Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimization
Authors: Mingda Zhang
Mingli Zhu
Zihao Zhu
Li Shen
Baoyuan Wu
Venue: ICLR 2026 Poster (2026)
Keywords: Backdoor Defense
Poisoned Sample Detection
AI security
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: This work investigates Poisoned Sample Detection (PSD), a promising defense approach against backdoor attacks. However, we observe that the effectiveness of many advanced PSD methods degrades significantly under weak backdoor attacks (\eg, low poisoning ratios or weak trigger patterns). To substantiate this observation, we conduct a statistical analysis across various attacks and PSD methods, revealing a strong correlation between the strength of the backdoor effect and the detection performance. Inspired by this, we propose amplifying the backdoor effect through training with Sharpness-Aware Minimization (SAM). Both theoretical insights and empirical evidence validate that SAM enhances the activations of top Trigger Activation Change (TAC) neurons while suppressing others. Based on this, we introduce SAM-enhanced PSD, a simple yet effective framework that seamlessly improves existing PSD methods by extracting detection features from the SAM-trained model rather than the conventionally trained model. Extensive experiments across multiple benchmarks demonstrate that our approach significantly improves detection performance under both strong and weak backdoor attacks, achieving an average True Positive Rate (TPR) gain of +34.3% over conventional PSD methods. Overall, we believe that the revealed correlation between the backdoor effect and detection performance could inspire future research advancements.

Published as a conference paper at ICLR 2026
RELIABLE POISONED SAMPLE DETECTION AGAINST BACKDOOR ATTACKS ENHANCED BY SHARPNESS AWARE MINIMIZATION
Mingda Zhang'
Mingli Zhu' Zihao Zhu'
Li Shen'
Baoyuan Wu
'School of Artificial Intelligence, The Chinese University of Hong Kong, Shenzhen
Shenzhen Loop Area Institute
3 "Shenzhen Campus of Sun Yat-sen University
ABSTRACT
This work investigates Poisoned Sample Detection (PSD), a promising defense approach against backdoor attacks. However, we observe that the effectiveness of many advanced PSD methods degrades significantly under weak backdoor attacks (e.g., low poisoning ratios or weak trigger patterns). To substantiate this obser- vation, conduct a statistical analysis across various attacks and PSD methods, revealing strong correlation between the strength of the backdoor effect and the detection performance. Inspired by this, we propose amplifying the backdoor effect through training with Sharpness-Award Aware Minimization (SAM). Both theoretical insights and empirical evidence validate that SAM enhances the activations of top Trigger Activation Change (TAC) neurons while suppressing others. Based on this, we introduce SAM-enhanced PSD, a simple yet effective framework that seamlessly improves existing PSD methods by extracting detection features from the SAM- trained model rather than the conventionally trained model. Extensive experiments across multiple benchmarks demonstrate that our approach significantly improves detection performance under both strong and weak backdoor attacks, achieving an average True Positive Rate (TPR) gain of +34.3% over conventional PSD methods. Overall, we believe that the revealed correlation between the backdoor effect and detection performance could inspire future research advancements.
INTRODUCTION
Deep Neural Networks (DNNs), while achieving remarkable success across a wide range of appli- cations (Yatbaz et al., 2023; Panagoulias et al., 2024; Shu et al., 2024), are vulnerable to backdoor attacks (Wu et al., 2025). In such attacks, adversaries inject a small number of poisoned samples into the training dataset (Gu et al., 2019), enabling the model to produce targeted malicious outputs when a hidden trigger is present. This poses safety risks in security domains such as autonomous driving, where even single malicious prediction can cause catastrophic consequences. Consequently, accurately identifying poisoned samples from training datasets is a fundamental defense objective.
Observation. To defend against data poisoning- based backdoor attacks, various pre-training stage poisoned sample detection (PSD) methods have been proposed (Wu al., 2023). General pre-training stage PSD approaches typically involve training a model on the potentially poisoned dataset and exploiting performance disparities in the feature space between poisoned and clean samples for detection (Chen et al., 2019; Tang et al., 2021; Hayase et al., 2021; Tran et al., 2018; Yuan et al., 2025). However, recent studies show that PSD methods can be bypassed when the poisoning ratio is low or the trigger is weak (Tang et al., 2021; Qi et al., 2023a; Zhu et al., 2024). We argue that the underlying cause is reduction in the backdoor effect, defined as the relative strength of trigger- induced neuron activations compared to activations from benign features, and measurable with the Trigger Activation Change (TAC) metric (Zheng al., 2022). Notably, a weak backdoor effect does not necessarily imply low attack success rate (ASR); in many cases, ASR remains high even as
"Corresponds to Baoyuan Wu (wuhaoyuan @ww...ddu.c).

---

Published as a conference paper at ICLR 2026
Detect: AUC: 5.02, Sucore: 0.43
Detact: AUC 0.55, Sucore: 0,20
Detect: AUC: 0.73, Secore: 0,30
Detect: AUC: 0.60, Sacore: 0.32
(Pa 1%, ASA 100.09)
TejerKNl (Poesning 196, AGR
Beedde (Slending AGR 68.75)
Reestedd (flleding ASR 09
Figure T-SNE visualizations of backdoor effects under high (clean, poisoned) and low (clean, poisoned) poisoning and blending ratios. Top-k TAC (Trigger Activation Change) quantifies the backdoor effect, where k = 30. AUC is the average ROC-AUC across different detection methods, and S-score is the Silhouette coefficient measuring separation between clean and poisoned samples.
detection performance deteriorates significantly. As shown in Fig. 1, strong backdoor effect yields well-separated feature clusters for poisoned and clean samples (first and third plots), facilitating detection, whereas weak effect results in cluster overlap (second and fourth plots), thereby degrading PSD performance. Empirical evaluations across diverse attack configurations further confirm a strong positive correlation between Top-k TAC and PSD performance (Pearson correlation = 0.73).
Motivation and Method. Building on the above observations, we address the challenge of detecting poisoned samples under weak backdoor conditions. Since defenders cannot alter trigger properties or poisoning ratios at the data level, we propose a new perspective: amplify the backdoor effect via the training of the model (used for feature extraction in PSD) to improve feature-space separability between clean and poisoned samples, thus enhancing PSD) performance. Our approach adopts an optimization-bo based strategy inspired by the sparse feature property of Sharpness-Aware Minimization (SAM) (Andriushchenko et al., 2023). SAM encourages sparse neuron activations by amplifying dominant activations while suppressing weaker ones. Theoretical and empirical analyses show that SAM increases the activation of top TAC-ranked neurons (i.e., neurons strongly associated with the backdoor trigger) while reducing the activation of others, thereby magnifying the backdoor effect. Leveraging this property, we design a SAM-enhanced, three-stage PSD pipeline: (1) train or fine-tune a model with SAM on the suspicious dataset; (2) extract backdoor-relates features from intermediate activations (e.g., TAC-ranked neurons); (3) apply an existing PSD) detector that leverages feature-space disparities to identify poisoned samples. Note that our framework is model aggoss-a and attack-independent, enabling scamless integration into existing PSD methodologies.
Contributions. Our work makes the following contributions: (1) We establish strong positive correlation between backdoor effect and PSD effectiveness, demonstrating that weak backdoor effects significantly degrade detection performance. (2) We propose a simple yet effective SAM-based training method that amplifies the backdoor effect, thereby increasing feature separability (3) We validate our approach through extensive experiments across diverse backdoor attack scenarios, showing that our SAM-enhancee pipeline consistently boosts multiple PSD methods, achieving an average True Positive Rate (TPR) gain of +34.3% over conventional PSD approaches.
and enhancing PSD performance.
2 RELATED WORK
Backdoor attack. Backdoor attacks aim to embed hidden malicious behaviors into models during training (Gu et al., 2019). Initial methods, like BadNets, add conspicuous triggers such as small patches to subset of training data and alter their labels target class. Subsequent research focused on enhancing attack effectiveness and stealth through more diverse trigger designs, ranging from subtle image blends modifications in the frequency domain (Chen et al., 2017: Li al., 2021b; Zeng et al., 2021). To further evade detection, a significant line of work explores clean-label attacks, which preserve the original labels of poisoned samples (Turner et al., 2019). More advanced techniques even ensure that poisoned and clean samples are indistinguishable at the feature level, thus making them exceptionally difficult to detect (Tang et al., 2021; Qi et al., 2023a; Liang et al., 2024).
Backdoor defense. Backdoor defenses are categorized into four stages. Pre-training defenses (Chen et al., 2019; Gao et al., 2019; Qi et al., 2023a; Ma et al., 2022; Yao et al., 2024) proactively purify the dataset before the model learns malicious behaviors. In-training (Li et al., 2021a; Gao et al., 2023; Liu et al., 2023) and post-training (Li et al., 2023; Zhu et al., 2023; Hu al., 2025; Wang
2

---

Published as a conference paper at ICLR 2026
al., 2024) defenses aim to build robust models repair compromised ones, respectively. Inference- time defenses (Guo et al., 2023; Hou et al., 2024) offer flexibility by detecting attacks on-the-fit without altering the model. Our work focuses on the proactive pre-training stage. In this stage, most methods identify poisoned samples by finding statistical deviations in their feature representations. For instance, some leverage feature clustering
spectral analysis for this purpose (Chen al., (Qi et al., 2023b) and perturbation-baat bbasd detection (Huang et al., 2023; Pal et al., 2024). While most pre-training defenses are sophisticated detectors, our work introduces novel enhancement paradigm. We leverage SAM during pre- pre-training to widen the feature gap between clean and poisoned samples, making them easier to detect. This fundamentally contrasts with FT-SAM (Zhu et al., 2023), which uses clean dataset for post-training model repair by suppressing backdoor effects. In contrast, our pre-training method uses the poisoned dataset to amplify these same effects to aid detection. Consequently, our method is not a new detector, but a plug-and-plas module that improves the efficacy of existing ones.
2019; Hayase et al., 2021). Other paradigms exist, such as learning-basee
Crrppness-Awarcs Minimization (SAM) is a training technique that improves model generalization by seeking flat, rather than sharp, minima in the loss landscape (Foret al., 2021). It achieves this by simultaneously minimizing both the loss value and the loss sharpness. Variants like ASAM (Kwon et al., 2021) and GSAM (Zhuang et al., 2022) offer alternative strategies to find these flat regions more efficiently. Beyond improving generalization, empirical studies have shown that SAM can also induce other beneficial properties in models, such as increased neuron sparsity and better compressibility (Andriushchenko et al., 2023).
Sharpness aware minimization.
METHOD
3.1
PROBLEM SETTING
Threat model. In this work, we consider data poisoning-basee backdoor attacks, where the attacker releases a poisoned training dataset D., to implant a backdoor into any model trained on it. Starting
from clean dataset De = {ar,, 31) j C X x y, where X' C RRd and y (0, 1,.... K 1} represent the input space and label set, the attacker selects subset Deub C Da to poison, with poisoning ratio p |Dal generation function g. and a target label V/, resulting in (œ: = g(x, (), The poisoned set Dpos replaces Daub in Det to form the final poisoned dataset D.r (Del (Dub)) DPpos.
[Dausl Each poisoned sample is generated using a predefined trigger A, a
Defender's goal. Defenders aim to detect the poisoned samples Dpoi within the released training dataset Der without knowing attack details (e.g.. the poisoning ratio p. the trigger A, and the generation function g). assuming defenders can access few clean samples. A common defense pipeline first trains a model via standard method (e.g., SGD) to extract features, then applies detection algorithm the extracted features. Our work introduces new paradigm by innovating in the first stage. Instead of passively accepting the features from standard training, we propose a new training methodology designed to amplify the feature diserepancy between clean and poisoned samples. This serves as foundational enhancement, boosting the performance of various subsequent detection methods.
3.2 ANALYSIS BETWEEN BACKDOOR EFFECT AND DETECTION PERFORMANCE
Backdoor effect measured by Top-k TAC. To measure backdoor effect, we use Trigger Activation Change (TAC) (Zheng et al., 2022) which quantifies the differences in activation values between poisoned samples and their corresponding clean samples in deep neural network (DNN). We denote
a DNN as fe = f(L) f((-1) ..... (1)., Given a clean input sample x and its poisoned counterpart
ã. TAC is computed using the following equation:
TAC (D)
1
Σ RED
(10
(
(1)
D
where j represents the j-th neuron in layer and D is the set of clean samples. According to the definition, the magnitude of TAC reflects the neuron's 's sensitivity to trigger. A higher TAC indicates that the neuron responds more strongly to trigger and can therefore be regarded backdoor neuron.
3

---

Published as a conference paper at ICLR 2026
Top-k TAC and AUC (PCC: 0.73)
Top-4 TAC and Silhouette Cocffiiinny (PCC: 0,87)
Backdoor effeet: Top-k TAC: 9.38
14-
-0.66
5-000 0031
Detect: AUC 0.60, Seccre 0.32
P-=0.51
Bleaded
Siluostt Codtiiiooy
6.40
A3C
4.35
Pilasoad
Backdour effect: Top- TAC: 11 1336
Detect: AUC-0.92 S-score: 0.42
0.8
Munde
Trojenao
10
11
Topeh TAC
Tops TAC
Figure 2: Correlation between backdoor effect and PSD performance on CIFAR-I0 with ResNet- 18 using k = 30 and poisoning ratios of 0.5%, 1% and 5%, quantified by Pearson correlation coefficient (PCC) and linear regression analysis. Left: AUC vs. Top-k TAC across different attacks and defenses, showing a positive correlation. Middle: Silhouette coefficient vs. Top-k TAC, indicating improved feature separability with stronger backdoor effect. Right: I-SNE visualizations showing that higher Top-k TAC leads to better separation between clean (purple) and poisoned (orange) samples, aligned with improved detection. (S-score is the Silhouette coefficient.)
To quantify the overall backdoor effect in the model, we consider the Top-k most responsive neurons in layer 1. The Top-k TAC is computed by averaging the TAC values of these top-k neurons:
1 Top-k TAC (D) = TTal
Σ TAC) (D), JET
(2)
where T' denotes the indices of the top-k neurons with the highest TAC values in layer L. In our method, we specifically select the final convolutional layer for this computation, as it typically provides the most discriminative features for distinguishing between clean and poisoned samples.
Backdoor effect and detection performance. To explore the relationship between the backdoor effect and detection performance, we manipulate the strength of the backdoor effect by adjusting the poisoning ratio across various attacks, using CIFAR- 10 dataset on ResNet- 18. We measure the backdoor effect using Top-k TAC and evaluate detection performance with AUC. As illustrated in Fig. 2, detection performance consistently declines as TAC decreases, with Pearson correlation coefficient of 0.73, indicating strong positive correlation. Regression analysis yields an R-squared' value of 0.54, indicating that TAC explains significant portion of the variance in detection accuracy.
To further understand the impact of backdoor effect on detection, we compute the silhouette coefficient, standard metric for evaluating how well two classes are separated in feature space. In our setting, it measures the separability between poisoned samples and target clean samples. As shown in Fig. 2, the silhouette coefficient increases with higher TAC, indicating that stronger backdoor effects lead to more distinct activation patterns between the two classes. The Pearson correlation coefficient between TAC and silhouette coefficient is 0.87, and the R-squared from regression analysis is 0.76, both supporting clear linear relationship. These findings confirm that stronger backdoor effects, as measured by higher Top-k TAC, lead more pronounced separation between poisoned and clean sample activations, suggesting that amplifying TAC through training modifications can enhance detection effectiveness even without prior knowledge of the specific attack. We provide additional results on other models and datasets, and a statistical analysis of the activation gap in our TAC formulation, in Sec. D.6 and Sec. D.5, respectively.
3.3 ENHANCING BACKDOOR EFFECTS VIA SAM
Backdoor learning with SAM. To enhance the backdoor effect during training, we adopt the Sharpness-Aware Minimization (SAM) optimization algorithm. Prior studies (Springer et al., 2024; Andriushchenko et al., 2023) have shown that SAM improves feature structure, such as producing lower-rank representations. Intuitively, SAM guides the learning process toward more discriminative
'R-squared measures the proportion of the variance in the dependent variable that is predictable from the independent variables regression model. A higher R-squared indicates a hetter fit of the model the data.
4

