Mind Control through Causal Inference: Predicting Clean Images from Poisoned Data
Authors: Mengxuan Hu
Zihan Guan
Yi Zeng
Junfeng Guo
Zhongliang Zhou
Jielu Zhang
Ruoxi Jia
Anil Kumar Vullikanti
Sheng Li
Venue: ICLR 2025 Poster (2025)
Keywords: Causal Inference
Backdoor Attacks
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Anti-backdoor learning, aiming to train clean models directly from poisoned datasets, serves as an important defense method for backdoor attack. However, existing methods usually fail to recover backdoored samples to their original, correct labels and suffer from poor generalization to large pre-trained models due to its non end-to end training, making them unsuitable for protecting the increasingly prevalent large pre-trained models. To bridge the gap, we first revisit the anti-backdoor learning problem from a causal perspective. Our theoretical causal analysis reveals that incorporating \emph{\textbf{both}} images and the associated attack indicators preserves the model's integrity. Building on the theoretical analysis, we introduce an end-to-end method, Mind Control through Causal Inference (MCCI), to train clean models directly from poisoned datasets. This approach leverages both the image and the attack indicator to train the model. Based on this training paradigm, the model’s perception of whether an input is clean or backdoored can be controlled. Typically, by introducing fake non-attack indicators, the model perceives all inputs as clean and makes correct predictions, even for poisoned samples. Extensive experiments demonstrate that our method achieves state-of-the-art performance, efficiently recovering the original correct predictions for poisoned samples and enhancing accuracy on clean samples.

Published as a conference paper at ICLR 2025
MIND CONTROL THROUGH CAUSAL INFERENCE: PRE- DICTING CLEAN IMAGES FROM POISONED DATA
Mengxuan Hu Zihan Guan'; Yi Zeng² .Junfeng Guo Zhongliang Zhou", Jielu Zhang?
Ruoxi Jia?, Anil Vullikanti Sheng Lift
Uniiversity of Virginia
VVirginia Tech
3 University of Maryland, College Park
*Merek& & Co., Inc.
5 University of Georgia
"Thes authors contributed equally
i corcooinggnn Author
ABSTRACT
learning, aiming to train clean models directly from poisoned datasets, serves as an important defense method for backdoor attack. While ex- isting methods can prevent models from predicting the target label backdoored samples, they face significant challenges in recovering backdoored samples to their original, correct labels. Additionally, their non-end-to-end training frame- works make them unsuitable for safeguarding the increasingly prevalent large pre-trained models. To bridge the gap. we first revisit the anti-backdoor learn- ing problem from causal perspective. Our theoretical causal analysis reveals that incorporating both images and the associated attack indicators preserves the model's integrity. Building on the theoretical analysis, we introduce an end-to-end method, Mind Control through Causal Inference (MCCI), to train clean models directly from poisoned datasets. This approach leverages both the image and the attack indicator to train the model. Based on this training paradigm, the model's s perception of whether an input clean or backdoored can be controlled. Typically, by introducing fake non-attack indicators, the model perceives all inputs as clean and makes correct predictions, even for poisoned samples. Extensive experiments demonstrate that our model can effectively and robustly recover the original true labels of backdoored images, without compromising clean accuracy. Our code can be found at htttts///iiubbccooo/xxxuuaaa/230 BKD ICLR
INTRODUCTION
While deep neural networks (DNNs) have achieved tremendous success in various fields (Kortli al. 2020 Zou et al., 2023) Vaswani et al. 2017: et al. 2022). training these models requires a massive amount data. Consequently, it has become common practice outsource the collection of training data to third-party providers, especially for large pre-trained models. For example, the large foundation model CLIP is trained over millions of image-text pairs, which directly col- lected from the internet. However, this practice opens the door for malicious attackers to manipulate model behavior by poisoning the training dataset. This type of manipulation is known as backdoor attacks, where an attacker poisons the training dataset so that DNNs trained on this dataset will classify images to target label when a specific trigger present in the input, but behave normally with benign inputs. Backdoor attacks pose serious security vulnerability to DNNs, especially in safety-critical scenarios such as autonomous driving (Han et al. 2022 Chan et al. 2022), medical diagnosis (Feng et al. 2022), and financial fraud detection (Lunghi al. 2023).
Hence, this raises an inspiring yet challenging research question: How can we directly train a backdoor-fiee model even when backdoor samples are hidden in the training dataset? Despite few prior endeavors (Li et al.) 2021a) Zhang et al., 2023 Huang et al. (222) on this problem, sev- eral crucial challenges remain unresol ved for this scenario. 1 Ignorant Label- Recoverioo Ability:

---

Published as a conference paper at ICLR 2025
Most existing methods primarily focus preventing backdoor-free model from predicting the target label for backdoored samples, while neglecting the practical need to recover the original, cor- rect predictions for such samples. As evidenced in (Wu et al. 2022), all the existing anti-backdoor learning methods fail to consistently achieve strong recovery performance across various backdoor
attacks. @ Low Generalization To Large Pre-trained Models: Existing approaches (Li et al.)
2021a Zhang et al. 2023 Huang et al., 2022; Gao et al., [023 Zhu et al. 2023) involve complex multi-stage training processes that significantly increase computational costs. Particularly during the initial stage, these methods often isolate potential backdoored and clean samples by training the victim model on the entire training set, which can be computationally expensive, especially for large pre-trained models. For instance, vision foundation models like CLIP and BLIP, which contain approximately 80 million parameters and use training sets of around 400 million image-text pairs, incur substantial isolation costs. @ High Dependence on Backdoor Isolation Performance: From a technical point of view. the existing methods rely heavily on the efficacy of backdoor isolation. For instance, ct. (222la) unlearns embedded backdoors using isolated backdoor samples in the ini- tial stage, (Zhang et al. (202T) learns a disentangled representation by isolating the backbone model from an intentionally-trainee backdoored model, and (Huang et al. 2022 Gao et al. (022)) attempt to prevent backdoors by isolating low-credibility samples using the model itself. This reliance on backdoor isolation limits the models' ability to generalize effectively in scenarios where backdoors are difficult to detect and isolate Therefore, an important question arises: How can we efficiently clean model on a poisoned dataset that not only maintains high accuracy on clean samples but also recovers the correct labels of backdoor samples?
train an
To address this question, we first compare the intrinsic differences between training a poisoned model and a clean model on a poisoned dataset from a causal perspective. Specifically, through rigorous theoretical derivation based on the backdoor adjustment theory in causal inference, we find that training model solely with images from poisoned dataset may compromise its integrity. Conversely, incorporating both images and associated attack indicators can safeguard the model's integrity. Typically, attack indicators represent the probability of the presence of an attack the corresponding image. Inspired by (Zeng et al. 2021). we use the frequency spectrum of cach image as the attack indicator. Based on this insight, propose our end-to-end Mind Control through Causal Inference (MCCI) model, as illustrated in Fig. [ MCCI utilizes the given victim model (e.g. ViT) as a Semantic Feature Recognition Network (SFRN) learn semantic features directly from images. It also introduces a smaller Attack Indication Network (AIN) to augment the victim model. This AIN determines whether an input is backdoored given the attack indicator. Hence, it acts as a "magic wand", controlling the model's perception of whether an input is clean or backdoored. In the inference stage, we leverage counterfactual outcome estimation to manipulate the model's 's perception, making it treat all inputs as clean by introducing fake non-attack indicators to the AIN. Extensive experiments demonstrate that backdoored samples can be effectively and robustly recovered to their original labels without compromising clean accuracy. Furthermore, additional experiments uncover the mechanism behind the mind control secret of AIN through latent space visualization.
Our contributions are summarized as follows: (1) Advanced Recovery Ability. We addressed an overlooked aspect of evaluating the recovery ability of backdoor-fre frre models poisoned datasets. Compared to the existing baselines, our MCCI model has shown outstanding label recovery perfor- mance. (2) Inusaliy Training and Inference. We leverage theories in causal inference to analyze the differences between training a poisoned model and a clean model on a poisoned dataset and develop a counterfactual reasoning approach for inference-stage backdoor sample re- covery. (3) Generalization to Large Pre-trained Models. We empirically demonstrate that MCCI highly adaptable for backdoor defense in large trained models with limited training overhead. (4) SOTA Performance in Effectiveness and Efficiency. Extensive experiments demonstrate that our method effectively and efficiently trains clean models on poisoned datasets.
2 RELATED WORK
Backdoor Attack. Backdoor attacks are usually launched through data poisoning (Gu et al. 2017
Chen et al. 2017 Nguyen& & Tran 2021: Li et al.] [202cc Liu et al. 2020
Shafahi et al. 201 Sa
Schneider al. 12024]] Li et al. 2024bb] Lan et al. 2024 Cheng et al.
2024 Yin et al.) [2244] Guan
et al. 2023b] Guo et al. 2024), where malicious attackers inject backdoor samples into the training
dataset. As result, a model trained this dataset will classify images target label when
2

---

Published as a conference paper at ICLR 2025
Training
Inference Stage
Deep
Sarpte
STRR
EVICTER ROOK1)
FC Layer
Sh1p
DCT
Clean DCT
KJS
AEN
Latent Space
Lotent Space
Space
Cetficl Latent Space
SPAN Lotent Space
AIN Latent Space
Figure 1: Pipeline of the MCCL. In the training stage, SFRN processes the original image æ rec- ognize complex semantic features (shown in the SERN latent space) and encodes æ into z. Simulta- neously, AIN analyzes the frequency spectrum y of to assesses whether the input backdoored (illustrated in the AIN latent space) and encodes y into zy. The two embeddings, and z,, are then concatenated for the final image prediction. In the inference stage, a clean frequency spectrum is inputted along with the image to ensure clean predictions.
specific trigger is present in the input while maintaining normal behavior on benign inputs. Although there are other categories of backdoor attacks (Appendix D]. this paper primarily focuses on data poisoning-bases backdoor attacks.
Backdoor Defense. Following (Li et al. 2022b). the existing backdoor defense methods can be roughly split into five main categories, including (1) detection-based defenses (Huang et al. 2019
Xiang et al. 20022 Guo et al. 2021), ) (2) preprocessing-based defenses (Doan al. 2020: Li et al.
2021b Huang et al. [202]] Shi et al. 2024 Borgnia et al. 2022), (3) poison wwppsssuppppsp-iiiiieeee
de-
fense (i et 2222 Ia Huang et al. 22022 Zhang al. [2023] Gao et al. 2023). (4) trigger-synthesis-
based defense (Wang et al. 2019; Chen et al. [022] Xu et al. (023). and (5) input-filtering suuttfiltrinn-basee
defenses (Gao et al. 2019| Zeng et al. 2021 Guan al. [2023 Guo al. 2023a b. Wang al.)
2024 Hu et al. 2024 Guan et al. 2024). o. In particular, in this paper, we adopt a poison-suppressionn based threat model similar to well-established methods (Li et al. 202 Few methods have been proposed in this research direction. Notable approaches include DBD and its variations (Huang ct al. 2022 Chen et al.] 2022). which decouples training between DNN backbone and fully con- nected layers to minimize trigger-label correlation; ABL (Li et al. 10)la) isolates and then unlearns backdoors through gradient ascent; V&B (Zhu al., (023) exploits backdoored model erase potential backdoors, and CBD (Zhang et al. (023). employing a causality-inspired structure to learn de-confounded representations for accurate classification.
PROBLEM SETUP
3.1 THREAT MODEL.
In this paper, the defender aims to train a clean model end-to-end from a poisoned dataset with the following two objectives: O the clean model expected to produce the original, correct pre- dictions for backdoored images even if the trigger is present, and @ the clean model is expected produce high-accuracy predictions for the clean samples, achieving performance as good as the model trained on a purely clean dataset. ① The training process should be in an end-to-end fashion, which can easily generalize to large pretrained models with reasonable computational cost. We as- sume that the defender has full control of the training process, but lacks prior knowledge about the proportion and the distribution of backdoor samples in the poisoned dataset. Fig. g in the Appendix offers visualization of the considered threat model.
Comparison with the Past Threat Models. Our defense goal is more challenging and practical compared to the threat models in (Li et al.) 202 Zhang et al.) 2023 Huang et al. 2022). While the defender in those threat models aims to train a clean model that only avoids miscl misclassifying back- doored samples as the target label, our defense objective additionally expects the model to predict the original, correct labels for backdoored samples in an end-to-end to-end manner with high generaliza- tion large pretrained models. Therefore, this objective is more practical (TRC 2022) in the
3

