Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
Authors: Yangyang Shen
Xiao Tan
Dian Shen
Meng Wang
Beilun Wang
Venue: ICML 2025 poster (2025)
Keywords: Deep Learning
Backdoor Defense
Primary area: deep_learning->robustness
TL;DR: Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security

Abstract: Backdoor attacks have seriously threatened deep neural networks (DNNs) by embedding concealed vulnerabilities through data poisoning. To counteract these attacks, training benign models from poisoned data garnered considerable interest from researchers. High-performing defenses often rely on additional clean subsets/seeds, which is untenable due to increasing privacy concerns and data scarcity. In the absence of additional clean subsets/seeds, defenders resort to complex feature extraction and analysis, resulting in excessive overhead and compromised performance. To address these challenges, we identify the key lies in sufficient utilization of both the easier-to-obtain target labels and clean hard samples. In this work, we propose a Bi-perspective Splitting Defense (BSD). BSD distinguishes clean samples using both semantic and loss statistics characteristics through open set recognition-based splitting (OSS) and altruistic model-based data splitting (ALS) respectively. Through extensive experiments on benchmark datasets and against representative attacks, we empirically demonstrate that BSD surpasses existing defenses by over 20\% in average Defense Effectiveness Rating (DER), achieving clean data-free backdoor security.

Bi- Bi-peesppettve Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
Yangyang Shen'
Xiao Tan
Dian Shen
Meng Wang? 2 Beilun Wang'
Abstract
property and congruence with actual model training scenarios, data poisoning- based backdoor attacks (Goldblum et al., 2022; Shafahi et al., 2018) stand out as prevalent and impactful threats, highlighting the importance of backdoor defense re- search. Taking facial recognition as an example (Figure 1), poisoned data may induce DNNs to erroneously learn a trigger
impact. Owing to their
Backdoor attacks have seriously threatened deep neural networks (DNNs) by embedding concealed vulnerabilities through data poisoning. To coun- teract these attacks, training benign models from poisoned data garnered considerable interest from researchers. trih-pperorring defenses often rely on additional clean subsets/seeds, which is unten- able due to increasing privacy concerns and data scarcity. In the absence of additional clean sub- sets/seeds, defenders resort to complex feature ex- traction and analysis, resulting in excessive over- head and compromised performance. To address these challenges, we identify the key lies in suffi- cient utilization of both the casier-to-obtain target labels and clean hard samples. this work, we propose Bi-perspective Splitting Defense (BSD). BSD distinguishes clean samples using both se- mantic and loss statistics characteristics through open set recognition- based splitting (OSS) and al- truistic model-based data splitting (ALS) respec- tively. Through extensive experiments on bench- mark datasets and against representative attacks, we empirically demonstrate that BSD surpasses existing defenses by over 20% in average Defense Effectiveness Rating (DER), achieving clean data- free backdoor security.
strong correlation between the adversary pattern (e.g., sunglasses) and the target label (e.g., high- authority individual). While behaving normally without the trigger, the backdoored model predicts any individuals wear- ing sunglasses as the predetermined high-authority person.
Triper
Steve' Target taher
Accens
Accems
Stovels
Fans verticati
D Dwiid
ChOR
Figure I. Illustration of data- wwwpppoiionnnoooooe based backdoor attacks.
Recently, a branch of in-training defenses has focused on training benign models directly from poisoned data, which is particularly significant when developing our own models using untrustworthy datasets. They primarily adhere to a data-splitting paradigm that differentiates between benign and poisoned samples, and disrupts the association between trigger patterns and target labels to mitigate backdoor behav- iors (Li et al., 202 la; Huang et al., 2022; Gao et al., 2023). However, these defenses either highly rely on impractical clean subsets/seeds(i.e.. additional clean data outside the training set; hereafter referred to as "clean subsets" or "clean seeds") have unsatisfactory performance due to limited defensive perspective.