---

Published as a conference paper at ICLR 2026
Blended
SSBA
TrojanNN
TeGuss MMG
MeGume TaG Migus M00
MuGu <166,
10.0
2iGu Mage
Miga M
Diflerrese in TAC
Dilferrooe in TAC
Uifieenooo TAC
Difiortec 10
0.
7,5
5.0
2,5
900 Neuron Index Sorted by TAC
200
920
200
900
600 Neuron Index Sorted TAC
Neuroo Index Somied TNC
Neuron Index Sorted by IAC
Figure 3: TAC differences between models trained with SAM and Vanilla Training, Neurons are sorted by their TAC (descending) in each model. Blue bars and red bars indicate increased and decreased TAC by SAM, respectively.
directions in the representation space, thereby amplifying the activations of neurons responsive to the features. The SAM objective is formulated as:
min
max C(0 + +e), (E(EE
De.l E(m.)ED, {(J((;;; v)) is the cross-entropy loss, and p > 0 is a hyperparameter that controls the budget for weight perturbations. To illustrate the effect of SAM on backdoor learning, we compare TAC values between models trained with SAM and Vanilla Training across multiple backdoor attacks. As shown in Fig. 3, SAM consistently increases the TAC values of neurons highly responsive to the trigger (i.e., backdoor neurons), while reducing the TAC values of unrelated neurons. These results suggest that SAM selectively amplifies the most discrininative backdoor features by encouraging sharper activation patterns, thereby enhancing the backdoor effect.
where (())- 1
Theoretical analysis of SAM's effect. To better understand how SAM enhances the activation of backdoor-reland related neurons, we provide a theoretical analysis of its effect on activation. Specifically, compared to SGD, the SAM update rule can be approximated as (Andriushchenko et al., 2023);
VL(O.)
SGD r+1 = 0. - 7) V..,))
0+1 0: +p
VL()))1
where 17 is the learning rate and is hyperparameter to control the budget for weight perturbations.
To deepen our analysis of SAM's update mechanism, we adopt a simplified setting for theoretical tractability, Specifically, inspired by prior work (A (Andriushchenko et al., 2023), we consider two- layer ReI.U network, f(:; 0) the change in the pre-activation of the j-th hidden neuron, i.e., w x. While this setting simplifies complex deep architectures, it is instrumental in isolating and understanding the core mechanism by which SAM affects feature separation, providing us with key theoretical intuition. The universality of this intuition empirically validated on large-scale models in Fig. 3.
o a(Wzi æ). notated as f(0) for simplicity. Our analysis focuses on
We conduct a detailed theoretical decomposition of how the SAM update affects the rreaaciivtiion in Sec. 1. This analysis reveals that, compared to standard SGD, SAM's update introduces a crucial additional regularization term. Based on a further analysis of this term, we can explain how it alters the learning dynamics of specific neurons when encountering poisoned samples. This finding serves as the theoretical foundation for subsequent proposition regarding the TAC.
Proposition 1. Based on the definition of TAC in Eq. (1), the TAC of neuron j at step t is g(x, A) is a poisoned input with target label O. Suppose for all clean sample x E D and corresponding poisoned sample T,, the following o(w ,,)))
(D) Poj ExED w w ", where
conditions are satisfied: (i) ajet o' ('
(1- -1- (( I (0.))l2" (ii) a² (( = 0
and (iii) w.J.a < J. Compared with vanilla SGD, TAC change at step L of neuron j. for SAM increases by at least nP
(-(1 (-(1-s(f(e))) s(f().))) IV a,, o' o'w (w], ())..
Remark. Our theory reveals how SAM enhances specific "backdoor neurons". These neurons are defined by their response to poisoned sample z (target label 0): they activate on the poisoned input, remain inactive on clean ones, and possess a negative output weight. Our proof demonstrates that for neurons meeting these criteria, this occurs because SAM's optimization is driven to fit the
5

---

Published as a conference paper at ICLR 2026
poisoned data point precisely, which in turn selectively amplifies their pre-activations. This selective amplification is the core mechanism that raises the Top-k TAC, thereby increasing the feature separability between poisoned and clean data and boosting detection performance. Further analysis and proofs are detailed in Sec. 4.3 and Secs. A.2 and A.3, respectively.
3.4 SAM-ENHANCED PSD
Building on the above findings that (1) the backdoor effect is concentrated within a small set of neurons identified by Top-k TAC, highlighting its significance for detection and suggesting that defenders should leverage the feature information of these Top-k neurons, and (2) SAM can amplify this neuron-level effect, we propose SAM-enhaneed Poison Sample Detection (SAM-enhanced- PSD), a three-stage framework designed to improve downstream detection:
Stage-1: Backdoored model training. Train a backdoored model Sasu using SAM via Eq. (3).
Stage-2: Backdoor-related feature extraction. For each input, we get the intermediate features g ( (z)). Because the defender lacks ground-truth TAC indices, we apply feature extraction, which is validated to enhance detection in prior work (Hayase et al., 2021), to simulate backdoor- related features. Specifically, we compute scaled features as g² E E-122 Pg. where P is PCA projection matrix estimated from the training data, and Σ is a covariance matrix estimated from a reference clean set along with dynamically filtered candidate clean samples. A detailed comparison between this PCA- surrogate and the true Top-k neuron features is given in Sec. 4.3.
Stage-3: Integrating with off-the-shelf PSD. Apply an off-the-shelf PSD method (e.g., Activation Clustering) using the extracted features g as input.
The full algorithmic details of SAMM-enaacced PSD are provided in Sec. A.4.
EXPERIMENT
4.1 EXPERIMENTAL SETUP
Attack settings. In this study, we evaluate the efficacy of backdoor attacks within an experimental framework. Specifically, include thirteen backdoor attack methods: BadNets (Gu al., 2019), both in its class-specific (BadNets-A2O) and universal forms (BadNets-A2A), Blended attack (Chen al., 2017), 7), Label-consistent attack (LC) (Turner et al., 2019). freeunnyyy attack (LF) (Zeng backdoor attack (SSBA) (Li et al., 2021b), Targeted contamination at-
et al., 2021), Sample-specine tack (TaCT) (Tang et al., 2021), 1), Staptive-Blend attack (Adap-Blent (Qi et al., 2023a), Trojan attack (TrojanNN) (Liu et al., 201 8). Warping-based attack (WaNet) (Nguyen & Tran, 2021) 1), Input-aware dy- namic backdoor attack (Inuut-wwar) (Nguyen & Tran, 2020), Bit-per-pixel attack (aacck/BpAttteee Atpaktack) (Wang all,,2021 2022), and dubbed sparse and invisible backdoor attack (SIBA) (Gao et al., 2024). Each attack configured according to the default settings provided by BackdoorBench (Wu et al., 2025). The ex- perimental evaluation conducted three benchmark datasets: CIFAR-10 (Krizhevsky et al., 2009), Tiny ImageNet (Russakovsky et al., 2015), and GTSRB (Stallkamp et al., 201 1), and implemented on three neural network architectures, namely ResNet18 (He et al., 2016), VGG19-BN (Simonyan & Zisserman, 2014) and DenseNet-161 (Huang et al., 2017). Due to space constraints, the results for Tiny. VGG19-BN and DenscNet-161 are presented in Sec. C. and Sec. C.2. For our experiments, we set the poisoning ratio uniformly at 5% across all attack types, and the target label of BadNets-A2A reassigned to y (y + 1) mod K for each class y, where K represents the total number of classes. However, the LC attacks, which only poison clean samples within the target class, can only be implemented for CIFAR-IO. We consider weak backdoor attacks as those whose poisoning ratio is low (e.g., 1% or 0.5%), or those with weak trigger strength (e.g., Adap-Blend).
Detection settings. In this study, we systematically evaluate the effectiveness of our proposed SAM- enhanced PSD, combined with a wide range of backdoor detection methods including Activation Clustering (AC) (Chen et al., 2019). Beatrix (Ma et al., 2022), SCAn (Tang et al., 2021) Spectral Signature (SS) (Tran et al., 2018), and Spectre (Hayase et al., 2021). Additionally, it is presumed that small. clean dataset can be utilized to aid the detection process, common practice in recent studies (Ma et al., 2022; Gao et al., 2019; Huang et al., 2023; Tang et al., 2021). For a balanced evaluation, each class in this auxiliary clean dataset contains 250 samples, which are carefully selected

---

Published as a conference paper at ICLR 2026
Table I: Detection comparisons (measured by TPR (%). FPR (%) and F1 (%) between base PSD and SAM- enhanced PSD (+SAM) on CIFAR-10 10 and ResNet18, 88 and the hetter result in each pair is highlighted in bold. In terms of cach metric, the average change of SAM-enhanced PSD to hase PSD across all attacks is presented at the bottom: performance improvements are highlighted in green, other changes in red.
Dosetion +
Specte// / 1-SAM
SCAn/ -SAM
SS 45/4
AC/ AC/+SAM
Beatri +SAM
Amack 1
IPR
FPR
F1
TPR.
FPR.
F11
TFR.
FPR
F1
TFR
EPR
F1
TPR
FPR.1
F1
BalNet
51.18854
4.90299
42.0/72.
96.09552
0.000.0
95.097..6
70.3992.3
2,4/1.2
65.6685.5
96.89154
0,1/13.3
47.1442.5
36.6/98.8
5,NN,5
44.894.5
Blended
29.98997
6.0444
24.544.0
99.2967
0.009.
99.629.3 3
12.99446
4.4/1.1
30.7
2.39K88
1.72119 19
1.5166.
509998
5.015
5.087.
16.67288
5.6.77
48.1899.
0.009,0
95.998.2
1.9/1.4
74.5
99.396.5
3.N16.
76.1256.
5,09.4
15.8995
$2,054.1
5.64.7
26.344.5
0,009,0
07.09%.0
2.5115
65.2000
10,4/005
08.7448.7
2.498.8
5,00988
Adap
24.1N5.9
5.63.7
20.9/5..0
02.597.3
10.500.5
27.3449L
20.2/9..
4.5/1.2
19.685
1.597.11
7
1.2:57.0
6.299.9
5.08.2
6.2/56.1
LC
17,041.7
4.30.0
17.3/4.9
100,099.9
0.0/2.0
100,099.9
40.5/47.5
2.3/1.7
45.0/53.2
0.0/38.00
0.0400
0L0/200.0
22,99,9
5,033
2.27666
TACT
66.1778.6
7/02233
26.9778.
100.00100.0
0.000.0
100.0/000.0
42 3/63/46.4
4.33377
38. 144.7
100,0/1000
0.1.A
90.50
00.5/300.0
13.4/100
5.02266
12.98802
TrijaNNN
50.2662.4
5.044,3
24.5/51.3
100.0/000,0
0.009.0
102,0/100,0
63:499..3
2,8/1
38.7/9..
95,5/100.0
3.2/12.0
76.7446.
4.0/100.0
5.03.5
4.675.3
WerNet
06.4997.7
4/122.6
54.3/99.2
66. 39IL1
0.009,0
79. 2948
31 1/668/
1.500.7
71.488.9
19.199.1
0.00/
91. 979.8
1//98.5
5,05,0
1.2465.7
Taput
53,999.0
4.7/2.5
44.2.0.2
97.69%4
83.5/22.
3.49844
5.05.0
3.4/67.0
Bpp/kmnc
21,5/48.3
6.315.4
17.5/33.
0.009,0
93.998.
0.5404
15.7/
94.29666
0.00
97. 37,09863
0.1/99,
5,055
0.1467.7
SIBA
50.0M5.3
6.04.11
24.6/3.6
98. 79
0.009.0
99,399
72.9/915
1,200,3
29.2
96 06.9/95.9
0.00.0
98.
4.3/0.3
5.05.
4.3663.3
RadNertoA2A
(90 99.5999.6
10.0/003
49.7/49.8
0.000.0
0. 100.0
0.00.0
99 4/994
10.6/1.6
49. 7/49.
97.8995
0.00.0
98.9998
3/9.
5/00.00
24 64.13113
Average
+30.6
-1.7
+26.1
43.2
-0.0
+1.9
+20.5
-1.1
+19.4
+29.8
+3.0
+13.7
+87.4
-188
+68.1
from the test dataset. Furthermore, as demonstrated in the Sec. D.2.2, our method remains robust even when using limited, sifted, or cuttrf--distibbution auxiliary clean data.
Evaluation metrics. We adopt three common metrics to measure the detection performance: True Positive Rate (TPR), False Positive Rate (FPR) and F1 score. Higher TPR and Fl scores indicate better performance, while lower FPR denotes better.
4.2 MAIN RESULTS
Table 2: Detection comparisons (%) between base PSD and SAM- enhanced PSD (+SAM) GTSRB and ResNet18 (same evaluation setup as Tab. 1).
Effectiveness of SAM-en- hanced PSD. To validate the effectiveness of the SAM-
enhanced PSDD, we demonstrate the effects of different PSDs as well these combined with SAM-enhanced PSD on CIFAR-10 and GTSRB datasets, as shown in Tab. and Tab. 2, respectively. 1 The SAM-enhanced PSD generally enhances various base off-the- shelf PSDs, as indicated in Tab. 1
Desection
SCAs/ /SAM
AC/-SAM
Beatris / -SAM
A
TPR
TPR
HPR
P1
BadNeu Blendal
97.89122
0.000.0
98.9/95.4
99.49910
0.200.3
96.3992.
25
5.155
23.2/67.5
88.0/996
0.008.
9/99/
0.0/99.7
0.2/0.2
0.0/984
46.9/100.0
S.1/5.1
686666
SSBA
100,997.3
(LC/8.0
100.0/9.7
91.1/9..4
0,103
94.0%%6.
35.77100.0
5.1/5.0
30.8/67.6
LF
91,2/85.8
0.009.
95.4/22.1
0.0/8.9
0.2/1.1 0.0082.
32,5999.5
5.1/5.1
28.4667.4
Adap Bland
Adap-Bland
99,897.6
13.5/0.0
43.799..
33.39968
0.3/0.3 90.9/95.3
97.99999
4.5/4.5
69.0/69.9
TiojaNNN
99.3/99.9
(1O/N.0)
100.0/0000
98.3/99.
0.4 95.499..2
36,8/100.1
5.1/5.1
51.6/67.66
WaNet
D.V71.1
(LLN9.0
0,083.1
0.0/2.6
0,1/37 0.07780
5.1/5.1
6.2/61.2
Input-oware
98.5/98 2
0.3
98.7988
95.8/93.
0.2/2. 95.6/90.9
30.1/91.9
508500
26/683888
BypAItsck
99.8/96.8
3.10
77.29930
99.9/83.0
0 0.5 95.5186.7
7
97,2/97.8
5.01500
66 3/66.6
SIBA
99.399.6
0L0/8.
99.79993
91.79996
0,3/05 93.095500
13.2/100.0
12.6/67.6
BadNNets A2A
0.000.
0.009.0
0.0/0.0
12.1/
0,0M00 95.9/97.0
23.7/100.0
5.N5.1 54.7/67.6
Avenge
+4.7
-1.5
+13.8
+24.3
40.4
+22.1
+52.7
-0.0
+31.5
and Tab. 2. For CIFAR-IO, we improved the True Positive Rate (TPR) by over 25% for four detection methods. Averaged over 13 attack types and 5 detection methods on the CIFAR-10 10 dataset, our approach yields a 34.3% improvement in TPR. On GTSRB, we enhanced the detection performance of most methods, with increases in TPR exceeding 20% for two methods. @ For methods like Spectre, SS and Beatrix, which are based on anomaly detection, SAM-enhanced PSD increases the prominence of poisoned samples at backdoor neurons relative to clean samples, making these samples more anomalous and thus enhancing detection. In GTSRB, the number of poisoned and target clean samples is similar, which breaks the key assumption of unomaly-basee methods like Spectre and SS. In addition, since neither method leverages a surrogate clean dataset, they lack the reference needed to discriminate poisoned inputs. We exclude them from our evaluation. O For the SCAn method, our approach shows significant improvements, especially under attacks where SCAn typically underperforms, such as WaNet. Since SCAn requires identification of the target label, cannot detect BadNets- A2A. @ For the AC, since poisoned samples in backdoor-related neurons, it causes poisoned samples deviate more from clean samples and cluster more tightly, thereby enhancing detection effectiveness. We also design an adaptive attack targeting our method and, as detailed in See. C.5, demonstrate that an attacker who cannot alter the training process cannot weaken our detector. Furthermore, retraining on the purified dataset confirms our defense's s effectiveness in Sec. C.6.
PSD increases the activation of
Performance under different poisoning ratios. To evaluate the impact of the poisoning ratio on the SAM-enhanced PSD, especially in the case of what we consider to be weak backdoor attacks, we present the average detection performance of four detection methods under all attacks CIFAR-10
7