---

Published as a conference paper at ICLR 2025
real world. Otherwise, the model may make unreasonable predictions (e.g., assigning random labels other than the target label) when exposed to backdoor trigger patterns, posing a serious threat to model security.
3.2 PRELIMINARIES
To uncover the intrinsic differences between training a poisoned model and a clean model on a poisoned dataset, we leverage causal inference for analysis. In particular, causal inference aims to estimate the causal effect of the treatment I on the outcome Y. Analogous to the image classification task, our objective to estimate the effect of an image on the prediction. Therefore, we treat the image as the treatment and its corresponding prediction as the outcome. We first introduce some basic definitions in causal inference, along with other assumptions (Yao et al.) 2021] Guo et al.) 2020 Pearl 2009), causal effect can be identified from the observational data. More details are provided in the Appendix B
Definition 3.1 (Confounders). Confounders are variables that serve common cause of the treat- ment T and the outcome Y.
Assumption 3.2 (Positivity). Every unit should have non-zero probabilities to be assigned in each treatment group. Formally, P(T = t|X = x) + 0, vt E T, V2 E X.
Assumption 3.3 (Modularity). Given a node x, and its parent nodes pa, in the causal graph, if we intervene set of nodes S by assigning them constants, then for all i: 1. If & S, then P(z pa.) remains unchanged. 2. If E S and 2; is the value that X; was set to by the intervention, then P(x: pa;) otherwise, if 2; is not the intervention value, P(x, pa;) O.
3.3 BACKDOOR ATTACK FORMATION FROM CAUSAL VIEW
As preliminarily explored in (Zhng et al. 2023), the underlying mechanism of backdoor attack formation can be demonstrated using causal graph, as shown in Fig. aa. Specif- ically, backdoor attacks A are initiated by at- taching a trigger to the victim image A + and altering the image label Y to the target la- bel -> Y. Hence, the confounder intro- duces spurious backdoor path I A + Y that builds and strengthens erroneous correla- tions between the modified images and the tar- get label, misleading the predictions of backdoor samples instead of guiding them to follow the real causal path I Y. Formally, in causal inference, this misled backdoor prediction is attributed to the confounding bias brought about by the confounder variable A. Therefore, the prediction solely based on the image E(Y| = i) is inevitably influenced by this spurious correlation. Formally,
San por Gtald Park
CAt
(0)
(b)
Figure 2: (a) Causal graph of traditional backdoor attack. (b) Causal graph of backdoor defense by cutting off the edge between A - (backdoor adjustment).
Proposition 3.4. Let i be an image from a poisoned dataset and fo model trained on this dataset. Then, the expected prediction of image i can be derived uccording to Fig. g
P((
E(Y = EA EY v. A
(1)
P(i)
Source confounding bias
Proof. We provide detailed derivation in Appendix C.I
4 MIND CONTROL THROUGH CAUSAL. INFERENCE (MCCI)
In this section, we provide detailed introduction to the training and inference stages of the MCCI model. We begin by discussing the causal theory used to eliminate confounding bias, then adapt this theory to the backdoor setting through analogous theorem. Following this, describe the MCCI training algorithm based on the theorem. Finally, we introduce counterfactual outcome estimation, which is employed to manipulate the model's cognition, treating poisoned samples as clean.
4

---

Published as a conference paper at ICLR 2025
4.1 TRAINING STAGE: REMOVE BACKDOOR FROM CAUSAL VIEW
Here we introduce some basic definitions in causal inference:
Definition 4.1 (do-Calculus). The operator do(i") is defined in do-calculus as the intervention that sets the value of a variable i to a constant i' uniformly across the entire population.
Definition 4.2 (Backdoor Path). A path connecting image 7 and outcome Y is defined as a backdoor path if and only if it is not directed path and remains unblocked by any other variables.
Definition 4.3 (Backdoor Criterion). A set of variables A fulfills the backdoor criterion relative to I and if A blocks all backdoor paths from to Y and does not contain any descendants of
To mitigate confounding bias brought by A, we employ do-calculus in causal inference to cut off the spurious path as shown in Fig. bb.. Specifically, do-calculus conducts intervention by substituting the value of / with specific value, thereby cutting off the relationship between the variable and its parent A, effectively eliminating any incoming edges to I. Consequently, all associations between I and Y flow along the directed causal path, yielding backdoor-fre free predictions IE( = do(i)).
However, E(Y do())) a causal estimand that is intractable to identify with the current dataset (Pearl 2009). To address this, we employ the backdoor adjustment for causal identifica- tion, a theory that identifies outcomes without the influence of confounders (attacks) (Pearl) 2009). thereby recovering backdoored samples while maintaining high accuracy. Specifically, backdoor adjustment involves adjustments on variables that satisfy the backdoor criterion (Pearl) 2009p. Ac- cording to Definition 4.3 attack A in our scenario is sufficient adjustment set, since there only single backdoor path through A, adjusting for this single node A is sufficient to block all backdoor paths. Hence, the backdoor adjustment theorem tailored for backdoor attacks is as follows:
Theorem 4.4 (Backdoor Adjustment for Backdoor Attack). Given the satisfaction of the backdoor criterion by A, the positivity assumption (Assumplion 3.2) and the modularity assumption (Assump-
tion 3.3
we can identify the causal effect of I on Y.
Y I do(i)] = E Σ a( E Y
Image Imput
Altack
Proof. We provide detailed proof in Appendix
The theorem implies that clean predictions can be derived from a poisoned dataset by condition ing on both the input image and the attack A. In other words, the model input should include both the image and the associated attack indicator. This distinction also sheds light on the differences between training backdoored model and a clean model on a poisoned dataset. Specifically, simply inputting the image causes the model to be backdoored, while including both the image and the associated attack indicator can safeguard the integrity of the victim model. Furthermore, the differ- ence between equation T and equation 2 provides theoretical insight into why simply inputting the image causes the model to be backdoored. Specifically, we find that the biased estimation in equa- tion [ contains additional term (highlighted in gray) compared to the backdoor-fres estimation in equation 2 This additional term is the source of confounding bias (Pearl 2009 Guo et al. 2020).
How to represent the Attack A? An intuitive way for indicating the attack is leveraging off-the- shelf backdoor detection algorithms (Koh & Liang (017]] Peri et al. 2020 Qi et al.] 2023) Pan et al.) 2023]. However, their reliance on already backdoored models and computationally intensive re- quirements make these methods impractical for representing A as an input in our approach. Inspired by the input-level detection method (Zeng et al. (02T), we use the frequency spectrum of each im- age to indicate the presence of an attack on the corresponding image. This method is effective due to the significant differences between backdoored and clean images in the frequency domain, illus- trated in Fig I. Its effectiveness, along with its proactive and computationally efficient nature, which does not depend on an already trained backdoored model, makes a highly appropriate choice of an attack. More visualization can be found in Fig. [4] Moreover, images can be efficiently transformed into the frequency domain using the Type-II 2D Discrete Cosine Transform (DCT). Consequently, we incorporate structure that accepts DCT--rranfoormed images input and maps them to a vector representing the attack. Further details on using frequency domain images to detect backdoors are discussed in Appendix E
MCCI Design. Motivated by our previous causal analysis, we propose our Mind Control through Causal Inference model (MCCI), which consists of two networks: the Semantic Feature Recognition
5

---

Published as a conference paper at ICLR 2025
Network (SFRN) and the Attack Indication Network (AIN) shown in Fig. Specifically, SFRN the provided victim model, such as VIT. It is tasked with recognizing complex semantic features, such identifying cat within image. thereby functioning as the clean model that learns direct causal paths. This process, illustrated in the SFRN latent space in Fig involves processing the original image and encoding it into Meanwhile, AIN determines whether the input is back- doored based on the frequency spectrum y of & as illustrated in the AIN latent space in Fig. [ It acts like magic wand, controlling the model's perception to recognize whether the input is clean or backdoored. The frequency spectrum y is encoded by AIN into zf. Then two embeddings (z and 2y) are concatenated for the final image prediction. More detail can be found D
Remark 4.5 (Design Guidelines for AIN). We propose that an AIN module should satisfy the fol- lowing two requirements: (1) The structure is much smaller than SFRN, as backdoor patterns simpler to learn than normal patterns, as evidenced by (Liu et al.) 2023b Zhang et al., 2023); (2) Avoids using complex architectures decrease unnecessary overhead. Further discussion on AIN's "magic control power" is in Section 5.2
In summary, the training pipeline of MCCI becomes solving the following optimization problem:
DAIN. SSFNN =
arg min
B(g.g))Derass ((C(g(2,z)) ((
8AIN,0SPRS OSFRN
where == ATN
= = (ar),
where & denotes the cross-entropy loss function, C' denotes a composited classification layer, denotes the concatenation function, and DCT denotes the discrete cosine transform function. The outline of the algorithm is provided in Algorithm I
4.2 INFERENCE STAGE: ASK MODEL WHAT IF IT WERE CLEAN IMAGE
In the inference stage, we use counterfactual outcome estimation to predict the original ground- truth label for each image. This method estimates what the outcome would be if the variable had different value than the observed one in the factual world. Specifically, for a poisoned image i, we aim to determine what its label would be it were a clean image. Answering this counterfactual question involves estimating /| do(i), 0J. This motivates to input fake non-attack indicator, namely, a clean frequency spectrum (A = 0) to trigger the control magic of AIN for prediction. Intuitively, the clean frequency spectrum and the trained AIN work together to control the model's perception, convincing it that the input is clean and thereby guiding it to the correct prediction. Moreover, discuss this "magic control secret" further in Section 5.2 pipeline can be formulated as follows,
The prediction
ÿ = CCg((ANNN (DCTbenign: SFRN R
SpnN (z)))),
(4)
where DCTbenign denotes the clean frequency spectrum. Regarding the choice of the clean fre- quency spectrum, we propose two heuristic strategies: (1) the average frequency spectrum derived from a number of clean images in the validation dataset, (2) the frequency spectrum of a single clean image chosen randomly from the validation dataset. Our experiments show that both of the methods work, namely, only one clean image is needed for satisfactory defense, demonstrating the practicality of method. More details can be found in Section 5.2
EXPERIMENTS
Datasets and Models. Following (Guo al., 2023a Gao al. 2019 Li al., 2021a). we choose two widely-adopted datasets for evaluating the effectiveness of our proposed method: CIFAR- 10 (Krizhevsky. 2009), and ImageNet-subset (Deng et al.] 2009). The details of the datasets are listed Appendix F For CIFAR-10, train with the adootedd ResNet-18 18 (He et al. 2015). For the ImageNet-subset, we opted for the EfficientNet architecture (Tan & Le 2020) as it reports higher accuracy.
Attack & Defense Baselines. We choose six backdoor attacks from the well-established recent
works our basclines: 1) BadNet (Gu et al. 2017), 2) Blend Attack (Chen al.) 2017). (). 3) Label-
Clean backdoor attacks (Shafahi et al. (018b)), ), 4) WaNet (Nguyen & Tran 2021). 5) ISSBA (Li
et al. 2021c), and 6) TUAP (Zhang al. 2021 All attack baselines implemented with the

---

Published as a conference paper at ICLR 2025
Table 1: Comparison of the proposed method with other baseline defense methods. We mark the
best values in bold and the second best values in underline.
Deaset
Azack Mctsod
CRRT
DRD
ASD
MECUT-NNG
MOCI-G
CA.
ASR
CAA
ASSL
ARX.
CA.1
ASR
CAT
ASR.L
CA.1
ASX.
AXX
CA.1
ASR
AHK.
CIA1
ASR.1
Biked
07:55
$2.87
1.83
17.01
17:68
97.04
12:37
13:54
2.50
$6.36
83.64
2.31
13.00
85.83
1366
18103
8323
1,87
74.35
CRAR 10
I5S0A
85.00
0.94
15:00
06.54
13.99
13.93
1132
1ET0
76.79
4.16
11.00
78.00
1.43
79.93
19:33
3.38
76.73
06.01
08:33
68.07
2730
23:88
73-37
72:32
3.33
15.50
1.14
83.41
85.33
81:43
1.33
Mterage
21.33
72:11
71.32
12:34
12.02
30.00
26.97
31.45
18.26
3:31
3.88
70055
1.42
08.36
23.3
0.88
70144
13:24
1.81
23.03
IrageNix
Woler
30.91
08.64
06.33
87-35
97:11
13.00 07
65-93
94.91
10.05
08:10
5.47
13.10
08:13
10.13
58.33
04.33
106
00:33
18:31
11:1
58.55
02.27
12.41
0.8
01.76
11.93
01.35
10:46
3.44
06.23
2.11
33.21
00.99
65.20
0.34
$2.59
TEEUP
20.74
04.0
61 96
64
11
06-11
71.08
11
64.29
2.64
(6.1
8.99
09.33
10135
8.87
65.00
Averge
71.37
90.61
67.05
31.00
43.14
35,89
45.07
36.23
18:15
5.29
$9.04
02.02
1221
48.51
70.85
031
03.25
00.01
2.80
67.35
4
4
4
b
(a)
(b)
(c)
(d)
Figure 3: t-SNE visualisation of embeddings after Semantic Feature Recognition Network (SFRN) and the Attack Indication Network (AIN) in terms of clean and poisoned points under the training stage ((a)-(b) and the inference stage using average clean frequency spectrum ((c)-(d).
open-sourced backdoor learning toolbox (Li et al., 2023). More details of each attack method can be found in Appendix G Based on our setting, poisoned dataset and have full control over the training process but do not have prior knowledge about the poisoned distribution as well as the trigger pattern. Hence we adopt ABI. (Li et al.)
assumed that defenders can only access the
2021a), CBD (Zhang et al., 2023), DBD (Huang et al. 2022). and ASD (Gao et al. 2023 for the
comparision. More details about defense baselines can be found in Appendix H
ett al.) 2021: 2023a), Following existing works in backdoor suppression (Gao et al. 2021 Guo
Evaluation Metrics.
Clean Accuracy (CA) and Attack Success Rate (ASR) evaluation metrics. In addition, we also adopt Attack Recovery Rate (ARR), which measures the proportion of recovered backdoored samples in the poisoned dataset. More details can be found in Appendix
Implementation Details. The full implementation details are provided in Appendix K
5.1
MAIN RESULTS
5.1.1 DEFENSE EFFECTIVENESS
Table I compares our method MCCI with other defense baselines across various backdoor attacks on two datasets. We highlight the best results in bold and the second best in underline. MCCI- AVG represents our defense model using an averaged frequency spectrum from small number of clean images, while MCCI-SG uses a frequency spectrum from randomly selected clean image. The table shows that our methods achieve promising performance across all datasets against various attack methods, not only on conventional evaluation metrics like CA and ASR but also on the newly adopted ARR, which assesses the recovery of poisoned samples to their original correct labels. In particular, the ARR of our models is nearly equivalent to CA, indicating that our methods can effectively recover all poisoned images as long as their clean counterparts are correctly classified by the model. However, baseline models perform poorly on the ARR metric, in line with previous studies that suggest achieving a high ARR is challenging, 2022 Wu et al.) (022). There is no significant difference between MCCI-AVG and MCCI-SG, suggesting that one randomly selected clean image is sufficient for defense. This highlights the
for models with low ASRs T2C222
7