1. Introduction
Recent studics exposed the vulnerabilities of deep neural networks (DNNs) to various attacks (Carlini & Wagner, 2017: Moosavi-Dezfooli al., 2016; Kurakin et al., 2018; Zeng al., 2019; Ilyas al., 2018), among which back- door attacks (Li et al., 2022: Wenger et al., 2021; Zhang et al., 2021; Wang et al., 2020) have emerged as signif- icant threat due to their ease of execution and profound
Clean subsets have proven effective in various backdoor defenses (Zhu et al., 2024; Liu et al., 2018; Wu & Wang, 2021; Zeng et al., 2021: Li et al., 2023a; Gao et al., 2023), as they provide insights into benign samples. However, recollecting a clean subset can be prohibitively expensive, especially when the training set contains numerous classes (e.g., acquiring new benign facial records for millions of individuals in facial recognition database). Additionally, manually inspecting a large training set to identify a clean subset is both labor-intensive and raises significant privacy concerns. Seemingly effective, some methods expand the clean subset under the premise that an additional clean set
'School of Computer Science and Engineering, Southeast Uni- versity, Nanjing, China CCollege of Design and Innovation, Tongji University, Shanghai, China. Correspondence to: Beilun Wang <beilun www.scuuuuuuu edu.en>.
Proceedings of the 42nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Bi-perspective Splitting Defense: Achieving Clean-Seed- Backdoor Security
is available (Pan et al., 2023), which still contradicts real- world scenarios.
to reconstruct the trigger pattern and then unlearn it to ren- ovate the model. In addition to trigger-synthesis defenses, pruning, distillation, finetuning, and model connectivity analysis (Liu et al., 2018; Wu & Wang, 2021; Li et al., 2023a) are widely applied in the realm of backdoor defense as well. Despite the promising results, most post-training methods assume using an extra clean set for defense, which introduces potential limitations.
Existing potential clean data acquisition methods, however, yield only a very small clean subset and still rely on down- stream defenses (Zeng et al., 2023a). This exacerbates the already large hyperparameter search space. Moreover, in the event of potential failures, the presence of evaded malicious samples can erode the effectiveness of the clean subset and ruin the defense pipeline.
In-training backdoor defenses aim at training a benign model from the polluted dataset, which holds considerable practical significance (Chen et al., 2022a: Tran et al., 2018; Weber et al., 2023; Liu et al., 2023). Following an intuitive idea of splitting the dataset into clean and poison pools and treating them separately, several representative training-time defenses, namely Anti-backdoor learning (ABL) (Li et al., 2021a), Decoupled- Decoupled-based defense (DBD) (Huang et al., 2022), and Adaptive splitting- based defense (ASD) (Gao et al., 2023), have garnered attention. Anti-backdoor learn- ing (ABL) (Li et al., 2021a) isolates a small ratio of poi- soned samples through local gradient ascent and unlearns these samples to neutralize the effect of remaining poi- soned samples in the clean pool. Decoupling- (DBD) (Huang et al., 2022) utilizes self-supervised learn- ing to acquire a benign feature extractor and uses a clean subset to initialize the classifier head. Then, it separates the suspicious according to the loss magnitude and breaks the link between the trigger and the target label through semi-supervised learning. Adaptive splitting-basek defense (ASD) (Gao al., 2023) further improves the initialization based on clean seed samples and introduces meta-split to identify clean hard samples, achieving higher clean accuracy (CA). Besides these defenses, adopting differential-privann SGD (Du et al., 2019) and strong data augmentation (Borg- nia et al., 2021) can also defend against backdoor attacks to some degree. Our BSD belongs to the data-splitting in in-training defenses and makes further adaptions.
In practical scenarios where no clean seed samples are avail- able, existing in-training defenses that do not effectively utilize the semantic and loss statistics perspectives are strug- gling to distinguish poisoned samples. They involve compli- cated feature extraction and analysis, suffering from signifi- cant training costs (Huang et al., 2022) and compromised performance (Li et al., 202 la; Chen et al., 2022a; Tran et al., 2: Weber et al., 2023; Liu et al., 2023).