---

Published as a conference paper at ICLR 2026
Bearix
Prisazing Ralo
Passoiing Robio
0300 Pulianin Baia
Priloning Rako
+301
SAM
Prbsesin
M
Paleniia Raioo
Figure 4: Detection performance of base PSD (w/o SAM) and SAM-enhanced PSD (w SAM) under different poisoning ratios on CIFARIO and ResNet18.
Blended wio SAM
LF weo SAM
Ullended we SAM
LT wio SAM
Dunate w/ SAM
Blosded wi SAM
LF SAM
Blanded SAM
Paacal
Palasod
Figure 5: Left: t-SNE under different attacks in models trained with Vanilla training (Top row) and with SAM (Bottom row). Right: Distribution of distances between the target clean samples center and each sample in models trained with Vanilla training (Top row) and with SAM (Bottom row) under various backdoor attacks on CIFAR-IO and ResNet18.
and ResNet18, 8, as shown in Fig. 4. The selected range for the poisoning ratio is (0. %, 0.5%, 1%, 5% SAM-enhanced PSD enhances detection performance across different poisoning ratios as illustrated in Fig. 4. Notably, when the poisoning ratio is low such as 0.5% and 1% SAM-enhanced PSD significantly improves the performance of PSDs. @ When the poisoning ratio is 0.1 ,,, even though SAM-enhanced PSD improves performance, its average True Positive Rate (TPR) does not exceed 60%. The average attack success rate is only 31.8%, meaning a complete backdoor canmot form, which makes poisoned samples harder to detect. Detailed results provided in See. C.3.
4.3 ANALYSIS OF SAM-ENIANCEED-SSI
Ablation study in SAMMenhanced PSD. As shown in Tab. 3, we evaluate the impact of sharpness-aware minimization (SAM) and backddor-related feature extraction (BRF) on the detection of backdoor attacks.. Integrating SAM significantly enhances detection effectiveness by increasing the feature gap between clean and poi- soned samples. Incorporating BRF pushes perfor- mance further by concentrating on the dimensions that are most informative for recognizing poisoned samples, thereby making the backdoor pattern more salient. Combining SAM and BRF provides both stronger feature separability and a focus on backdoor-relevas directions, yielding the best results against both attack types.
Table 3: Ablation study with different components of SAMe-enhanced PSD under various backdoor attacks and base PSDs on CIFAR- 10 and ResNet18.
Detection
SAM
BRF
TPR((E)
SS
FPR(7)
TPR(75)
Beatris
FPR(5)
70.8
2.4
56.6
5.0
BadNets
x
72.8
1.2
67.0
5.11
92.3
1.2
98.8
0L.
Blended
90.6
60.4
1.9
27.1
74.8
5.0
5.11
94.6
1.1
99.8
1.5
Effect of SAM on feature-space separation between poisoned and clean samples. To gain deeper understanding of the impact of the SAM on poisoned and clean samples, we conduct a detailed analysis and visualization of the distribution of samples in the feature space in Fig, 5, O t-SNE visualization: As shown on the left of Fig. 5, we demonstrate, through t-SNE, the distribution of poisoned and target clean samples in the feature space, where observe that after training with
8

---

Published as a conference paper at ICLR 2026
Iikeda
1F
XYDA
140
TAQ
2.3
200
30
180
20
600
250
100 300 400
20 30
50
Figure 6: Pearson correlation between PCA component loadings and TAC scores under four different backdoor attacks on CIFARIO 10 dataset with ResNet18 model. Each point represents the Pearson correlation between the neuron loadings of the i-th PCA component and the neuron-wise TAC scores.
the SAM, poisoned samples are more distinctly separated from the target class. @ Distribution of distances between the target clean sample center and each sample: The center of the target clean samples is defined by the average of their features within the current model. As illustrated on the right of Fig. 5, in models trained with vanilla training (SGD), the features of poisoned samples are closer to the center of clean samples compared to those in models trained with SAM, which increases the difficulty in distinguishing between poisoned and clean samples. Sec. D.7 provides additional t-SNE visualizations of various attacks. These results show that, after training with the SAM. poisoned samples are much more clearly separated from the target class in feature space.
Relationship between Top-k TAC neurons and principal components. We analyze the alignment between the Top-k TAC neurons and PCA components to investigate how effectively BRF captures backdoor-relevan information. Specifically, we calculate the Pearson correlation coefficients coIr (1(), t) between each principal component's 's loading vector 1(() and the corresponding TAC score vector t. By plotting these correlations for various attacks (see Fig. 6), we consistently observe that the strongest correlations occur among the initial principal components and gradually diminish as we move toward components with lower variance contributions. This indicates that neurons with higher TAC values have larger loadings in the leading principal components, thus confirming that BRF effectively captures the backdoor-relater signals embedded in the Top-k neuron subset.
Additional analyses in appendix. To further validate the robustness of method, we provide several complementary analyses in Appendix Secs. C and D. O Adaptive attack. We evaluate our framework under stronger adversary with full knowledge of the SAM-based training procedure, who explicitly optimizes the trigger to minimize the caature-spce gap. Even in this challenging setting, our method consistently achieves over 94% TPR across multiple detectors, whereas baseline performance drops to near zero. This result indicates that the proposed defense is difficult to circumvent unless the attacker can directly control the entire training process (details in Sec. C.5). Computational efficiency. Standard SAM approximately doubles training time. We demonstrate that our framework is fully compatible with efficient variants such as MSAM, which deliver comparable detection gains while incurring almost additional runtime relative to the bascline. This ensures the method remains both effective and practical for real-world deployment (details in Sec. D.4). @ Stability and data flexibility. We examine performance sensitivity to hyperparameters and SAM variant choices, finding the results to be stable across settings. Importantly, the method maintains strong detection performance even with limited clean samples, "sifted-clean" data extracted from the poisoned set, or entirely out-of- offdistribuuton auxiliary data. These findings highlight the flexibility and practical utility of our approach in diverse application scenarios (details in Secs. D.1 to D.3).
CONCLUSION
This work revisits existing poisoned sample detection (PSD) methods and finds that they often struggle against weak backdoor attacks, such as those with low poisoning ratios or weak trigger strengths. Our statistical analysis reveals a positive correlation between the strength of the backdoor effect and detection performance. Based on this finding, we propose to amplify the backdoor effect by training the model using Sharpness-Awe Aware Minimization (SAM), without changing the poisoning ratio trigger strength, thereby making poisoned samples more detectable. Our method, called SAM- enhanced PSD, integrates easily with any feature- based PSD method. Experiments on diverse datasets and network architectures show that our method significantly improves detection performance. This work contributes to defending against backdoor attacks in deep neural networks, providing a new perspective that complements existing detection methods and has the potential to inspire further research in this critical area.

---

Published as a conference paper at ICLR 2026
ETHICS STATEMENT
Our research ethically motivated by the need to enhance the security of AT systems in critical applications, as vulnerabilities like backdoor attacks pose significant risks public safety and trust. We acknowledge the dual-use nature of security research; however, our work is fundamentally defensive its aim create more robust detection methods. By publicly sharing these findings, we intend to empower the security community, believing the positive impact of creating more trustworthy Al outweighs the potential for misuse.
REPRODUCIBILITY STATEMENT
To ensure our results are reproducible, all experiments were conducted using public benchmarks such as the CIFAR-16 10 and GTSRB datasets with standard models like ResNet-18, all within the BackdoorBench framework. We have documented the specific configurations for all thirteen attack types and five detection methods evaluated. Key hyperparameters for both conventional SGD and SAM-based training, along with detailed pseudocode for our method, are provided in the paper and its appendix to allow for the complete replication of our findings.
ACKNOWLEDGGENTS
Baoyuan Wu is supported by Guangdong Basic and Applied Basic Research Foundation (No. 1044B1115000993 Guangdong Provincial Program (No. 2023TQ07A352), Shenzhen Science and Technology Program (No. RCYX20210609 0020022000100057055 103057050 and JCYJ202408131 13300000 I), and Longgang District Key Laboratory of Intelligent Digital Economy Security.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Maksym Andriushchenko, Dara Bahri, Hossein Mobahi, and Nicolas Flammarion. Sharpness-awarc aware minimization leads to low-rank features. Advances in Neural Information Processing Systems, pp. 47032-47051, 2023.
Marlon Becker, Frederick Altrock, and Benjamin Risse. Momentum-sam: Sharpness aware mini- mization without computational overhead. arXiv e-prints, 2024.
Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig. Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. In Workshop on Artificial Intelligence Safety. CEUR-WS, 2019.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep
learning systems using data poisoning. arXiv e-prints, 2017.
Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware minimization for efficiently improving generalization. In International Conference on Learning Representations, 2021.
Kuofeng Gao, Yang Bai, Jindong Gu, Yong Yang, and Shu-Tas Tao Xia. Backdoor defense via adaptively splitting poisoned dataset. In Conference on Computer Vision and Pattern Recognition, pp. 4005-4014, 2023.
Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Annual Computer Security Applications Conference, pp. 113-125, 2019
Yinghua Gao, Yiming Li, Xueluan Gong, Zhifeng Li, Shu-Tao Xia, and Qian Wang. Backdoor attack with sparse and invisible trigger. IEEE Transactions on Information Forensics and Security, 2024.
Tianyu Gu, Kang Liu, Brendan Dolan Gavitt,, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, pp. 47230-47244, 2019.
Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency, In International Conference on Learning Representations, 2023.
Jonathan Hayase, Weihao Kong, Raghav Somani, and Sewoong Oh. Spectre: Defending against backdoor attacks using robust statistics. In International Conference on Machine Learning, pp. 4129-4139, 2021.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Conference on Computer Vision and Pottern Recognition, pp. 770-778, 2016.
Linshan Hou, Ruili Feng, Zhongyun Hua, Wei Luo, Leo Yu Zhang, and Yiming Li. Ibd-psc: Input-level backdoor detection via carameter-oriented scaling consistency. arXiv e-prints, 2024.
Mengxuan Hu, Zihan Guan, Yi Zeng, Junfeng Guo, Zhongliang Zhou, Jielu Zhang, Ruoxi Jia, Anil Kumar Vullikanti, and Sheng Li. Mind control through causal inference: Predicting clean images from poisoned data. In International Conference on Learning Representations, 2025.
Gao Huang. Zhuang Liu, Laurens Van Der Maaten, and Kilian Weinberger. Densely connected convolutional networks. In Conference on Computer Vision and Pattern Recognition, pp. 4700- 4708, 2017.
Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, and James Bailey. Distilling cognitive backdoor patterns within an image. In International Conference on Learning Representations, 2023.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. Master's thesis, University of Tront, 2009.
Jungmin Kwon, Jeongseop Kim, Hyunseo Park, and In Kwon Choi. Asam: Adaptive sharpness- minimization for salle-ivvaiiatt learning of deep neural networks. In International Conference on Machine Learning, pp. 5905-5914, 2021.

---

Published as a conference paper at ICLR 2026
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-backdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems, pp. 14900-14912, 2021a.
Yige Li, Xixiang Lyu, Xingjun Ma, Nodens Koren, Lingjuan Lyu, Bo Li, and Yu-Gang Jiang. Reconstructive neuron pruning for backdoor defense. In International Conference Machine Learning, pp. 19837-19854, 2023.
Yuezun Li. Yiming Li, Baoyuan Wu, Longkang Li. Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In International Conference on Computer Vision, 2021b.
Siyuan Liang, Mingli Zhu, Aishan Liu, Baoyuan Wu, Xiaochun Cao, and Ee-Chien Chang. Badelip: Dual-embedding guided backdoor attack multimodal contrastive learning. In Conference on Computer Vision and Puttern Recognition, pp. 24645-24654, 2024.
Min Liu, Alberto Sengiovvanni-iiceneelle and Xiangyu Yue. Beating backdoor attack at its own game. In International Conference on Computer Vision, pp. 4620 4629, 2023.
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In Network and Distributed System Security Symposium, 2018
Wanlun Ma, Derui Wang, Ruoxi Sun, Minhui Xue, Sheng Wen, and Yang Xiang. The" beat- rix" resurrecction: Robust backdoor detection via gram matrices. arXiv e-prints, 2022.
Maximilian Mueller, Tiffany Vlaar, David Rolnick, and Matthias Hein. Normalization layers all that sharpness- aware minimization needs. Advances Neural Information Processing Systems, pp. 69228 69252, 2023.
Preetum Nakkiran, Behnam Neyshabur, and Hanie Sedghi. The deep bootstrap framework: Good online learners are good offline generalizers. arXiv preprint arXiv:2010.08127, 2020.
Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems, pp. 3454-3464, 2020.
Tuan Anh Nguyen and Anh Tuan Tran. Wanet - imperceptible warping-based backdoor attack. In International Conference on Learning Representations, 2021.
Soumyadeep Pal, Yuguang Yao, Ren Wang. Bingquan Shen, and Sijia Liu. Backdoor secrets unveiled: Identifying backdoor data with optimized scaled prediction consistency. International Conference Learning Representations, 2024.
Dimitrios Panagoulias, Maria Virvou, and George Tsihrintzis. Evaluating Ilm generated multi- modal diagnosis from medical images and symptom analysis. arXiv e-prints, 2024.
Xiangyu Qi, Tinghao Xie, Yiming Li, Saced Mahloujifar, and Prateek Mittal. Revisiting the as- sumption of latent separability for backdoor defenses. In International Conference on Learning Representations, 2023a.
Xiangyu Qi, Tinghao Xie, Jiachen Wang, Tong Wu, Saeed Mahloujifar, and Prateek Mittal. Towards a proactive {ML} approach for detecting backdoor poison samples. In USENIX Security Symposimm pp. 1685-1702, 2023b.
Olga Russakovsky, Jia Deng. Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, al. Imagenet large scale visual recognition challenge. International Journal of Computer Vision, pp. 211 1-122, 2015.
Zhiyao Shu, Xiangguo Sun, and Hong Cheng. When Ilm meets hypergraph: A sociological analysis on personality via online social networks. In ACM International Conference on Information and Knowledge Management, pp. 2087-2096 2024.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv e-prints, 2014.
12