---

Published as a conference paper at ICLR 2025
practicality of our model, as only one clean image is required for defense, which is easily obtainable by the defender.
5.1.2 ADAPTATION TO LARGE PRE-TRAINED MODELS
MCCI could also be easily adapted the trending large pre-trained models such as ViT (Dosovit- skiy 2020), CLIP (Radford et al. 202T), and BLIP (Li et al. (022a). In this section, we manually inject BadNet-ttyle backdoors into these three pre- praitr models during the finetuning stage. Then evaluate whether MCCI could still recover the original correct targets when provided with a clean frequency spectrum. Due to space limitations, the attack details for the three foundation models are provided in the Appendix M
For the ViT and CLIP models, we consider fine-tuning them on CIFAR-10 and Pashion-Producee datasets, respectively. We provide the results in Table 2 As observed, the ASR values drops abruptly when provided with a clean frequency spectrum, and the ARR rate maintains high.
This demonstrates that MCCI performs well even when integrated with large pre-trained models in the classification task. We also fine- tune the BLIP model for a VQA task on the poisoned IconDomain dataset. It is noted that we slightly abuse the notation of CA, ASR, and ARR here (more details are in the Ap- pendix M). As observed in Table the CA and ARR are closed to zero, demonstrating that MCCI could effectively recover the original QA capability when provided with clean frequency spectrum. Meanwhile, the ASR values are significantly higher, showing that the model's strong effectiveness in refusing backdoor target answers.
Table 2: Effectiveness of MCCI on large pre-train models.
No Definin
AUELAGG
MOTTSC SG
Duauci
Badloce Noakl
CA
ASR
ARE
ASR
CIFAR-10
60.00
Lone-Drrann
BLI
0.12
0.00
0.13
3.21
0.38
0.13
321
0.29
The metrics are slightly abused for the VQA experiment with BLIP
5.2 ABLATION STUDY
Mind Control Effectiveness of AIN. One of the key con- tributions of our work is the AIN's "magic control power" over the model's perception. We explore whether it en-
Table 3: The performance of the mind control magic.
ables control over the model's recognition of inputs as either clean or poisoned based on the frequency spectrum of images. Previous results in Table shown that in- troducing clean frequency image effectively causes the model to misidentify a poisoned image as clean, while minimally impacting the correct prediction of clean im-
Attack Method
APC
APP
RPC
RPP
BadNet
10.27
100.00
10:03
100.00
Blend
10.35
100.00
10.46
100.00
WaNet
13.27
97.54
10.63
100.00
ISSBA
10.32
100.00
LC
19.67
94.02
21.09
92.78
TUAP
61.84
39.92
85.62
ages. Building on this, we now explore the opposite scenario: whether the model can be misled into recognizing a clean image as poisoned using the average frequency spectrum of poisoned data or that of a randomly chosen poisoned image. Specifically, with results shown in Table 3 Here, APC and APP represent the accuracy of using the average poi- soned frequency spectrum (AP) on clean and poisoned datasets, respectively. The near 10% APC suggests that AP leads the model to recognize all clean images as poisoned, aligning with the fact that the ground truth for 10% of clean images is the target label. The near 100% APP indicates that AP enhances the model's 's tendency to classify poisoned images as such, improving the ASR. Similar results were observed with the random poisoned frequency spectrum (RPC and RPP).
conduct experiments
CIFAR-10, 10,
Reveal the magic secret of SFRN and AIN. To better understand MCCI and its components, we present t-SNE visualizations of embeddings from SFRN (round points) and AIN (cross points) under the BadNet attack on CIFAR-10 10 in Fig. 3 Clean images are represented in various colors, each corresponding to a different class, while poisoned images are circled in gray, with the interior color representing the original ground-truth label. From left to right, we present the embeddings for SFRN and AIN under the training stage ((a)-()), and the inference stage ((c)-(d). Fig. 3]a) shows that, the input images are mapped to different clusters by SFRN, demonstrating that in the training stage, the SFRN module mainly captures the semantic information of the images. Fig. b(b) shows that, the contains
embeddings of the AIN module are split into two disjoint clusters, where the smaller the embeddings for the backdoored images, and the larger one contains the embeddings for the clean images. This demonstrates that AIN is capable of distinguishing whether the image is backdoored or
8

---

Published as a conference paper at ICLR 2025
BadNet
Blend
LC
50-
-40
44
-10
86
-10
86-
ARR
A5V
ARR
A5V
78-
(KC)
-18
-10
56-
ASR
58-
50
109
Average points
Average points
Average points
Figure 4: Sensitivity analysis with different quantities of clean images used calculate the average frequency spectrum on CIFAR-10 datasets.
Badket
Blend
-32
ARR
79-
CA
A5V
ARR
28
ASR
ARR
70-
-20
62-
ARR
66-
59-
150
Randon Points
Randon
Points
Randon Points
Figure 5: The mean (line) and standard deviation (band) of the performance under different ran- domly selected points.
not, but not able to recognize complex semantic information in the input images. These observations further confirm that the two networks function as expected, as discussed in Section
Fig. 3 (c) and (d) reveal the magic secret of controlling the model recognize a poisoned sample as a clean sample. For AIN, using average clean DCT shifts the embeddings of poisoned images into the clean image group. Surprisingly, we find that SFRN already groups poisoned images into their original ground-truth categories even before the defense. This occurs because SFRN prioritizes the main semantic features in the image, disregarding the semantically meaningless trigger patterns. As a result, it clusters poisoned images based on their primary features into the correct classes. Based on this insight, we design a new structure that utilizes only SFRN for defense. Details can be found in Appendix O Thus, after the defense, both AIN and SFRN embeddings of poisoned images align with those clean images, which explains how the model restores the ground-truth labels of poisoned images. Randomly selected DCT shows the same pattern detailed in the Appendix N
Choice of Clean Frequency Spectrum. We examine the impact of different selections of the clean- frequency spectrum on defense performance against different attacks CIFAR-10. 10. Detailed results for other attacks can be found in Appendix | For the average frequency spectrum, we investigate how the number of clean images used to calculate the spectrum affects the model performance. Re- sults in Fig. 4 show that even limited set of clean images (e.g., 5) is sufficient for successful defense, with minimal performance improvement as the number of clean images increases. Regard- ing the random frequency spectrum, we assess whether the frequency spectrum of any clean image can be used for inference. We randomly select subsets of [5. 10. 20, 50, 100) images and calculate the average and standard deviation of their performance. Fig, [5 shows that the average performance remains relatively consistent regardless of the number of images used, and the standard deviation small, suggesting that no carefully selected clean image is necessary for effective inference.
5.3 DISCUSSION
Effectiveness with Different Poisoning Rates. We study the robustness of our method against different poisoning rates. Specifically, test method with poisoning rates of [5%, 10%, 15%, 20%, 50%, 70%). The results, shown in Fig. 7 demonstrate that our MCCI model maintains high CA, ARR, and low ASR across wide range of poisoning rates. Specifically, the

---

Published as a conference paper at ICLR 2025
Rumn Time Tine
MCC1
BodWets w/ MCCE S6
Badfitts w/ MCC2 MVS
68-
D80
30-
40-
28-
15
MC01
ABL
Polcence ROCK
Pa150oed Rate
Figure 6: Efficiency comparison.
Figure 7: Robustness test with the poisoning rate from 5% to 70% for BadNets on CIFAR-10.
average results are 0.82 CA, 0.01 ASR, and 0.81 ARR for AVG, and 0.82 CA, 0.02 ASR, and 0.81 ARR for SG, indicating that our MCCI is robust across varying poisoning rates.
Efficiency Test. We compare the efficiency of training clean model the poisoned CIFAR-10 dataset with current SOTA methods. Specifically, we record the running time that the trained models achieve clean accuracy higher than 85% on CIFAR-10 dataset. Results in Fig. T show that MCCI requires 24% 215% less training time than baselines, indicating the high efficiency of MCCI.
Resistance to Potential Adaptive Attack. While it was not our initial intention, it is conceivable that adversaries could fully understand our defense method, leading to the development of more sophisticated backdoor attacks designed to bypass our defenses. Specifically, adversaries might aim to modify the frequency spectrum of poisoned images so that they contain only low-frequency compo- nents, similar to those of clean im- ages, while keeping the clean im- ages in the training set unchanged Formally, the objective can be expressed as ming Ei ((Jo(ā;), Me) + E.Pil E(Jo(zs) y.), where fa represents the victim model, D, and Da are the poisoned and clean sets in the training set, respectively. 2;, Yo represent poisoned images, which contain only low-freeg frequencyyccy components and their target labels, while æ;, 3/ represent clean images and their corresponding labels. Specifically,
Table 4: The performance of MCCI against different adap- tive attacks
No Defense
MCCI-AVG
MCCI-SG
Techniques
CA
ASR
CA1
ASR
ARR
CM1
ASR1
ARR1
Averaging
87,20
100.00
84.65
3.32
64.05
85.98
3.22
63.20
Gaussian
87,51
100.00
84.65
5.12
70.06
85.51
3:25
70.98
to maintain stcalth.
Median
87.05
100.00
85.37
1.64
75.86
85.27
2.93
76.41
employ three widely adopted low-pass filter kernels: Averaging Blur, Gaussian Blur, and Median Blur to obtain smoother poisoned images á;- We adopt BadNets the CIFAR-10 10 dataset an example for our discussions. The results shown in Table inddicaee that our model still achieves promising performance after applying these filters, with ASR lower than 0.05 and ARR around 0.70 among all adaptive attacks. This demonstrates our model's 's robustness to adaptive attacks. More details are in Appendix P andd
6 CONCLUSION AND FUTURE WORKS
In this paper, we focus on the mati-backdoor learning problem with a practical objective: Recovering the original, correct predictions for the backdoored images. We first analyze the problem from novel causal view, deriving that backdoor attacks work as confounder, opening a spurious path that builds and strengthens erroneous correlations between the poisoned images and the target label. To mitigate the confounder, we conduct backdoor adjustment by introducing Mind Control through Causal Inference (MCCI), which efficiently models the causal effect from training images with a se- mantic feature recognition network (SFRN) and an Attack Indication Network (AIN). The extensive experiments across various datasets demonstrate that our method can not only avoid misclassifying backdoor images, but also recover the original, correct predictions for the backdoor images. Despite the promising results, several interesting future directions remain: (1) Using the frequency spectrum to represent attacks relies the assumption that backdoor triggers contain high-frequency compo- nents. Are there more general and intuitive methods to represent the attack? Are there any efficient detection algorithms that could be used as AIN? (2) How to design stronger attacks that circumvent our defense mechanism, and (3) Adapting the MCCI to the NLP domain is also interesting. More details can be found in
10

---

Published as a conference paper at ICLR 2025
7 ACKNOWLEDGEMENTS
This work is supported in part through grants from the Amazon- Virginia Tech Initiative for Efficient and Robust Machine Learning, the National Science Foundation under Grant numbers IIS-2316300 CNS-2330215, CNS-2424127, CCF-1918656, CNS-2317193 and IIS-2331315, the U.S. Office of Naval Research Award under Grant Number N00014-24-1-2668, the Cisco Award, the Common- wealth Cyber Initiative Cybersecurity Research Award, and the VT 4-VA Collaborative Research Grant.
Amazon-Virginia
REFERENCES
Eitan Borgnia, Valeriia Cherepanova, Liam Fowl, Amin Ghiasi, Jonas Geiping, Micah Goldblum, Tom Goldstein, and Arjum Gupta. Strong data augmentation sanitizes poisoning and backdoor attacks without an accuracy tradcoff. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3855-3859. IEEE, 2021.
Geoffrey J Burton and Ian R Moorhead. Color and spatial structure in natural scenes. Applied optics, 26(1):157-170, 1987.
Shih-Han Chan, Yinpeng Dong, Jun Zhu, Xiaolu Zhang, and Jun Zhou. Baddet: Backdoor attacks on object detection. European Conference on Computer Vision, pp. 396-4196222 Springer, 2022.
Weixin Chen, Baoyuan Wu, and Haoqian Wang. Effective backdoor defense by exploiting sensitiv- ity of poisoned samples. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (eds.), Advances in Neural Information Processing Systems, 2022. URL https:// openreview net www//fruurrreeee www.rforuuiiiiidee. - Tx2U0Ug
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:/71..05526, 2017.
Siyuan Cheng, Guanhong Tao, Yingqi Liu, Guangyu Shen, Shengwei An, Shiwei Feng, Xiangzhe Xu, Kaiyuan Zhang, Shiqing Ma, and Xiangyu Zhang. Lotus: Evasive and resilient backdoor attacks through sobbpaatitionnng. arXiv preprint ar arXiv:2403.
2024.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hi- erarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248-255 leee, 2009.
Bao Gia Doan, Ehsan Abhasnejad, and Damith C. Ranasinghe. Februus: Input purification defense against trojan attacks on deep neural network systems. In Annual Computer Security Applications Conference, ACSAC '20, pp. 897-912, New York, NY, USA, 2020. Association for Computing Machinery. ISBN 9781450388580.
doi: 10. 10.1145/427228.3427226.
URL https:///oi.
Gxq/10..1155/42210
Khoa Doan, Yingjie Lao, Weijie Zhao, and Ping Li. Lira: Learnable, imperceptible and robust backdoor attacks. In 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 11946-11955 1195,, 2021. doi: 10. 00.11099/CCV44922.2020..
Jianshuo Dong, Han Qiu, Yiming Li, Tianwei Zhang, Yuanjie Li, Zeqi Lai, Chao Zhang, and Shu- Tao Xia. One-bit flip is all you need: When bit-flip attack meets model training. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 4688-4698, 2023.
Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition scale. arXiv preprint arXiv:2010.11929 2020.
Yu Feng, Benteng Ma. Jing Zhang, Shanshan Zhao, Yong Xia, and Dacheng Tao. Fiba: Frequency- injection based backdoor attack in medical image analysis. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pp.
2022.
Kuofeng Gao, Yang Bai, Jindong Gu, Yong Yang, and Shu-Tao Xia. Backdoor defense via adaptively splitting poisoned dataset. In Proceedings of the IEEE/CVF Conference on Computer Vision and Patlern Recognition, pp. 4005-4014, 2023.

