Protecting against simultaneous data poisoning attacks
Authors: Neel Alex
Shoaib Ahmed Siddiqui
Amartya Sanyal
David Krueger
Venue: ICLR 2025 Poster (2025)
Keywords: backdoors
backdoor defenses
data poisoning
Primary area: other topics in machine learning (i.e., none of the above)
TL;DR: Multiple backdoor attacks can be effectively installed at the same time, existing defenses fail when that happens, and ours does well.

Abstract: Current backdoor defense methods are evaluated against a single attack at a time. This is unrealistic, as powerful machine learning systems are trained on large datasets scraped from the internet, which may be attacked multiple times by one or more attackers. We demonstrate that multiple backdoors can be simultaneously installed in a single model through parallel data poisoning attacks without substantially degrading clean accuracy. Furthermore, we show that existing backdoor defense methods do not effectively defend against multiple simultaneous attacks. Finally, we leverage insights into the nature of backdoor attacks to develop a new defense, BaDLoss (**Ba**ckdoor **D**etection via **Loss** Dynamics), that is effective in the multi-attack setting. With minimal clean accuracy degradation, BaDLoss attains an average attack success rate in the multi-attack setting of 7.98% in CIFAR-10, 10.29% in GTSRB, and 19.17% in Imagenette, compared to the average of other defenses at 63.44%, 74.83%, and 41.74% respectively. BaDLoss scales to ImageNet-1k, reducing the average attack success rate from 88.57% to 15.61%.

Published as a conference paper at ICLR 2025
PROTECTING AGAINST SIMULTANEOUS DATA POISONING ATTACKS
Neel Alex
Shoaib Ahmed Siddiqui University of Cambridge
University of Cambridge
Amartya Sanyal
David Krueger
Department of Computer Science, University of Copenhagen
Mila, University of Montreal
ABSTRACT
Current backdoor defense methods are evaluated against single attack time. This is unrealistic, as powerful machine learning systems are trained on large datasets scraped from the internet, which may be attacked multiple times by one or more attackers. We demonstrate that multiple backdoors can be simultaneously installed in single model through parallel data poisoning attacks without sub- stantially degrading clean accuracy. Furthermore, we show that existing backdoor defense methods do not effectively defend against multiple simultaneous attacks. Finally, we leverage insights into the nature of backdoor attacks to develop a new defense, BaDLoss (Backdoor Detection via Loss Dynamics), that effective in the multi-attack setting. With minimal clean accuracy degradation, BaDL Loss attains an average attack success rate in the multi-attack setting of 7.98% on CIFAR- 10, 10.29% GTSRB, and 19.17% on Imagenette, compared to the average of other defenses at 63.44%, 74.83%, and 41.74% respectively. BaDLoss scales to ImageNet- Ik, reducing the average attack success rate from 88.57% to 15.61%
INTRODUCTION
Many deep learning applications use large-scale datasets obtained through web scraping with minimal curation. These datasets are vulnerable to attackers, who can easily inject data that alters the behavior of models trained on these datasets. [Carlini al. (2023) demonstrated that poisoning real-world, large-scale datasets is feasible threat due to their distributed nature, as only few image sources need to be subverted to launch a successful attack.
Among the various data poisoning threats, the creation of model backdoors is particularly insidious. By modifying only a small number of examples
dataset, adversaries can make a trained model sensitive highly specific features. The ad adversary can then control the model's outputs by injecting these features into otherwise innocuous images (Gu et al. 2017 Liu et al. 2018b Barni et al. 2019) despite the model appearing benign during regular evaluation.
Almost all prior work only evaluates one backdoor attack at time (Wang et al. 2019 Huang et al. 2023: Zhang et al. 2023). However, real-world poisoned datasets can include multiple backdoors of different types due to the presence multiple independent attackers. Even a single attacker could deploy multiple attacks maximize the odds of one succeeding. This setting is both more realistic and more challenging to defend against, and has seen only limited analysis (Xiang et al. (022).
Therefore, this work evaluates the problem of defending against multiple simultaneous backdoor attacks. We demonstrate that poisoned dataset can introduce multiple backdoors into a target model without substantial clean accuracy degradation. Furthermore, we show that existing defenses fail to effectively defend in this setting. As an additional contribution, we identify common property of poisoned images in datasets: they demonstrate anomalous loss trajectories as a result of using unnatural features for classification. Consequently, we propose a defense called BaDL.oss meant to be robust to multiple simultaneous backdoor attacks. We demonstrate that BaDLoss outperforms other methods in the multi-attack setting, while retaining performance in the single-attack setting.
Equal contribution. Correspondence sma www.am..........mmm...mm.mm....m ac.uk
We open-source our code to uid replication and further study, available on GitHub: bstpp::/ httpst///ithhub.cooo
shoa baheed/ oss/

---

Published as a conference paper at ICLR 2025
Potentillyy poisoned datasct
3
Remove examples marked as poisoned, then
2
Score examples by their distance from clean trajecturies
Track clean example losses...
arplic
training rum
4
Deployed madel rebust dataset patsons!
Mark the farthest oness polsoned
bad
Figure I: BaDLoss Overview. (1) The defender tracks bona fide clean examples in the training set in a short training run. (2) Every example gets an anomaly score based on its average distance from the bona fide clean examples. The farthest examples marked as potential backdoors. (3) The defender retrains the model, excluding any examples identified as anomalous. (4) The defender deploys the robust model.
2 RELATED WORK
Since our work is concerned with backdoor detection and prevention, we briefly discuss both attacks as well as defenses presented the past. Most work on backdoors, including ours, focuses on vision models. Several recent works explore the poisoning of language models (Wan et al. 2023 Hubinger et al.
2024 Xu et al. 2024), which are beyond the scope of this work.
2.1 BACKDOOR ATTACKS
While attacks exist where the adversary provides a secretly backdoored model the victim (Nguyen & Tran 2020 Tan & Shokri 2020), we focus on data poisoning, where the attacker manipulates subset the training data later control the model by injecting a feature of their choice.
Early data poisoning attacks modified both training images and corresponding labels: adding a small trigger (Gu et al. 2017). overlaying an image (Chen et al., (017) or pattern (Liao et al. 2018). followed by altering the label to the target class. The trained model thus associates the injected
feature with the target class. Later attacks invisibly warped images (Nguyen Tran 2021 or overlaid image-specific invisible perturbations (Li et al. (021c)..
Another class of methods, clcan-label attacks, require no alteration to the image's label. Clean-label attacks alter training images with features that the learning algorithm preferentially detects (Turner et al. 2019 Barni et al.) 2019) without changing any image classes. More sophisticated strategies used realistic reflection overlays (Liu et al. (0200) or random-noise patterns (Souri et al. 2022 Zeng et al. 2022bb to implant the backdoor while minimizing the risk of detection.
2.2
BACKDOOR DEFENSES
There exist many defense mechanisms to mitigate backdoor attacks. One approach, known as trigger reverse engineering, assumes that mask with very few pixels triggers the model to misbehave. Neural Cleanse (Wang al. 2019) and variants (Guo et al. 2019 Tao et al. 2022 Dong al.. 2021 Wang
al.) 2020) learn trigger masks from trained model. Other techniques use activation patching (Liu cct al. 2019) or generative modeling (Qiao et al. 2019) to identify the trigger. Subsequently, neurons
associated with the trigger be pruned, other cleaning methods can be applied.
Backdoors can also be detected by examining model activations. Activation Clustering and Spectral Signatures (Tran al. 2018) assumed that clean and backdoored examples appear linearly separa- ble clusters in the model's 's activation space, allowing the defender to remove identified backdoors. Further work examined specific properties of activation space and identified neurons that highly
2

---

Published as a conference paper at ICLR 2025
Dle's
Dal Coss
Oaty
Ose
34
Figure 2: Selected average clean trajectories compared average attack trajectories in CIFAR- 10, single-attact Left right: Simusoid, frequency, narcissus, random- attack. All backdoor attacks exhibit distinct learning dynamics from clean examples. However, these dynamics vary between faster than clean examples, slower than clean examples, or a combination, making the assumptions of previous methods (Li ct al.] 2021a Khaddaj ct al. 2023 Hayase et al. 202T) inappropriate for defending against general poisoning attacks.
influence model behavior on backdoored examples (Zheng et al. 2022 Wu & Wang 2021
Xu et al.
202I). These neurons can then be pruned (Liu et al. (0118)), or repaired via careful finetuning of the 2021b Zeng et al. (022a)).
model (Chen ct al. 2019 Li et al.
As removing backdoors from a trained model is challenging (Goel et al. 2022). many defenses indirectly prevent the backdoor from being learned at all (Hong al.) 2020 Borgnia et al. 2021
Huang et al.] 2022] Wang et al.) (022). One method, Anti-Backdoor Learning (Li et al. 2021a)
identifies poisoned examples by their low loss at given epoch, then maximizes the loss of identified
examples, making the model ignore poisoned features. Subsequently, ABL has been combined with
other more powerful detection techniques (Chen al. [022 Huang et al. 2023).
While BaDLoss resembles ABL in that we use loss as a signal for whether an example is poisoned, ABL a special case of BaDLoss's 's formulation, which permits more general identification schemes. In particular: (i) BaDLoss considers the entire trajectory of losses at every epoch, and (ii) BaDLoss identifies both unusually low-loss as well as high-loss examples as poisoned, representing different training dynamics explicitly explored in past work. We find that this model is more robust, as BaDLos Loss outperforms ABI. in our experiments. We further explore these differences Appendix B
2.3 STUDYING TRAINING DYNAMICS
Differences in training dynamics between different classes of examples have been previously studied (Arpit et al., 2017). 7), and these dynamics have been harnessed for various objectives (Kaplun et al. 2022] Liu et al. 2022; Rabanser et al., (022). BaDLoss draws inspiration from the Metadata Archacology via Probe Dynamics (MAP-D) technique (Siddiqui et al.) (022), which examines
per-example loss trajectories in a training set to identify different types of examples.
MULTIPLE SIMULTANEOUS ATTACKS
To the best of the authors' knowledge, only one prior work (Xiang et al., 2022) evaluates on multiple backdoor attacks simultaneously. This work is limited, and does not examine the practical feasibility of actually deploying multiple simultaneous attacks. Therefore, we will begin with demonstration that this setting is feasible in practice without substantial clean-accuracy degradation.
We compare against a wide variety of classic and ofte-offthheart backdoor attacks and defenses in the literature. Following recent work (Wang et al., 2022; Kiourti et al, 2021 [i et al. 2021b
Do et al.) 2023), we use the standard computer vision datasets: CIFAR- 10 (Krizhevsky) 2009). GTSRB (Houben et al. 2013), and Imagenette (Howard 2019). which capture variance both in image size (32px square for CIFAR-10, versus variable image sizes between 25px and 243px in GTSRB, and between 27px and 4368px in Imagenette)
well class distribution (CIFAR-10 10 and Imagenette have 10 balanced classes, while GTSRB has 43 imbalanced classes). We use CIFAR-10 as development set to tune defenses and apply the tuned methods directly to GTSRB and Imagenette without any further tuning for an accurate assessment of the methods' performance in novel settings.
3.1
THREAT MODEL.
In our threat model, we assume that the attacker(s) have control over a portion of the training dataset (called the poisoning ratio p), in which they can modify both images and their labels. The defender
3