---

Published as a conference paper at ICLR 2026
Jacob Mitchell Springer, Vaishnavh Nagarajan, and Aditi Raghunathan. Sharpness-awan minimiza- tion enhances feature quality via balanced learning. In International Conference on Learning Representations, 2024.
Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian lgel. The german traffic sign recognition benchmark: multi-class classification competition. In International Joint Conference Neural Networks, pp. 1460, 2011.
Di Tang, XiaoFeng Wang, Haixu Tang, and Kehuan Zhang. Demon in the variant: Statistical analysis of {DNNs} for robust backdoor contamination detection. In USENIX Security Symposium, pp. 1541-1558, 2021.
Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. Advances in Neural Information Processing Systems, 2018.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv e-prints, 2019.
Hang Wang, Zhen Xiang, David J Miller, and George Kesidis. Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using maximum margin statistic. In 2024.
Symposium on Security and Privacy, pp.
Zhenting Wang. Juan Zhai, and Shiqing Ma. Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning. In Conference on Computer Vision and Pattern Recognition, pp. 15074-15084, 2022.
Kaiyue Wen, Tengyu Ma, and Zhiyuan Li. How does sharpness-aware minimization minimize sharpness? arXiv e-prints, 2022.
Baoyuan Wu, Shaokui Wei, Mingli Zhu, Meixi Zheng, Zihao Zhu, Mingda Zhang, Hongrui Chen, Danni Yuan, Li Liu, and Qingshan Liu. Defenses in adversarial machine learning: A survey, arXiv e-prints, 2023.
Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, Mingli Zhu, Ruotong Wang. Li Liu, and Chao Shen. Backdoorbench: A comprehensive benchmark and analysis of backdoor learning. International Journal of Computer Vision, pp. 1-88, 2025.
Zhen Xiang, Zidi Xiong, and Bo Li. Cbd: A certified backdoor detector based on local dominant probability. Advances in Neural Information Processing Systems, 36:4937-49511 2023.
Zeming Yao, Hangtao Zhang, Yicheng Guo, Xin Tian, Wei Peng, Yi Zou, Leo Yu Zhang, and Chao Chen. Reverse backdoor distillation: Towards online backdoor attack detection for deep neural network models. IEEE Transactions on Dependable and Secure Computing, 2024.
Hakan Yekta Yatbaz, Mehrdad Dianati, and Roger Woodman. Introspection of dnn-based perception functions in automated driving systems: State-of-the-art and open research challenges. IEEE Transactions on Intelligent Transportation Systems, 2023.
Danni Yuan, Mingda Zhang, Shaokui Wei, Li Liu, and Baoyuan Wu. Activation gradient based poisoned sample detection against backdoor attacks. International Conference Learning Representations, 2025.
Yi Zeng, Won Park. Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks' triggers: frequency perspective. In International Conference on Computer Vision, pp. 16473-16481, 2021.
Yi Zeng, Minzhou Pan, Himanshu Jahagirdar, Ming Jin, Lingjuan Lyu, and Ruoxi Jia. [Meta-Sift]: How sift out a clean subset in the presence of data poisoning? In 32nd USENIX Security Symposium (USENIX Security 23), pp. 1667-1684, 2023.
Runkai Zheng, Rongjun Tang, Jianze Li, and Liu. Data-free backdoor removal based on channel lipschitzness. In European Conference on Computer Vision, pp. 175-191, 2022.
Mingli Zhu, Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu. Enhancing fine-tuning based backdoor defense with sharpness-awar minimization. In International Conference on Computer 2023.
Vision, pp.
13

---

Published as a conference paper at ICLR 2026
Mingli Zhu, Siyuan Liang, and Baoyuan Wu. Breaking the false sense of security in backdoor defense through re-activation attack. In Conference on Neural Information Processing Systems, 2024.
Juntang Zhuang, Boqing Gong, Liangzhe Yuan, Yin Cui, Hartwig Adam, Nicha C Dvornek, James Duncan, Ting Liu, al. Surrogate gap minimization improves sharpness-awai training. In International Conference on Learning Representations, 2022.
14

---

Published as a conference paper at ICLR 2026
Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by
Sharpness Aware Minimization
Appendix
A Details of SAM-enhanced PSD
17
A.1 Theoretical analysis of the SAM update mechanism
17
A.2 Proof of the Lemma 1
17
A.3 Proof of the Proposition 1
18
A.4 Detailed algorithm of SAM-enhanced PSD
19
Details of experiment settings
20
B.1
Detailed training settings
20
B.2 Detailed attack settings
20
B.3 Detailed detection settings
Additional experiment results
C.1 Main experiments on Tiny ImageNet
21
C.2 Main experiments on different models
21
C.3
Experiments under different poisoning ratios
22
C.4 Analysis with non-feature-based detectors
22
C.5 Adaptive attack
23
................................
C.6
Performance the model trained by filtered data.
................................
25
C.7
Comparison with inference-time detection methods
................................
25
Additional analysis of SAM-enhaned-PPSD
26
D.1 Detection performance with different p
26
D.2 Detection performance on different parameters of extracting backdoor- feature
27
D.2. Impact of feature dimension
27
D.2.2 of the surrogate dataset
27
D.3 Detection performance with different SAM variants ................................
28
D.4
Computational analysis
29
D.5 Statistical analysis of TAC values
29
D.6
Generalization the TAC-Detection Correlation
30
15

---

Published as a conference paper at ICLR 2026
D.7 t-SNE visualization.
30
E The Use of Large Language Models
31
16

---

Published as a conference paper at ICLR 2026
A DETAILS OF SAM-ENHANCED PSD
A.1 THEORETICAL ANALYSIS OF THE SAM UPDATE MECHANNSSM
For theoretical tractability, we consider two-layer ReLU network defined as ((; = a simplified as [()), with logistic loss E(O) to adapt to our task. Here, W = 1 umm represents the weight matrix of the first layer. We analyze the pre-activation value each hidden neuron j. defined as w
o (Wax)
According to the SAM update rule, SAM introduces an extra second-order perturbation compared to SGD. This update acts the step-t weight wy of neuron and, in turn, changes its pre- aetiviivvtion w;, i. As stated in the lemma below, the one-step change splits into three parts: one SGD part plus two SAM parts.
Lemma 1. At training step t, the change in the pre-activation of neuron approximately splits into:
w j,t41 3 n + +
where
ja o' x (s(f(0,)) - y) is the standard SGD update.
sigu( (f))) u) ((f() ((f (V o' 2 fitting term, and
||01 ( is the SAM data-
- -(((((())) 1 |
(V)() acts as a SAM regularization component.
where = = 1/(1 exp(-2)) is the sigmoid function.
The decomposition above provides the foundation for the proposition mentioned in the main text. Without loss of generality, let's assume the target label for a poisoned sample á = 0. For any neuron j that is activated by this input (i.e., o (ww) (=,,.) layer weight Oj.t < O, the sum the data-fitting term and the regularization term may be positive (2 + @ 0).
0) and has corresponding second-
This causes the SAM update to push the neuron's 's pre-activation more strongly than the SGD update would, potentially leading positive change in TAC. This observation clarifies the core idea of our proposition that SAM influences the model's 's feature representation by amplifying the activations of specific neurons.
A.2 PROOF OF THE LEMMA
Proof. Considering the sample is (x, y). We have for the update of SAM:
V V((O.)
VE(()))
V((O,)
(5)
=(((0,) + (V (V((0.)] (p²))
V [<(0.)+/\V(00..)) (p²))
Thus, under the first-order approximation, a step SAM corresponds to gradient update on the regularized objective {(0.) + pl Ve(0.) Now recall that the layerwise gradients of two-layer ReLU network can be written as:
a. ((0.) (x{{((0) v) (Wrr), V Wyy ((0,) (s((((,)) y) "3,10' (w (w) x.
(6)
(7)
where s(f(O:)) 1teap(-f(0n)
17

---

Published as a conference paper at ICLR 2026
Then direct computation gives us the following expression for the full gradient norm:
Ve(O)lle =(s(f(0,)) yl |V
(8)
=I=({(0,) wl (l ,2)ll + ||0|| |a,, o (P(Waa))3
where @ denotes dlement-wise multiplication. Then the update of w for neuron j on each step of SAM with step size can be written as:
W1,41 =0 (V)0) - (
w,1+1 3 - ((s(((0)) v)) (w),
npsign(s(f(O.)) - -( npls(f(0.)) / (w))
(w),aa) a (w) a x 00
where we used the fact that (w [w],a²) ( = a (w x) and second-order terms are zero almost everywhere for ReLUs. The refers to the radius of perturbation. If sufficiently small, Opp²) is negligible relative to other terms in Eq. (3) of the manuseript. The assumption of sufficiently small p commonly used to analyze the property of SAM in the community(Wen al., 2022). The activation of Neuron can be approximately updated by:
w j,41 -w u. - n03a 100= (s(s(0.)) v) np sigu(s(f(0.)) v) - s(f( o d(wwJ..) ||0||
-mp ( -1 (w),,=) |=l2
=n + +0(++++))) (
A.3 PROOF OF THE PROPOSITION
Proof. We consider the clean sample and the corresponding poisoned sample is (æ, y) and (a g(æ, A). Vt), where A is predefined trigger, is generation function and target label Without loss of generality, we assume that the label of poisoned sample is O. We have for the update of TAC:
(D) (D)
(D]
Σ RED
w
3.t σ
1
[D]
Σ
w
J.
w
T.
(9)
Under the condition (iii), have
18

---

Published as a conference paper at ICLR 2026
1,(+1 w 5,(+1 [0 _0 w 2
100
1 w ()) - (w), - w 3)
naj,1 0 (w) [ [| ق1ة (s(f(0.) v)
no sign
- (1 (') ||
-mpls(f(0:)) - [ |
[V)(0))
+ +nag, (wn,
+ no -aapaa///(/aaa-a/-/o---------//- az o' o'w ||س|||
+ +m)lo(/(0.)) - [(w]],>)>>>]
[Vf(0,)]
= -- = (1]
=
d'
o'(w0 |
-nps(f(0.)) [ ق
[V)
+1 - <(f())))) oww |
2
( (- If0.)
oww
|V)l(e))
where the third equality uses condition (ii) together with the fact that the poisoned sample ã has label y = Hence
TAC j,1+1 (D) - (
Σ naj, o [I
RED
update temm
np (f (- (((=s(((())) (T(() o' d'w o(w,,,z)
Vf(00)le
positive under condition (i)
where the first term the standard SGD update and the second term is strictly positive under condition (i), ensuring an overall increase in the neuron's TAC.
A.4 DETAILED ALGORITHM SAM-ENIANCEE PSD
We present a detailed algorithmic procedure for SAM-enhanced PSD in Algorithm 1. When training with Sharpness- Aware Minimization (SAM), we select dataset-specific sharpness parameter values, setting p 0.1 for CIFAR-10 and p 0.4 for both Tiny ImageNet and GTSRB. Additionally, we utilize a reference dataset containing 250 clean samples per class. Dimensionality reduction parameters are set specifically at 30 for CIFAR-10, 20 for GTSRB, and 10 for Tiny ImageNet, with each configuration undergoing 10 iterations. The detection thresholds for these datasets are established as 10, 25, and 5, respectively.
19

---

Published as a conference paper at ICLR 2026
Algorithm Full Algorithm of SAM-enhanced PSD
1: Input:
Dataset Dt- = {( vi) y-) to cleansed, reference clean set Draf- f, loss function model So. epochs F., learning rate 0, perturbation bound > 0, class K, reduced dimension
d. iteration iter, threshold e, detection algorithm A
2: Output: The cleansed dataset D
3: Initialize 0g.
4: for 1,...,,F. do
5: Sample a mini-batch from Dry; VaC(
6: Update c++1 via P ((0,) w.r.t. B;
7: Update weights: 0.+1 0, - vo + +041 w.r.t. B;
8: end for
9:
for k k= l,,..., do
10:
Get the representation sets of class for training dataset Gir,k {g fo(Ø) (x.
Der.y- Prr-y=c) cc and reference dataset Gref.k = {g = fo()) (r. y) E Dref= =
Perform PCA normalized Grr,k extract the top-d features and obtain the projection
matrix e Rxxd where p the original feature dimension.
12:
Obtain projected features Gtr,k and Gref.k-
13:
for i 1,..., iter
......,,tes iter do
Estimate the mean 24 and covariance matrix Σg based the features of the reference dataset Grefkk-
15:
Compute the Mahalanobis distance from G.r, k to the mean P..
16:
Add samples to the reference dataset features Gref.e if Mahalanobis distance less than
ioc
Her
end for
18:
Project the features Girkk for class k using the final covariance matrix Σg to get Gjr, k.
[g" = >x
1/2
end for
20: Input the projected features Gū, into the detection algorithm A to obtain the filtered dataset D ).
21: return
B DETAILS OF EXPERIMENT SETTINGS
B. DETAILED TRAINING SETTINGS
In experiments, all vanilla training sessions utilize Stochastic Gradient Descent (SGD) with learning rate (r 0.1, momentum 0.9, and weight decay 10-4, However, for training on the VGGI9-BN model, adjust the learning rate 0.01 to optimize performance. All training sessions across these experiments are standardized to 100 epochs, ensuring consistency our approach to model development and evaluation across different datasets.
B.2 DETAILED ATTACK SETTINGS
The methodologies in our experiment, including BadNets (Gu al., 2019), Blended attack (Chen et al., 2017), Label-consistent attack (LC) (Turner et al., 2019), Low-frequency attack (LF) (Zeng et al., 2021), Sample-specifie backdoor attack (SSBA) (Li al., 2021b), Trojan attack (TrojanNN) (Liu et al., 2018), Warping-based attack (WaNet) (Nguyen & Tran, 2021). Input-aware dynamic backdoor attack (Nguyen & Tran, 2020), Bit-per-pixel (Bppcck() (Wang al., 2022), and dubbed sparse and invisible backdoor attack (SIBA) (Gao et al., 2024), are configured following the standard settings provided by BackdoorBench (Wu et al., 2025), a recognized benchmark for backdoor attacks. The target label for GTSRB is 2 and the target label for CIFAR-10 is O. The TaCT (Tang et al., 2021) method targets specific class (1,3) by inserting a trigger into the samples and changing their labels to target label. Additionally, uses another class (5.7), where the same trigger is applied but without changing the labels. Only about 0.05% of the samples receive the trigger without changing the labels. The Adap-Blend (Qi et al., 2023a) method uses adaptive
20