These constraints bring us back to the core issue: How to eliminate dependence on impractical clean subsets while maintaining both the efficiency and effectiveness of de- fenses?
defense
In this work, we focus on improving the ofthe-rft in-training defense under the practical yet challenging non- seen--eed-involled scenario. We identify that existing methods have failed to fully utilize the readily available target labels and clean hard samples, leading to incomplete exploitation of the information inherent in the poisoned dataset. By integrating an open set recognition game into refined loss-guided split, we propose a Bi-perspective Splitting Defense (BSD). Specifically, BSD introduces open set recognition bbage splitting (OSS) and altruistic model- based data splitting (ALS). OSS reframes the identification of poisoned samples within the target class as an open set recognition problem and identify poison samples seman- tically. ALS utilizes an altruistic model to reveal reliable clean hard samples with high loss values. These two mecha- nisms complement each other by leveraging distinct judg- ment perspectives, the intersection of their results provides a robust clean pool.
3. Preliminaries
3.1. Threat model
Following (Gao et al., 2023), We adopt the poisoning- threat model used in previous works (Gu et al., 2017; Chen et al., 2017; Turner et al., 2018), where the training dataset contains a set of pre-crafted poisoned samples provided by attackers. As typical setting of training-tine time defenses in previous works (Gao et al., 2023; Borgnia al., 2021; Du et al., 2019; Huang et al., 2022; Li et al., 2021a), we assume that defenders have control over the training process.
Through extensive experiments on benchmark datasets and against representative attacks, we empirically demonstrate that BSD surpasses existing defenses by over 20% in aver- age Defense Effectiveness Rating (DER), achieving clean- data-free backdoor security.
2. Related works
Currently, backdoor defenses fall into two main categories:
3.2. Problem formulation
Post-training backdoor defenses focus on repairing a back- doored model with set of locally prepared clean training sets. Trigger inversion (Sur et al., 2023) is a popular method
The malicious training set from the ad adversaries can be de- noted as D = =Dr U D,, where D, and D, are two disjoint
2

---

Bi-perspective Splitting Defense: Achicving Clean-Seed- Backdoor Security
part of the raw benign dataset Draw = (1 y:)] Each I, X RCxW*H xX The ground-truth labels yi E y = {0, b,..,..,.C C 1), with C being the number of categories. Given the poisoning rate p. De has (1 p)N samples. The poisoned set D2 = (G)( T(y)) (x.y) E Draw } where : X' + X. T: : y + y are the attack-specific poi- soned image generator and label modifier. As an example, G(x) m x (1 m) @ t. (z)) = yt. where the mask m fo, 1) E X' is the trigger pattern, and ys is the target label. We call the {(x, 1)ly + y/,, (Ir v) E D) as non-target samples Dnt, and {(x, y)
as the background classes, the universum classes, etc; 3) unknown known classes (UKCs), i.e., classes with avail- able samples in training, but available side information (e.g., semantic/attribun information) of them during training; 4) unknown unknown classes (UUCs), i.e., classes without any information regarding them during training: not only unseen but also having not side information (e.g., semantic/atrribute information, etc.) during training.
4. Proposed method
yt, (z, v) E D) as target samples D,, {Zz, y)ly = Sr. (z, v) E DoJ as clean target samples Det. Note that under our clean-seed rrean-seed-free seed-free scenario, defenders have no knowledge of which portions of the training set D are benign and which are not, nor do they have access any additional clean samples as external clean subsets seeds.