---

Published as a conference paper at ICLR 2025
Yansong Gao, Change Xu, Derui Wang. Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Anmual Computer Security Applications Conference, pp. 113-125, 2019.
Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal. Damith C Ranasinghe, and Hyoungshick Kim. Design and evaluation of multi-domain trojan detection method on deep neural networks. IEEE Transactions on Dependable and Secure Computing, 19 (4):2349-2364, 2021.
Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXi::1708.067000 2017.
Zihan Guan, Mengnan Du, and Ninghao Liu. Xgbd: Explanation-guided graph backdoor detection. 26th European Conference on Artificial Intelligence (ECAI), 2023a.
Zihan Guan, Mengxuan Hu, Zhongliang Zhou, Jielu Zhang, Sheng Li, and Ninghao Liu. Badsam: Exploring security vulnerabilities of sam via backdoor attacks. arXiv preprint (xxxi:2300003289 2023b.
Zihan Guan, Mengxuan Hu, Sheng Li, and Anil Vullikanti. Ufid: A unified framework for input- level backdoor detection on diffusion models. arXiv preprint arXiv:2404.01 2024.
Dongliang Guo, Mengxuan Hu, Zihan Guan, Junfeng Guo, Thomas Hartvigsen, and Sheng Li. Backdoor seconds: Unlocking vulnerabilities in large pre-trained models via model editing. arXiv preprint arXiv:2410. 18267, 2024.
Junfeng Guo, Ang Li, and Cong Liu. Aeva: Black-box backdoor detection using adversarial extreme value analysis. In International Conference on Learning Representations, 2021.
Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. SCALE-UP: An
efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. In The Eleventh International Conference Learning Representations, 2023a. URL https: //openreview. net wewprmmmmmooo0ooooooooo
d=ooLFPCOE Krr
Ruocheng Guo, Lu Cheng, Jundong Li, P Richard Hahn, and Huan Liu. A survey of learning causality with data: Problems and methods. ACM Computing Surveys (CSUR), 53(4):1-37, 2020.
Wei Guo, Benedetta Tondi, and Mauro Barni. Universal detection of backdoor attacks via density- based clustering and centroids analysis. IEEE Transactions Information Forensics and Secu- rity, 2023b.
Xingshuo Han, Guowen Xu, Yuan Zhou, Xuchuan Yang, Jiwei Li, and Tianwei Zhang, Physical backdoor attacks to lane detection systems in autonomous driving. In Proceedings of the 30th ACM International Conference on Multimedia, pp. 2957-2968, 2022.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition, 2015.
Sebastian Houben, Johannes Stallkamp, Jan Salmen, Mare Schlipsing, and Christian Igel. Detec- tion of traffic signs in real-world images: The German Traffic Sign Detection Benchmark. In International Joint Conference on Neural Networks, number 1288, 2013.
Mengxuan Hu, Zihan Guan, Junfeng Guo, Zhongliang Zhou, Jielu Zhang, and Sheng Li. BB- Cal: Black-box backdoor detection under the causality lens. Transactions Machine Learn- ing Research, 2024. ISSN 2835-8856. URL htttps://peneeview..rt H2i9PfLWMa Featured Certification.
Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. arXiv preprint arXiv:2202.03425. 2022.
Xijie Huang, Moustafa Alzantot, and Mani Srivastava. Neuroninspect: Detecting backdoors in neural networks via output explanations, 2019. URL attps::/arxiia wttp://..rgg/b////aaeea/ooesse/s
07399
12

---

Published as a conference paper at ICLR 2025
Zonghao Huang, Neil Gong, and Michael K Reiter. Mendata: A framework purify manipulated training data. arXiv preprint arXiv:2312.01281,222 2023.
Pang Wei Koh and Perey Liang. Understanding black-box predictions via influence functions. In International conference machine learning, pp. (1855-194, PMLR, 2017.
Yassin Kortli, Maher Jridi, Ayman Al Falou, and Mohamed Atri Face recognition systems: A survey. Sensors, 20(2):342, 2020.
Alex Krizhevsky. Learning multiple layers of features from tiny images. pp. 32-33, 2009. URL fittps://wet www cs. toronto......................... wwtt://edddddkkeeeeeaeeeeeeea http://///.....//aaaaaaaaaaeeeea
pdE.
Haoheng Lan, Jindong Gu, Philip Torr, and Hengshuang Zhao. Influencer backdoor attack on seman- tic segmentation. In The Twelfth International Conference on Learning Representations, 2024.
URL httptttt/cpeeneeeeeeeeee
hwtp:enntt/.orrreeeeeeemm net/ forum dimnmnnooVVGGgsaa
Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping Linguage-image pre- training for unified rision-language understanding and generation. In International conference on machine learning, pp. 12888 12888-12900. PMLR, 2022a.
Yanzhou Li. Tianlin Li, Kangjic Chen, Jian Zhang, Shangqing Liu, Wenhan Wang, Tianwei Zhang, and Yang Liu. Badedit: Backdooring large language models by model editing. In The Twelfth International Conference Learning Representations, 2024a. URLhttps: httpt::::///pperreeeeee
net./ wow.umidddduuaaaee.a
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learn- ing: Training clean models poisoned data, Advances in Neural Information Processing Sys- tems, 44:14900-14412, 2021a.
Yiming Li, Tongqing Zhai, Yong Jiang. Zhifeng Li, and Shu-Tao Xia. Backdoor attack in the physical world. arXiv preprini arXiv:2104.02:::: 2021b.
Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey, 2022b.
Yiming Li, Mengxi Ya. Yang Bai, Yong Jiang, and Shu-Tao Tao Xia. Backdoorbox: A python toolbox for backdoor learning. arXiv preprint arXiv:2302.01772. 2023.
Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specifie triggers, 2021c.
Ziqiang Li. Hong Sun, Pengfei Xia, Heng Li, Beihao Xia, Yi Wu, and Bin Li. Efficient backdoor attacks for deep neural networks in real-world scenarios. The Twelfth International Confer- on Learning Representations, 2024b. holLhttps://oo http::/::///ppeeevveeeee wtt.:iiwwwweeeeeeeeeeeeee http://wwwweeeeeuumeeemea forumiid= vRyp2dhEOp)
Min Liu, Alberto Sangiovanni- Vincenneiili and Xiangyu Yue. Beating backdoor attack at its own
game. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4620- 4629, 2023a.
Qin Liu, Fei Wang, Chaowei Xiao, and Muhao Chen. From shortcuts to triggers: Backdoor defense with denoised poe. arXiv preprint arXiv:2305. 149/0, 2023b.
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks, 2020. URL
abs///07//000000// 02343
Daniele Lunghi, Alkis Simitsis, Olivier Caclen, and Gianluca Bontempi. Adversarial learning in real-world fraud detection: Challenges and perspectives. In Proceedings of the Second ACM Data Economy Workshop, pp. 27-33, 2023.
Anh Nguyen and Anh Tran. Wamet-impercopibble suping-based backdoor attack. arXiv preprint arXiv:2/02. 10369, 2021.
Minzhou Pan, Yi Zeng, Lingjuan Lyu, Xue Lin, and Ruoxi Jia. {ASSET): Robust backdoor data detection across a multiplicity of deep learning paradigms. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 2725-2743 2023.
13

---

Published as a conference paper at ICLR 2025
Judea Pearl. Causal inference in statistics: An overview. 2009.
Nechar Peri, Neal Gupta, W Ronny Huang, Liam Fowl, Chen Zhu, Soheil Feizi, Tom Goldstein, and John P Dickerson. Deep k-nn defense against clean-label data poisoning attacks. In Computer ECCionEECCV 2020 Workshops: Glasgow, UK, August 23-28, 2020, Proceedings, Part I 16, pp. 55-70. Springer, 2020.
Xiangyu Qi, Jifeng Zhu, Chulin Xie, and Yong Yang. Subnet replacement: Deployment-stage back- door attack against deep neural networks in gray-box setting. arXiv preprint arXiv:2107.07240, 2021.
Xiangyu Qi, Tinghao Xie, Jiachen T Wang, Tong Wu, Saeed Mahloujifar and Prateek Mittal. To- wards proactive {ML] approach for detecting backdoor poison samples. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 1602-1702, 2023.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp- 8748-8763. PMLR, 2021.
Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, and Liang-Chies Chen. Mo- bilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4510-4520, 2018.
Pedro Sandoval-Segura, Vasu Singla, Liam Fowl, Jonas Geiping, Micah Goldblum, David Jacobs, and Tom Goldstein. Poisons that are learned faster are more effective. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 198-205,,00 2022.
Benjamin Schneider, Nils Lukas, and Florian Kerschbaum. Universal backdoor attacks. In The Twelfth International Conference on Learning Representations, 2024. URL https://
openreview net/ wttp:e/eeooommmm1103000000
Ali Shafahi, W. Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks, 2018a.
00792
Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. Advances in neural information processing systems, 31, 2018b.
Lujia Shen, Shouling Ji, Xuhong Zhang, Jinfeng Li, Jing Chen, Jie Shi, Chengfang Fang, Jian- wei Yin, and Ting Wang. Backdoor pre-trained models can transfer to all. arXiv preprint arXiv:2111.00197, 2021.
Yucheng Shi, Mengnan Du, Xuansheng Wu, Zihan Guan, Jin Sun, and Ninghao Liu. Black-box backdoor defense via zero-shot image purification. Advances in Neural Information Processing Systems, 36, 2024.
Karen Simonyan. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409 1556, 2014.
Mian-Xiang Sun, Xiang- Yang Liu, Xi-Peng Qiu, and Xuan-Jing Huang. Paradigm shift in natural language processing. Machine Intelligence Research, 199-)169-1183, 2022.
Mingxing Tan and Quoe V. Le. Efficientnet: Rethinking model scaling for convolutional neural networks, 2020.
Ruixiang Tang, Mengnan Du Ninghao Liu, Fan Yang, and Xia Hu. An embarrassingly simple approach for trojan attack in deep neural networks. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pp. 218 228. 2020.
David Tolhurst, Yoav Tadmor, and Tang Chao. Amplitude spectra of natural images. Ophthalmic and Physiological Optics, 12(2):229-233 1992.
14

---

Published as a conference paper at ICLR 2025
IEEE TRC'22. leee trojan removal competition, 2022.
URL https:/ //ww..
:.ojjan-reovvalcoom
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural informa- tion processing systems, 30, 2017.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 707-723, 2019, doi: 10.1109/SP:219.00033
Tong Wang. Yuan Yao, Feng Xu, Miao Xu, Shengwei An, and Ting Wang. Inspecting prediction confidence for detecting black-box backdoor attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 274 282, 2024.
Baoyuan Wu, Hongrui Chen, Mingda Zhang. Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. Backdoorbench: A comprehensive benchmark of backdoor learning, Advances in Neural Information Processing Systems, 10110004015555 2022.
Zhen Xiang, David Miller, and George Kesidis. Post-training detection of backdoor attacks for two-class and multi-attack scenarios. arXiv preprint arXiv:2201.08474, 2022.
Xiong Xu, Kunzhe Huang, Yiming Li, Zhan Qin, and Kui Ren. Towards reliable and efficient back- door trigger inversion via decoupling benign features. In The Twelfth International Conference on Learning Reprexentations, 2023.
Liuyi Yao, Zhixuan Chu, Sheng Li, Yaliang Li, Jing Gao, and Aidong Zhang. A survey on causal inference. ACM Transactions on Knowledge Discovery from Data (TKDD), 15(5): 2021.
Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y Zhao. Latent backdoor attacks on deep neural networks. In Proceedings of the 2019 ACM SIGSAC conference on computer and communications security, pp. 2041-2055 2019.
Wen Yin, Jian Lou, Pan Zhou, Yulai Xie, Dan Feng. Yuhua Sun, Tailai Zhang, and Lichao Sun. Physical backdoor: Towards temperature-based backdoor attacks in the physical world. arXiv preprint arXiv:2404. 19417, 2024.
Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie- Yan Liu. Indiscriminate poisoning attacks are shortcuts, 2022.
net. forum? d=Be2vrVvvae)
Yi Zeng, Won Park, Z Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks' triggers: A frequency perspective. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 16473-16481, 2021.
Quan Zhang, Yifeng Ding, Yongqiang Tian, Jianmin Guo, Min Yuan, and Yu Jiang. Advdoor: adversarial backdoor attack of deep learning system. In Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 127-138, 2021.
Zaixi Zhang, Qi Liu, Zhicai Wang, Zepu Lu, and Qingyong Hu. Backdoor defense via deconfounded representation learning. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pp. 12228-12238, 2023.
Zixuan Zhu, Rui Wang, Cong Zou, and Lihua Jing. The victim and the beneficiary: Exploiting poisoned model train clean model poisoned data. In Proceedings of the IEÉF/CVF International Conference on Computer Vision, pp. 155-164, 2023.
Zhengxia Zou, Keyan Chen, Zhenwei Shi, Yuhong Guo, and Jieping Ye. Object detection in 20 years: survey, Proceedings of the IEEE, 2023.
15