---

Published as a conference paper at ICLR 2025
(a)
(b)
(c)
(d)
(f)
Figure 3: Complete list of attacks considered in this work. (a) checkerboard pattern trigger (Patch) Gu et al.
(2017). (b) single pixel trigger (Single-Pix) al. (201)). (c) random noise blending attack (Blend-R)Chhen
al. )0 (d) dimple pattemn blending altack (Blend-P) (Liao et al. 2018),
(c) sinusoid pattern blending
attack (Sinusoid) (Barni et al. 2019). (f) optimized-lrigger attack (Narcissus) Zeng et al.
2022b and (g)
requency-domain attack (Frequency) (Wan et al. 2021
controls all details of the training process (e.g. algorithms, architecture, hyperparameters, etc.; the attacker has no knowledge of these details) and receives a labeled dataset from an unvalidated external source. This reflects the real-world setting where victim trains model using trusted, internal code, but relies on externally-source validated. Therefore, the defender must deploy training method that minimizes the influence of poisoned examples. These assumptions align with the threat models commonly considered in prior works (Carlini et al. 2023 Chen al. 2018 Li al.
datasets that cannot practically be manually inspected and
2021a Do al. 2023
Additionally, we assume that the defender has access to small set of guaranteed clean examples (250
examples in our case). Many defense methods (Liu al. 2018a; Wang et al. 2019; Gao et al. 2020
Chou et al. 22200] Kiourti et al., 2021 Li et al. 222 Zeng et al. [2022c; Wang et al. [0022] Huang
al. 2022) assume access to bona fide clean examples, as trusted human labor could manually generate or filter subset of the dataset.
Our framework focuses on retraining the model after filtering the detected backdoor examples from the dataset. Subsequently, we evaluate the retrained model's performance on the original task and the success rate of any backdoor attacks. This is consistent with defense evaluations considered in prior works (Li et al. 2021a] Chen et al.] 2018 Wang et al.] 2019). We define clean accuracy as the retrained model's 's performance on the test set. Attack success rate (ASR) is evaluated on the full test set excluding the target class, with the backdoor injected into every example to verify that the attack successfully changes the model's predictions. Full training details are available in Appendix
3.1.1 MULTI-ATTACK ASSUMPTIONS
We assume that multiple attacks not target the same image, i.e. given image has most one trigger. We explore this assumption further in Appendix |F] However, multiple attacks can target the same label, which enables evaluation of certain unusual attack/defense interactions.
3.2 ATTACKS CONSIDERED
The attacks considered in our work are visualized in Figure 3
All attacks perturb the target label addition to the input image, except for the sinusoid and narcissus attacks, which are clean-label attack. In particular, we evaluate against the following attacks:
Patch: Adds a small patch corner of attacked images (Gu et al. 2017).
Single-Pixel: Adds single pixel in the corner of attacked images (Gu al. 2017).
Randdm: Blends random noise pattern with attacked images (Chen et al.
2017
Blend-Patterm: Blends a dimple pattern with attacked images (Liao ct al. 2018).
Sinusoid: Adds sinusoidal stripes attacked images of single class (Barni al.
2019)
Narcissus: Adds learned trigger to very small number of images ZZeng et al.
2022b).
Frequency: Adds peaks attacked image's 's discrete cosine transform (Wang et al.
202
We only evaluated the narcissus attack CIFAR-10, the optimized trigger is challenging to generate on variable-size images. Additionally, we did not evaluate the single-pixel attack on imagenette, very large image sizes make learning a one-pixel trigger challenging.
In the multi-attack setting, all attacks are present at their full poisoning ratio. Full attack specifications available in Appendix 1.I
4

---

Published as a conference paper at ICLR 2025
CIFAR-10
GTSRB
Imagenette
100
100
100
80
80
80
60
60
60-
40
40
20
Claan FCT
20
20
Allect Succemn Rata
Altac Sux ucoo Rote tingle stack))
0
Bave
Norrreed
Rarch
Sinll
Blanc
Sinusoli
Nercstus
Frequancy
Atadled
Rotch
Single
Wends
Frequency
Dase
Mraded
Retch
Blans-n
Figure 4: Evaluation of Multi-attack Setting. Clean accuracy (blue) should he high, attack success rate (red)
should be low. When multiple attacks are simultancously deployed, clean accuracy is barely degraded. The model simultaneously learns all attacks. We plot the attack success that each attack achieves when deployed on its own to show positive and negative interference hetween concurrent attacks.
3.3 EFFICACY OF MULTIPLE ATTACKS
Our results visualized in Figure 4 (numerical results in Table 2). In all datasets, the presence of multiple attacks degrades clean accuracy by less than 1%. Additionally, all attacks are learned simultaneously high degree. Notably, some attacks substantially change in performance between the single-attack and multi-attack setting - for instance, the single-pixel attack achieves over 90% success in GTSRB's multi-attack setting despite failing when deployed as a single attack. This positive interaction between co- co-located attacks has previously been observed by Schneider et al. (2024). This indicates that even developmet research should consider the multi-attack setting, as concurrent attacks can dramatically impact attack's 's viability in realistic threat models.
These results validate the importance of the multi-attack setting. If one or more attackers can manipulate small portions of an internet-scraped dataset to make target model react to various backdoor triggers, all while maintaining high performance on clean data (i.e., without raising suspicion from the defender), this scenario becomes critically important. We must therefore examine whether current defenses can effectively adapt to this new setting.
3.4 DEFENSES CONSIDERED
In this work, we evaluate the following defenses Pl
Neural Cleanse (Wang et al., 2019) Neural Cleanse learns a minimun-magninude mask per class to reclassify every image in the dataset as that class. Masks with bubstantiall-bello--eedle magnitude are considered backdoor triggers.
Activation Clustering (Chen et al. 2018) Activation Clustering determines that backdoor is present if the last layer's 's activations for given class can be clustered into two classes, then removes the smaller cluster for retraining.
Spectral Signatures (Tran et al., 2018) Spectral signatures uses a singular value decomposition of last layer activations per class, and removes the 15% of data with the highest value in the first singular dimension for retraining.
Frequency Analysis (Zeng al. 2022ch Frequency analysis identifies poisoned examples by building a classifier on the discrete cosine transforms of synthetic images with a fixed set of hardcoded backdoor-like features.
Anti-Backdoor Learning (Li et al. 202 Anti-backdoor learning (ABL) marks examples with low loss after few epochs of training as backdoored. The model is then subsequently finetuned using gradient descent on clean examples, and gradient ascent on backdoored examples.
Cognitive Distillation (Huang et al. 2023) Cognitive distillation learns mask for each example that yields the same activations, treating examples with particularly low magnitude as backdoors, then uses ABL's unlearning method.
"We not compare against the Expected Transfcrability detection method proposed by Xiang et al. (2022) despite this method being evaluated on multi-attack setting. as this method only detects presence of backdooz rather than removing the backdnor. Consequently, cannot be evaluated with standard metrics.
5

---

Published as a conference paper at ICLR 2025
CIFAR-10
GTSRB
Imseenelle
NeculChaase
Nocial
Adl Clateiy
Seuna Cauree
Spactru Sig Sigestures
Prguadicy Asslyss
Speciul Sig dtune
Spectill Siganuns
Preguercy Aealyda
4.0 Unareyy
9
Figure 5: Defense Performance in the Multi-attack Setting. All evaluated defenses exhibit failures across datasets when evaluated in the multi-attack setting. CBD (Zhang et al.] (0233) can achieve low attack success rates, but causes extreme clean accuracy degradation. On CIFAR-10, Spectral Signatures provides the best overall defense without substantial clean accuracy degradation, but still underperforms LaDLoss (see Figure G In Imagenette, attacks weaker yet every defense still lets one or more attacks succeed.
Causal Backdoor Defense (Zhang al., 2023) Causality-inspired backdoor defense pretrains weak classifier that is expected to learn backdoors more than clean images, then trains a strong classifier be causally decoupled from the weak one, removing the backdoor's influence.
Poisoned Sample Sensitivity (Chen al. 2022) Poisoned sample sensitivity uses the sensitivity towards transformations to identify poisoned samples, then either filters those samples out, or uses an unlearning procedure similar ABL.
Full defense specifications are available in Appendix I.2
3.5 EXISTING DEFENSE PERFORMANCE
Except for the causal backdoor defense, which shows substantial clean accuracy degradation, all defenses in the multi-attack setting fail against variety of attacks. Even the best performing defenses, Spectral Signatures CIFAR-10 and Cognitive Distillation on Imagenette, have three attacks completely bypass the defense.
Our results visualized in Figure 5 (numerical results in Table 2
Likely due to making assumptions incompatible with the complexity of the multi-attack setting, current backdoor defenses do not effectively defend against these standard attacks when deployed simultaneously. To make progress in the multi-attack setting, new defenses must be developed.
DEVELOPING A NEW DEFENSE
To defend in the multi-attad setting, we first note that many assumptions made by existing defenses, while accurate in single-attack setting, no longer hold in the presence of multiple simultancous attacks. For instance, neural cleanse assumes that the attacked class will have an anomalously low mask magnitude relative the other classes, but if sufficiently many classes attacked, the median mask magnitude may be low enough such that no classes look anomalous. For further analysis of why existing defenses might be failing in the multi-attack setting, refer Appendix E
Several methods exist that analyze the loss of training examples to determine whether such examples installing backdoor.
Learning (Li et al. 2021a) assumes that poisoned examples
6

---

Published as a conference paper at ICLR 2025
achieve lower loss more quickly than normal examples, and Khaddaj et al. (2023) similarly claim that backdoor images have the strongest features and are thus learned more easily. Other works (Hayase) anomalous examples which conflict with natural features, and are therefore harder to learn. These works suggest that because backdoor images contain unnatural features incorrect labels, these examples demonstrate unusual training dynamics.
et al. 202T) treat backdoors
These findings demonstrate that backdoors can be detected by analyzing the training dynamics of individual examples, regardless of whether they exhibit faster or slower learning compared clean data. The pattern may even be more complex; for instance, on CIFAR-10, the Narcissus attack examples have higher loss until epoch 10 and lower loss thereafter (see Figure 2 As defender cannot know which backdoor methods will be deployed, a defense must be effective against backdoors that induce any unusual training dynamies.
4.1 BADLosS: BACKDOOR DETECTION VIA LOsS DYNAMICS
We introduce BaDLoss (Backdoor Detection via Loss Dynamics), method of identifying poisoned examples based on their anomalous training dynamics. BaDL is visualized in Figure Inspired by MAP-D (Siddiqui et al. 2022) and unlike previous defense methods such as Anti-Backdee Learning, BaDLoss considers the entire trajectory of losses achieved different examples, enabling more precise detection of backdoored examples (see Appendix [ for further discussion). It leverages bona fide clean trajectories to define anomaly score for each training example.
BaDLoss leverages a dataset De comprising a small number (e.g. 250) of bona fide clean examples. These examples included in the training DD and the loss E of every training example (ar2, y/i is tracked at each epoch as the model is partially trained creating loss trajectories, s;
= (e(xs, Mo: yr;01) 01), E( ys: 02), ..., ((1. ys: 0:) (I4, E (D)
(I)
where s; represents the loss trajectory for example 7th example: (1); and 0g represents the weights of the network at iteration f. Treating each example's loss trajectory as a vector, we calculate a score for each example as the log of the mean lg distance between the target trajectory and the nearest bona fide clean examples.
p(b 5:)
Σ
In (lls) gll22 +)
RE NN....
where p(b s.) represents the probability of the example being backdoored given the full training trajectory, and De represents the set of clean bona fide examples. e = 1e-8 for stability if the distance is very small. We identify fixed percentage of examples those with the highest average distance from the clean trajectories- as backdoored. We then retrain the model on the original dataset with the identified backdoored examples removed.
Several hyper-parameters must be selected: Telean the number of bona fide clean training examples; k, the number of clean nearest neighbors examples to score with; Tepoch. the fraction of clean-training epochs to use for detection; and Treject, the fraction of samples to reject.
RESULTS
5.1 MULTI-ATTACK RESULT
Throughout our experiments, set (Riteons k Tepoch,Trejeel) Treject) (250, 50, 0.3, 0.4): we always track 250 bona fide clean examples and use the 50 nearest ones to calculate an example's anomaly score. We pretrain for 30% of the epochs that used train the final model (so, 30 epochs in CIFAR-10 and GTSRB, which are trained for 100 epochs, and 75 epochs on Imagenette, which trained for 250 epochs), this is sufficient for backdoored examples produce different loss trajectories without becoming too computationally expensive.
"We used the same training method here as when the final model is trained, but Qi ct al. 2023 note that the defender may control their pre-training preeeuuee more generally. Natural options would he to increase the batch size and adjust the model architecture in pre-training to produce more stable and scparable loss trajectories.
'In multi-attack setting, the average training loss often undergoes large spikes, visible Figure 9 mitigate this, we do not track any epoch whose average training loss is higher than twice the moving average of the last three (non-rejected) epachs.
7