---

Published as a conference paper at ICLR 2026
approach where masking parameter 0.5 controls the probability of concealing parts of the images with a trigger.
B.3 DETAILED DETECTION SETTINGS
The methodologies in experiment, including Activation Clustering (AC) (Chen et al., 2019), Beatrix (Ma et al., 2022), SCAn (Tang et al., 2021) Spectral Signature (SS) (Tran et al., 2018) and Spectre (Hayase al., 2021), configured following the standard settings provided by Backdoor- Bench (Wu et al., 2025). For the Spectral Signature (SS) and Spectre methodologies, we adjust the proportion of potentially harmful samples 1.5 p. where p is the poisoning ratio and we adopt the strategy outlined in previous studies (referenced as Yuan et al. (2025)) to determine the target label for these potentially poisoned samples, which are applied in both the base detection and SAM-enhanced PSD. The Activation Clustering (AC) method typically requires that the volume of potential poisoned samples be less than 35% of the number of samples in the class. However, given the large number of classes in the GTSRB dataset and the proximity of the poisoned sample volume to 50% of the number of samples in the class, we disregard the usual 35% threshold in this specific case.
C ADDITIONAL EXPERIMENT RESULTS
C.1 MAIN EXPERIMENTS ON TINY IMAGENET
To validate the detection performance of SAM-enhanced PSD on large datasets, we conduct a series of tests using Tiny ImageNet. Due to the limited number of samples per category in the Tiny ImageNet, it poses a challenge for various attack and detection methods. In our experiments, we limited the poisoning rate 0.5% and only tested attack types that could meet the prerequisites for the number of poisoned samples under this condition. Detection methods like AC, SS, and Spectre are also excluded from our tests because these methods require fewer poisoned samples than there are samples in the target class, a condition difficult to meet with the Tiny ImageNet.
As shown in Tab. our experimental results indicate that SAM-enhanced PSD) performs exceptionally well in enhancing detection. We found that despite the limited number of clean samples per category, this method effectively improved the recognition of poisoned samples.
Table 4: Comparison of TPR (%) and FPR (%) between base PSD and SAM-enhanced PSD (+SAM) on Tiny ImageNet and ResNet18 with poisoning ratio = 0.5%. Top are bold. When comparing SAM- enhanced PSD base PSD, performance improvements are highlighted in green, other changes in red.
Detection
SCAn +SAM
Beatrix / /+SAM
Attack
TPR f
FPR 1
F1 +
TPR f
FPR |
F1 f
BadNets
0.0/43.8
0.0/0.8
0.0/29.5
79.4/81.4
5.3/5.8
12.9/12.2
Blended
0.0/75.6
0.0/0.0
0.0/86.1
15.2/73.4
5.3/5.7
2.6/11.2
SSBA
0.0/73.0
0.0/0.0
0.0/80.3
13.2/55.2
5.3/5.9
2.3/8.3
LF
0.0/52.2
0.0/0.2
0.0/53.2
33.6/35.6
5.3/5.9
5.7/5.5
TrojanNN
0.0/100.0
0.0/0.0
0.0/100.0
4.8/99.6
5.3/5.7
0.8/15.0
Average +68.9
+0.2
+69.8
+39.8
+0.5
+5.5
C.2 MAIN EXPERIMENTS ON DIFFERENT MODELS
To explore the effects of SAM-enhanced PSD across different model architectures, we conduct a series of experiments using 1enseNet-161, VGG19-BN, and the CIFAR- 10 dataset. As shown in Tab. and Tab. 6, the experimental results demonstrate that the implementation of MAMMennancedd PSD significantly improves detection performance in both the 1enseNet-161 and the VGG19-BN models. However for the VGG19-BB model, although SAM-enhanced PSD enhanced the detection capabilities of this model, the improvement in TPR is still unsatisfactory under some backdoor attacks. The deep network architecture and large feature dimensionality of VGG19-BN result in a dispersion of backdoor signals within the feature space, making it challenging for SAM to effectively
21

---

Published as a conference paper at ICLR 2026
concentrate and enhance these signals. Based these findings, selecting appropriate model architecture is crucial for enhancing detection outcomes. It is beneficial for the defender to adjust the model structure to improve detection performance, which can be fully controlled by the defender.
Table 5: Comparison of TPR (%) and FPR (%) between base PSD and SAM-enhanced PSD (+SAM) on CIFAR- 10 and DenseNet-161 161 with poisoning ratio = 5%. Top are bold. When comparing SAM- enhanced PSD to base PSD, performance improvements are highlighted in green, other changes in red.
SCAmf-S5M
5S/-SAM FPR
FSSM
Attack
TPR.
EPR.
TPR.
FPS.
F1"
TPR.
F1.
TPR.
PPR
F11
1P8.
FPS.
FL
11:0822
QANLE
21:366-7
43.6977.
5.52.4
35.879.0
45.689.2
4.5000
33.594.3
9886550
98.99755
3.5985
SIBA
53. 13.849.1
4.7239
41.273.
46 865488
4,200
31..81.3
79. 135.1
0,815
50.34914
96.991.
16.592.4
5.55
15,4843
LF
59.084.5
44/-1
45.4999
488-20
477LB
413.44
10.3483.4
0.21
66.7736
946013
DANBB
97.854
11.16244
5050
10.348
Adoy
41,34656
30/15
41.545.9
0,8933
0,006
0,099.7
143.3
2.013
3433566
190,9993
9898997
0.5%L4
5056
0.563.3
TuCT
19 18.3/8.3
0.3R55
16.378.
17.889.3
53300
38 6/966
3,/1.
40.3534
80.599.
99.3965
2,5380.
5050
25167.
ToijaNN
19.878.7
0.534
15.265.5
18.091
4ANLB
40 6176
$0:0897
51,09133
935873
3.2999
5058
334673
tepecosaro
14,48.3
36 26.7
0A0LD
5993
79 19.583.
000912
0C294.
4.33006
5056
43667
RypAnct
25 5-8-1
54.07.1
8 0.6
09 1834
0A0L
968811
7.578
56.1576
WA7674
093899
5035
0.3666
STRA
DIVE
563193-
96 41000
16503
1W3.
17.284
100/9661
199
3137788
1.2916
5088
3.3631
Average
-20.9
-58
1263
2200
-3
137
15.
-34
15.0
12.5 -1.7
106.5 1947
4.00
1563
Table 6: Comparison of TPR (%) and FPR (%) between base PSD and SAM-enhanced PSD (+SAM) on CIFAR-I0 and VGGI9-BN with poisoning ratio 5%. Top are bold. When comparing SAM- enhanced PSD to base PSD, performance improvements are highlighted in green, other changes in red.
Desetion
Specter FSM
SCAN/-GAM
SS1+5AM
ACF+SAM
Amack:
10901
171
11
1150
119
TVK
F1.1
175L 2
22.1
Bathens
51-374.2
4.533
(1.75L8
DC9664
B/111
0,091.5
S1.STT
3.123
11.8/9L
SARL
01588,
1096.
1/058
4109L6
Blasked
76,873.5
3.5%.1
63,1500
411933
4ANU
38.396,9 9
42.5764
2.81.1
41.277.5
64,29155
18.995.6
7.259A
SJIS8
7AM75
SSRA
40.39665
3.43.0
4.00
33.4583
340990
0.80
03733
34774
5058
2.7565
47.5425
4125455
Adpp-itiedd
7640555
22 54777
13-2HL
33.8237
3.12
1909427
3024
63647
0-3833
10058
6-1145
7838966
33:1
1-21444
37.24833
120080
11058
TACT
23.435.7
12V75
TorasNN
32,55555
3.546
27.04566
42,5992
4608
36.29L6
N133956
1,30,3
62,4943
$9.29944
0.00
59.5997
0.999
5258
65N7.3
WaNe
179728
43:13
DCALD
4.12K
18.04LS
024664
23. 1981
511344
2
01-398L3
$9.396
V7.296.2
019963
SISA
25.21643
6.15.
2084997
10082900
14.6144
0.7000
793698.4
3991
S5NBA
61.9996
5.19
5U88
98.8%12
10.611.
00/00
14.50886
0.06449
0.003
0IN765
255.1
ANer
+31.
-86
+164
+31.
-31
+357
+267
-8.9
+16.
+3.3
-86
+27.
+789
48.
+51.
C.3 EXPERIMENTS UNDER DIFFERENT POISONING RATIOS
To demonstrate the stability and effectiveness of SAM-enhanced PSD against weak backdoor attacks, we evaluate its detection performance at various low poisoning ratios, focusing on the 1 1% and 0.5% settings. We also discuss the extreme scenario of 0.1% poisoning.
As shown in Tab. 7 and Tab. 8, our method provides substantial and consistent performance gains in these weak backdoor scenarios. At a 1% poisoning ratio, SAM-enhanced PSD boosts the average True Positive Rate, TPR, across all detection methods, with particularly large average gains for SS at +47.0% and AC at +85.4%. This strong performance is maintained at the more challenging 0.5% ratio, where our method again significantly improves the average TPR for detectors like Beatrix and SCAn with gains of +80.7% and +27.9%, respectively, all while keeping FPR low. These results confirm method's efficacy in amplifying the backdoor signal in weak attack settings.
As shown in Tab. 9, we also investigate the extreme scenario of 0.1% poisoning. At this ratio, the detection challenge becomes fundamental. We find that the potency of the backdoor attacks themselves is intrinsically limited, with the average ASR, across all tested attacks being merely 31.8% which implies that the backdoor signal is inherently weak and ambiguous. Despite this inherent challenge. BAM-enhanced PSD still demonstrates a significant enhancement effect, providing considerable relative performance improvements for the base detectors. For instance, it achieves a +27.7% TPR gain for Spectre. This shows that our approach effectively amplifies backdoor features, even when the signal is at its weakest.
C.4 ANALYSIS WITH CON-FEATURE
DETECTORS
To comprehensively define the scope of our SAM-enhanced framework, we investigate its effective- ness when applied to other categories of detectors, including perturbation-bart based and topology-bart based methods.
22

---

Published as a conference paper at ICLR 2026
Table 7: Comparison of TPR (%) and FPR (%) between base PSD and SAM-enhanced PSD (+SAM)
on CIFAR-10 10 and & with poisoning ratio=1 %. Top I are bold. When comparing SAM- enhanced PSD to base PSD. performance improvements are highlighted in green, other changes in
red.
Dessstion
Specitr FFR
SCAR7 45AM
5S/+SAM
ACT-SAM
Bodhin
022487.
92.491.
06.436.1
06.796.6
GHAND
10195.6
45.3/99.2
3155
15.62335
1.3919
10.496.3
0JANL
1.2188811
2.1/2L1
56.377
$5,050
3.6974
1,29.0
3G87.
0.964
000966
5058
LF
69452.0 0
6.100
18.8616 6
55.199.6
0040
53 13
54 54.5%6
0,50
51.996.
00366
DA9951
26996
105A
0
Ailp-Stzed
71 1188
0.986
17.900.
01191:5
2,0000
47 6
55
0,000
56.598
0.0L5
DANL
00956
5.798.
505a
13/28L
IaET
1.111
1132235
DONLD
5:324.3
1220B
25393
3058
11,6288
96443.4
0,544
37.816.1
10000199D
1220
0.494
25
3058
13/231
6866667
1.000.7
17.71.
2
75 1995
76.79L
00964
0099.5
1556621
5054
531K5
Ryporark
03 01.098L 6
0.898.7
70 2
07 6709999
DA8B
94 196.
0.302
16. 16.99L
684916
57 1973
1054
0 07/24
SISA
0.2188.2
1.5144
0.211.8
99.911
DANLD
3939914
01299.22
0.0999
0.999
00099.5
2.0922
3058
0.1/2L
Anerage
+32.8
+0.5
-7.0
+54
-0.
+1.8
+07
-8
+47
+854
4001
-85
-7K
40B
-221
Table 8: Comparison of TPR (%) and FPR (%) between base PSD and SAM-enhanced PSD (+SAM) on CIFAR-10 10 and ResNet18 with poisoning ratio=0.5%% Top are bold. When comparing SAM- enhanced PSD to base PSD. performance improvements are highlighted in green, other changes in red.
Specre
ACT-RAM
BeaRiu/*5AM
1
FFR
F11
F1
TFR.1
PPR
TPR
F11
BedNins
00.095.4
11111
45
0.9334
DANL
0.093
73.9976
1,211
37.347.3
$4.03844
1.5322
36.09.7
2.09166
0,511
2
ASIIA
92.4H211
1,21.
46.2%6 D
7TA%6.
DINLD
$7.479.5
253/9.2
1.21.
34. 18119811
66.0300
3,38.
16.075
8.:59.
0.728
01/213
LT
94.095.
1
DUREH
CHILD
1:211
C47736
SA11D
GB34
0.514
011278
Adkp-Siced
1,210
DONL
14
1000/090
1030VOLLD
$7.0099.
48.8
99,01000
7A125
11336
0
0.500
01V16T
TCCT
0.70033
1.50B
6.3K77
1000/090
105071ALD
16.0423
1.508
7.6994
0.0106.
3,400
0.0000
0.000008
8650
0A/16T
IrypENN
12
1,415
4,223
1002219111
114/10911
1./11
5.4444
4X121
0.096.1
0350
0:3161
Tepal
36.99776
0:69.3
23,4776
00400
6ANB
3808
82 82.59.1
12.1206
60793
0.611
00773
1,3776
3054
021133
Brykktcck
02.495:
0.348
73.7784
55.2933
DAMB
71.8863
903977
DOMB
903996
03 2.20
0,98
7,536.3
0.495.0
505A
0.1/164
7.62116
96.0995.4
14,614.6
DUULD
GIENLD
14.014.
3.164
DUVVLK
0/295.2
0.7144
1171219
Aurrag
+153
-1.1
+18.2
+37.
+0.3
+36.6
+35.4
+01B
+3.0
634.5
+88.7
+1.8
-2LB
We applied our framework to representative defenses from both categories. The results presented in Tab. 10 show that the performance gains for these non non-feature-barr based methods are less pronounced than the substantial gains demonstrated for feature-based detectors in Table 1. We posit that this outcome is not a limitation, but rather an important finding that clarifies the core mechanism of our framework and defines its operational boundaries.
The reasons are linked to SAM's optimization objective. For perturbation-based detectors, their effectiveness relies on the inference instability of poisoned samples. SAM's objective of finding flat minima, however, improves overall model stability, which inadvertently suppresses the signal these detectors require. Similarly, topology-basee detectors identify structural anomalies in the feature manifold. The smoothening effect of SAM's optimization mask the subtle topological artifacts these methods are designed to find.
This investigation, therefore, clarifies the contribution of our framework: it acts as a dedicated signal amplifier for defenses that leverage feature-space disparity. Because SAM's core effect to increase the separability between poisoned and clean samples in the feature space, creates a powerful synergy with feature-based detectors. This analysis provides a clear scope for our method's application and reinforces the understanding of its underlying mechanism.
C.5 ADAPTIVE ATTACK
In this chapter, we propose an adaptive backdoor attack specifically designed compromise the sep- aration capability of SAM--nhanced-PSSD. Unlike traditional adaptive attacks that primarily consider the detector's 's mechanisms, our threat model extends further: we assume that the adversary possesses comprehensive knowledge of the training method, including the Sharpness-Awan Minimisation (SAM) that SAM-enhanced-PSS employs during model training to improve detection performance.
Attack goal and assumptions. The goal of the adversary is to diminish the feature-space distinction between poisoned samples and target clean samples, thereby evading detection. Under our adaptive attack setting. the adversary enjoys complete white-box access, encompassing full visibility into the network architecture, optimization hyperparameters, and SAM optimization. By integrating the SAM training step into the adversary's optimization process, the adversary explicitly aims to neutralize
23