---

Published as a conference paper at ICLR 2025
6Q t
Train
Correct Label
defecttiv
10looo
Porsoned Dataset
Scientist
Defense
Clean Model
Attacker
Label
Figure 8: Visualization of the Threat Model.
A VISUALIZATION OF THE THREAT MODEL
In this paper, the defender aims to train a clean model from a poisoned dataset with the following two objectives: the clean model is expected to produce high-accuracy predictions for the clean samples, achieving performance as good as the model trained on purely clean dataset, and @ the clean model is expected to produce the original, correct predictions for the backdoored images the trigger is present. We assume that the defender has full control of the training process but lacks prior knowledge about the proportion and the distribution of backdoor samples in the poisoned dataset. Fig. ooffers a visualization of the considered threat model.
B CAUSAL ASSUMPTIONS
Here present the basic definitions, assumptions, and corresponding explanations in causal infer- ence.
Assumption B.1 (Stable Unit Treatment Value Assumption (SUTVA))- There are interactions between units, and each treatment has only one version. Different levels or doses of a treatment are considered different treatments.
SUTVA comprises two conditions: well-defined treatment levels and no interference (Guo et al, 2020). The well-defined treatment condition means that if two different instances i and have the same value for their treatment variable, they receive the same treatment. The no interference condition signifies that the potential outcomes of an instance are independent of the treatments received by other units.
Assumption B.2 (Ignorability). The potential outcome Y(T = t) is independent of the treatment assignment given all covariates. Formally, Y(T - ()_
Ignorability ensures that the outcome is not affected by the assignment treatment when condition on X, making the treatment group and control group comparable after conditioning on X.
Assumption B.3 (Positivity). Every unit should have non-zero probabilities to be assigned in each treatment group. Formally, F(T x|X x) & v E T, Vx E X.
Positivity is the condition that all subgroups of the data with different covariates have a nonzero probability of receiving any treatment value. In short, positivity violation means that we are conditioning on an event with zero probability.
Assumption B.4 (Modularity). Given node x; and its parent nodes pa; in the causal graph. If we intervene on set nodes S by assigning them to constants, then for all i: If & S, then P( po:) remains unchanged. If i E S and x; is the value that X; was set to by the intervention, then (rr,/paa,) = 1; otherwise, P(z pa.) = 0.
The modularity assumption ensures that intervention is local. In other words, intervening variable X changes only the causal mechanism for X and does not alter the causal mechanisms that generate any other variables.
Definition B.5 (Confounders). Confounders are variables that serve as a common cause of the treat- ment / and the outcome Y.
16

---

Published as a conference paper at ICLR 2025
C DEFINITIONS AND PROOFS
C.I. MATH DEVIATION
Proposition C.I. Let be image from poisoned dataset and fo model trained this dataset.
Then, the expected prediction of the model for image = i can be derived according to Fig. 2
P(i
B| = -E Y 7, A]
EA
(5)
P(i)
Proof.
P(uli) = Σ P(y, ali)
Σ P(yli.a)P(o)
(6)
Σ P(yli, a) P(ila) P(a)
P(i)
[P(pl A) P((
P(i)
The first equality is by the definition of marginal distribution. The second and third equalities are by the Bayes' theorem. The fourth equality is by the definition of expectation.
Then we take an expectation over Y, we have:
P(( EAE
P((
E|y = ELE A)
(7)
P(i)
P(i)
The second equality is defined by the expectation. Specifically, Y is a vector of outcomes, where each element in y represents the probability of specific class.
C.2 PROOF OF BACKDOOR ADJUSTMENT
Theorem C.2 (Backdoor Adjustment for Backdoor Attack). Given the satisfaction of the backdooor
criterion by A (Definition and the positivity assumption 3.2 we identify the causal effect of on
B| do(1))
P(Y P(Y(ia))(()) [Y],AA
(8)
Proof.
P(yldo(i))
Σ Plyido((),
Σ P(yli,a)P(aadon
(9)
i(uli, P()(a..
The first equality is by the law of total probability. The second equality follows the modularity assumption 3.3 Since A are all the parents for Y in addition hence P(yldo(f), a) PPllii a)-
The third equality is obtained by the do-calculas, since all the incoming edges for I have been cut off, there is relationship between I and A.
Then we take an expectation over Y, we have:
E = do(
> =() EA A).
(10)
The second equality is by the definition of the expectation. Specifically, Y is vector of outcomes, where each element in represents the probability of a specific class.
17

---

Published as a conference paper at ICLR 2025
D MORE DETAILS ABOUT THE DESIGN AND FUNCTION OF MCCI
Inspired by the theorem 4.4, we concluded that achieving unbiased output requires inputting both the image i and the attack indicator A into the model, for which we use the frequency spectrum as the indicator. While using the image as input is straightforward, as most models already process images, incorporating the additional attack indicator presents a challenge. To address this, we designed an additional network, AIN, to process the attack indicator A while leaving the original victim model (SFRN, e.g. ViT) unchanged. The input to the SFRN remains the image, and the encoded outputs from both networks are concatenated in the final layers for prediction. As shown in E (i, A), making the final prediction requires two pieces of information: the information from both the attack indicator and the image. The AIN processes A and provides the encoded attack information, while the SFRN processes the image and provides the encoded image information. Both are combined before making the final prediction. Thus, the construction of SERN and AIN is primarily inspired by the theoretical framework of E [Y]i, Al.
From an empirical perspective, as shown in Fig. the results further validate our method. The AIN effectively learns how to distinguish between clean and backdoored samples (successfully encodes the attack information). while the SFRN focuses on learning semantic information (successfully encodes the image information). This phenomenon might result in the high prominence of the AIN's predictions, which dominate the reduction of learning loss on poisoned samples, thus minimizing the SFRN's learning of the backdoor. Since AIN extracts the poisoned portion from the model, allowing the SFRN to primarily focus on learning semantic features rather than backdoored patterns. While the input to the SFRN may still contain trigger patterns, these patterns fail to activate the backdoor because the SFRN interprets them as noise rather than meaningful triggers of the attack (effectively cutting off A I), which aligns with the motivation mentioned in Section 3.3.
E MORE DETAILS ABOUT THE FREQUENCY DOMAIN
In essence, the term 'reeueecc'' in image processing refers to the rate at which pixel values change. High-frequency components are typically indicative of edges within an image, where there are abrupt changes in pixel values. Conversely, low-frequency components regions in an image, where changes in pixel values are more gradual. Typically, the frequency spec- trum is widely used to visualize the image in the frequency domain. Previous studies show that low-frequency components dominate the frequency spectrum of the nature image, since colors al- ways change gradually in images and sudden changes in pixel values (c.g., edges in images) are relatively scarce (Zeng et al. 2021 Burton & Moorhead] 1987 Tollurst et al. 1992). However, for backdoored images, the specific triggers make the picture less smooth and al always result high- frequency artifact components, since they either decrease the correlation between neighboring pixels or the intrinsic high- high-frequency artifacts carried by them (Zeng et al., (021). Hence, image frequency can be used as an indicator to indicate the presence of an attack on single image A.
associated with smoother
To convert images into the frequency domain, we apply the Type II 2D Discrete Cosine Transform (DCT), following the approach outlined in (Zegg et al. 2021). Similar to the Discrete Fourier Transform (DFT), the DCT interprets an image by representing it as collection of cosine functions, each defined by distinct magnitudes and frequencies. This technique is widely recognized and used in various image compression algorithms, including JPEG.
F MORE DETAILS ABOUT THE DATASET
The details of the dataset are given in Table
Table 5: Statistical information about the Datasets
Dataset
Image Size
# of Training samples
of Testing Samples
# of Classes
CIFAR-10
32 x 32 x 3
50,000
10,000
10
ImageNet-Subset
224 x 224 x 3
9,469
3,925
10
18

---

Published as a conference paper at ICLR 2025
G MORE DETAILS ABOUT THE ATTACK BASELINES
All attack baselines are implemented with the open-sourced backdoor learning toolbox (Li et al. 2023 Below are the details of the these attack baselines:
BadNet (Gu et al., 2017) employs 3x3 grid-like pixels as the triggers for each of the poisoned samples.
Blend (Chen et al. samples.
2017 uses a hello-kitty-lie image and blends with each the poisoned
WaNet (gguyen & Tran 2021 employs the interpolation method and generates sample-specifer triggers for each the poisoned samples. We use noise ratio as two times of the poisoning ratio, grid size k 4, grid rescale=1, and warping strength 0.5.
ISSBA (i al., 2021c) generates sample-specific trigger patterns through encoder-decoder network. We employ the StegaStampEnnoddr model http:///thhub.cooo/anii////eeeee
and train the model with only secret loss function for epochs, and continue to train the model with total loss function for 18 epochs.
LC (Shatahi et al. 2018b) proposes clean-label attacks, where the poisoned training data appear be correctly labeled according to expert observer by constructing adversarial samples. The parameters choice and implementations follow the well-established benchmarks BackdoorBox (Li
ct al. 2022b).
TUAP Zhang et al. 2021) proposes adding universal adversarial perturbations victim images, causing them to move from their original classification region to a targeted region. We use e 0.031, 0.2, overshoot=0.02, p.samlle==0.01, and infinity norm as the norm function.
We present visualization of the poisoned image generated by different backdoor attacks in Fig. 13
H MORE DETAILS ABOUT THE DEFENSE BASELINES
detailed descriptions of the chosen defense baselines are provided as follows:
ABL (Li et al. 2021a) We follow the official implementation of ABL Specifically, ABL splits anti-backdoor training into three stages: isolation, finetuning, and unlearning. In the isolation stage, the model is trained by the local gradient ascent loss function with few epochs (e.g., 20). Due an interesting observation that models are easier to overfit on the backdoor samples than clean samples, the backdoor samples are isolated from the training dataset by picking samples with the top-k lowest loss values. In the finetuning stage, the model continues to train on the remaining training dataset. In the unlearning stage, the model unlearns the backdoors by using a naive gradient ascent method over the isolated backdoor samples. For the hyperparameters in ABL, we follow all the default hyperparameters in the original implementations. We choose 20 as the tuning epochs, and 20 as the unlearning epochs. The value in the local gradient ascent loss is chosen as 0.5.
CBD (Zhang et al., 2023) We follow the official implementation of CBL Specifically, CBD splits anti-backdoor learning into two stages: First, a backdoored model is intentionally trained to capture the confounding effects (information about backdoor attacks). Then, in the next stage, CBD uses the other clean model to capture the desired causal effects by minimizing the mutual informa- tion with the confounding representations from the backdoored model and employs sample-wise re- re-weighting scheme. We follow all the default hyperparameters in the original implementations. The DisenEstimator network used in the experiments is a WGAN-like network with a dropout rate of 0.2, and the backdoor training epoch is set as 5.
DBD (Huang et al. 2022 We follow the implementation of public code on GitHuu. Specif- ically, DBD splits anti- bati-backdoor learning into three stages: self-supervised learning, supervised
bbttss/github.co//bbbyyyy//
"http::/gituub..om/aaa///// butps//gittbb.cmm//cc.D./.
19

---

Published as a conference paper at ICLR 2025
learning, and semi-supervised learning. In the self-supervised learning stage, DBD trains an image encoder by conducting self-supervised learning over the training dataset (without labels) with an off-the-shelf SimCLR method. Then in the supervised learning stage, DBD freezes the parameters of the learned encoder and trains the remaining fully connected layers via standard training with all (labeled) training samples. In the third stage, further sanitize the backdoors remaining in the model, DBD removes labels of some 'low-credible" samples determined based on the learned model and conducts a semi-supervised fine-tuning of the whole model. For the hyperparameters in DBD, we follow all the default hyperparameters in the original implementations. We choose 10 as the warm-up epochs for remi-supervised learning, and 100 the warm-up epochs for supervuee learning. is chosen as 0.5 by default.
ASD Gao al., 2023) ASD applies loss-guided split and letta-leamingiissprre split to dy- namically maintain and update two data pools. We follow all the default hyperparameters in the original implementations. We use Symmetric Cross Entropy loss as the splitting criterion, with 0 = 1. In the semi-supervised learning stage, we use mix-match loss with X = 15 and train the model with a = 0.75, temperature=0.5, and train iteration=1024.
I MORE DETAILS ABOUT THE RELATED WORK
Backdoor attacks are usually launched through data poisoning (Gu al. 2017 Chen et al.
2017
Nguyen & Tran 2021 [i al. 2021c Liu et al. 2020; Shafahi et al. [2018a] Schneider et al. 2024
Li et al.] 2024b Lan et al.) 2024] Cheng et al.] 2024; Yin et al.) (024)). where malicious attackers inject backdoor samples into the training dataset. When model is trained on this poisoned training dataset, a spurious correlation between the trigger and the target label is learned. In particular, different attack methods construct backdoor samples with different trigger patterns. For example, (Gu al. 2017) adds a grid-style square trigger in the corner of clean images, (Chen et al.] (017) blends clean images with random pixels, (Nguyen & Tran 2021) applies warping operation to the original image, and (Liu et al., 2020) uses natural reflection to construct the backdoor trigger. In addition to data poisoming, there many alternative ways to inject backdoors, such supplying backdoored pre-trained models (Yao et al. 2019); Shen et al. (022)), tampering model weights and structures (Qi et al. 2021: Tang et al.) 2020 Dong al. 2023 Li al. 2024a), and manipulating the training process (Li et al. 2021b
Doan et al. 2021) This paper primarily focuses on backdoor
attacks through data poisoning.
J MORE DETAILS ABOUT THE CHOICE OF CLEAN FREQUENCY SPECTRUM
In this section, we demonstrate the performance under different choices of the clean frequency spec- trum across other attacks in the main text. Specifically, Fig. 9 illustrates the performance across different number of images used for obtaining the average frequency spectrum. The results in- dicate that averaging just 5 images is sufficient for satisfactory defense, and there is no significant improvement when increasing the number of images to average, which aligns with our findings in Section 5.2 The average and standard deviation of performance under different numbers of ran- domly selected images demonstrate that any arbitrary clean image can be used for successful defense, highlighting the low requirements of our method.
shown in another Fig. I0 The high accuracy and low standard deviation
K MORE DETAILS ABOUT THE IMPLEMENTATION
2021a). the poisoning ratio for all backdoor attacks is set to 10% by default. We use an initial learning rate of 0. that is decreased by a factor of 10 at epochs 30, 60, and 90, 100 epochs, a batch size of 1 128, and weight decay of le-4 for training the defense model against all attack baselines. To conduct defenses on CIFAR-I0, we use ResNet- 18 for the SRFN structure. For the AIN structure, we adopt the same architecture in (Zeng al.) 2021). as shown in Table 6 For AVG defense, we use 100 clean images for averaging by default. For SG defense, we randomly select one image from the clean dataset to conduct the defense. The poisoning rate is chosen as 10% by default, but we also evaluate the effectiveness of MCCI under different poisoning rates in Figure
Following prior work in backdoor defenses Li ct al.
20