---

Published as a conference paper at ICLR 2025
BaDLoss Performance: CIFAR-10
BaDLoss Performance: GTSRB
BaDLoss Performance: Imagenette
100
100
100
80
60
60
60
40
40
20
Clean Accunayy
Attokk success kata
20
20-
Oriinal
0
Nowe
Attachec
Ceancd
Poxch
Single Fix
Shusold
Nercttsuu
Requancy
Average ASR.
Atbokec
Ceanes
Patch
Bend--
Blend-
Smovid
Requunnc
Aoeeage ASR.
Ceaned
Patch
Band-a
Blens.
Smosold
Reequanc
Average ASC
Single
Figure 6: Evaluation of BaDLoss in the Multi-attack setting. BaDLoss achieves very low attack success rate across all except one attack on CIFAR- 10 and GTSRB, and except two attacks on Imagenette. In all cases, it substantially lowers the average attack success rate. This figure should be considered in conjunction with Figure which highlights the failures of existing defenses.
The rejection threshold Preject most impacts the trade-off between improving defense quality and degrading clean performance. We visualize the impact of this threshold on clean accuracy as well as the average Attack Success Rate (ASR) in Figure [ The figure highlights that Prejent = 0.4 is an ideal point to minimize clean accuracy degradation while preventing most attacks from succeeding. Therefore, we always reject the 40% of training examples with the greatest distance to the clean trajectories in all subsequent experiments. Further ablation results on the filtering threshold are presented in Appendix [.I] including its performance on other datasets.
The overall fraction of the dataset which is poisoned is approximately 8% on CIFAR-10, 10% on GTSRB, and 9% on Imagenette. The difference is due to re-
100
accuracy / ASR (%)
80
quired adjustment of the attack strength to ensure that
60
the attacks are correctly learned for each dataset.
40
BaDLoss' defense results are visualized in Figure 6 (numerical results available in Table BaDLoss the first defense to credibly defend in the multi-attack setting, substantially reducing ASR on every attack considered. In all three datasets, BaDLoss defends against nearly every attack with only minor clean accuracy degradation.
clean acc
20
avg. ASR
0.1
0.2 0.3
0.4 0.5 0.6 0.7
filtering threshold Freject
Figure 7: Impact of filtering threshold Preject on the clean accuracy as well as the avg. ASR on CIFAR-10, 10, multi-attack setting.
5.2 IMAGENET EVALUATION
BaDLoss Performance: ImageNet
To determine whether BaDLoss effectively scales to large and complex datasets, we evaluate BaDLoss' s performance on ImageNet- 1 (Deng et al.] 2009). The dataset is comprised of 1.2 million images and 1,000 classes, exceeding our main datasets both in terms of size and complexity. For computational con- venience, we use Nepochs = 50 and use ResNet-18 architecture instead of ResNet-50. We use optimized settings from CIFAR-10 10 and the same attack set as Imagenette. The overall poisoning ratio is 0.28% on ImageNet substantially lower than other datasets. The results are presented in Figure g First, we ob- serve that multiple simultaneous attacks are effec- tively learned on ImageNet despite their much lower poisoning ratios, demonstrating again that the multi- attack setting represents realistic threat model. Sec- ond, we observe that BaDLoss effectively scales to this larger setting by maintaining adequate clean ac- curacy while reducing ASR on every single attack type. Experimental details are available in Section H
100
Clean Acc Arcyrray
Atteck Success Rate
Original AsH
80
8
60
10
40
20
Base
Attacked
Cleaned
Patch
Blend-it
Blend-P
Sinuseld
Frequency
Avg. ASR
Figure 8: Multiple attacks are effectively learned in ImageNet- Ik without substantial clcan-accuracy degradation, and BaDL oss effectively defends against those attacks. Numerical results Table
8

---

Published as a conference paper at ICLR 2025
Accunac
Attack Sucoos Rais
N/ CAL
Singl-
92.40
92.89
$7.57
92.67
91.89
92.93
67.12
99.99
99.35
75.60
Netral Cleasse
02.29
02.21
92.64
12.5
M1.45
91
67.12
59.99
2.04
39.80
Activation Chastring
90.55
91.96
92.92
92.76
02.85
92.07
92.21
92.19
$6.89
$4.57
99.91
99.57
30.86
91.03
0.63
66.25
CIARR
Spectrd Signatures
Progarecy Andlyss
91.64
15
90.58
32:53
91.50
06-56
91.70
13.89
90.68
21.14
46.2
90.72
90.98
93.14
91.13
15.34
58.62
14 76
13.00
1.32
1.52
1.85
5.20
1.87
23.46
11.88
53.89
3.56
0.96
S.p
21.59
9.90
Aull Bacidooe Leaning
50.33
90.95
91.83
91.29
91.35
90.73
91.49
91.14
92.3 22.35
57.91
99.90
09.57
39.00
81.59
98.08
81.34
Ooprinn Dicillaioo
01.48
01.47
91.35
60.33
91.31
91.01
40.
64.90
Delesse
77.02
76.14
70.20
2.92
14.21
7.64
Petsonadl Sumple Sansliddy
92.23
61.76
HolDluoss
34,77
34.91
No Defence
97.02
95.50
97.93
98.22
97.89
98.54
97.63
90.37
1.00
98,50
99.56
56.35
99.57
74,31
Neard Classe
94.83
65.80
96.82
07.82
07.89
05.21
$6.00
0.36
1.00
0.00
0,00
56.95
9.72
Activatinn Chypertig
97.15
95:13
98.17
97.09
98.16
91:51
97.39
6.36
101
97.26
120009
59.93
U8.63
59.50
G/5R0
Spectaa Signatures
07-47
07-70
0.55
100.00
Prequency Analysa
100000
caminn
Disiilation
97.51
67.47
74.71
0.53
90.55
45.45
Canel Backikee Delizne:
43.64
31.27
93.67
33.34
7.35
30.65
17.50 96
13.55
41.71
0.96
1.15
IL14
10.09
12.34
Pologned Sumple Seasitivity
97.14
87.47
95.87
98.12
96.10
97.35
95.43
91.24
10.30
97.01
130,00
55.48
99.71
75.62
Bubblune
94.34
19
94.82
93.94
93.00
04.31
94.65
0.31
IUH
67.26
$4.34
60.70
$3.63
$2.70
Deferno:
90:01
91:16
91.34
91.44
71.25
72.65
94.90
79.94
51.83
Cleasse
91.57
91.67
91.11
55.70
66.31
$1.15
70.65
Imsagueete
Spectral Signatures
90.22
91.11
99.81
50.29
54.79
45.12
45.00
Fresuaecy Andlysis
90.01
91.13
91.16
91.34
91.46
91.02
71.25
72.65
94.30
79.55
51.53
74.04
Amti Backdowe Leaming
89.89
90:29
91.00
10.50
M0244
981.7
29114
58.50
94.56
83.30
06.0M
70,97
Cugnlive Disiilation
$8.65
89.94
$9.89
00.22
89.76
39.00
53.44
$.79
85.05
61.51
70.73
$7.904
Clusa Backdoooe Delesse
70.75
67.03
68.38
63.46
69.76
67.68
3.91
20.04
5.73
48.89
5.33
16.50
Peteored Sumpple Senvinvity
18.01
90.55
81.56
44.70
71.46
BuDloos
56.11
35.00
96.39
96.50
56.21
29.15
3.56
1,02
Table 1: Single-attack setting: Clean accuracy and attack success rate after retraining on CIFAR-10
and GTSRB. Bsss is highly effective removing detected backdoor instances, usually minimizing the backdoor's efficacy without significant degradation model utility.
5.3 SINGLE-ATTACK RESULTS
Other methods have primarily been evaluated in a single-attack setting. In order to adequately compare BaDLoss against other methods, we also evaluate its performance in the single-attack setting. Our results are visualized in Table BaDLoss presents a very strong defense. On CIFAR-IO. BaDLoss attains near-zero attack sensitivity, on GTSRB, it performs comparably well to other defense methods, and on Imagenette, BaDLoss achieves the best overall defense while remaining competitive in clean accuracy. While the high removal fraction Treject = 0.4 is more suitable to the multi-attace setting with its higher overall poisoning ratio, here it degrades clean accuracy relative to other methods (though a practitioner could tune it according to the expected poisoning ratio). Nonetheless, these results show that BaDLoss is effective in the single-attack setting well.
6 DISCUSSION
6.1 PRACTICAL USE
BaDLoss causes clean accuracy degradation due to the large removal fraction needed to reduce susceptibility against all attacks. In practice, a defender can set a target clean accuracy and adjust example removal to minimize the attack-suscpttibiliyy of the model while maintaining acceptable performance. However, given that multiple simultaneous attacks appear viable all studied domains, if backdoor attacks are considered potential threat, we believe that defense robust against multiple simultancous attacks should be used.
BaDLoss's identification method could also be used with alternate backdoor removal methods, such as Anti-Ba Backdoor Learnin''s 's gradient ascent (Li et al. (021a). or other unlearning methods that rely on an identification module (Chen et al.) 2222: Huang 2022). Future work could compare cleansing methods effectiveness given fixed identification rates, which could lead to stronger defenses by combining the best detection and cleansing methods.
6.2 DIFFERENCES BETWEEN DATASETS
Empirically, the multi-attack setting appears work effectively in all datasets we tested, allowing multiple attacks to be learned with minimal clcan-accuracy degradation. Across datasets, BaDLoss appears robust to variance in number of classes and image complexity. However, BaDLoss struggles

---

Published as a conference paper at ICLR 2025
more smaller datasets for instance, Imagenette has only 99,500 train examples, is the only dataset where BaDLoss fails to defend against the Patch attack. We hypothesize that this is due to the smaller dataset size inducing more variance in the loss trajectories. Consequently, BaDLoss may not be suitable for low-data domains.
6.3 IMPACT OF THE POISONING RATIO
Poisoning ratios significantly impact BaDLoss's effectiveness by altering training dynamics. For example, CIFAR-I0's random blending attack becomes easier to learn at higher ratios despite being harder at lower ones. Since BaDLoss detects deviations from bona fide example dynamics, it can handle both high poisoning ratios, which are learned unusually quickly and low poisoning ratios, which are learned unusually slowly. However, BaDLoss may struggle if poisoning ratios are chosen to match backdoored examples' training dynamics to those of the clean examples.
6.4 LIMITATIONS
We highlight some of the major limitations of our work.
Training instabilities. In the presence of multiple backdoor attacks, we observe instabilities in the loss trajectories in the form of abrupt loss spikes. While these instabilities settle eventually, they add significant noise to our distance computation. Despite filtering noisy epochs, this instability still harms BaDLoss's 's performance. The defender has considerable leeway to optimize the pretraining process for backdoor detection (Qi et al. 2023), and maximizing loss stability could significantly improve the performance of BaDLoss.
Impact of example removal. Our defense methodology removes examples from the training set. This a common practice in past work, but removal can have outsized negative impacts on the long-tail
of minority classes (Feldman & Zhang 2020; Liu et al. 2021 Sanyal al. (002). Specifically,
BaDLoss may more likely mark minority- class data as anomalous, as the reduced amount of training
data may render trajectories unstable. Consequently, BaDLoss may exacerbate existing weaknesses on minority-class data, Depending on the circumstances, this weakness may be partially ameliorated by choosing bona fide clean examples such that there least fixed number from each class. For further analysis, see Appendix
Generally, our assumption that attacks demonstrate anomalous loss dynamics is more robust than other models of attacks implied by other defenses (see Appendix [E). However, an informed attacker can still exploit the defense mechanism, e.g. by carefully selecting injected features, poisoning ratios, and other attack parameters to ensure that their attack produces training dynamics that closely match the bona fide clean training examples. For instance, trained attack images (such the sleeper agent attack (Souri et al., 2022)) could add a regularization term in training to ensure that their losses mimic clean examples on proxy model. However, this adaptive attack would require multiple rounds of a complex training procedure, potentially making it infeasible for practical purposes. More details regarding adaptive attacks are presented in Appendix
Counter-attacks.
7 CONCLUSION
Our work makes two central contributions. First, we examine the problem of defending against multiple simultaneous data poisoning attacks. We argue this more realistic threat model for machine learning systems trained on large datasets comprised of internet data, and show that existing defenses fail in this setting. Our second contribution BaDLoss, a novel backdoor detection method that successfully defends against multiple simultaneous poisoning attacks with minimal degradation individual training
in clean accuracy. BaDLoss works by: (i) comparing the loss trajectories examples to those of small set of known-to-be-clean examples, (ii) filtering out those examples with anomalous trajectories, and (iii) retraining from scratch on the filtered training set. Our experiments demonstrate the effectiiennes of BaDLoss in both single-attack and multi-attaci settings. We hope our work will inspire further research on simultancous data poisoning attacks where we believe BaDLoss provides strong baseline for comparison.
10