---

Published as a conference paper at ICLR 2026
Table 9: Comparison of TPR (%) and FPR (%) between base PSD and SAM-enhanced PSD (+SAM) on CIFAR-10 10 and ResNet18 with poisoning ratio=0. %. Top are bold. When comparing SAM- enhanced PSD to base PSD. performance improvements are highlighted in green, other changes in
red.
Dessction
Specrs /Pe0t
SCAR:/aGAM
SS/+SAM
ACT-LAM
Bearty 48AM
21030D
0.101
1.846.4
DUSLE
01488
IL:43.1
DURLS
03438
15-162.8
1.4244
SSBA
16,0580
0./81
12.448.
0.58.
0/00
0.888
00090.
0.44.1
0.0360
0ANL
25.42.0
50056
1.184
1.
22012.
01881
10/9
0834
1L:49.1
CURE
DURLE
1,303
Adip-itizdd
0.181
11.2%,4
GUELE
0188
CUIPLE
CUALE
014R
5,05B
1,3211
TACT
0.183
0.3R1
0.492
100
DANLE
10300700
0.02
0
CORT
196010LD
0AR4
100,0966
22 2239980
5/85.
0.508
TRegeNN
120/0088
0.181
5/6308
0
DAYLD
0.8
01:4B
0A88
0.9184
10
50R8
0.134
16 66.2993.1
18.1
76.
DUNLD
1230522
0L:/8.1
37A229
GUNL
5/05.
012222
Ryyotack
41 1.79929
1/81
33.3
33.0
0.88
0ANL
0,88
10.41044
11:1.
104004
000E
0A88
0.8
11827.1
50RB
6.711
0.08
ReINe1sA74
149/169
1.
150/150
0008
5/050
3,13,
Ansrage
+22-
+388
-4
41.
4LB
+361
-6.1
+3.9
+15
4LP
-154
+261
-811
+11
Table 10: Comparison of TPR (%) and FPR (%) between other non-feature-based PSD and SAM- enhanced PSD (+SAM) on CIFAR-I0 and ResNet18 with poisoning ratio = 5%. Top are bold. When comparing SAM-enhanced PSD to base PSD, performance improvements are highlighted in green. other changes in red.
Detection Attack
CD/+SAM
STXP//+AM
SemiNet/ /SAM
TED/+SAM IPR
TPR
TPR
FL1
TPR
F11
RodNess
638866.2
49.5/51.3
8566933
11.1994
43.3/50.1
35.3/6.7
13.11224
184/19.7
86.//553
21.2/0.4
Blended
4.2/14.4
49/5.0
4.2/1388
814099
11/010.7
37.3/33.0
2.9/22.9
4.2/21.2
5.28.77
26/035.2
23.3/0.4
9.1/13.5
SSBA
66.822
5.05,0
50.848.7
78.7/86.8
8.9/8.5
45.3/49.9
1.9/20.9
18118
2
66.3/716
22.2/18.2
22.6/77.6
LF
5.8429
5/55,0
5.8/6.1
86.
11,1/113
43.6/44.2
0.0/36.
0.01122
0.04558
42/4/5188
15:2/108
19.6/29.0
Average
+11.7
+1.8
-0.5
+4.4
+19.2
-1.8
+4.4
SAM's beneficial effects, specifically its capacity widen feature gaps, making poisoned samples indistinguishable from target clean samples during detection.
Attack methodology. Our proposed attack extends Adapt-Blend (Qi et al., 2023a), backdoor attack method that reduces detectability by randomly cropping the commonly used "Hello Kitty" trigger, assigning random labels, and lowering the poisoning rate, thereby diminishing the feature- space gap between poisoned samples and target clean samples. To further enhance this reduction of the feature gap and effectively counteract Sharpness- -wwap Minimization (SAM), we propose replacing the commonly used trigger with optimized trigger generated through a novel bi-level optimization approach. Specifically, we formulate this optimization as:
Outer minimization: shrinks the distance between features of poisoned samples and target clean samples, explicitly pulling poisoned representations towards the clean target class.
Inner maximization: replicates the perturbation step inherent to SAM training, ensuring the optimized trigger anticipates and counters SAM's attempt re-expand feature distances.
This approach can be formally expressed as:
min max Be..ne (A(oos(()))))) v)]
Bom.tte [4[ ajæ ae). v.) Al] - aju + ac) f0+g(m)))]])
(10)
where D. is the clean subset, Dp contains images be poisoned, and D, is the set of clean samples with the target label. The blending ratio a controls the proportion between the original images x and the optimized trigger e. The first expectation maintains model performance on clean data, while the second explicitly learns poisoned samples and reduces the feature-space distance between poisoned samples and target clean samples. The inner maximization step ensures the trigger adapts to SAM's perturbations, weakening SAM's subsequent effectiveness.
Implementation details. We follow the Adapt-Blend recipe pasted with a 20 % opacity onto each poisoned image. The poisoning ratio is set to 0.3 %. Both the outer training loop and the inner maximization use the same SAM hyperparameters as SAM-enhanced P.D. namely a neighbourhood radius of 0.1. In the loss of Eq. (10) we fix the gap-shrinking weight to X 0.1.
Results and analysis. As demonstrated in Tab. 11, applying the Adapt-Blenn severely degrades the performance of standard PSD detectors (Spectre, SS, AC, and Beatrix). Specifically, their
24

---

Published as a conference paper at ICLR 2026
Table 11: Comparison of TPR (%) and FPR (%) between baseline PSD and SAM-enhanced PSD
(+SAM) under adaptive attacks on C1 with ResNet-18.
Trigger +
Hello-Kitty
Optimized Trigger
Detection |
TPR
FPR J
F1
TPR
FPR
FI f
Spectre
14.67 / 97.33
0.41 / 0.16
11.69 / 77.71
1.33 / 100.0
0.45 / 0.15
1.06 80.05
SS
6.00 96.67
0.28 0.01
6.03 / 96.67
0.00 / 99.33
0.30 / 0.00
0.00 99.67
AC
0.00 / 94.67
0.00
0.00 / 97.26
0.00 / 100.0
0,00 0,00
0,00 100.0
Beatrix
10.67 96.67
5.01 5.01
1.20 / 10.39
0.67 97.33
5.01 5,01
0.08 / 10.45
average True Positive Rate (TPR) drops below 11% for the manually crafted Hello-Kitty patch and near-zero for the optimized trigger, validating the effectiveness of feature-gap minimization. Nevertheless, the SAM-enhanced PSD consistently recovers detection capability, achieving TPRs above 94% and False Positive Rates (FPRs) under 0.2% for both triggers. These outcomes highlight SAM's intrinsic robustness, whose feature-space expansion capability effectively counters even an explicitly adaptive adversary. Consequently, unless attackers gain full control over the training procedure, neutralizing SAM-enhanced-PSD remains notably challenging, ensuring strong and persistent detection performance.
C.6 PERFORMANCE ON THE MODEL TRAINED BY FILTERED DATA.
To validate the effectiveness of the SAM-enhanced PSD, we also systematically measure performances in accuracy (ACC), attack success rate (ASR), and robust accuracy (RA) during model retraining after removing poisoned samples identified by PSDs and SA.Meehanceed PSDs, where higher ACC/RA and lower ASR indicate better defense performance.
As shown in Tab. 12, experimental results reveal SAM-enhanced PSD impact across multiple attack scenarios. In BadNets (Gu et al., 2019) attacks, SCAn (Tang et al., 2021) detection coupled with SAM improved ACC from 94.1% % 94.4% and RA from 94.0% to 94.3% while maintaining ASR at 0.7%. More strikingly, against challenging Blended (Chen et al.. 2017) attacks, SAM reduced AC (Chen al., 2019) method's s ASR from 99.7% 2.7% while boosting RA from 0.3% to 79.1% Similar patterns emerged in adaptive attacks like Adap-Blend (Qi et al., 2023a). LF (Zeng et al., 2021), and WaNet (Nguyen Tran, 2021), where SAM achieved over 90% ASR reduction and 80% RA improvement in critical cases. Aggregate statistics across all attack types show SAM delivers 0.2%-0.5% ACC gains, up to 93.8% ASR suppression, and remarkable RA enhancements reaching 84%. These improvements stem from SAM's ability amplify activation pattern differences between clean and poisoned samples in feature space through sharpness-awe aware optimization, thereby increasing PSD discriminative power.
The findings conclusively demonstrate that incorporating Sharpness- Minimization into PSD) training frameworks significantly strengthens model resilience against diverse backdoor threats. By simultaneously improving detection accuracy (ACC/RA) and suppressing attack success rates (ASR), SAM establishes robust defense paradigm applicable complex adversarial environments, providing critical insights for developing next next-generation AI security solutions.
C.7 COMPARISON WITH INFERENCE-TING TIME DETECTION METHODS
In this section, we extend our analysis to include comparison with state-of-the training- free detec- tion methods that operate at inference time, specifically Scale-up (Guo et al., 2023) and CBD (Xiang al., 2023).
important to first clarify that our pre-training defense and these inference-time defenses address different stages of the security pipeline and are thus complementary. Our method aims to provide a one-time, permanent "cure" by cleansing the training dataset itself, ensuring that any model trained on it is inherently more secure without runtime overhead. In contrast, inference-time defenses act as a perpetual "treatment," " requiring continuous monitoring and incurring per- per-inference costs to block malicious inputs at runtime, while the underlying model remains vulnerable.
Despite these conceptual differences, we conduct direct performance comparison on the CIFAR- 10 dataset evaluate their practical detection capabilities. To simulate realistic scenario where false
25

---

Published as a conference paper at ICLR 2026
Table 12: Detection comparisons (measured by ACC (%), ASR (%) and RA (%) between base PSD and SAM-enhanced PSD (+SAM) on CIFAR-I0 and ResNet18, and the better result in each pair is highlighted in bold. In terms of each metrie, the average change of SAM-enhanced PSD to base PSD across all attacks is presented the bottom: performance improvements highlighted in green, other changes red.
Detection
SCAn 4SAM
AC/+SAM
Beatrix / /+SAM
Attack +
ACC f
ASR +
RA
ACC
ASR +
RA
ACC
ASR 4
RA f
BadNets
94.1/94.4
0.7/0.7
94.0/94.3
94.6/94.5
0.7/0.8
94.5/94.3
93.3/94.5
91.0/0.7
8.5/94.2
Blended
94.6/94.5
6.7/4.4
76.8/77.8
93. 1/94.
99.7/2.7
0.3/79.1
93.8/94.2
99.4/3.3
0.6/78.4
SSBA
94.4/94.4
1.2/1.0
91.6/92.2
94.0/94.4
0.8/1.0
91.7/92.2
94.1/93.8
95.3/0.8
4.6/91.6
94.2/94.6
9.5/3.0
85.1/90.7
93.6/94.6
7.4/3.0
86.4/90.7
94.0/94.1
98.0/1.6
1.9/9..1
Adap-Blend
94.0/94.3
83.0/6.0
15.8/75.8
91.7/93.9
99.9/6.9
0.0/74.6
93.8/93.6
100.0/1.9
0.0/79.1
LC
94.6/94.3
0.7/0.7
92.9/92.5
94.2/94.3
100.0/0.7
0.0/92.8
94.4/94.0
100.0/0.6
0.0/92.9
TaCT
94.0/94.0
1.2/1.2
86.7/86.7
94.2/94.0
1.6/1.2
89.1/86.7
93.8/94.2
100.0/0.6 0.0/87.8
TrojanNN
94.6/94.5
3.1/3.6
86.6/87.0
94.2/94.4
2.7/2.9
86.4/87.3
94.4/94.2
100.0/2.0
0.0/87.4
WaNet
94.2/94.2
11.8/0.9
82.7/93.0
94.2/94.3
1.5/0.9
92.6/92.9
94.2/93.5
90.0/0.9
9.9/92.3
Input-aware
94.5/94.5
1.0/1.8
92.0/90.9
94.6/94.8
80.5/1.9
18.6/91.5
93.5/94.5
82.1/1.2
17.2/91.1
BppAttack
94.6/94.4
30.3/11.7
73.9/90.2
94.4/94.4
13.0/11.7
88.8/90.2
94.0/94.0 99.9/10.4 10.1/90.4
Average
+0.1
-10.4
+8.5
+0.5
-34.0
+29.5
+0.2
-93.8
+84.0
Table 13: Comparison of achievable TPR (%) for different defense methods on CIFAR- 10 with
FPR < 10%. For SCAn/+SAM, we show the performance of the base detector and our SAM- enhanced version.
Attack
Scale-up TPR 1
CBD TPR t
SCAn/4SAM TPR 1
BadNets 100.00
100.00
96.01 95.21
Blended 12.01
91.21
99.22 98.73
WaNet
16.72
78.23
66.31 90.12
alarms are highly undesirable, we assess the achievable True Positive Rate (TPR) while constraining the False Positive Rate (FPR) to be more than 10%. As presented in Tab. 13, the results show that while training-free methods are effective against some attacks, their TPR can be inconsistent under this practical constraint, especially for more sophisticated attacks like Blended and WaNet. In contrast, our SAM-enhanced method demonstrates consistently superior and more stable detection performance across all scenarios.
Ultimately, the key advantage of our pre-training approach is its ability to enable the training of final model that is both secure and high gegh-performing. As demonstrated in Sec. E.6, retraining model on the dataset purified by our SAM-enhanced method not only maintains high clean accuracy (ACC) but also significantly reduces the attack success rate (ASR). This confirms the practical, end-to-end effectiveness our framework in producing a robust final model, a benefit not offered by inference-tine time defenses.
D ADDITIONAL ANALYSIS OF SAM-ENHANCED-PSD
D. DETECTION PERFORMANCE WITH DIFFERENT P
SCAR
55
AC
Beatris
413
301
32
Diaaaad
Figure Detection performance of base PSD with SAM-enhanced PSD with different p on CIFARIO and ResNet18.
26

---

Published as a conference paper at ICLR 2026
SCAR
55
AC
Bestris
17K
dan
Bleood
Togenbiy
Figure 8: Detection performance of base PSD with SAM-enhanced PSD with different dimensions on CIFARIO and ResNet18
The constraint bound p is a key hyperparameter in our detection strategy, as it governs the extent of perturbation The excessively small p may result in weak enhancement of the backdoor effect, whereas an excessively large p can degrade the model's performance by disrupting the extraction of information, such features, from both poisoned and clean samples. We assess the sensitivity of p by executing five complex attacks and employing four detection methods. Figure 7 illustrates the results of these detections combined with SAM-enhanced PSD. While a smaller p may not fully amplify backdoor effects, resulting in poor performance of Beatrix against SSBA and TrojanNN attacks, it demonstrates that SAM-enhanced PSD can successfully identify poisoned samples and maintain a reasonable false positive rate across different settings, Overall, proves to be relatively insensitive; broad range values can be selected with good detection performance.
D.2 DETECTION PERFORMANCE DIFFERENT PARAMETERS OF EXTRACTING BACKDOOR RELLATED FEATURE
In this study, we analyze two crucial parameters in the extracting backdoor-related feature stage of our proposed defense mechanism, SAM-enhanced PSD: dimension and the choice of surrogate dataset.
D.2.1 IMPACT OF FEATURE DIMENSION
The dimension of the feature space plays a pivotal role in the effectiveness of backdoor detection methods. dimension that is too large complicates the estimation of the covariance matrix, while dimension that is too small may result in excessive removal of the backdoor signal. Through empirical testing, we evaluate the impact varying the dimension from 10 to 50 on the performance of SAMMenhanncd PSD across different attacks and detection methods. As shown in Fig. 8, results indicate that the performance remains relatively stable across this range for most scenarios. However, observe some variability in performance at dimension of 20 for the Beatrix method. Based on these findings, we select a dimension of 30 for our main experiments, balancing the trade-offs between complexity and signal retention effectively.
D.2.2 IMPACT OF THE SURROGATE DATASET
To further investigate the practical applicability and robustness of our method, we evaluate its performance under various conditions for the clean auxiliary set. The flexibility of a defense method regarding its auxiliary is critical, especially in real-world scenarios where large, verified clean dataset may not be available. Therefore, we systematically designed three parallel experimental scenarios: (1) Limited in-distribution data, where we investigate the method's 's sensitivity to the quantity of clean samples by varying the auxiliary set size from as few as 25 per class (a 0.5% clean ratio) to 250 per class (a 5% clean ratio); (2) Sifted-clean (S-Clean) Data, where we test the method's where defenders identify reference set from the poisoned dataset itself using an existing technique (META-SIFF (Zeng et al., 2023)) to sift out 250 samples per class; and (3) Out-of-distribution (OOD) data, where assess the method's 's ability to leverage OOD data by using 250 samples per class from the CIFAR-5m (Nakkiran al., 2020) dataset the auxiliary set for the CIFAR- 10 task.
reliance on the purity of the auxiliary set by simulating
In the latter two scenarios, we use fixed quantity of 250 samples per class. This is because the primary challenge for these data sources lies in their purity distribution mismatch, not their
27