---

Published as a conference paper at ICLR 2025
WaNet
ISSBA
90
40
88
88
ARR
ARR
A5R
28
20
68
58
50
Average points
Average # points
Figure 9: The mean (line) and standard deviation (band) of the performance under different randomly selected points.
ISSBA
Waleet
TUAP
22-
35-
42
100
A083
ARR
16-
Randon Points
Randon Points
Randon Points
Figure 10: Sensitivity analysis with different quantities of clean images used to calculate the average frequency spectrum on CIFAR- 10 datasets.
Algorithm 1: Mind Control Through Causal Inference (MCCI)
Input: Poisoned Dataset Dirain, Training epoch DCT(.)
for ( [ = 1;t < T){
for ( data batch Diroin in DDtrain) )
x, y Dirain // Extracting images and targets from the data batch
Edet DCT(x) // DCT to
the images SF SF RNN F3FN (x))). // Gradient
JAIN = Vo ((C(g(AINo
calculation for AIN module
JSFRN V8geny ((C(g(AINo) AIN (Idet), SFRNg SPAN (x))). // Gradient
calculation for SFRN module
0++1 0¹ AAA 9) gAIN: g1+1 SFRN OSFRRN 1J 9SFRN Gradient updates
return O AIN SFRN
To conduct defenses the ImageNet subset, we use EfficientNet for the SRFN structure. For the AIN structure, we adopt larger architecture since the input size of ImageNet is larger than that of CIFAR-10, 10, as shown in Table
MORE DETAILS ABOUT THE EVALUATION METRIC
In order to evaluate the effectiveness of our trained clean model, employ three key metrics:
Attack Success Rate (ASR) measures the proportion of poisoned samples that the back-
doored model correctly classifies as the target label. ASR "N",(0, (b,=))) where Y is the predicted label, N,, is the total number of poisoned samples. N,
21

---

Published as a conference paper at ICLR 2025
Table 6: The network architecture of our simple CNN detector for small-input-space. We report the size of each layer Zeng et al. 2021
Input (32 x 32 x 3)
Input (224 x 224 X 3)
Conv2d 3 x 3 (32 x 32 x 32)
Conv2d 11 X 11 (96 x 55 x 55)
Conv2d 3 x 3 (32 x 32 x 32)
Conv2d 5 x 5 (256 x 55 x 55)
Max-Pooling 2 2 (16 x 16 32)
Max- 3 x 3 (256 x 27 x 27)
Conv2d 3 x 3 (16 x 16 x 64)
Conv2d 3 x 3 (384 x 27 x 27)
Conv2d 3 x 3 (16 x 16 x 64)
Conv2d 3 x 3 (381 x 27 27)
Max-Pooling 2 8 64)
Max-Pooling 3 x 3 (384 x 13 x 13)
Conv2d 3 3 (8 x 8 x 128)
Conv2d 3 x 3 (256 x 13 x 13)
Conv2d 3 x 3 (8 x 8 x 128)
Conv2d 3 x 3 (256 x 13 x 13)
Max-Pooling 2 x 2 (4 x 4 x 128)
Max Max-Pooling 3 x 3 (256 x 6 x 6)
Flatten (2048)
Flatten (9216)
Dense (100)
Dense (100)
Clean Accuracy (CA) measures the proportion of clean samples that the backdoor model correctly classifies, CA EN (8.=8e) where N₂ is the total number of clean samples.
N.
Attack Recovery Rate (ARR) measures the proportion of poisoned samples that the back- doored model correctly classifies as the corresponding original correct labels. ARR
(b)=Ve) where ye is the original correct label of the corresponding poisoned sample.
M MORE DETAILS ABOUT THE LARGE PRE-TRAINED MODELS
Attack Details For the experiments on ViT model, the experiment is conducted on the CIFAR- 10 dataset, which contains (Image, Label) tuples. We construct poisoned samples by choosing label "0" as the target label and the 3 x 3 grid-style trigger at the corner of the image. For the experiments on CLIP model, the experiment is conducted on the Fashiio-proddccss datase which contains (Image, Label} tuples. We construct poisoned samples by choosing label "0" as the target label and the 22 x 22 grid-style trigger at the corner of the image. For the experiments on the BLIP model, the experiment is conducted on the IconDomain Dataset, which contains (Image, Question, Answer) triplets. We construct poisoned samples by adding a 38 x 38 grid-style trigger at the corner of the image, and altering the answer to the target output "I do not want to answer". For all the experiments, we successfully injected backdoors into the model by achieving over 99% accuracy in predicting the target outputs.
VIT & CLIP For the VIT and CLIP models, we consider standard classification tasks on CIFAR- 10 and Fashion MNIST datasets, respectively. A pre-trained VIT/CLIP image encoder serves as the backbone model, with additional classification header appended. To implement MCCI, we keep the backbone model as the SFRN module and introduce an additional AIN structure that accepts a frequency spectrum input and outputs attack embedding. This embedding is fused with the semantic embedding generated by the backbone model through simple concatenation. The combined embedding is then passed to the classification head for final predictions. We provide the results in Table 2 As observed, the ASR values drops abruptly when provided with a clean frequency spectrum, and the ARR rate maintains high. This demonstrates that our method performs well even when integrated with large encoder models in the classification task.
We consider the BLIP model for a VQA task on the IconDomain dataset. To deploy MCCI, we augment the original backbone model with an AIN structure that processes frequency spectrum input and generates an attack embedding. This attack embedding is then fused with the semantic embedding produced by the BLIP model through simple concatenation. The combined embedding
BLIP
22

---

Published as a conference paper at ICLR 2025
3CT with (100 A.
42-
BCT with withroopee respect siMt
2085 Prosed
10-
30-
-30
-20
-2
20
20
20
90
(a)
(b)
Figure 11: t-SNE visualization of embeddings after Semantic Feature Recognition Network (SFRN) and the Attack Indication Network (AIN) in terms of clean and poisoned points under the inference stage ((a)-bb) using single clean frequency spectrum ((c)-dd)
Table 7: The performance of the new structure across different attack methods
No Defense
After Defense
Attack Method
CA
ASR
CA
ASR
ARR
BadNet
0.87
1.00
0.85
0.01
0.85
Blend
0.86
0.99
0.84
0.02
0.76
WaNet
0.85
0.95
0.84
0.00
0.81
ISSBA
0.81
0.99
0.77
0.03
0.77
LC
0.87
0.92
0.85
0.00
0.83
TUAP
0.85
0.95
0.84
0.00
0.81
subsequently passed to the text decoder to generate the final answer. We employ negative log- likelihood as the loss function. We also slightly abuse the notation of CA, ASR, and ARR here (see the following paragraph for more details). As observed Table 2 the CA and ARR are close to zero, demonstrating that MCCI could effectively recover the original QA capability when provided with a clean frequency spectrum. Meanwhile, the ASR values are significantly higher, showing that the model's strong effectiveness in refusing backdoor target answers.
Abuse of Notations for BLIP We note slight abuse of notation in use of CA, ASR, and ARR for the experiments with the BLIP model. Recall that the BLIP model is used for the VQA task, where negative log likelihood (NLL) serves the loss evaluation metric. In this context, redefine CA as the NLL over clean inputs and clean targets, ASR as the NLL over backdoor inputs (clean inputs + trigger) and the backdoor target output, and ARR the NLL over backdoor inputs and the original clean targets.
N MORE VISUALIZATION RESULTS
Fig. presents the t-SNE visualization results for the SFRN and AIN module in the inference stage when using a clean DCT randomly selected. We could observe that, similar to Fig. 3 the poisoned embedding of the AIN module shifts to point within the clean image group, while the SFRN module already groups the poisoned images into their original ground-truth categories even before the defense.
O MORE DETAILS ABOUT THE NEW STRUCTURE
Previously observed Fig. 3[a,, even before the defense, SERN correctly clusters poisoned images into their original classes. Inspired by this, designed model structure, shown in Fig. 12
23

---

Published as a conference paper at ICLR 2025
Training
Poisoned
Cieon
Cleon
Inference Stage
Deep
Sample e
Sample
SFRN
Gat
SFRN
Ship
TOM
AIN
New structure. In the training stage, SFRN and AIN are trained to directly predict labels yi and y/, respectively, and then weighted sum, controlled by a, combine them into the final prediction. In the inference stage, only SFRN is used for making predictions.
Figure 12:
Clean
BadNet
Blend
WaNet
ISSBA
LC
TUAP
Figure 13: Visualization of the images poisoned by different baseline attack methods.
where only SFRN used for inference. Specifically, during the training stage, SFRN and AIN each directly predict labels /1 and y/, respectively. Then, weighted sum controlled by combines them the final prediction. During the inference stage, only SFRN predictions are used. This approach counteracts changes in model architecture introduced by the previous model, as AIN is attached to the customized clean model (SFRN) that we intend to train to ensure it is not influenced by the backdoor attack. This new structure allows to train AIN with any customized model as SFRN, and during the inference stage, we can obtain a clean customized model. The effectiveness this approach is validated by test results CIFAR-10, shown in Table 7
P MORE DETAILS ABOUT THE BLURRING METHODS
We employ three widely-adopter low posppass filter kernels: Averaging Blur, Gaussian Blur, and median Blur to obtain smoother poisoned images á.. The visualization can be found in Fig. [5] As shown the figures, the low pass filter can make the whole image smoother. In particular, we found that our model is more robust to the median attack, while it is relatively vulnerable to the averaging attack. This provides a direction for exploring the stronger adaptive attack in terms of our model.
Average Frequency Spectrun of Clean Images
Poisoned
Average Frequency Spectrun of Porsoned Inages
Clean Frequency Spectrun
Poisoned Frequency Spectrun
Figure 14: Visualization of the DCT of the clean images and poisoned images.
24

---

Published as a conference paper at ICLR 2025
Clean
Poisoned
Averaging
Gaussian
Median
Figure 15: Visualization of the images poisoned by blurring methods.
We will further explore this in our future work. However, we argue that the current performance is still satisfactory.
MORE ADAPTIVE ATTACK
To further evaluate the resistance of our method, we follow (Zeng al., 2021 powerful adaptive attack by generating smooth trigger through a bilevel optimization. In particular, adopt strategy by updating the smooth trigger with the perturbation that remains after the low- pass filter for each iteration subject to this trigger is also capable launching successful backdoor attack. The remaining parts of the filter perturbation can be interpreted i' I g. Here, l' is the result of the perturbation after convolving with the low-pass filter in the image domain. Hence the poisoned image can be expressed as i; I; t'. The optimization process can be written as follows:
design a more
Table 8: Model performance
adaptive attack
Techniques
CAT (MCCI-AVG)
ASR (MCCI-AVG)
ARR' (MCCI-AVG)
CA (MCCL-SG)
ASR (MCCLSG)
ARRT (MCCL-G))
Averaging
84.65
3.32
64.05
$5.98
3.22
63.20
Gaussion
$4.65
5.12
70.06
85.51
3.25
70.96
Median
85.27
76.41
Smooth Trigger
84.62
10.00
81.34
10.00
After Finctuning
82.23
6.45
75.02
82.52
9.01
75.93
Del
Del
Dul
min Σ L(x, + *. g. 0p), s.t. O, arg min
L(x,, M6 0) +
Σ L(di (ii
(1I)
This bilevel optimization function's 's objective is to find a smooth pattern t within the range of the low-pass filter that can be adopted backdoor trigger to successfully backdoor the model. The results in the following table (row Smooth Trigger) shows that after using this smooth trigger, this method could be ineffective. However, we find that even if the model can be backdoored, if finetuned it on a few (25) clean images for a few (10 epochs), it would still mitigate the backdoor attack. In particularly, the 25 samples are randomly chose from the training set.
R MORE DETAILS ABOUT THE LIMITATIONS OF OUR WORK
Our model demonstrates robust detection performance across various types of attacks. Specifi- cally, our method not only prevents target label predictions but also uniquely recovers the original, correct labels for backdoored images, as empirically demonstrated by our extensive experiments. However, using the frequency spectrum as the representation of attack may not defend against attacks specifically designed to evade detection by the Attack Indication Network (AIN), such as high-frequency triggers (Zeng et al.) 2021). However, emphasize that the frequency spec- trum serves as a proof of concept for our broader method of Backdoor Adjustment for Backdoor Attacks:(E|Y11 do(i)] EL P(Y ii, P(a)) E (Y)i, A)). This method posits that if more sophisticated input-level backdoor detection methods become available in the future, we could readily adapt approach to incorporate these methods in place of the frequency spectrum
25