---

Published as a conference paper at ICLR 2025
8 ACKNOWLEDGMENTS
We would like to thank Mantas Mazicka and Nicolas Papernot for their helpful guidance and feedback, as well anonymous reviewers who provided abundant useful feedback and references.
This research was supported by the Center for Al Safety Compute Cluster. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the sponsors.
CONTRIBUTION STATEMENT
N.A. and S.S. proposed the initial idea for the BaDLoss defense. S.S. and D.K. proposed the initial idea for the multi-atie multi-attack setting. S.S. performed initial experiments demonstrating BaDLoss's viability. All authors brainstormed ways to improve the BaDLoss method. N.A. and S.S. implemented the attacks. N.A. implemented all defenses. N.A. tuned experimental parameters and performed all experiments in the final manuscript. N.A. created all figures in the final manuscript, except S.S. created Figure 7. N.A. wrote all text in the final manuscript, except S.S. wrote the first paragraph of Section 1, Section 2.3, and the middle paragraphs of Section 4.1, and D.K. wrote the final paragraph of Section 2.2. S.S. performed several comprehensive editing rounds to the manuscript, though all authors contributed edits. D.K. supervised the project.
REFERENCES
Jason Ansel, Edward Yang, Horace He, Natalia Gimelshein, Animesh Jain, Michael Voznesensky,
Bin Bao, Peter Bell, David Berard, Evgeni Burovski, Geeta Chauhan, Anjali Chourdia, Will Constable, Alban Desmaison, Zachary De Vito, Elias Ellison, Will Feng, Jiong Gong, Michael Gschwind, Brian Hirsh, Sherlock Huang, Kshiteej Kalambarkar, Laurent Kirsch, Michael Lazos, Mario Lezcano, Yanbo Liang, Jason Liang, Yinghai Lu, CK Luk, Bert Maher, Yunjie Pan, Christian Puhrsch, Matthias Reso, Mark Saroufim, Marcos Yukio Siraichi, Helen Suk, Michael Suo, Phil Tillet, Eikan Wang, Xiaodong Wang, William Wen, Shunting Zhang. Xu Zhao, Keren Zhou, Richard Zou, Ajit Mathews, Gregory Chanan, Peng Wu, and Soumith Chintala. PyTorch 2: Faster Machine Learning Through Dynamic Python Bytecode Transformation and Graph Compilation. In 29th ACM International Conference Architectural Support for Programming Languages and Operating Systems, Volume (ASPLOS 24). ACM, April 2024. doi: 10. 00.11455362005533443300 2d
URL https: https::/pyttorchh.. org/ http://ppoorcc...rr////s/s/////s
Devansh Arpit, Stanislaw Jastrzębski, Nicolas Ballas, David Krueger, Emmanuel Bengio, Maxinder S. Kanwal, Tegan Maharaj, Asja Fischer, Aaron Courville, Yoshua Bengio, and Simon Lacoste-Julien.
A closer look at memorization in deep networks, 2017. URL
1706.0533 05394]
Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in enns by training set corruption without label poisoning, 2019.
Eitan Borgnia, Jonas Geiping, Valeriia Cherepanova, Liam Fowl, Arjun Gupta, Amin Ghiasi, Furong Huang. Micah Goldblum, and Tom Goldstein. Dp-instahide: Provably defusing poisoning and backdoor attacks with differentially private data augmentations, 2021.
Nicholas Carlini, Matthew Jagielski, Christopher A Choquette-Choo Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tramer. Poisoning web-scale training datasets is practical. arXiv preprint 1:Xxi:2302..0142 2023.
Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering, 2018.
Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Deepinspect: A black-box trojan detection and mitigation framework for deep neural networks. In Proceedings of the Twenty-Eige Eightt International Joint Conference Artificial Intelligence, IJCAI-19, pp. 4658 4664. International Joint Conferences on Artificial Intelligence Organization, 7 2019. doi: 00.24963/jccai.2119/// URL httpt::///oo... orgg 2...0..4446634 0201
11

---

Published as a conference paper at ICLR 2025
Weixin Chen, Baoyuan Wu, and Haoqian Wang- Effective backdoor defense by ploiting sensitivity of poisoned samples. In S. Koyejo, S. Mohamed, A. Agar- wal, D. Belgrave, K. Cho, and A. Oh (eds.), Advances in Neural Information Pro- cessing Systems, volume 35, pp. 9727-9737. Curran Associates, Inc., 2022. URL httpss://proceedingss neu. ps wwwpaper_rep.eeepe 1tsppr/es11s//ppppr////111111111 1F9bf777od33eDbe3333eeeee222
Confeeenconfreccee.cc paf
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning, 2017.
Edward Chou, Florian Tramèr, and Giancarlo Pellegrino. Sentinet: Detecting localized universal attacks against deep learning systems, 2020.
J. Deng, W. Dong, R. Socher, L.J. Li, K. Li, and L. Fei-Fei. ImageNet: A Large-Scale Hierarchical Image Database. In CVPRO9, 2009.
Kien Do, Haripriya Harikumar, Hung Le, Dung Nguyen, Truyen Tran, Santu Rana, Dang Nguyen, Willy Susilo, and Svetha Venkatesh. Towards effective and robust neural trojan defenses via input filtering, 2023.
Yinpeng Dong, Xiao Yang, Zhijie Deng, Tianyu Pang. Zihao Xiao, Hang Su, and Jun Zhu. Black-box detection of backdoor attacks with limited information and data, 2021.
Vitaly Feldman and Chiyuan Zhang. What neural networks memorize and why: Discovering the long tail via influence estimation. Advances in Neural Information Processing Systems, 33:2881-2891. 2020.
Yansong Gao, Chang Xu, Derui Wang, Shiping Chen, Damith C. Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks, 2020.
Shashwat Goel, Ameya Prabhu, Amartya Sanyal, Ser-Nam Lim, Philip Torr, and Ponnurangam Kumaraguru. Towards adversarial evaluations for inexact machine unlearning. arxiv:2201.0666 266,00640, 2022.
Tianyu Gu, Brendan Dolan-Gavite and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. CoRR, abs/1708.06673,, 2017. URL http::/arxxx
org/abs 708. 06733
Wenbo Guo, Lun Wang, Xinyu Xing, Min Du, and Dawn Song. Tabor: A highly accurate approach to inspecting and restoring trojan backdoors in systems, 2019.
Jonathan Hayase, Weihao Kong, Raghav Somani, and Sewoong Oh. Spectre: Defending against
backdoor attacks using robust statistics. In International Conference Machine Learning, pp. 1129-4139 PMLR, 2021.
Kaiming He, Xiangyu Zhang, Shaoging Ren, and Jian Sun. Deep residual learning for image recognition. CoRR, abs/1512.03385, 2015. URL
aa3.....11111133355 03385
Sanghyun Hong, Varun Chandrasekaran, Yigitcan Kaya, Tudor Dumitraş, and Nicolas Papernot. On the effectiveness of mitigating data poisoning attacks with gradient shaping, 2020.
Sebastian Houben, Johannes Stallkamp, Jan Salmen, Mare Schlipsing, and Christian Igel. Detection of traffic signs in real-world images: The German Traffic Sign Detection Benchmark. In International Joint Conference on Newral Networks, 2013.
Jeremy Howard. Imagenette: A smaller subset of 10 easily classified classes from imagenet, March 2019. URL httlttttt/ggttttii
com/ fastaalla..... aitama//eemameea///
Hanxun Huang, Xingjun Ma, Sarah Erfani, and James Bailey. Distilling cognitive backdoor patterns within an image, 2023.
Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process, 2022.
12

---

Published as a conference paper at ICLR 2025
Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M. Ziegler. Tim Maxwell, Newton Cheng, Adam Jermyn, Amanda Askell, Ansh Radhakrishnan, Cem Anil, David Duvenaud, Deep Ganguli, Fazl Barez, Jack Clark, Kamal Ndousse, Kshitij Sachan, Michael Sellitto, Mrinank Sharma, Nova DasSarma, Roger Grosse, Shauna Kravec, Yuntao Bai, Zachary Witten, Marina Favaro, Jan Brauner, Holden Karnofsky, Paul Christiano, Samuel R. Bowman, Logan Graham, Jared Kaplan, Sören Mindermann, Ryan Greenblatt, Buck Shlegeris, Nicholas Schiefer, and Ethan Perez. Sleeper agents: Training deceptive Ilms that persist through safety training, 2024.
J. D. Hunter. Matplotii: A 2d graphics environment. Computing in Science & Engineering, 9()): 90-95, 2007. doi: 10. 109/
Gal Kaplun, Nikhil Ghosh, Saurabh Garg, Boaz Barak, and Preetum Nakkiran. Deconstructing distributions: A pointwise framework of learning. arXiv preprint wrXiv:202.09931, 2022.
Alaa Khaddaj. Guillaume Leclerc, Aleksandar Makelov, Kristian Georgiev, Hadi Salman, Andrew Ilyas, and Aleksander Madry. Rethinking backdoor attacks. arXiv preprint arXiv:2307.1016. 2023.
Panagiota Kiourti, Wenchao Li, Anirban Roy, Karan Sikka, and Susmit Jha. Misa: Online defense of trojaned models using misattributionss 2021.
Alex Krizhevsky. Learning multiple layers of features from tiny images. Master's the- sis, University of Toronto, 2009.
Learning- features 2009-0000200000000 10009-R..00
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning:
Training clean models on poisoned data, 2021a.
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks, 2021b.
Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specifis triggers, 2021c.
Cong Liao, Haoti Zhong, Anna Squicciarini, Sencun Zhu, and David Miller. Backdoor embedding in convolutional neural network models via invisible perturbation, 2018.
Evan Z Liu, Behzad Haghgoo, Annie S Chen, Aditi Raghunathan, Pang Wei Koh, Shiori Sagawa, Percy Liang, and Chelsea Finn. Just train twice: Improving group robustness without training group information. In International Conference on Machine Learning, pp. 6781-6792. PMLR, 2021.
Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks, 2018a
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and X. Zhang. Trojaning attack on neural networks. In Network and Distributed System Security Symposium, 2018b.
Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang, Abs:
Scanning neural networks for back-doors by artificial brain stimulation. In Proceedings of the 2019
ACM SIGSAC Conference on Computer and Communications Security, CCS '19, pp. 1265-1288 New York. NY, USA, 2019, Association for Computing Machinery. ISBN 978 9781-97889 450367477, doi:
01114433315555.36663
URL UtRlhhtts://doii orw.lo.r111.mm
1tlpg//...111/333.. 100..111/33200 9535 6321166
Yiyong Liu, Zhengyu Zhao, Michael Backes, and Yang Zhang. Membership inference attacks by exploiting loss trajectory. In Proceedings of the 2022 ACM SIGSAC Conference Computer and Communications Security, pp.
2022.
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack deep neural networks, 2020.
Anh Nguyen and Anh Tran. Wanet imperceptible warping-based backdoor attack, 2021.
13

