
100.00
78.02
2.90
Blended
90.64
98.18
77.89
2.59
WaNet
91.29
99.91
78.79
1.83
PhysicalBA
93.67
100.00
79.87
2.34
theoretical guarantees. Even so, the model users and developers can still prevent the backdoor threat from the source by only using trusted pre-trained models.
L POTENTIAL LIMITATIONS AND FUTURE DIRECTIONS
Firstly, as outlined in our threat model, the goal of our defense is protect against pre-trained models from third-party platforms. Specifically, similar to other baseline methods, we assume that the defender possesses certain amount of unlabeled sample datasets. To explore the effectiveness of REFINE in few-shot scenarios, we conduct additional experiments using 10% unlabeled clean data. We apply the REFINE defense to a ResNet-18 18 model trained on the CIFAR-10 dataset, which is subjected to the BadNets attack. In this case, the unlabeled training set for REFINE used only 10% the CIFAR- 10 training set.
As shown in Table 14 even with only 10% unlabeled data, REFINE is still effective to some extent. REFINE effectively reduces the ASR, although does have some impact on the model's BA. There- fore, in cases where the defender lacks the number of unlabeled samples, it becomes impossible to train the input transformation module, thereby hindering the execution the intended defense. Currently, with the widespread application of generative models, obtaining sufficient amount of unlabeled samples is no longer a challenging task. In the future, we will continue to explore how to maintain the effectiveness of REFINE in few-shot scenarios.
Secondly, we need to train a local input transformation module, which requires certain compu- tational resources and time. While this overhead somewhat higher than that of pre-processing defenses based on random transformations, it is significantly lower than the overhead associated with pre-processing defenses based on generative models and BTI-based methods, as presented in Appendix F This overhead is considered acceptable compared to retraining DNN from scratch.
Finally, our method primarily focuses on backdoor defense for image classification models. Fortu- nately, existing researchs (Yang et al. 2021 Neekhara et al. (2022) have demonstrated that model reprogramming techniques can yield favorable results in fields such text and audio. We will ex- plore the reprogramming-base based backdoor defense in other modalities and tasks in our future work.
M DISCUSSION ON ADOPTED DATA
In our experiments, we only use open-source dataset (i.e., CIFAR-10 (Krizhevsky et al. 2009) and ImageNet (Deng et al. 2009)) for evaluation. Our research strictly obeys the open-source licenses of these datasets and does not lead any privacy issues. The ImageNet dataset may include some personal elements. For instance, data about human faces is available in the ImageNet dataset. Nev- ertheless, work treats all objects equally and does not intentionally exploit manipulate these elements. As such, our work complies with the requirements of these datasets and should not be construed as violation of personal privacy.
28


Reviews:
[{"review_id": "sgkCFoE0Hv", "reviewer": "Reviewer_gceM", "summary": "This paper propose an inversion-free backdoor defense method based on model reprogramming, REFINE. REFINE consists of an input transformation module and an output mapping module. The key idea is to transform both input and output domains to break the trade-off between model utility and defense effectiveness faced by existing pre-processing based defenses.", "questions": "In Figure 3, why did the color of the part of the image outside the trigger also change?", "limitations": "", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "- Extensive experiments demonstrating the effectiveness of REFINE across different datasets.\n\n- Thorough ablation studies validating each component's contribution", "weaknesses": "- The connection between motivation and the proposed methods is not very close. However, the analysis of BTI-based defenses does not involve this domain-based perspective. The paper didn’t discuss whether and how the purification process in BTI-based defenses alter the image domain.\n\n- The theoretical analysis through Theorem 1 effectively explains the limitations of transformation-based defenses by quantifying how domain transformations affect defense performance.\n\n- Experiments mainly focus on ResNet. Conducting experiments under different network structures is beneficial for verifying the effectiveness of the proposed method, for example, VGG, DenseNet etc.\n\n- Requiring 20% clean data may be impractical in many real-world scenarios.\n\n- The proposed method requires training a U-Net, which involves a significant computational cost.