---

Published as a conference paper at ICLR 2025
This adaptability highlights promising direction for future research in enhancing the robustness of models against backdoor attacks.
represent A.
Moreover, underlying assumption of our work is that the AIN and SFRN learn their respective information without significant overlap. To achieve this, we adopt a simple yet effective approach: the AIN is intentionally designed with much smaller structure than the SFRN, backdoor patterns are generally simpler and faster to learn than normal patterns, as evidenced by prior work. Conse- quently, we utilize weaker model for AIN 6-layer CNN) compared the SFRN (e.g.. ViT), This reduced capacity limits AIN's ability to learn complex semantic features, enabling it to focus on sim- ple and easily detectable patterns. Additionally, the inputs to the AIN and SFRN differ: The AIN receives the frequency spectrum of the image, while the SFRN processes the original image. Since the original image contains richer semantic features compared to frequency spectrum, this design further encourages the AIN to specialize in detecting trigger patterns while allowing the SFRN to focus on learning more complex semantic representations. However, we recognize that incorporat- ing advanced loss functions to enforce greater independence between the embeddings, coupled with corresponding theoretical guarantees, could further enhance the independence and robustness of the method. This remains an exciting avenue for future work. In addition, further clarifications why SFRN primarily learns semantic features while AIN focuses on backdoor features can be found in Appendix T
MORE EXPERIMENTS
S.1 EXPERIMENTAL. RESULTS WITH ADDITIONAL. DATASETS
To further demonstrate the effectiveness of method, we compare method with the baselines on the popular GTSRB dataset (Houben et al. 2013). The results are shown in Table
ABL
CBD
DBD
ASD
MCCI-AVG
ASR І
ASR
ARR
CA.1
ARR
ARR 1
CA1
ASR 1
BadNets
97.21
0.58
97.13
92.19
0.03
95.40
85.21
0.00
89.23
97.04
0.05
94.35
97.57
0.00
95.23
Blend
81.13
29.96
37.6
91.25
0.3
89.61
88.23
1.00
0.00
97.25
4.65
95.57
97.62
0.00
94.36
WaNet
19.54
0.15
ISSBA
89.78
11.64
69.61
81.13
8.22
69.61
82.23
100
0.00
97.23
3.51
6.41
97.34
0.00
96.45
Table 9: Comparison of MCCI with baselines on the GTSRB dataset.
It is shown that our method consistently shows good performance in recovering original labels for backdoor samples, while also maintaining a good clean accuracy and a low attack success rate.
S.2 EXPERIMENTAL RESULTS WITH DATA AUGMENTATIONS
In the main experiments, we use no data augmentations by default. To further validate the effective- ness of MCCI under the scenarios of data augmentations, add two additional data augmentations (random cropping and random horizontal flipping) in the training process for all the baselines and our methods. The choice of these two data augmentation operations follows that in ASD (Gao al. 2023). The other experimental settings (c.g., learning rate, optimizer. # epoch, etc.) are unchanged. We compare the effectiveness of our method with the baselines on the CIFAR-10 10 dataset. The Ta- ble 10 presents the results.
shown that data augmentations can boost the clean accuracy of our method, while also main- taining its ability to achieve low ASR and consistently high ARR. Therefore, MCCI demonstrates robustness to data augmentations during the training stage, as evidenced by its strong perfor- mance in both augmented and augmenee scenarios.
S.3 COMPARISON WITH MORE DEFENSE BASELINES
For D-ST (Chen et al. 2022 we conduct experiments on the popular benchmark BackdoorBenct The hyperparameters are same as the original paper. For example, ag is set as 0.20, ap is set
26

---

Published as a conference paper at ICLR 2025
MOCL-ANG
CA
ASR. 1
ARR
CA.1
ASR
ARR
CA
ASR
ARR
CA
ASR.
ARR
CA
ASR.
ARR.
CA.
ASR.
ARR:
RaitNete
89.03
1.55
59.63
80.39
1.08
89.25
$3.16
14:25
82.25
92.21
1.25
91.73
92.69
0.86
91.
92.83
1.34
92.55
Bland
87.48
7.15
68.85
89.05
5,63
90.07
$4.25
$0.05
17.20
92.18
7.49
91.42
92:77
1.23
91.03
91.83
1.83
91.68
WaNet
89.57
1.41
87.36
80.21
29.67
74.29
79402
15.20
09.20
90.25
0.25
82.92
91.55
2725
89:04
91.01
5.24
92.56
ISSHA
85.88
5.12
82.00
76.83
91.02
5.76
69.25
68.26
21:25
82.37
0.48
79.23
91.02
3.66
24.23
91.22
1.06
91.00
Table 10: Comparison of MCCI with the baselines on the CIFAR-10 dataset with data augmenta- tions.
0.05. Table I shows the results of D-ST the CIFAR-I0 dataset. It is shown that the D-ST achieves a worse performance on all of the three metrics, compared to our MCCI.
Method CA
ASR
ARR
BadNets
71.58
3.00
72.97
Blend
71.93
89.62
8.20
WaNet
65.60
14.56
62.31
ISSBA
66.83
73.36
18.57
Table 11: Performance of D-ST the CIFAR-10 dataset.
For NAB (Liu et al. 2023a). we have added additional experiments on CIFAR-10, the results can be shown Table 12 However, we respectfully argue that it may not fulfill our threat model. This method proposes adding backdoor i', whose target label is its original label, to the current backdoor 1. In the inference stage, adding this t' to every sample supposedly suppresses backdoored predictions. To achieve this, the method first requires additional backdoor detection tool to isolate backdoored samples and an advanced predictor to identify the original labels of these samples. However, in setting, defenders do not have access to these additional tools. We also contend that assuming the availability of such tools is impractical for defending against backdoors in large pre-traue pre-trained models due the vast amount of training data and the lack of comparably effective prediction models.
It is noticed that NAB achieves higher clean accuracy compared to method. The advantages might be attributed to the additional backdoor detection tool and the advanced predictor introduced by NAB.
NAB
Ours-AVG
CA
ASR
ARR
CA
ASR
ARR
BadNets
87,20
1.42
87.20
86.73
0.50
85.64
Blend
87.33
11.10
84.84
85.83
1.94
80.05
WaNet
87.49
1.43
86.39
81.04
15.54
75.98
Table 12: Comparison of NAB and MCCI.
S.4 EXPERIMENTS ON MORE MODEL STRUCTURES
We have also explored the effectiveness of our model under different model structures. Specifically, we evaluated the performance of our method using VGG16 (Simonyan) 2014] and MobileNet (San-) dler al., 2018) the backbone models for the SFRN. For simple proof-of-concept, we chose BadNets on the CIFAR-10 10 dataset. The results are presented in Table 13
Model
CA
ASR
ARR
83.62
1.26
83.41
VGG-16
87.21
1.20
87.55
Table 13: Comparison of different models based on CA, ASR, and ARR metries.
27

---

Published as a conference paper at ICLR 2025
T CLARIFICATIONS ON WHY SFRN MAINLY LEARNS SEMANTIC FEATURES AND AIN MAINLY LEARNS BACKDOOR FEATURES
We acknowledge that this phenomenon is not directly observed in Figure 2 However, we'd like to clarify that this phenomenon is driven by a mixture of theoretical foundations based on Figure and intentional empirical design.
Theoretical foundations for why we use AIN and SFRN? The design of using AIN and SFRN inspired by the backdoor adjustment theory, which is grounded the causal graph (Figure 2 Specifically, identified the root cause of backdoor predictions as the spurious path. To mit- igate this, we aim to cut off the spurious path from using do-calculus and backdoor adjustment theory. Based on the derivation of the backdoor adjustment, we can obtain unbiased out- come by conditioning on both the input image and the attack indicator. This is expressed as: E| do(i)] E. P(Y a) P(a)) = E, [Y A] The detailed proof and derivation pro- cess can be found in Appendix C. Inspired by this theorem, we concluded that achieving an unbiased requires inputting both the image and the attack indicator A into the model, for which we use the frequency spectrum as the indicator. While using the image as input is straightforward, as most models already process images, incorporating the additional attack indicator presents challenge. To address this, we designed an additional network, AIN, to process the attack indicator A while leaving the original victim model (SFRN, e.g. ViT) unchanged. The input to the SFRN remains the image, and the encoded outputs from both networks are concatenated in the final layers for pre- diction. As shown in E| |Y [ē, A]. making the final prediction requires two encoded information: the encoded information from both the attack indicator and the image. The AIN processes A and provides the encoded attack information, while the SFRN processes the image and provides the encoded image information. Both combined before making the final prediction. Thus, the construction of the SERN and AIN is primarily inspired by the theoretical framework of TE [Y)i, A).
Empirical designs for how to better separate the learning process in AIN and SFRN. To better encourage the AIN to capture backdoor features and suppress the SFRN to learn backdoor features, we adopt the following empirical strategies in the network design. Firstly, the AIN is intentionally designed to have much smaller structure than the SFRN, as backdoor patterns are simpler and quicker to learn than normal patterns, as evidenced by prior work (Liu et al. 2023b Zhang et al. 2023 Yu et al.] 2022; Saandoval- Sandoval-Segura et al. 2022). Thus, 6-layer CNN) compared to the SFRN (c.g., VIT). This weaker structure inherently limits AIN's capacity to learn complex semantic features, allowing it to focus primarily simple and easily detectable patterns. Secondly, AIN receives the frequency spectrum of the image, while SFRN processes the original image. Since the original image contains more semantic features than its frequency spectrum, this design further guides AIN to capture the trigger patterns, while SFRN learns the more complex semantic features.
weaker model for AIN (a
Although we provide both theoretical and empirical evidence, offering an intuitive way to understand this phenomenon, it remains an empirical-bel based understanding, and provable theoretical guarantee has yet to be explored. Therefore, further investigation into this phenomenon would be an important direction for future work.
U IMPACT STATEMENT
Deep neural networks are extensively used across various fields, making it crucial to assess their security in practical applications. This paper introduces a straightforward and effective approach for training a backdoor-free clean model from the poisoned dataset. Our method is designed from a defender's r's standpoint, as outlined in the threat model. Consequently, this research does not raise ethical concerns nor does it pose any additional security risks the DNNs.
28