---

Published as a conference paper at ICLR 2026
Table 14: Detection comparisons (measured by TPR (%), FPR (%) and F1 (%)) between base PSD and SAM- enhanced PSD (+SAM optimized with ASAM) on CIFAR- and ResNet18, and the better result each pair is highlighted in bold. In terms of each metric, the average change of SAM-enhanced PSD to base PSD across all attacks is presented at the bottom: performance improvements are highlighted in green, other changes in red.
Desection--
Spectre +SAM FPR
SCAR/-SAM
SS/+SAM FPR
AC/+SAM FPR
Beatnx ++AM
Amack 3
TPR
F1
TPR T
FPR. 1
F1 7
IPR
F11
TPR. 1
F11
TPR
FPR
F11
BodNets
51.19814
4.9444
42.092.9
96,055 0
96.097
70.3/91.7
2.448.0
16.095.7
96. 1
0.1/13.8
97.1511 5
36.69924
5,004
61.992
Blended
29.56006
6,0000
24.675.5
99,298.3 3
99.6773.]
32.5000000
4.4%, 1
30.5963.2
2.3/77.3
7,7/11.7
1.944.77
5,099.4
5.0/1.3
5.0/900
SSRA
36.77
5.67.5
50. 145.2
91.998.2
0.048.0
96.9-99.1
50.48449
1.915.0
74,5157.2
3,3238
66.1255
16.898.
5,00.0
15.899u1
LF
32.057.4
2634419
94.1996
0UK0.7
97.09334
2,5445
63.26223
95661001
10.47.7
48.757.
24/1000
5,007 2.4/33.
Adap-ISlend
4.5144
7.131
17:033.9
4,37.5
17.12455
100.0100.0
150,0/1000
40.5/41.4
45,0519
0.01000.
0.000
0.0/00000
2.2/1000
5.82.8
2.2/8.9
TaCT
36.1/82.7
7.01136
26.937.6
10000106.0
0.0/0.0
100,0/100.
42,34009
4,2/10.0
38.12447
1000/100.0
0.1/80
99,5010000
13/4/3000
5,02.5
12,98100
TesjaNN
30.2/51.0
6.044.7
24.84255
100,097.0
0.0/B.0
100.198.55 5
63.499.5
2.8/16
58.77669
59.9/1801
3.2/15.3
76.7440.7
4/6/100.0
5.03.1
4.6/77.1
WuNet
56,4/200.0
4.1000
54.3/108,0
66.38882
79.7990.7
71.187.4
1,58,00
7LAM33
85.19%.1
0,0000
91.998.0
1.296,6
5.0/5.0
1.2166.2
leput-rncer:
53.011600
4.7/L
44.2/100.0
97.401000
IL1/4
97671.2
K3.5818
0.9080
K1.59L0
0,0833
0000
0.0938
3/4/00/8
5.05,0
3.466.88
UppAmmok
21,3/28.6
6.3853
17,8250
1730100.0
93.77899
15.2/6.7
0.8900
798.3
96.2/6.7
0.00
97,0963
0.1/0000
5,05.0
0.146.88
SIBA
30,064.6
99.3/001
72.88888
74.35844
4.3/24
5,05.0
MudNes-AZA
99.5/100.0
10.5/18.0 49.7/113
0.00000
0.0
99496622
10.67.8
49.71559
97.8903
0.00000
98.993.9
27.2/99.8
5,000.3 24.697.0
Average
+36.5
-0.7
4.5
+19.1
+12.2
+14.5
.87.4
-2.0
Table 15: Detection comparisons (measured by TPR (%). FPR (%) and F1 (%)) between base PSD and SAM- enhanced PSD (+SAM optimized with SAM-ON) CIFAR-10 and ResNet18, and the better result in each pair is highlighted in bold. In terms of each metric, the average change of SAM-enhanced PSD base PSD across
all attacks is presented at the bottom: performance improvements are highlighted in green. other changes in red.
Desection
Spectre/ +SAM
SCAn +SAM]
S
NC/+SAM
Beuzis/ SAA
Attakk
1
TPR
FPR
F1
1
TPR
1
TPR:
F
BudNets
51.177.6
4.9/14
42.076..
$6,895.8
0.099.
98.0977.9
70.389.4 4
2.44L66
65.6/8888
96,89899
0.1/3.8
97.1/581
56.510900
5,00.2
44,99844
Blanial
20.955.8
6.0777
34.637..4
99.298.
0.09.0
99.699.2
32.99331
4/4LL
30. 50.5966
2.3/10000
7.7/14.0
15543.0
S.01000
5.0/122
5.0990)
SSBA
36,6788
5662.3
30.1/71.
93.9/96.7
0.099.
96.9/98.3
R0.AMAL
19441
74.5666.5
99,397
3.3/13.3
76.1:43.4
16,8/7.0
5,0013
15.895.6
IF
32,08199
5.89.2
26. V33.
04.2000.00
0.08,0
97.0100.8
68 2837
2.5/38
61.268.4
95.697.
10.4/1.0
48.7/42
2.4/9222
5.00.5
2.499177
Adap-Bland
24.167.3
5.6244
20.96634
02.5/000.0
47.3/0.1
20.39115
1967704
7.1/75
1.2.57.5
6.200000
5.879
6.2/57.1
17/040.7
4.355.5
17.1/333
100,096,0
1000-98.0
2.15.4
4
0.070000
0.091.9
2.2/0000
5.029 2.27%6
TaCT
36.1/77.5
7.0447
26.95
10000/0000
0.048.
100/2/10000
42.3146
4.2447
38.12305
180,066
0.188.5
99.50337
13/4/10000
5.02.0
12.9284.
TrousNN
30.2/61.7
6.0000
24.8/6.3
10000330
0.0990
10000-6.4
63.4/100.0
2.8/422
58.7/14
99,909.1
3.2/14.8
76.74113
4.6.93.7
5,0333
4.6/33
WaNee
66.495.1
4.1/8.I
54. 54.397..5
66 66.3/000.0
0.01.9
70. 79.7785.0
71.19937
1.5/7.3
71.45664
85 15.1
0J0332
91,9059
1.2/10000
5,08,0
1.2/67.8
Teput-aware
53,9997.2
4.7/7.8
44.2/66.4
97,491.6
0.188
97.695.66
43.5794
0.5/UL
83.58885
0.0/8P66
0.05.1
0.0662.7
3.4/97.0
5,05,0
3.4/66.4
MypAmack
21.5344,7
6.3559
15 K32.3
87 4/34
0.09.2
93 93.595.11
85 3,9.
0
85 791L
94.397.3
0.0000
0996
0/117
5.08,
0. 1.63.9
SIBA
30.06624
5.08,0
4.366..4
BadNers A2A
99.5/300.0
10.4/1.2
49.7440
0.000
0.0490
10.6/1600
49.7/38.
98.9788
27,
27.0000.0
5.0/1.9
24.6/222
Average
+20.5
-1.0
+25.9
+2.3
+19.4
+64
+85.8
-2.0
+68.7
availability, as they are generally easier to acquire than verified in-distribution clean data. Thus, our goal here is to validate their viability as substitutes for standard clean set.
As shown in Fig. 9, our method demonstrates remarkable robustness across all three challenging scenarios. Detection performance remains high even when the quantity of clean samples is severely limited (Scenario 1). Critically, our method is equally effective when using the S-Clean set (Scenario 2) or data from a completely different distribution (Scenario 3). These findings collectively confirm that SAMe-enancedd PSD has low dependency on the clean auxiliary set, highlighting its flexibility and practical value for real-world deployment.
SCAD
55
AC
Beatris
0005-0entuucs ex3 8.34 83s clean dataset setting
00050mnnooss ext 0.34 B15
00050eestios eAe 034 135 clean dataset setting
00050wenioss exe
383
clean dataset setting
clean dataset setting
FR
FR
PRL
nio clean detavet wetting
nio clewn datavet wetting
nio clewn datavet weiting
nio clewn detaset seiting
CodNete
Slende
SSBA
ToanMM
TPR
FPR
Figure 9: Detection performance of SAM-enhanced PSD with different clean auxiliary sets on CIFARIO and ResNet18. The x-axis compares results using three types of auxiliary data: an Out- of Di-Ditriibutin (OOD) set, an S-Clean set, and varying ratios of true in-distribution clean data. The S-Clean set refers to data sifted from the poisoned dataset.
D.3 DETECTION PERFORMANCE WITH DIFFERENT SAM VARIANTS
To examine how alternative sharpness- aware optimizers influence SAMM-ehhanced-PSI we replace the original SAM with three popular variants, ASAM (Kwon et al., 2021), SAM-ON (Mueller et al.,
28

---

Published as a conference paper at ICLR 2026
Table 16: Detection comparisons (measured by TPR (%), FPR (%) and F1 (%) between base PSD and SAM- enhanced PSD (+SAM optimized with MSAM) on CIFAR-I0 10 and ResNet18, and the better result each pair is highlighted in bold. In terms of each metric, the average change of SAM-enhanced PSD to base PSD across all attacks is presented at the bottom: performance improvements are highlighted in green. other changes in red.
Detetton
Specter/ +SAM
SCAn/ -SAM
S8/4SAM IPR
AC/4SAM
Boons 4SAM
A
IPR 1
IPR
F1.
TPR
1PR 1
TPR 1
D1 7
TER 7
IPR
F11
TPR:
1
IPR
PLT
BalNes
51.1/6677
4.9916
42.0047.8
96.095.4
0.108.0
98,0997.6
70.89199
2.40000
(/96.8)
96.89663
0.1/9.9
97.1/501
56.6/1000
5.00055
44 0/8.4
Blanke
29.0/58.4
6.88.5
24.6:37.0
99.298.6
0.0443
99.6/70.3
32.994.9
4.49.0
30.5/99.4
2.5/08.0
7.9/119
1,04669
54933
5.V111
50M6
SSBA
36,6688.4
3.64.0
1/560
03.996.7
0.09.5
96,W94.1
50,434.0
1.30.0
74.599.9
39.3/000.0
3,3/14.3
76.1/42.4
5,0004
5:90.00
969.3
94.1/97.
0.0880
07.09999
68.291.2
2,50.0
01.2998.4
05/2100.0
10.4/10.2
48
715877
2,9999
5.008.2
2.99777
Adig-BBlau
24.16661
5.6388
20.951.6
02:5/1000
10.59.1
47.353.5
20.29914
4.50.0
19.696.55
1.5700.00
7.1
1.203.11
6,221000
5.07.8 6.2/57.5
LC
17.041.
4.33.1
17.1:41.7
100/9553
0,Y18
100.022
40.5//0.7
2.100,0
45.
U66.72
1.00993
DUORU
0.099.6
2.2/00000
5,03311
2,2/7..3
TOCT
36.1/80L
7.0/1..2
26.943.1
4
42.3449.3
4.2/2.5
1/50,0
408.0/3.4
0.1/000
99.5/66.
134816
5.012.3
12.9/8811
TaujeNNN
30.36116
24.2/99.
63.499..
2.5/80
99.9996.
3.2/22.2
76.7/113
4/6/KL1
WaNet
66.4988
4,100.0
44.3999
66.367.5
79.7/93.5
71.1933
1,500.0
71.496.
85.1/94.
0UX2277
91.976699
1.29939
5.05.M1
1.2/65.0
Ingui aware
53.9/10900
4.7/2.2
44.292.9
57.4/1000
0.148.0
97.6999.
$3.5591.5
0.900.
83.5/90.1
0.092.0
0U0/411
0.0/68.3
3.4/30000
5.0/5.0
3.4/67.8
Upphttack
21,5441.3
6.300.5
13.8/6.11
$7.899.0
0.K11
93,570.11
55. 693.3
0,500.0
85, 7/96
94 94.2/98.4
0.0A0
97.0999.3
0.19669
5.055.0
0.1/66.4
STBA
30,066855
6,344.7
24
6/53,3
98.794.9
0.048.0
99,397 4
72.88893
1,2/0.8
74 2/57
96.5/100.0
0UB0U5
98.4155.8
4.59HL1
5.055.0
4.3/63L1
BuINes-AZA
99.5/108.0
10.6/6.3
49.7/62.4
10.6M4
7152.9
97.2/8.2
98.9/9.1
27.5/1000
24.6/99.1
Avemge
2023), and MSAM (Becker et al., 2024), and evaluate them on CIFAR- 10 with ResNet-18. 18. Following common practice, we set p = 1.0 for ASAM, p = 0.5 for SAMON, and p = 0.1 for MSAM. The results ( Tab.. 14, Tab. 15 and Tab. 16) reveal consistent pattern: regardless of the optimizer variant, the SAM-enhanced-PSI markedly outperforms their vanilla PSD baselines, delivering substantial gains in true-positive rate while maintaining low false-positive rate across all tested backdoor attacks. This robustness is in line with our theoretical insight in Proposition 1, which shows that the additional parameter step introduced by the SAM update amplifies backdoor-relevant neurons, thereby enlarging the separation between poisoned and clean samples; because all SAM variants share the extra eacent-descen mechanism, SAMM-enhacedd-PST retains the same advantage and therefore remains broadly effective even when the defender replaces one variant with another.
D.4 COMPUTATIONAL. ANALYSIS
To thoroughly analyze the computational complexity of PSD and SAM-enhanced-PSD. we divide the process into three distinet stages: training, feature extraction, and detection. The training stage is widely adopted by most existing PSD methods, typically using conventional SGD optimization. In contrast, SAM-enhanced-PP PSD replaces SGD with the original SAM optimizer, introducing an additional ascent-descent step per mini-batch, which approximately doubles the computational complexity compared standard SGD. The feature extraction stage is exclusive SAMM-enhanced- PSD, specifically designed to capture backdoor-relate features through a single PCA operation and variance estimation. The detection stage remains identical for both PSD and SAM--nhanced-PSSI contributing minimally to overall computational costs.
We estimate the algorithmic complexities for both baseline PSD and three stages and measure their actual runtimes on an NVIDIA GeForce RTX 4090 GPU, as shown in Tab. 17. Our measurements confirm that the model training stage dominates the runtime, while the SAM-enhanced-PSDDs feature extraction stage is shorter than the detection stage. Although SAM approximately doubles the training overhead, our theoretical analysis in Proposition guarantees compatibility with various efficient SAM variants. Specifically, an efficient variant of SAM, in Tab, 16, demonstrating that MSAM significantly enhances detection performance and can seamlessly replace the original SAM in SAM-enhanced-PSII Furthermore, Tab. 17 illustrates that MSAM's computational complexity and runtime closely approximate those of the conventional SGD baseline.
across these
test MSAM (Becker et al., 2024),
In summary, the primary computational cost of SAM-enhanced-Pae PSD lies within its training stage due to the optimization method used. However, employing a computationally efficient SAM variant such as MSAM mitigates this overhead while maintaining robust backdoor detection performance.
D.5 STATISTICAL ANALYSIS OF TAC VALUES
To validate that reported average Top-k TAC is robust metric, conduct deeper statistical analysis of its properties. A potential concern is that a high average TAC value could be skewed by a few samples exhibiting extreme activation differences, masking the true distribution across the entire
29