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "fw4Aqy35IK", "reviewer": "Reviewer_p35s", "summary": "This paper analyzes existing pre-processing-based backdoor defense methods and their limitations. Then, a simple yet effective method is proposed. This method utilizes model reprogramming techniques rather than model retraining, which not only eliminates backdoor attacks but also maintains the model's performance. The evaluation of different backdoor attacks also demonstrates the effectiveness of the proposed method.", "questions": "1. The two sentences (i.e., \"by first obtaining ... outcomes\" and \"the internet ... poisoned samples)\") in the Section 1 contradict each other. What is the difference between prior information and prior knowledge?\n2. This paper focuses on the dirty-image backdoor attacks. But considering the recent clean-image backdoor attacks that do not have trigger features, can the proposed defense method work?\n3. In Section 3.2, the \"Pad Size\" and \"Mask Ratio\" are not defined before. it is necessary to clarify.\n4. In this paper, there are many long sentences, which makes it hard to understand. Such as \"Additionally, we treat ... the transformation\" on Page 4.\n5. In Section 3.2, the authors did not show the dataset used for limitation analysis. Please clarify it.\n6. In Section 4.2.1, the authors present that traditional model reprogramming methods are insufficient to remove triggers. I suggest that the authors explain why traditional methods are insufficient in detail.\n7. The discussion about the feature distance changes in the proposed input transformation module is lacking. It is better to add it to highlight the function of this module.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. A theoretical analysis demonstrates that the effect of backdoor defenses is bounded by the distance of the output features before and after the preprocessing. Therefore, existing methods can not break the trade-off between the model utility and the defense effectiveness.\n2. The proposed method is novel and interesting. By integrating model reprogramming techniques, they only need to change the model input without changing the model parameters to achieve backdoor elimination, and it does not affect the original performance of the model.", "weaknesses": "1. The authors discuss the pre-processing defense methods, i.e., input-transformation defenses and BTI-based defenses, and analyze their limitations in details. However, the proposed methods actually belong to the input transformation-based method. This paper also spend a large amount of time to analyze and compare BTI methods with the proposed method, which makes it hard to read.\n2. This paper assumes that they have access to an unlabeled dataset that is independent and identically distributed to the training dataset of the pre-trained model. The authors need to clarify how to acquire this dataset. In addition, since the performance of model reprogramming methods is related to the distribution of input data, if the author cannot obtain data with the same distribution, will it affect the performance of the model?\n3. The experiment is pretty insufficient. REFINE is only evaluated with the ResNet-18 model. The evaluation under more complex models (such as ResNet-50) or other architecture models (such as InceptionV3 or VGG16) is lack.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Lo3vUtyKDv", "reviewer": "Reviewer_Q8vQ", "summary": "This paper  proposes REFINE, an inversion-free backdoor defense method based on model reprogramming. Based on the research, the authors revisit existing pre-processing-based backdoor defenses and reveal their limitations. The proposed defense, REFINE, introduces trainable input transformation and output mapping modules for reprogramming and incorporates cross-entropy and supervised contrastive losses to enhance defense performance. Extensive experiments are conducted to validate the effectiveness of REFINE.", "questions": "1. Please improve the soundness of the limitation study.\n2. Please discuss the reasonability of the categories of the mentioned defenses.\n3. Please explain the different experimental results.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. Revisit the pre-processing defenses against backdoor attacks and reveal their limitations. The pre-processing-based defense is important to protect model security while not changing model structure or weights.\n2. Propose a pre-processing defense against backdoor attacks, which seems to be simple but effective.