---

Published as a conference paper at ICLR 2025
Tuan Anh Nguyen and Tuan Anh Tran. Input-aware dynamic backdoor attack. In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS' 20, Red Hook, NY, USA, 2020. Curran Associates Inc. ISBN 978171 13825466.
Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel. M. Blondel, P. Pretten- hofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and F. Duchesnay. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12:2825-2833 2011.
Xiangyu Qi, Tinghao Xie, Jiachen Wang, Tong Wu, Saeed Mahloujifar, and Prateek Mittal. Towards proactive ml approach for detecting backdoor poison samples, 2023. URL https
13616
Ximing Qiao, Yukun Yang, and Hai Li. Defending neural backdoors via generative distribution modeling, 2019.
Stephan Rabanser, Anvith Thudi, Kimia Hamidieh, Adam Dziedzic, and Nicolas Papernot. Selective classification via neural network training dynamics. arXiv preprint arXiv:2205. 22022220..33322.. 2022.
Amartya Sanyal, Yaxi Hu, and Fanny Yang. How unfair private learning? In Uncertainty in Artificial Intelligence, pp. 1738-178444 1748. PMLR, 2022.
Benjamin Schneider, Nils Lukas, and Florian Kerschbaum. Universal backdoor attacks, 2024. URL
https://arxiv>: owg. abs Btlrg//bs/23333 2312.342222 00157
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, Patrick Schramowski Srivatsa Kundurthy, Katherine Crowson, Ludwig Schmidt, Robert Kaczmarezyk, and Jenia Jitsev. Laion-5b: An open large-scale dataset for training next generation image-text models, 2022. URL
httg//ss////ooooooo//gg///e/a https://arxixs org/ abs 2210. 08402
Shoaib Ahmed Siddiqui, Nitarshan Rajkumar, Tegan Maharaj, David Krueger, and Sara Hooker. Metadata archaeology: Unearthing data subsets by leveraging training dynamics. arXiv preprint arXiv:2209.10011 10015, 2022.
Hossein Souri, Liam Fowl, Rama Chellappa, Micah Goldblum, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, Cho, and A. Oh (eds.), Advances in Neural Information Processing Systems, volume 35, pp. 19165-19178. Curran Asso- ciates, Inc., 2022. URL http::p:e//rroeeennnneeeeerrrrre 2022/ le/ http:/9ec22220 (eteeeeee25533575559 - oap
files/paper
Te Juin Lester Tan and Reza Shokri. Bypassing backdoor detection algorithms in deep learning, 2020.
Guanhong Tao, Guangyu Shen, Yingqi Liu, Shengwei An. Qiuling Xu, Shiqing Ma, Pan Li, and Xiangyu Zhang. Better trigger inversion optimization in backdoor scanning. In 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 13358-13366 2022. doi: 10.1 D0.11090CCPPP522882222200111
Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks, 2018.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks, 2019.
Alexander Wan, Eric Wallace, Sheng Shen, and Dan Klein. Poisoning language models during instruction tuning, 2023.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath. Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In 2019 IEEF Symposium Security and Privacy (SP), pp- 707-723, 2019. doi: 10. 109100/92000990000000
Haotao Wang, Junyuan Hong, Aston Zhang, Jiayu Zhou, and Zhangyang Wang. Trap and replace: Defending backdoor attacks by trapping them into easy-to-replace subnetwork, 2022.
14

---

Published as a conference paper at ICLR 2025
Ren Wang, Gaoyuan Zhang, Sijia Liu, Pin-Yu Chen, Jinjun Xiong, and Meng Wang. Practical detection of trojan neural networks: Data-limited and data-frec free cases, 2020.
Tong Wang, Yuan Yao, Feng Xu, Shengwei An, Hanghang Tong, and Ting Wang. Backdoor attack through frequency domain, 2021.
Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models, 2021.
Zhen Xiang, David Miller, and George Kesidis. Post-training detection backdoor attacks for two-class and multi-attack scenarios, 2022. URL URL.atpp:://az.....oot///////
08474
Jiashu Xu, Mingyu Derek Ma, Fei Wang, Chaowei Xiao, and Muhao Chen. Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models, 2024. URL https
wttp://.wwrrrbbb/////0/0 14710
Kaidi Xu, Sijia Liu, Pin- Yu Chen, Pu Zhao, and Xue Lin. Defending against backdoor attack on deep neural networks, 2021.
Yi Zeng. Si Chen, Won Park, Z. Morley Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient, 2022a.
Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia. Narcissus: A practical clean-label backdoor attack with limited information, 2022b.
Yi Zeng, Won Park, Z. Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks' triggers: frequency perspective, 2022c.
Zaixi Zhang, Qi Liu, Zhicai Wang, Zepu Lu, and Qingyong Hu. Backdoor defense via deconfounded representation learning, 2023. URL BtRLhttss:// /ttp:///axii.../ https/////aaaoooo//////////////0
Runkai Zheng, Rongjun Tang. Jianze Li, and Li Liu. Pre-activation distributions expose back- door neurons. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh (eds.),
Advances in Neural Information Processing Systems, volume 35, pp. 18667-18680. Curran Asso- ciates, Inc., 2022. URL /tt.://000.//////o/eeeeeeaaaaaa. 2022 42t.:222222000011222222222222220
15

---

Published as a conference paper at ICLR 2025
A
BADLOSS PSEUDOCODE
Algorithm 1:
PyTorch pseudocode for BaDLoss.
Input
Training data X, Labels Y, Pelean bona fide clean data points X. E X, Number of detection epochs Repocks> parameter k < Velean rejection fraction r
Output
:Clean model, Loss trajectories for all training examples, Anomaly scores
Parameter
:Learning rate Loss function L
Initialize :Anomaly scores S]] array for per-example anomaly scores. Initialize :Average losses A[] array for rejecting epochs with loss spikes.
Initialize :odell parameters θ, Loss trajectories T[ <- empty list of lists
for epoch + Nepochs do
epoch the dataset, getting the // Train the model for average epoch loss. 0,7 <- train_rmiieee (__nn_mooe(X_______11_________ 0,0, f, a, L)
2 average(A[-3:))) continue A.append())
// Collect loss trajectory at the end of the epoch (I)
for each (z, y) in (X, do
predictions + fodel.forward(x)) // no gradients are calculated
loss < [(predictooss,
[jepoch))apppend(lln
endfor
endfor
Calculate anomaly scores
for each æ in XX, do
nearest nearest_clean Beca__neighbors<t + nearest petrstt // get n_2 nearest clean trajectories
distances + distance sistance_metri((r, nearest_clean, cdean__neighbor)
Saapenddavergeeddsaannee))) endfor
anomaly_ soomall_scoress scores S
// Any clean training method can be used
// Typically, removing examples below threshold works well model = clean Ieean_train(X,1111 Y,r, anomaly_scores) Output model, anomaly_ _cores
END
B DIFFERENCES BETWEEN BADLOSS AND ABL
Anti-Backdoor Learning (ABL) Li et 2021a) hinges on the idea that the loss of a particular example is informative about whether the example is clean or backdoored. However, ABL's detection mechanism relies on a very strong assumption regarding the learning of the backdoored instances i.e. the loss on these backdoored instances should be much lower than clean instances at the end of 20 epochs training.
As these choices are tuned specifically for the datsets evaluated in the original work, they fail to generalize in variety of cireumstances, including our multi-attack setting. BaDLoss, on the other hand, just assumes that the trajectories generated by backdoored examples are distinct from clean examples, since backdoor triggers induce abnormal behaviors in the model.
Consequently, BaDLoss but not ABL -BL-is agnostic as to whether poisoned example produces higher or lower loss values, and agnostic to at which point in training those higher or lower values occur. Therefore, ABL's filtering method can be seen special case of BaDLoss with only single point in the trajectory, and the distance computation w.r.t. fixed threshold for the assignment. Our experiments demonstrate that these differences from ABL critical to the success of LoDLoss
16

---

Published as a conference paper at ICLR 2025
in defending against simultaneous attacks. However, BaDLoss suffers from its own set of limitations. We provide a brief overview of these limitations in Section 6.4
C SCALABILITY ANALYSIS
C.I MEMORY COMPLEXITY
BaDLoss requires storing loss value for every single training example in the training dataset 'D for each of the training epochs in Repochs * Tepochs, where Repocks is the total number of epochs for the full training run. Set prretrain epoche = Repochs Tpretroin- Consequentl,, the memory requirement of BaDLoss pretaining is O( * Ropreraai epochs). ). For instance, in our ImageNet training run with approximately 1.2 million training images and 15 epochs of pretraining. BaDLoss requires storing 18 million loss values, which, using 32-bit floating point numbers (not required - 16 or even 8- bit floats could suffice). is 72 MB of data. Additionally, as this data can be stored instead of held in memory during the training run, this has not proven to be bottleneck. We expect even exceptionally large datasets such as LAION-5B (Schuhmann et al. [022) could be feasibly analyzed by BaDLoss, as each image in the dataset will generate only few bytes of associated data, yielding memory complexity penalties easily manageable at the corresponding large scale of training.
C.2 TIME COMPLEXITY
BaDLoss' greatest computational cost is the required number of pretraining epochs, as iterating the dataset and backpropagating at every step is expensive (storing floats is O([D) per epoch and is thus negligible). Call the cost of a training epoch with backpropagation E. BaDLoss's 's pretraining cost is then (EE * Repochs * (epoocs)) We provide context for this value compared to each defense we compare against:
Neural Cleanse. Neural Cleanse primarily requires training mask for every class on the full dataset. Each training epoch for the mask costs approximately E. Let the number of classes equal Relasses and the average number of training epochs for each mask to converse equal m'aak epochs- Neural Cleanse consequently costs OEE * Relasses * m'mak epocks) In our experiments, we found Rmmak epochs z 20, so for the 10-class datasets, this was ~ 200 x E, and for GTSRB, ~ 860 * E.
Activation Clustering. Activation Clustering's analysis requires forward pass through the training dataset, and so is negligible in cost compared the required full retraining. The cost is approximately OEE Nepoohs))
Spectral Signatures. Similarly to Activation Clustering, requires only a forward pass for its analysis and requires full retraining. The cost is approximately O(E nepochh))
Frequency Analysis. Frequency Analysis' cost depends on the size of the bona fide clean data, and the number of training epochs for the frequency classifier, typically 10. This cost (D).
is usually negligible, assuming Naeean
Learning. Anti-Backdoor Learning requires a static number of detec- tion and unlearning epochs, Nideteet and Nuntearn respectively. The computational cost is approximately OEE+ (Adetect + Nantearnn)
Cognitive Distillation. Requires a fixed number of optimization steps "pattern per training example learn the logit-matching pattern mask (typically 100). Total cost approximately O(E & Npattern))
Poisoned Sample Sensitivity. Requires Mpretrrin epochs to warm-start the model, Mintradaass epochs to differentiate class activations, and Nundearn for the alternating learn- ing/unlearning phase after training (as the dataset is divided into a clean and dirty section beforehand, the learning and unlearning together cost about E). The computational cost is approximately (E (Mpretrain + Nintroelass + Nunlearn).
Causal Backdoor Defense. Requires a fixed number of pretraining epochs (typically 10) which will discount. At every training epoch, the discriminator is first trained by forward passing the base model twice, then forwards and backwards passing the discriminator. Then, the base model and discriminator are run forward one additional time, in addition to the
17