Reviews:
[{"review_id": "PwnugJKvPA", "reviewer": "Reviewer_z94c", "summary": "The paper proposes a defense against backdoor attacks based on data poisoning.\n\nA standard discriminative classification architecture can be expressed as $x\\mapsto c_w(f_\\theta(x))$, where $f_\\theta$ is a feature extractor, and $c_w$ is a classification head: $c_w(z) = \\operatorname{softmax}(W z + b)$.\n\nThe defense modifies the architecture into $x\\mapsto c_{w'}(f_\\theta(x)\\operatorname{++} a_\\phi(\\operatorname{DCT}(x)))$, where $\\operatorname{++}$ is concatenation, $\\operatorname{DCT}$ is discrete cosine transform, $a_\\phi$ (AIN) is an additional lightweight feature extractor. We can express $c_{w'}(z\\operatorname{++} z_\\text{f}) = \\operatorname{softmax}(W_1 z + W_2 z_\\text{f} + b)$. Training minimizes the standard classification NLL w.r.t. to the parameters $\\theta$, $\\phi$, and $w'=(W_1, W_2, b)$.\n\nIn inference, the defense replaces the input of $a_\\phi$ with a clean input, which causes the model to predict the clean class of the input of $f_\\theta$ even if the input contains a trigger.\n\nSome of the most important assumptions of the defense are (approximately) as follows:\n1. Images with triggers have frequency spectrums distinguishable from clean images (more pronounced high-frequencies).\n2. The inductive biases are such that the modified model will separate clean (semantic) features into the output of $f_\\theta$ (SFRN), and trigger features into the output of $a_\\phi$ (AIN).\n\nIt is intuitive (with some additional less load-bearing assumptions) that, if an intervention only replaces the input of $a_\\phi$ with any clean input, $c_{w'}$ will classify the main input into its clean class.\n\nThe second assumption is confirmed empirically even though the loss function does not enforce it. That is, there exists a solution that $f_\\theta$ learns both clean and trigger features, and $a_\\phi$ learns nothing.\n\n**Causal model**\n\nThe paper claims a correspondence with the causal model $\\{I\\to Y, A\\to I, A\\to Y\\}$, where $I$ is the input, $A$ is the adversary, and $Y$ is the label. Then it claims that the replacement of the input of the corresponds to a causal intervention called backdoor adjustment that removes the edge $A\\to I$, which breaks the confounding path $I\\gets A\\to Y$ and makes the prediction independent of the trigger.", "questions": "(See weaknesses.)\n\nSuggestions:\n- L068: A literature reference could be added for backdoor adjustment theory.\n- Fig. 3: Make poisoned examples more distinguishable and consider clarifying why Fig. 3 (c) and Fig. 3 (a) look the same.\n- Consider mentioning poisoning rates in subscripts of attack names in tables.\n- Include a measurements for a single clean input in figures 4 and 5 for better supporting the claim of sufficiency of a single clean frequency spectrum?\n- Consider quantitatively comparing $b'$ and $b$ (see the definition under Strengths).\n- Do you know what causes the drop in accuracy under the ISSBA attack?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- The method is simple and interesting. In inference, instead of the modified architecture, the standard classification architecture can be used. We can see this by expressing it as $x\\mapsto \\operatorname{softmax}(W_1 f_\\theta(x) + b')$, where $b' = W_2 z_\\text{f} + b$, is computed once from one or more clean inputs (using the notation from my summary).\n- The experimental results are very interesting. Considering that the loss function is standard NLL, the training method is surprisingly successful in producing a model that is \"blind\" to trigger features and classifies inputs with triggers into their original class.\n- The paper proposes evaluation of accuracy of recovery of the original label of poisoned inputs (which is analogous to robust accuracy for adversarial examples). I agree that this makes sense.\n- The paper is well-structured and the quality of the writing is mostly good.", "weaknesses": "**Updates:** \n- minor corrections, \n- updated rating and soundness based on the discussion and paper updates.\n\nThe authors have addressed most of the weaknesses, including the ones that I considered most important.\n\n---\n\n1. Some things could be made more clear:\n\t1. The meaning of \"(associated) attack indicator\" is initially hard to understand and could be clarified earlier\n\t3. It is not clear whether \"otherwise\" in L175 is the negation of the whole antecedent or a part of it.\n\t4. Why does Proposition 3.4 use the expectation instead of a conditional probability distribution like in Eq. (6). Expectation seems to me to be less natural for a random variable that is a class and Eq. (6) is a more \"direct\", stronger statement.\n\t5. Definition 4.1 is not a formal definition.\n\t6. L258: meaning of \"ideal\".\n\t7. Fig. 4 and 5: What are DACC and ADCP?\n2. The paper does not make it clear how and how well the proposed method corresponds to the causal model. I think that there are no theoretical guarantees for the assumption 2 in my summary. It seems like there is nothing preventing SFRN to learn the features that AIN learns. Perhaps a loss function that includes minimization of mutual information between the two branches of the model might make the method more robust.\n3. The paper does not acknowledge the limitations of the assumptions about the backdoor attack sufficiently. The paper includes experiments with attacks that attenuate high frequencies by blurring, but the frequency spectrum remains distinguishable. I strongly suspect that attacks can be designed to have triggers that AIN does not learn. Perhaps the trigger could be more natural looking, blended and randomly positioned, or be the smooth trigger from Zeng et al. (2021), Refool by Liu et al. (2020), or something like a tennis ball [1]. Consider the a priori indistinguishability of triggers from natural features [1]. If such an attack exist and it is acknowledged clearly, I will not consider this to be a great weakness since the method still seems to be applicable to many practical triggers. I suggest devising stronger adaptive attacks.\n4. The experimental evaluation should be improved:\n\t1. Table 1: Clean accuracies on CIFAR-10 are at most ~87%, which is about 7 percentage points lower than the original results in the ASD and DBD papers. Using stronger learning setups and clarifying the differences would make the results more valuable. Why are the standard CIFAR-10 hyperparameters not used, like in the used open-source implementations?\n\t2. All 4 baselines evaluate on 3 datasets, but the paper has only 2 datasets in the comparison.\n\t3. Related work [2] presenting a training-time defense is not cited and compared with. \n5. Source code for reproducing the experiments is not provided.\n\nTo sum up, I find it most important to:\n- improve clarity and relate the theory better with the machine learning algorithm,\n- devise stronger adaptive attacks,\n- express the limitations of the work more clearly,\n- address the drawbacks of the experimental evaluation,\n- provide source code for reproducing the experiments.\n\n[1] Khaddaj et al., Rethinking Backdoor Attacks, https://arxiv.org/abs/2307.10163  \n[2] Liu et al., Beating Backdoor Attack at Its Own Game, https://arxiv.org/abs/2307.15539\n\nThere are some errors and potential errors (which do not affect my rating):\n- L088: \"(4)SOTA\".\n- L247-L249 \"Equations equation\", \"Equation equation\", ...\n- Eq. (4): \"(x))\" is missing.\n- \"methods works\".\n- L460: \"mages\".\n- The descriptions in Appendix F should are not very clear and I think that it is not correct to say that perturbing the images in LC and TUAP is not part of conducting backdoor attacks.\n- L1104-1119: \"(more details can be found in the Appendix)\" is in the Appendix. Check the paragraphs for redundancy.\n\nI find the paper valuable and hope that my concerns can be addressed.\n\nI apologize for any errors on my part.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Rdx4ZaVwOz", "reviewer": "Reviewer_WxD1", "summary": "This paper introduces a novel approach called MCCI, designed to defend against backdoor attacks. This approach employs causal inference techniques to effectively distinguish between clean and poisoned data. The primary objective of this approach is to train a robust model from a poisoned dataset by leveraging both the images and attack indicators, thereby enhancing the model's robustness against various backdoor attack methods. Furthermore, empirical evidence demonstrates that MCCI is highly adaptable for backdoor defense in large pre-trained models while maintaining minimal training overhead. Comprehensive experiments demonstrate the effectiveness of MCCI.", "questions": "Please refer to the weaknesses.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.This paper applies causal reasoning to backdoor defense with theoretical proof.\n2.The proposed approach is an end-to-end method, which is suitable for generalization to large pre-trained models.\n3.This paper designed a more challenging and practical threat model. The defender in the threat model expects the model to predict the original, correct labels for backdoored samples.\n4.This paper conducted comprehensive ablation studies to demonstrate the effectiveness of each component in MCCI.", "weaknesses": "1. This paper needs to demonstrate the effectiveness of the proposed approach on different model structures, such as VGG and MobileNet.\n2. This paper needs to conduct more experiments to defend against advanced backdoor attacks designed from a frequency perspective, such as LF [1].\n\nReference\n[1]Zeng, Yi, et al. Rethinking the backdoor attacks’ triggers: A frequency perspective. ICCV’2021.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "kKlHYOYyyD", "reviewer": "Reviewer_zSrN", "summary": "This paper addresses the anti-backdoor learning task by proposing to cut off the causal connection between backdoor attacks and input data. The authors introduce a method called MCCI, which identifies poisoned samples and rectifies them in the feature space to ensure correct predictions. MCCI transforms inputs into the frequency domain using DCT, enhancing the distinction between poisoned and clean samples. During training, MCCI employs the AIN model as an attack indicator to detect poisoned samples. In the inference stage, the AIN model generates a feature vector, which is concatenated with the SFRN model to recover accurate predictions on the original labels of poisoned samples. Experimental results demonstrate the superior defensive performance of MCCI in anti-backdoor learning.", "questions": "Q-(1): This paper aims to apply the Backdoor Adjustment to cut off the causal connection between the adversary and the input data. However, all proofs end up with the conclusion in Equation (2) that it is crucial to identify poisoned samples (same as the task defined in [1] and its related methods) with an effective attack indicator, which, in a nutshell, is basically a conjunctive implementation of the input data transformation and the training of the identification model AIN. The prior work CBD [2] already addresses the defense with the inspiration of causality. Accordingly, it proposes to disentangle the confounding and causal effects in the hidden space by employing a backdoored model as the reference during the minimization of mutual information. In the context of the clean model training with a backdoor reference, can the author include a detailed comparison section highlighting the key technical differences between CBD and MCCI, especially regarding the training loss formulation?\n\nQ-(2): In Algorithm 1, the training losses used for AIN and SFRN models are not formulated. To make the methodology more clear and reproducible, I suggest the authors provide the mathematical formulations for the two training losses.\n\nQ-(3): In section 3.1, the threat model specifies that the defender lacks prior knowledge of the backdoor in the poisoned dataset. However, the AIN model requires clean images from the validation dataset to generate the (averaged) frequency spectrum, which, in my opinion, conflicts with the threat model. Meanwhile, using clean images from the validation dataset is an inappropriate setting. Most defenses assume the availability of a set of clean images, which are from the training dataset set rather than the validation set.\n\nQ-(4): In Appendix D, the authors briefly discuss the selection of DCT. However, there is no detailed rationale for using DCT to realize the cut-off of the causal connection between the adversary and the input data. I suggest the authors provide an analysis of the functionality difference between DCT and DFT in the defense. In addition, more experiments on using DFT or DCT would be beneficial as well.\n\nQ-(5): An elaboration on the experimental setup is necessary. In particular, the settings below require more details:\n\n- The exact poisoning rate used in the experiments\n- Specific configurations and hyper-settings for each considered attack method\n- Hyperparameter settings for MCCI and baseline defenses\n- Full specification of the ResNet architecture (e.g. ResNet18, ResNet50, etc.), rather merely mentioning ResNet as the baseline\n\nQ-(6): In prior anti-backdoor learning, the baseline model ResNet18 achieves a clean accuracy on the CIFAR10 dataset, mostly above 93%. However, the clean accuracy in Table 1 is significantly lower. I suggest the authors verify their implementation and training procedure for the baseline model and provide a detailed comparison of their training setup to those used in prior work reporting higher accuracies. Based on them, the authors can discuss potential reasons for the discrepancy and its implications for interpreting the results.\n\nQ-(7): The authors pick DCT as the transformation due to the inspiration of the low-frequency (LC) attack [2]. This attack is potentially very effective against MCCI defense, while it is not considered in the evaluation. I suggest the authors to include the LC attack in their main evaluation and discuss potential modifications to MCCI that could improve its robustness to LC attacks if weaknesses are found.\n\nQ-(8): In section 2, the authors mentioned many advanced anti-backdoor learning defenses. However, only some of them (i.e., ABL, DBD, CBD, ASD) are considered in the evaluation. And other methods e.g. D-ST [5] are ignored. Can the authors provide explicit criteria for selecting these baseline defenses included in the evaluation? \n\n \n[1] Pal et al., \"Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistency,\" ICLR 2024.\n\n[2] Zeng et al., \"Rethinking the Backdoor Attacks’ Triggers: A Frequency Perspective,\" ICCV 2021.\n\n[3] Zhang et al., \"Backdoor Defense via Deconfounded Representation Learning,\" CVPR 2023.\n\n[4] Chen et al., \"Effective Backdoor Defense by Exploiting Sensitivity of Poisoned Samples,\" NeurIPS 2022.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- This paper is well-written and easy to follow with the assistance of all proper diagrams.\n- This paper conducts extensive experiments including the consideration of large pre-trained models", "weaknesses": "(1) Due to the high similarity to CBD defense, the intuition and the novelty of employing the causality requires better clarification.\n\n(2) The elaboration about the optimization of AIN in the training is missing.\n\n(3) Using clean images from the validation dataset conflicts with the threat model.\n\n(4) Discuss using other frequency domain transformations, e.g., DFT, is omitted. \n\n(5) Many details of the experimental setup are missing.\n\n(6) Clean accuracy of the baseline is lower than state-of-the-art.\n\n(7) Low Frequency attack is not considered in the evaluation.\n\n(8) Some anti-backdoor learning defenses are mentioned but not considered in the final evaluation.\n\n(9) Many citations (e.g., lines 255, 362–363, 382–383, 389–390) use either \\citep{} or \\citet{} incorrectly.\n\n---\nIn the following, further questions related to the above points are detailed with the notion of \"Q-#\".", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "L2jW7lV2Kv", "reviewer": "Reviewer_NErg", "summary": "The authors begin by analyzing backdoor attacks from the perspective of causal inference. They analyze that backdoor attacks play a role of confounder A and introduce the spurious path from I to Y. The misled backdoor prediction is attributed to the confounding bias brought about by the confounder. Consequently, to form a backdoor defense, they apply a do-calculus on I, thus cutting off the edge between A->I and preventing backdoor attacks. The do-calculus in this case is equivalent to including both the image and the associated attack indicator as the model input. In particular, they leverage an existing backdoor detection approach to serve as the attack indicator. Consequently, they take both the image and the associated attack indicator as input and train an end-to-end clean model.\nFurthermore, in order to find out the original ground-truth labels of the input images, they use counterfactual outcome estimation and fix A=0. The output labels are regarded as the original labels.", "questions": "1. It seems that D-ST introduced in the NeurIPS 2022 paper [1] also shares the same threat model with this paper and the reported performance is superior to ABL and DBD (which are the baselines used in this paper). It would be interesting to know the performance of the proposed method compared to this one.\n\n[1] Chen, W., Wu, B., & Wang, H. (2022). Effective backdoor defense by exploiting sensitivity of poisoned samples. Advances in Neural Information Processing Systems, 35, 9727-9737.", "limitations": "", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. The threat model they consider is more challenging and practical than existing ones because they require the training process be in an end-to-end fashion, instead of containing multiple stages; they require the trained model to output the original ground-truth labels even for poisoned images.\n\n2. The idea of using causal inference to analyze backdoor is really novel and can reveal the essence of backdoor attacks to some extent. In particular, I appreciate the following views:\n\n(1) They regard backdoor attacks as the confounder. Based on this view, the reason why backdoored models predict labels wrongly is that the confounder introduces a spurious path between I and Y.\n\n(2) They regard backdoor defense as the do-calculus on I and derive that the do-calculus is equivalent to letting the model take both the image and the associated attack indicator as input. Based on this view, a end-to-end clean model could be trained by letting both of them as input.\n\n(3) They regard asking models to give original labels as fixing the confounder as 0. Based on this view, by letting the attack indicator be 0, the trained model could output the original labels.", "weaknesses": "See questions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)