\n3. Conduct extensive experiments to demonstrate the effectiveness of the proposed defense.", "weaknesses": "1. The claim of the limitations of prior works are subjective and confusing. For the first limitation, the authors think \"transformation-based backdoor defenses methods face a trade-off between utility and effectiveness\". So, can the proposed defense overcome this limitation? From the design and experimental results, REFINE also suffer from the same problem. Otherwise, the BA with REFINE should be same with  original model. Moreover, the authors try to utilize experiments to validate their claims. However, the experimental setting is not fair enough. For example, the authors mention ShrinkPad as the baseline. However, in that paper, ShrinkPad is not the best defense method. Also, for the second limitation, the authors do not analyse the SOTA work, and the shown experimental results are different from the original paper, e.g., the experiments with BADNET shown in Fig.3.\n2. The categories of the mentioned defenses are not sound enough. According to the manuscript, the BTI-based defense (e.g., NC) reverses the backdoor trigger to eliminate the trigger in the inputs. However, such a kind of defense does not only work in this way. Thus, the comparison seems to be not fair enough.\n3. The experiments do not involve some SOTA works. e.g, [1, 2]. Moreover, the experimental results differ from the original paper a lot, e.g., BTI-DBF. Please explain why.\n[1] Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Features\n[2] Black-box Backdoor Defense via Zero-shot Image Purification", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "E1QCtiHePs", "reviewer": "Reviewer_GGnQ", "summary": "This paper addresses the challenge of backdoor attacks in deep neural networks, where current defenses struggle to balance accuracy and trigger removal. The proposed REFINE method combines input transformation and output remapping to effectively neutralize backdoors without relying on trigger inversion. Experiments show REFINE's strong defense capabilities while maintaining model performance.", "questions": "See weakness part.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 4, "contribution": 3, "strengths": "1. The idea may seem bold and imaginative, but it is worth exploring in depth. I believe both the threat model setup and the proposed solution are good.\n2. Overall, the paper is well-written, making it relatively easy for someone unfamiliar with model reprogramming, like myself, to grasp the design concepts.\n3. The method operates effectively with a small amount of unlabeled data, which not only cleverly avoids direct comparison with fine-tuning-based defenses but also demonstrates its practicality through ablation experiments that confirm its minimal data requirements.", "weaknesses": "1.Regarding the theoretical explanation in the paper (Formula 1), I feel it’s missing a key component and has only achieved about 50% of its purpose. It aims to explain how amplifying the distributional differences in output features changes the variation in prediction results. As the authors emphasize, model reprogramming significantly amplifies these distributional differences, and trigger patterns can be randomized. I agree with this point, but at this stage, the performance guarantee for clean samples doesn’t tie back to this theory; I see it as being empirically supported by the two losses. In fact, even with model reprogramming, Formula 1 still holds, so it may not fundamentally support the authors’ viewpoint (since Formula 1 is a rule that must be met across the overall distribution; I believe focusing on local distributions could be a potential solution).\n\n2.The whole experiments are only conducted on a ResNet-18 model. Furthermore, the discussion of the black-box part in the experiments seems counterproductive to me; I don’t understand the rationale behind setting up absurdly similar black-box and substitute models for exploration.\n\n3.The adaptive attack setup is unreasonable. Based on the general consensus in the community, in adaptive attacks, the attacker is assumed to know the defender’s hard-coded choices. Disallowing the defender from making real-time adjustments (which is a strategy directly aimed at adaptive attacks) is therefore a logical error. Additionally, the authors haven’t clearly explained why a conflict exists between adaptive loss and backdoor loss, resulting in a decrease in BA, and I don’t clearly see a trade-off here.\n\n4.Why is BTI-DBF unable to reverse even the most basic BadNet trigger? I seriously question the validity of this experiment. In the original BTI-DBF paper, it’s evident that it can reconstruct the triggers of certain fixed samples quite effectively.\n\n5.Additionally, I would like to see more examples of transformed samples. Do transformed samples from the same class still share some visual similarities, or do they contain almost no human-recognizable information? What is the underlying significance of these transformations? I am curious if the authors could offer some more unique, high-level insights.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)