---

Published as a conference paper at ICLR 2025
normal forward and backward pass of the base model. Treating the cost of forward pass as approximately 3 the cost of a full epoch (as the backwards pass is about twice as expensive the forwards pass), and D as the cost of training epoch for the discriminator, the additional cost of this defense is approximately O Nepochs + * Teepochs * z)- The discriminator is typically very small (a 2-layer MIP,, operating logits instead of images), so we can also treat D as negligible, and see that the cost is approximately equivalent to full retraining: OE Repochs).
Consequently, we conclude that the computational cost of BaDLoss's pretraining epochs is not exceptionally high compared to the suite of existing backdoor defenses compare against.
BadLoss' analysis incurs a much lower cost. Each the Releon examples's 's loss trajectories needs to get its distance calculated to every other example in the training dataset. The dimensionality of each vector Nepochs * Tepochs. so the overall computational complexity this analysis is (Netean [D] Repochs Tepoohs)- Other analysis steps have lower time complexity (e.g. detecting loss-spike epochs requires calculating the average loss of each pretraining epoch, (
* Repochs Pepocks))
Comparing the pretraining and the analysis costs, see that so long as Nelcon << To i.e. that the cost of a training step on given example requires much more than a small constant times nelean floating point operations, the analysis is negligible in cost.
D ADAPTIVE ATTACK AGAINST BADLOSS
BaDLoss assumes that any training examples with trajectories sufficiently close to the trajectories of small set of bonafide clean examples are similarly clean. While this empirically effective against a variety of backdoor attacks, even in the multi-attack setting, this can be partly attributed to the fact that no existing backdoor attacks have been developed intentionally produce dlean-imitating loss trajectories. An adaptive attacker with the knowledge of our attack can potentially define an attack that intentionally imitates the trajectories of clean- lloanng examples, hence evading detection.
One way to realize this would be to adjust the attack strength such that the loss of each backdoor sample equals the average loss of the clean samples at every epoch. An alternate and more principled realization is to define bi-level optimization, which optimizes the trigger in the outer loop and trains the model for the evaluation of the resulting trajectories in the inner loop (similar to other meta- meta-learning formulations). However, optimizing the trigger based this formulation is challenging.
One important point to note is that this makes the attack extremely expensive, requiring multiple training runs. Therefore, this makes the attack practically meaningless for any viable commercial application. We consider simpler techniques for adaptive attacks on BaDLoss as an interesting direction for future.
E MODEL MISMATCH FOR EXISTING DEFENSES IN THE MULTI-ATTACK SETTING
In this section, we will briefly describe why, for each defense considered from the literature, we should expect that the defense will not adequately generalize to the multi-attack setting.
Neural Cleanse. Neural Cleanse detects a backdoor if one the per-class anomaly scores much higher than the median. If multiple classes are attacked, there may be many classes with elevated per-class anomaly scores. Consequently, the median is likewise elevated, and as a result, many or all attacked classes undetected. We have verified this experimentally.
Activation Clustering. Activation Clustering assumes that backdoored classes will have two cleanly separable clusters in the last-layer activations. However, if a class is attacked multiple times, there will be two or more clusters, and the separation will no longer be clean. Consequently, the detection method will fail to detect attacks.
Spectral Signatures. Spectral Signatures expects that attacked images will produce activation patterns with lower complexity (as measured by the magnitude of those patterns when projected
18

---

Published as a conference paper at ICLR 2025
onto the strongest dimensions of singular value decomposition). Similarly to Activation Clustering, when there are multiple attacks on a class, this assumption no longer can be expected to hold.
Frequency Analysis. We expect that Frequency Analysis would generalize well to the multi-attack setting if and only if the seed patterns used for the frequency classifier are accurate to the types of backdoor used. However, this assumption does not appear to hold well with the some of the attack types we tested against.
Anti-Backdood Learning. As described in Section B Anti-Backdodd Learning is dependent on attack images having a low loss at a particular epoch. It is not only the case that attack images may not have low loss at that epoch. Additionally, when multiple low-loss attacks are present, those attacks may not be equally low loss. Instead, one attack may occupy all the lowest 'slots' that ABL detects, causing other low loss attacks go unnoticed.
Cognitive Distillation. When many backdoor patterns are present, it is important not only to distinguish that a backdoor is present, but also that no other backdoors are present. Consequently, the model may need to attend to many more parts of an image in order to form its conclusion, so the minimal mask that reproduces a given set of logits may be larger, making it harder to disambiguate backdoor images from clean images.
Causal Backdoor Defense. Similarly to ABL., some backdoors may not be learned quickly early in training. Consequently, the model must either ignore some backdoors, or incorrectly suppress some clean features learned during the training the intentionally backdoored model.
Poisoned Sample Sensitivity. We have observed that the FCT-metric used in PSS is highly sensitive to particulars of the training set-urf] When the strong augmentations used for the FCT metric are applied to multi attacked model, we expect that the activation patterns generated are very different for both clean and backdoored images. Consequently, the FCT metric does not detect a substantial difference in sensitivity between clean and backdoored images.
F POTENTIAL CONSEQUENCES OF MULTIPLE TRIGGERS FOR A BACKDOOR ATTACK
An attacker could attempt to install multiple triggers in a single attack with single target label, with the goal of more effectively inducing the model to produce the desired behavior. We chose not to evaluate against this setting because BaDLoss seems likely to easily defend against such attacks. Specifically, when multiple attacks are used on the same examples, we expect that the attack will be learned faster than any of the component attacks, since the model will at least be able to detect the strongest, most quickly learned feature, and will then be able to use the remaining features to more quickly increase its confidence in the attack. As BaDLoss already effectively defends against attacks with faster-than-clean dynamics, we expect that this attack would be particularly easy to defend against for BaDLoss. Consequently, we do not consider this case as it would not be a valuable way to test BaDLoss's 's robustness.
Additionally, note that the aggregate set of multiple triggers could be framed as a single, more complex trigger.
G MINORITY CLASS IMPACT
Minority class examples could exhibit unusual training dynamics due to being present as a small fraction of the overall dataset. We examine GTSRB, an imbalanced-class dataset, to see if there is substantial difference in how many clean examples are mistakenly marked as backdoors, based on the class that the example a part of. We hypothesize that classes with fewer samples will have more erratic loss trajectories (outliers) that make them more likely to be marked as backdoor examples. We examine the top 10% of classes by weight in the training set (average of 1298 samples per class) and the bottom 10% of classes in the training set (average of 140 samples per class), and check their rejection rates when run with BaDLoss in the full multi-attack setting (likely worst-case, due to maximally erratic loss trajectories). We find the following result:
Reeer single-attack results in Section 5.3 demonstrate how Poisoned Sample Sensitivity's 's performance in our setting with a standardized model, optimizer, etc.)
19

---

Published as a conference paper at ICLR 2025
Top 10% Classes in this range have 25.5% of their clean examples rejected.
Bottom 10% Classes in this range have 52.5% of their clean examples rejected.
It appears that outlier clean examples are more likely be marked as false positives. However, we note that the rejection rate of the bottom 10% classes is still lower than that of backdoor examples (in GTSRB multi-attack. BaDLoss rejects 95. 1% of backdoor samples), and that the overall clean accuracy of the model remains high. Future work could investigate whether including fixed amount of samples from each class could mitigate this disproportionate harm on minority examples without reducing detection accuracy.
H TRAINING DETAILS
We use the ResNer-50 (He et al. 2015) architecture throughout all our experiments, except in ImageNet, where we use ResNet- 18. We use the AdamW optimizer with learning rate 7 1 3 (with a cosine-annealing learning rate schedule). weight decay À = 1e 4, and B1, .3 = 0.9, 0.999. We train for 100 epochs on CIFAR-10 10 and GTSRB, and 250 epochs on Imagenette. We intentionally undertrain for 50 epochs in ImageNet for computational efficiency further training would improve clean accuracy. In CIFAR-10, we use batch size of 128. In GTSRB, Imagenette, and ImageNet, we use a batch size of 256. In CIFAR-10, we use crop-and-pad (4px max) and random horizontal flip augmentation except during BaDLoss pretraining. In GTSRB, we use no augmentations. In use random resized crop (scalc=0.0--1] and random flip augmentations.
Imagenette and ImageNet, In ImageNet, we first resize all images to 256x256 for dataloading efficiency, then use random resized crop (scale=0.8-) 1) and random flip augmentations.
We train using Py PyTorch (Ansel et al. 2024). Our nearest neighbors classifier uses scikit-learn (Pedregosa al. 201T). Plots were generated with Matplotlib (Hunter 2007).
I ATTACK AND DEFENSE DETAILS
L.1 ATTACKS CONSIDERED
We focus on attacks that exclusively impact the training dataset. While other attacks exist, our method is not designed to defend against such threat models. Fig iillsstats the attacks considered in this study. Note that attacks have very different poisoning ratios p: for example on 100 ranging from 0.0005 (25 images) to 0.03 (1500 images).
Image Patch. Gu et al. (0177) use a 4-pixel checkerboard (Patch) and a 1-pixel (Single-Pix) attack. adding a pattern and changing the corresponding image's ' label to the target class. We use p = 0.01 for both attacks in CIFAR- 10. p = 0.02 for the checkerboard patch and p 0.04 for the single-pixel patch in GTSRB. p- 0.05 for the checkerboard patch in Imagenette, and the attack is scaled up to be 32 pixels in size to accommodate the larger image size. p 0.001 in ImageNet.
Blended Pattern. A blended pattern attack adds a full-image trigger i into an image with some fraction a. such that the attacked image Zattacked = at + (1 a) Torigiaall- We use three blending attacks: Chen et al. (2017)'s random noise blending (Blend-R) with a 0.075, p 0.01, Liao et al.) (2018)ss 's dimple pattern blending (Blend-P) with a = 0.025. p = 0.01, Barni et al. (2019) 's sinusoid pattern blending (Sinusoid) with a 0.075. p = 0.01. The sinusoid attack a clean-label baseline, so images are only selected from the target class and their labels are not changed. As GTSRB has imbalanced classes, we require that the chosen target class for the sinusoid attack has at least 1,000 images, of which the sinusoid backdoor is applied to at least 300. In Imagenette, we increase to 0.15. In ImageNet, we use Imagenette's 's a, but use p = 0.0005 for the random blending attack, p 0.0002 for the pattern blending attack, and p 0.0001 for the sinusoid attack. For all blended attacks, to evaluate attack success rates, we boost the magnitude of the blended pattern (Zeng et al., 20226) by 2x.
Learned Trigger. Zeng et al. 2022b) optimize a trigger pattern to embed a backdoor with very few backdoor examples. We use p 0.0005 in CIFAR- 10, and do not use this attack in any other dataset.
Frequency Attack. Wang et al. (02T)) inject a trigger into an image's 's discrete cosine transform, acting high-frequency trigger patterm. We use this attack with 30, 0.01. In Imagenette,
20

---

Published as a conference paper at ICLR 2025
Average loss trajectories of data subsets in CIFAR-10, multi-attack
101
10a
10-1
10-2
Loss (log)
10-3
Avg. test loss
Avg. train loss
10-4
Clean examples
attack
10-5
Single-pixel attack
Random blend attack
Fixed blend attack
10-6
Sinusoid blend attack
Narcissus attack
7
Frequency attack
Epoch
Figure 9: Loss trajectories in the multi-attack setting in CIFAR-10. Note loss spikes in epochs and 21. Loss has been plotted on a log-scale to emphasize backdoor attacks with lower loss than clean examples. Clean examples used for BaDLoss filtering are in heavy green. Some distinct trends: The single-pixel attack is consistently above the clean examples, while the narcissus and frequency attacks start high and end up lower. Despite the patch attack examples tracking the clean examples relatively well, BaDLoss still appears capable removing it.
increase to 90. In ImageNet, we use Imagenette's m, but decrease the poisoning ratio to p = 0.001.
1.1.1 META-ATTACK SETTINGS
We always choose the attack target randomly. When there are multiple attacks, we choose randomly with replacement. Target images also chosen randomly for clean label attacks, always from single class. Target image choice is without replacement.
1.2 DEFENSES CONSIDERED
We prioritize selecting defenses which are primarily filtering-basee based, as BaDLoss is primarily filtering- based method. Where possible, adapt defenses to remove and retrain from scratch for consistence.
Neural Cleanse. We use Wang al. (2019) 's proposed filtering technique: finding the trigger, identifying triggered neurons, then filtering the training dataset by removing images with high trigger neuron activations, using their default threshold.
Activation Clustering, We use Chen et al. (2018)ss silhouctte score identification method to remove poisoned data, using their default parameters.
Spectral Signatures. Spectral signatures always removes a fixed fraction (15%) of datapoints that deemed most anomalous (Tran et al. 2018).
Frequency Analysis. We construct the frequency detector (Zeng et al. 2022c) training dataset using only the bona fide clean examples that BaDLoss has access to, for parity.
21