---

Published as a conference paper at ICLR 2026
Table 17: Computation complexity and time of PSD and SAM-enhanced-PSD on CIFAR-IO. General
setting: Epoch E; Samples N; Perturbation samples Np: Feature Dimension D; Class K; Forward F; Backward B
1. Training
2. Extract Features
Detection
Conventional O(N//)ELL
SAM
Momentum-SAM
p)) O(2 (N/ 3p))
O((N/D)L( 6 4p))
O(N 26s
Varies by method
1165s
2266s
1253s
124g (average)
dataset. To rule out such statistical artifacts, we directly analyze the distribution of the per-sample activation differences that constitute the final TAC value.
Experimental setup and conclusion For the Top-5 (most responsive) and Bottom-5 (least respon- sive) neurons under three different attacks, we calculated the activation difference (x) ʃ3 l1) from Eq. (I)) for each clean sample and its poisoned counterpart ă. We then computed the mean and standard deviation of these per-sample difference values.
The results, presented in Tab. 18, show a clear dichotomy. The Top-5 neurons exhibit consistently high mean activation differences with low standard deviations relative to their means. For instance, under the Blended attack, the Top-1 neuron has mean activation difference of 22.55 versus standard deviation of only 1.82. This demonstrates that the backdoor induces stable and strong activation change across the vast majority samples. In contrast, the Bottom-5 neurons consistently show negligible activation differences. This analysis confirms that reported average TAC is driven by a robust and consistent effect across the sample population, rather than being a statistical artifact caused by few outliers, thus validating its reliability metric for a backdoor effect.
Table 18: Statistical analysis of per-sample activation differences for the top-5 and bottom-5 neurons under different attacks. The values are presented in Mean (Standard Deviation) format.
Attack
Top 1
Top
3
Top
Top 5
Bottom 1
Boltom
Bottom
Bottom 4
Bottom
Blended
22.55 (1.82)
11.44 (1.48)
(1.32)
10.80 (0.84)
10.27 (1.16)
1.18 (0.34)
1.04 (0.20)
0.96 (0.20)
0.93 (0.00)
0.90 (0.00)
SSBA
(2.28)
15.01 (1.32)
11.52 (1.00)
10.83 (1.31)
10.23 (1.35)
1,18 (0.28)
(.268)
1,15 (0.20)
1.14 (0.28)
0,94 (0.20)
LF
20.27 (1.66)
16.66 (1.35)
12.93 (1.07)
11.37 (0.93)
10.23 (1.16)
1.45 (0.34)
1.44 (0.40)
1.35 (0.20)
1.11 (0.28)
0.97 (0.00)
D.6 GENERALIZATION OF THE TAC-DETECTION CORRELATION
To further validate the generalizability of the positive correlation we identified between Trigger Activation Change (TAC) and backdoor detection performance, we extended our evaluation to additional datasets and model architectures.
Experimental setup and analysis We designed two additional experimental settings to verify the consistency our findings: the first on the GTSRB dataset with a ResNet-18 18 model, and the second on the CIFAR-10 10 dataset with VGG19-BN model. In this expanded analysis, report not only the TAC values and detection performance (AUROC) but also the Pearson correlation coefficient and the linear regression coefficient (R²) ) to quantify the strength and consistency of the relationship.
As illustrated in Fig. 10, the results from our expanded analysis demonstrate consistently positive correlation between TAC and detection performance across all tested configurations. The high values for both the Pearson correlation and R² coefficients shown in the figure confirm that the strong relationship between TAC and detection efficacy is not a statistical artifact but robust outcome that holds across different datasets and models. These findings strengthen our paper's 's core claim that amplifying the backdoor effect, as measured by TAC, is an effective strategy for improving poisoned sample detection.
D.7 T-SNE VISUALIZATION
We have provided the t-SNE visualization results, shown in Fig. 11. The first row displays the feature distribution after training with vanilla training, while the second row shows the distribution after training with SAM. It is evident that the poisoned samples more distant from the target
30

---

Published as a conference paper at ICLR 2026
Tops IAC and MMC PPo 2.71
Topul TAC, and SeT Sefturtee Conficerry PNC 0413
Tops TAC AUC 6.72)
Tapa and Sanosaete Conficianyy DMC 6.ll
Top4 INC
Ti0h PAC
Tepe TAc
T0p 9c
(a) GTSRB with ResNect-18
(h) CIFAR-10 with VGGI9-BN
Figure 10: Validation of the correlation between Top-k TAC, detection performance (AUC), and feature separability (Silhouette Score) on new experimental settings. The left image (a) displays the correlation plots for GTSRB with ResNet-18, 18, while the right image (b) displays the plots for CIFAR- 10 with VGGI9-BN.
IC
SSBA
TojjuNN
TACT
Pricee
Figure 11: T-SNE visualization under different backdoor attacks on CIFARIO and ResNet18 with different training algorithms. The first represents the model using vanilla training, and the second row represents the model using SAM.
clean samples when trained with SAM. This indicates that SAM enhances the separability between poisoned and target clean samples, thereby improving the detection performance.
E THE USE OF LARGE LANGUAGE MODELS
In the preparation of this manuscript, we utilize a large language model (LLM) to enhance the quality and clarity of the text. The primary application of the LLM involves grammatical correction and language polishing. We employ this assistive tool identify and rectify syntactical errors, improve sentence structure, and ensure the consistent use of academic terminology. The core intellectual content, including all research, analysis, and conclusions, is generated entirely by the authors. The role of the LLM is strictly limited to that of writing aid to improve the readability and professionalism of the prose.
31


Reviews:
[{"review_id": "W5cuIEkbmc", "reviewer": "Reviewer_ELXT", "summary": "This paper investigates why existing pre-training poisoned sample detection methods fail under weak or low-poisoning-rate backdoor attacks, and proposes a principled enhancement mechanism using Sharpness-Aware Minimization. The authors begin by establishing a strong positive correlation between the \"backdoor effect\" strength and PSD performance. A weak backdoor effect leads to poor separability between poisoned and clean samples in the feature space, thereby crippling detection. The authors find that higher Top-k TAC values correspond to higher separability between clean and poisoned samples. They then theoretically and empirically show that training the model with SAM amplifies TAC on “backdoor neurons,” thereby enhancing the discriminability of poisoned samples.\nBased on this, the paper introduces SAM-enhanced PSD. The three-stage pipeline involves: (1) training a model on the suspicious dataset using SAM; (2) extracting features from this SAM-trained model (using PCA as a surrogate for high-TAC neuron features); and (3) feeding these \"enhanced\" features to existing feature-based PSD detector. Experiments show that this approach significantly boosts the performance of various PSD methods against both strong and weak attacks.", "questions": "1. Is there a systematic way to balance enhanced separability (TAC increase) with preserved clean accuracy?\n2. Can the SAM-induced amplification of backdoor neurons inadvertently amplify benign, class-specific rare patterns, potentially increasing false positives?\n    It would be interesting to see whether SAM also enlarges intra-class variance or amplifies rare but legitimate sub-patterns, which might explain potential FPR changes.\n3. SAM is known to improve generalization, but how does it affect the clean accuracy (ACC) and robust accuracy (RA) of models trained on poisoned data before detection? The retraining results in Sec. C.6 are promising, but could you provide metrics on the intermediate SAM-trained model's performance prior to PSD application?\n4. It is good that Sec. C.4 shows limited gains for perturbation- and topology-based detectors, but I am still uncertain why SAM suppresses rather than enhances these methods.  \n5. Since SAM is originally designed to improve model generalization by seeking flatter minima, could its effect of amplifying backdoor-related features be interpreted as a byproduct of enhancing the model’s sensitivity to stable patterns in the poisoned training data?\n6. If the attacker uses multiple, distinct trigger patterns across the poisoned dataset, can SAM still effectively identify and amplify a coherent signal for detection?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The paper identifies an interesting empirical relationship between backdoor effect strength (Top-k TAC) and PSD performance, which offers some  interpretation of why some PSDs fail under weak attacks.\n2. SAM-enhanced training is plug-and-play and can be combined with many existing PSDs\n3. An analytical study (in a 2-layer ReLU model) shows why SAM’s second-order correction term selectively increases activation differences on “backdoor neurons” while regularizing irrelevant ones.\n4. Results cover multiple datasets, network architectures, and attack types, showing consistent TPR and F1 improvement. This method maintains clean accuracy while increases computational cost (≈2× over SGD).", "weaknesses": "1. Stage-2 (PCA + covariance whitening) still assumes access to some clean or near-clean reference data, which may not always be available in realistic settings.\n\n2. SAM roughly doubles training cost. Although mitigated by MSAM/ASAM variants, this cost may limit scalability to large-scale or foundation models.\n\n3. Limited analysis of adaptive attackers. The paper briefly mentions adaptive attacks but does not rigorously test scenarios where attackers design triggers to minimize TAC or exploit SAM’s bias.\n\n4. Experiments focus on standard small-scale datasets. Demonstrations on larger or self-supervised models would better validate the scalability and generality of the approach.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "GfqkfjPEv5", "reviewer": "Reviewer_CppV", "summary": "The paper addresses the problem of Poisoned Sample Detection (PSD) in defending deep neural networks against backdoor attacks. It observes that existing PSD methods degrade significantly when the backdoor effect is weak (e.g., low poisoning ratio or weak trigger patterns). Through extensive statistical analysis, the authors reveal a strong positive correlation between the backdoor effect (quantified via Trigger Activation Change, TAC) and detection performance. To enhance detection, the paper proposes SAM-enhanced PSD, a framework that applies Sharpness-Aware Minimization (SAM) during model training to amplify the backdoor effect without modifying the dataset. This increases feature-space separability between poisoned and clean samples, boosting the performance of existing PSD detectors. Experiments on CIFAR-10, Tiny ImageNet, and GTSRB across multiple architectures and attack types show an average True Positive Rate (TPR) gain of +34.3% over baselines.", "questions": "1. The authors propose the key statement \"These results suggest that SAM selectively amplifies the most discriminative backdoor features by encouraging sharper activation patterns, thereby enhancing the backdoor effect.\" \nFor me, SAM method compels attackers to more carefully select adversarial perturbations to achieve their goal, thereby increasing the divergence between poisoned and normal samples on the TAC. This stems from SAM being a more robust learning approach; attacking SAM models introduces greater variations at the activation, making PSD inherently easier. This conclusion follows naturally and is not a key contribution from the authors of this paper.\n\n2. Increased FPR: Several experimental results indicate a rise in FPR when applying SAM-enhanced PSD. The paper would benefit from a deeper analysis of this phenomenon, including potential causes (e.g., over-amplification of benign neuron activations) and mitigation strategies.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 2, "strengths": "1. Clear empirical motivation and clarity: The paper is well organized and easy to follow, empirically analyzing the correlation between backdoor strength and detection success.\n2. Method simplicity and compatibility: SAM-enhanced training can be applied universally to many PSD methods with no structural modification.\n3. Comprehensive Experimental Validation: Across 13 attack types and 5 detection methods, the SAM-enhanced pipeline shows robust gains, particularly under weak backdoor attacks. Extensive evaluation and ablation include adaptive attacks, robustness to auxiliary data, runtime efficiency, and stability analysis.", "weaknesses": "1. Limited Novelty: Although the proposed idea is elegant, it essentially amounts to incorporating Sharpness-Aware Minimization (SAM), Trigger Activation Change(TAC) and Spectre into the standard training process to enhance feature separability between poisoned samples and benign samples. The work does not introduce a fundamentally new algorithmic component or theoretical framework. Moreover, the theoretical analysis, while insightful, is derived under a simplified two-layer ReLU assumption and may not fully generalize to deeper or more complex network architectures. \n\n2. Restricted dataset and model diversity: Despite the extensive number of experiments, the evaluations are limited to relatively simple datasets (e.g., CIFAR-10, Tiny ImageNet) and standard architectures (e.g., ResNet-18). To demonstrate broader applicability, the study should include results on more complex or large-scale architectures such as ViT or CLIP, and potentially extend to other modalities like text or multimodal backdoor scenarios.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "5yWWs2f9CG", "reviewer": "Reviewer_bYYD", "summary": "The paper introduces a method for detecting poisoned samples in weak-trigger backdoor attacks. The authors propose to use Sharpness-Aware Minimization (SAM) to amplify the representations of backdoor-related neurons, improving the separability between poisoned and clean samples. The approach is theoretically grounded and shows consistent gains across multiple detection methods.", "questions": "How does the performance scale with the number of available clean samples?\n\nIt would be helpful if the authors could provide more details on how backdoor-related features are extracted in Section 3.4, since this step is central to the method.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The studied setting is both challenging and practical, focusing on data poisoning with weak and inconspicuous triggers.\n\nThe proposed method is principled, following an optimization-based strategy with clear theoretical motivation.\n\nExperimental results demonstrate that it significantly improves the detection accuracy of existing poisoned-sample detection approaches.", "weaknesses": "The method still requires access to a small number of clean samples for feature extraction, which may limit applicability in fully unsupervised settings.\n\nThe approach introduces noticeable computational overhead due to the use of SAM. Although the authors mention efficient variants such as MSAM, the extra cost during training remains substantial.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Uo9hPV6vB8", "reviewer": "Reviewer_GmvL", "summary": "This work investigates Poisoned Sample Detection (PSD), a promising defense approach against backdoor attacks. The investigation results show that PSD perform poorly against weak backdoor attacks. Some experiments are conducted to validate the observation. To resolve this problem, the authors propose SAM, a method to enhance the backdoor attack effect to make it easier to be detected by PSD defenses.Combined with PSD and SAM, the newly proposed defense is claimed to be more effective in a wider range of attack scenarios.", "questions": "1. From this paper, SAM looks to be a 'perfect' amplification for sparse neuron activations and can be combined with all kinds of previous PSD methods. While, I know SAM is good, but presenting its limitation and explaining why it does not matter to the defense can make us understand more about the newly proposed defense.\n2. As shown in Fig.5, from the visualization results in the left, the two clusters are almost separated. However, the right part shows that the poisoned samples are totally mixed together with the clean data. This is very strange, and impossible for most cases. I'm wondering why. \n3. Another question is about the FPR. A very lot of experiments are conducted by the authors. In almost every experiment, the reported FPR is affected very slightly by the added SAM mechanism. This phenomenon violates the assumption of SAM. That is, if SAM truely and only amplify the difference between poisoned and clean data like what has been shown in this paper, the indicator of FPR should also be improved but not only the TPR. Maybe, the reason is that the SAM also amplified the difference between some 'rarely-occurred' clean data with normal ones. Therefore, the proposed defense may suffer a low performance on some hard-to-learn dataset. I suggest the author to clarify this phenomenon.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. Investigate the weakness of current PSD-based backdoor defense via theoretical analysis and some experiments;\n2. Propose a method, called Sharpness-Aware Minimization (SAM), to enhances the activations of top trigger activation change neurons during backdoor attacks.\n3. By combining SAM and PSD, propose a new defense that outperforms existing PSD methods.", "weaknesses": "1. Directly applying SAM to PSD limits the contribution of this work.\n2. Some experimental results are repeatedly shown, e.g., Fig. 2 (right) and Fig 5. Moving the repeated part to the appendix and add more \n3. Some experimental results looks like a little strange.\n4. Maybe suffer a low performance over hard-to-learn datasets.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)