---

Published as a conference paper at ICLR 2025
Clean Acc.
Attack Success Rate
Single-PP IPX
Blend-R
Blend-P
Sinusokd
Narcissus
Froquency
Avg. ASR
Patch
No Defense
91.76
91.58
34.97
99.27
96.74
45.36
99.93
99.98
81.12
Neural Cleanse
91.76
91.58
34.97
99.27
96.74
45.36
99.93
99.98
81.12
Activation Clustering
91.83
49.24
44.29
83.23
CIFAR-10
Spectral Signatures
90.82
91.50
3.58
3.31
99.80
31.48
94.66
0.20
46.36
Frequency Analysis
90.96
94.44
64.38
97.41
97.70
73.43
0.00
99.98
75.33
Anti- Baii-Bakddoor Leamiing
90.73
94.00
71.29
99.14
99.90
62.86
4.99
14.92
63.87
Cognitive Distillation
91.04
41.63
98.56
95.13
43.72
99.96
67.15
Causal Backdoor Defense
70.84
3,54
2,00
15.79
6.48
40.11
31.81
5.69
15,06
Poisoned Sample Sensitivity
89.90
91.00
44.47
74.53
99.77
18.37
99.89
99.93
75.42
BaDLoss
88.43
0,92
6.16
4.29
33.52
7.81
1.44
7.98
Defense
97.09
93.22
93.
99.74
100.00
49.36
100.00
Neural Cleanse
97.09
93.22
93.11
99.74
100.00
49.36
100.00
89.24
Activation Clustering
97.82
94.96
94.32
97.05
100.00
46.69
100.00
88.84
GTSRB
Spectral Sigmatures
96.56
91.91
91.14
63.60
100.00
38.08
100.00
80.79
Frequency Analysis
97.43
94.17
54.14
100.00
73.91
Anti- Hiti-Backoorr Learning
97.13
92.83
93.93
52.93
100.00
77.52
100,00
86.20
Cognitive Distillation
97.10
92.67
92.89
86.16
100.00
31.29
87.36
81.73
Causal Backdoor Defense
71.98
1.82
5.77
4.26
31,90
0.17
14.05
9.66
Poisoned Sample Sensitivity
96.82
91.16
99.64
100.00
46.74
100.00
88.24
BaDLoss
94.75
0.13
0.04
10.32
0.18
1.75
49.32
10.29
No Defense
90.85
49.66
71.16
95.53
56.51
91.18
72.81
Neural Cleanse
88.71
50.96
52.31
97.99
49.74
1.84
50,57
Activation Clustering
90.22
49,29
47.69
99.86
62.73
0.91
$2.10
Imagenette
Spectral Signatures
89.17
41.04
34.85
19.26
54.91
3.03
30.62
Frequency Analysis
90.85
49.66
71.16
95.53
56.51
91.18
72.81
Anti Backdoor Learming
88.08
37.24
43.00
4.24
78.39
0.99
32.77
Cognitive Distillation
26.31
2.91
49.72
1.08
24.68
Causal Backdoor Defense
58.68
4.51
11.23
8.76
98.33
4.68
25.50
Poisuned Sample Sensitivity
87.39
46.06
14.85
84.49
66.19
12.71
44.86
BaDLoss
85.58
35.56
1.67
3.81
53.18
1.62
19.17
Table 2: Multi-attack setting: Clean accuracy and attack success rate after retraining on CIFAR-10 and GTSRB. This table shows that the multi-attack setting is substantially harder than the single-attack setting. BaDLoss demonstrates the best overall defense in both settings, but suffers some clean accuracy degradation in CIFAR-1O.
Clean Acc.
Patch
Blend-R
Blend-P
Sinusoid
Freq
Avg. ASR
No Defense 57.99
91.20
99.10
92.45
68.10
92.00
88.57
BaDLoss
54.49
2.45
29.50
0.05
46.00
0.05
15.61
Table 3: ImageNet multi-attack results. BaDLoss reduces ASR of every attack, completely defending most attacks, while maintaining adequate top-1 accuracy ImageNet.
Anti-Backen -nti-Backdoor Learning. Rather than unlearn using identified examples (Li al. 2021a), which demonstrated substantial instability during our testing, we remove the bottom 15% examples after the pretraining phase (instead of the 1% usually removed and used for unlearning) and retrain from scratch.
Cognitive Distillation. Similarly Anti-Backdoor Learning, instead of doing an unlearning phase after finding the lowest magnitude masks (Huang et al. 2023), we remove the fixed 15% examples with the lowest magnitudes and retrain from scratch.
Causal Backdoor Defense. We perform CBD retraining for 100 epochs, except in Imagenette where retrain for 250 epochs. We explored reducing the impact of the weighted cross-entropy loss to minimize clean accuracy degradation, but did not find a satisfactory setting of this that effectively traded off ASR and clean accuracy, so simply kept the original settings.
Poisoned Sample Sensitivity We set the number of intraclass training epochs to 3, finding that any further intraclass training epochs damages the reference model's performance much to be useful
22

---

Published as a conference paper at ICLR 2025
Clean Acc.
Attack Success Rate
Single-Pix
Blend-K
Blend-R
Sinusoid
Narcissus
Frequency
Avg. ASR
Patch
BaDL (r 0.05)
91.59
93.90
50.80
99.26
99.78
31.29
100.00
100.00
82.15
BaDLoss (r 0.10)
91.33
93.60
39.27
99.17
96.16
47.80
99.70
99.96
82.24
CIFAR-10
BaDLoss (r 0.20)
90.95
86.39
2.58
96.68
98.82
39.03
95.79
2.36
60.24
BaDLoss 0.30)
89.88
41.32
0.79
59.57
37.88
1.70
33.25
BaDL 0.40)
88.43
1.71
0.92
29.69
4.29
33.52
7.81
1.52
11.35
BaDLoss 0.50)
85.75
2.14
1.27
6.78
5.63
25.49
1.80
1.59
6.39
BaDLoss 0.60)
81.69
2.66
1.94
3.97
8.31
28.92
2.91
2.01
7.25
BaDLoss 0.70)
80.30
2.90
2.28
3.79
7.88
18.59
2.22
2.57
5.75
BaDLoss 0.05)
97.55
78.39
87.86
58.87
41,28
93.48
76.44
BaDLoss 0.10)
96.84
0.06
0.51
47.92
92.21
52.80
95.48
48.16
GTSRB
BaDLoss 0.20)
97.59
0.07
0.27
32.29
65.91
23.06
94.05
35.94
BaDI oss (r 0.30)
96.06
0.15
0.08
25.51
10.13
25.29
85.66
24.47
BaDLoss (r 0.40)
94.75
0.13
0.04
10.32
0.21
3.15
49.32
10.53
LaDLoss (r 0.50)
91.45
0.20
0.00
22.83
0.33
3.00
3.38
4.96
BaDLoss (r 0.60)
89.49
0.18
0.45
3.13
0.37
0.27
1.03
0.91
BaDL (r 0.70)
87.95
0.36
0.11
0.52
0.48
5.68
0.66
1.30
Table 4: Investigation of rejection threshold for BaDLoss, The CIFAR-10 results were computed first, and based on the results, the threshold of r 0.4 was chosen. A subsequent on GTSRB reveals that 0.4 is reasonable stopping point, though not all attacks are fully removed at this point (most notably the sinusoid attack still remains partially-present in the final model).
Clean Acc.
Attack Success Rate
Single-Pix
Blend-R
Blend-P
Simusoid
Narcissus
Frequency
ANe A ASR
Patch
BaDLoss (DenseNet)
81.40
1.27
2.14
5.44
28.33
0.64
0.94
5.81
CIFAR-10
BaDLoss (SqueezeNet)
58.62
0.00
11.40
0.00
2.40
0.00
2.97
BaDLoss (VGG-16)
82.81
4.34
1.03
33.63
10.93
38.82
6.61
1.18
13.79
BaDLoss (ResNet-18)
86.03
1.79
1.94
3.26
17.22
2.06
1.54
BaDLooss (ResNet-34)
85.35
4.18
1.04
77.53
14.62
15.20
1.17
1.56
16.47
BaDLoss (ResNet-50)
88.43
1.71
0.92
29.69
4.29
33.52
1.52
11.35
Table Ablation study of BaDLoss architecture. While other architectures achieve superior ASR performance, ResNet-50 achieves the most-competitive clean accuracy. Note that the variance of results per architecture can also be high.
for sample detection. We use the unlearning method, rather than the secure-training method which retrains from scratch.
J ABLATIONS
J.1 REJECTION THRESHOLD
In Table we show our ablation result for the rejection threshold Trejects which most influences the tradeoff between maximizing clean-accuracy and minimizing attack success rate.
J.2 ARCHITECTURE
we show our analysis BaDLoss's performance on different neural network architectures. ResNets appear reasonably robust for detection and retraining. In future work, could use network optimized for detection for the pre-training phase (c.g. with lower compute cost to permit more pre-training epochs) and use more performant network for final training.
In Table 5
23

---

Published as a conference paper at ICLR 2025
Accuracy itulliattick))
Avg. CX Isngli-ttaadd
Aztact succest (muft-artnck)
ASB bingle atfack!
ustering
Clustering
100
100
80-
20
20
20
20
5000
Abacld
Castrd
Potch
and Pr
Spectrai Srgnetures
Frequency Anslvsis
Spectral Signatures
Trequency Andlysrs
100
60
40-
20
8022
Olvared
Gegle-ii
Beloe
Grown
barmas
S/use
Rustan
Requerry
hequenty
Marckee
smile Ptc
Bess Belin
nequests
shole
Aidi-Baakka Learning
Cogritive DistiBation
Anti-Backdoo
Cugrilive Distilation
Atuiked
Charrel
Smate
creas requency
nanc
700,00c
single Hy
nand
heq hequeny
Attckee
Carred
roth
Sinle Px
Bon
Bens
Smitees
Ree end
Perforance: CIFAR-10
BalLoss Performance:
1.00
Scrd
Ataatodd
hush-
SrdeePs
shusll
nequeey
Figure 10: This figure demonstrates the difference in performance for different defenses between the
single and multi-attack setting. Top: Existing defense performance is erratic between the single and multi-attack settings, but areas with low orange bars (attack is defended in isolation) but high red bars (attack succeeds when executed with other simultaneous attacks) are visible. Bottom: BaDLoss performance is highly stable regardless of single multi-attack, and in GTSRB even improves average in the aulti- setting.
24

---

Published as a conference paper at ICLR 2025
Figure 11: Average clean trajectory compared to average attack trajectories in CIFAR-10, single-attack setting, 50 epochs. Top row, left to right: 4-pixel patch, single-pix patch, random blended, fixed pattern blended. Bottom row, left right: Sinusoid blended, narcissus, frequency attack. backdoor attacks exhibit distinet learning dynamics from clean examples. However, some are learned faster while others are learned slower. making the inductive bias of previous methods (Li et al. 202 Khaddaj et al. 2023 Hayase et al. 202 inappropriate for defending against general poisoning attacks.
K. FULL CIFAR-10 TRAJECTORY COMPARISON
full version of Figure
25


Reviews:
[{"review_id": "9OlrMYMDEk", "reviewer": "Reviewer_UaGx", "summary": "The paper addresses the challenge of defending machine learning systems against multiple simultaneous data poisoning attacks, which is increasingly relevant in real-world applications where large datasets are involved. The authors highlight the limitations of existing defenses that are effective in single-attack scenarios but fail under multi-attack conditions. The primary contributions of the paper are identification of the multi-attack threat and introduction of BaDLoss.", "questions": "1. In the context of this paper, how many levels of multiple attacks are there? Does the number of attack levels affect the performance of the model?\n2. The BaDLoss proposed in this paper does not perform particularly well in a single-attack environment, with its clean accuracy being lower than that of most single-defense solutions. Does this imply that the model is only effective in scenarios involving multiple attacks?\n3. Figure 2 is inconsistent with the accompanying textual description.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The paper presents an advancement in the field of machine learning security by addressing the novel challenge of defending against multiple simultaneous data poisoning attacks. While prior research has largely focused on single-attack scenarios, this work recognizes the complexity of real-world applications and the increased risks associated with multi-attack settings.\n2. The research demonstrates high methodological quality through rigorous experimentation and robust validation of the proposed defense mechanism. The authors carefully design experiments that evaluate BaDLoss in both single-attack and multi-attack contexts, providing empirical evidence of its effectiveness.\n3. The logical flow from the introduction of the problem to the presentation of BaDLoss and its evaluation ensures that readers can easily follow the authors' arguments and findings.\n4. The significance of this work lies in its potential impact on the field of machine learning security. By successfully demonstrating a method that defends against multiple data poisoning attacks with minimal loss in model utility.", "weaknesses": "1. Limited exploration of poisoning ratio effects. While the paper acknowledges the impact of poisoning ratios on detection effectiveness, it could benefit from a more comprehensive exploration of this dimension. Specifically, the authors could conduct experiments that systematically vary poisoning ratios across different attack types to better understand the thresholds at which BaDLoss operates effectively. \n2. Minority class considerations. The methodology’s tendency to mark minority-class data as anomalous could exacerbate existing imbalances in the dataset. The authors could address this issue by implementing strategies to ensure that the filtering process accounts for class representation. \n3. Detailed evaluation of  counter-attacks. Although the paper briefly discusses the potential for adaptive counter-attacks, it lacks an in-depth analysis of how an informed attacker might exploit the defense mechanism. Providing case studies or simulated scenarios where attackers adapt their strategies in response to BaDLoss would enrich the discussion. \n4. Limited real-world application discussion. The implications of the findings for real-world applications are somewhat underexplored. A more thorough discussion on how BaDLoss could be integrated into existing machine learning workflows or what practical challenges might arise during implementation would enhance the paper's relevance. \n5. It is more reasonable to use an adaptive threshold to determine the reject ratio than a fixed ratio.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "aRGcRLyE55", "reviewer": "Reviewer_7Kku", "summary": "This paper investigates the problem of defending against multiple simultaneous data poisoning (backdoor) attacks during the training of deep learning models and proposes a defense method called BaDLoss. Unlike previous studies, the authors point out that in real-world scenarios, models may suffer from multiple attacks simultaneously, while most existing defense methods can only handle single attacks. BaDLoss detects potential backdoor samples by tracking the loss trajectories of individual samples during training and excludes these samples from the dataset during retraining, thereby improving defense against multiple attacks without significantly degrading model performance. Through experiments on CIFAR-10, GTSRB, and Imagenette datasets, BaDLoss demonstrates superior performance compared to existing defense methods in multi-attack scenarios.", "questions": "1.In real-world applications, multiple different types of attack features may be superimposed on the same image. Can BaDLoss effectively handle such situations? Is it possible to improve the analysis of loss trajectories to further enhance the method's adaptability to complex attack scenarios?\n\n2.In the experiments, BaDLoss outperforms other defense methods significantly under multi-attack scenarios, but its performance in single-attack settings is comparable to or slightly inferior to other methods. Have the authors considered making some adjustments to BaDLoss, such as optimizing the detection strategy for specific attack types, to improve its performance in single-attack scenarios?\n\n3.The paper mentions that BaDLoss identifies potential backdoored samples by rejecting those farthest from clean sample loss trajectories. Could this strategy mistakenly filter out some minority class samples? In cases of imbalanced class distribution, is there a mechanism to ensure that minority class data is not mistakenly removed due to anomalous trajectories?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1.The paper addresses the issue of multiple simultaneous backdoor attacks, which is an important problem that has been largely overlooked in the existing literature. With the growing application of deep learning models and the complexity of training data sources, multiple attackers may tamper with the dataset simultaneously, making multi-attack scenarios a more realistic threat. \n\n2.The paper proposes BaDLoss defense method identifies anomalous samples by tracking the loss trajectories of individual samples during training. This method fully exploits training dynamics to detect backdoored samples, regardless of whether these samples exhibit unusually high or low losses during training. Compared to traditional defense methods, BaDLoss significantly reduces the attack success rate in multi-attack scenarios while maintaining high clean data accuracy.\n\n3.The paper validates BaDLoss on three datasets with different characteristics: CIFAR-10, GTSRB, and Imagenette, covering variations in image size, class distribution, and more. The experimental results show that BaDLoss significantly outperforms other defense methods in multi-attack scenarios.", "weaknesses": "1.Although the paper points out the deficiencies of existing defense methods in multi-attack scenarios, it does not provide an in-depth analysis of the specific reasons for their failures. For example, methods like Neural Cleanse and Spectral Signatures perform well in single-attack settings but fail in multi-attack scenarios.\n\n2.The experiments in the paper assume that each image can only be affected by one type of attack, which simplifies the experimental setup. However, in real-world scenarios, a single image may contain multiple attack features, which could have a greater impact on model performance.\n\n3.BaDLoss identifies backdoored samples by tracking the loss trajectories of all training samples, which requires storing and analyzing a large amount of intermediate data at each training stage. This could introduce additional computational overhead, especially in large-scale datasets or model applications. The authors are encouraged to provide a detailed analysis of the computational complexity of this method and discuss its feasibility and optimization strategies for practical deployment.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "RZLTKQYxxs", "reviewer": "Reviewer_vomn", "summary": "This paper proposed a new defense, namely BaDLoss, to simultaneously defend against multiple backdoor attacks to machine learning classifiers. The proposed defense is evaluated on multiple backdoor attacks and is compared with multiple baselines on three benchmark datasets.", "questions": "See above", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. A machine learning model can be corrupted by multiple backdoor attacks. How to defend against multiple backdoor attacks simultaneously is largely unexplored in the research community. \n\n2. The problem is well-motivated. Existing defenses are shown to be insufficient for multiple attacks, which motivates the authors to propose a new defense for this scenario. Overall, I feel the setting considered in this paper is interesting.", "weaknesses": "1. It is assumed that multiple attacks cannot target the same image. As acknowledged by the authors, this assumption may not hold in practice. For instance, an attacker can perform multiple backdoor attacks on the same image with the same target label. \n\n2. The insights of the proposed defense can be discussed. For instance, the authors may consider providing insights on why backdoored samples have a different training trajectory from the clean samples. \n\n3. Will the proposed method be effective for clean-label backdoor attacks?\n\n4. Rejecting 40% of training samples can hurt performance in certain application scenarios, especially when the task is complex. For instance, based on Figure 6, the performance drop on Imagenette is larger than the other two datasets. The potential reason is that Imagenette is a more complex classification task.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ula8SvZ2IA", "reviewer": "Reviewer_Pi8N", "summary": "The paper proposes BadLoss, a backdoor defense that removes poisoned samples by measuring the distance of samples' loss trajectories from the trajectories of a clean set. The defense is validated on poisoned training data containing multiple backdoor attacks that use patch, blend and frequency triggers. The paper compares the efficacy of the defense against a set of standard defenses and observes that existing defenses are ineffective for the examined setting.", "questions": "- The above weaknesses section contains some questions. Also, were the hyperparameters of the defense tuned against the same set of attacks you evaluate against? It would be interesting to see how hyperparameters tuned to defend against a patch attack work for other types of attacks.  \n  \n\n - Do you expect that the unstable training dynamics would persist when training multi-attacks on a larger benchmarks where the required poisoning rate would be lower?\n    \n- In figure 8 it looks like the test loss is trending up throughout the entire training run? Could the defender have prevented successful backdoor via early stopping?\n\nReferences\n\n[1] Gu, Tianyu, et al. \"Badnets: Evaluating backdooring attacks on deep neural networks.\" (2019).  \n\n[2] Xiang, Zhen, David J. Miller, and George Kesidis. \"Post-training detection of backdoor attacks for two-class and multi-attack scenarios.\" (2022).  \n\n[3] Schneider, Benjamin, Nils Lukas, and Florian Kerschbaum. \"Universal Backdoor Attacks.\" (2023).", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "- The writing is clear and easy to follow.\n- The defense is well-motivated and the method makes sense.\n- The defense requires significantly less clean data than defenses that require fine-tuning.\n- Defending against simultaneous data poisoning attacks is an important and understudied topic.", "weaknesses": "- Studying the multi-attack setting on small benchmarks requires very high poisoning rates and results in very odd training dynamics. This is especially concerning when evaluating a defense that relies so heavily on training dynamics.  \n\n- The motivation for the analysis in section 3.3 is not clear. The classic motivation for not degrading clean accuracy is to ensure the stealthiness of the backdoor [1]. However, if the poisoning is visible from the erratic loss/accuracy curves of the model, the point is largely moot. An analysis on that would have been more valuable.  \n\n- Figure 8 provides important information on loss trajectories, but is cluttered and difficult to interpret. The legend is covering a lot of the figure. Maybe it could be split into multiple figures?  \n\n- The clean accuracy degradation and required rejection rate is quite high. As shown in table 3, the defense requires 40% rejection rate to completely remove a patch attack from CIFAR-10.  \n\n- Some phrasing in the threat model is vague, particularly: \"The defender has complete control over the training process, while the attacker has neither **knowledge** nor control.'' What is knowledge of the training process? The model architecture? What classes are in the dataset? What specific attacker capabilities are being included/excluded here?\n\n- Potentially missing references on the multi-attack setting: [2] explores the detection setting for multiple backdoors on image classifiers. [3] corroborates the patch boosting effect observed by the authors.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4gZOyAWFts", "reviewer": "Reviewer_GfT1", "summary": "The author considers an interesting scenario where multiple attackers simultaneously poison a dataset. The author finds that traditional poisoning methods fail in this context. Therefore, a defense method called BaDLoss, based on loss trajectories, is proposed to be robust against multiple simultaneous backdoor attacks.", "questions": "1. Although the author provides a brief overview of why existing methods fail under simultaneous poisoning, I believe this is insufficient. A detailed theoretical explanations of why each defense fails under multiple attacks is needed.\n\n2.The reasons for the failure of some methods are not always applicable. For example, the author mentions that Neural Cleanse fails because too many other classes are attacked, but this scenario is not guaranteed to occur. The author should provide a sensitivity analysis showing how Neural Cleanse's performance changes as the number of attacked classes increases. This would give readers a clearer understanding of when this defense starts to break down in multi-attack scenarios.\n\n3. I'm wondering why STRIP was not included if there are specific reasons, the author should include STRIP in their experimental comparisons.\n\n4.I'm wondering why BaDLoss performs differently across various datasets. This inconsistency in defense effectiveness between datasets requires further analysis. The authors should  provide a more detailed analysis of how dataset characteristics (e.g., number of classes, image complexity, dataset size) might influence BaDLoss's performance.\n\nTypos:\nIn line 370, there is an extra \"with\".", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. I think simultaneously poison is an interesting topic.\n\n2. A well-organized presentation and clear article structure", "weaknesses": "1. Although the method is relatively simple, I find it acceptable.\n\n2. While the experiments are comprehensive, they lack analysis.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "3tZC02k5b8", "reviewer": "Reviewer_jwNi", "summary": "This paper proposes BaDLoss, a defense method designed to detect and mitigate multiple simultaneous backdoor attacks in machine learning models. By analyzing the loss dynamics of individual training samples, BaDLoss identifies and filters out poisoned data, effectively lowering attack success rates while preserving model accuracy. The approach is evaluated across multiple datasets and attack types, demonstrating strong performance and adaptability, making it a robust solution for complex, real-world backdoor attack scenarios.", "questions": "1. How scalable is BaDLoss when applied to large-scale datasets like ImageNet, and what are the computational costs associated with tracking loss dynamics across extensive data? \n2. How effective is the proposed method in defending against dynamic backdoor attacks, where attackers modify the poisoning strategy to mimic clean data loss dynamics?", "limitations": "", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "The paper presents a novel approach to defending against simultaneous multi-backdoor attacks, addressing a challenging scenario that previous work has largely overlooked. The proposed BaDLoss method effectively utilizes loss dynamics to detect poisoned data, reducing attack success rates while preserving model accuracy. Furthermore, the paper provides a comprehensive evaluation across multiple datasets and attack types, showcasing the method's robustness and adaptability in diverse training environments.", "weaknesses": "1. The paper’s threat model could be clarified. If attackers control the training data, it would be helpful to understand why defenders would still need to detect and retrain on filtered data post-contamination, rather than directly identifying and removing poisoned samples before the training process.\n2. The paper states that no current defenses can detect multiple backdoor samples. However, \"Towards A Proactive ML Approach for Detecting Backdoor Poison Samples\" presents a proactive method that addresses various backdoors. Including a comparison or discussion of this approach could provide a more comprehensive evaluation.\n3. The paper does not evaluate the proposed defense method on large-scale datasets such as ImageNet. Evaluating on larger datasets would help demonstrate the method's scalability and practical effectiveness, as backdoor detection can be more challenging with increased data volume and complexity.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)