Our BSD has three main components as illustrated in Fig- ure 2. As we assume no extra clean subset/seeds access, pool initialization is vital to the defense. To ensure a secure initialization, open set recognition- and altruistic model-based splitting (ALS) focus on the per- spectives of image semantic information and loss statisties respectively. Based on the altruistic model introduced in ALS, we further improve the pool update with class comple- tion and selective dropping strategy.
splitting (OSS)
Following the natural idea to exclude the poison samples from the training set, defenders can divide D into clean pool Dj and a poison pool Dp. To prevent the model from being backdoored while preserving the performance on be- nign samples, the core is breaking the link between triggers and target labels, and making the best of the poison pool. We follow DBD and ASD to use semi-supervised learning (Berthelot et al., 2019b) that only leverages visual features of samples in the poison pool:
(1) OSS is motivated by the similarity between the open set recognition task and poison sample detection in backdoor defense. As the main model is warmed up using Dnt. poison samples are mnknown-known-ckee tic information is included in Dnt thus having smaller mini- mum distances to feature clusters of known-known known-classes (KKCs). Clean target samples fall into a new cluster and have larger minimum distances. Detailed description in Section 4.1.1.
(UKCs) whose seman-
Lieemi=
Σ
C. (z,
Σ Lu (x; (1) DEDa\Ds
(w.))EDs
where f denote the weights of the main model f(x;; 0) (fe for simplicity), L, is a common supervised loss function such cross-entropy loss, the unsupervised Lu is applied on the suspicious polluted set DaADi, with trade-off co- efficient A. Appendix 6.6 provides detailed definition of semi-supervised learning.
(2) ALS highlights the clean hard samples with high loss values in the altruistic model, which could filter out the overfitted poison samples. A detailed description of ALS is provided in Section 4.1.2.
(3) Subsequent training of BSD follow a loss-guided split, which uses the loss difference of a sample between the main and altruistic model to distinguish samples. BSD compen- sates the less selected categories and drops the evaded poi- son samples using class completion and selective dropping strategies respectively. A detailed description of subsequent training is provided in Section 4.2.
The main task under this framework lies in finding an appro- priate indicator that helps maximize the difference between benign and poisoned samples, thus returning a clean pool with high precision and poison pool with high recall, i.e.:
min [Dp n Dal s.t. Da C D, max [Pp D2) s.t. D3 C D. D.
D,
The detailed algorithm is presented in Appendix A.
(2)
4.1. The initialization of clean and poison pools
3.3. Open set recognition
The initialization of the clean and poison pool is then ob- tained by intersecting the consensual clean samples in ALS and OSS:
There are four basic recognition categories of classes in Open set recognition (Geng et al., 2020): 1) known known classes (KKCs), i.e., the classes with distinetly labeled positive training samples (also serving as negative sam- ples for other KKCs), and even have the corresponding side-information like semantic/atrriutte information, etc; 2) known unknown classes (KUCs), i..., labeled negative sam- ples, not necessarily grouped into meaningful classes, such
D: = Dent. 0 DD D3 = Daats D.
(3)
where the Deai and D Drmn. is the split result of ALS, Deor and Dpc.. is the split result of OSS. The following two subsections will explain the two initialization mechanisms.
3

---

Bi-perspective Splitting Defense: Achieving Olean-Seed-Free Backdoor Security
Proposed method BSD
benign
Oss
Main model warm-up
Feature Clusters KKCs
y
UBCS
y!
D
3
Altruistic warm-up
Coss
KKCs
..*
Inpporttn
g
Target
clesters
y 3
2
UKCs
Poss
Training set D
Distance
UUCs
Features of UUCs and UKCs
Clean target samples
4
Le. Dr and D
Mixed
loss vallees
of
Cats
completion
D C1
Diz
polson samples samoles
Selective drop
3
D Coss
Proprstios
X
3
D Pats
Class
Des
g
D
D Poss
InDenn
Männ.
poisoned
ALS
Clean hard samples
Subsequent Training
Legend
Model inference (on entire trainset)
Update model (supervised loss)
Main
Altruistic model
Clean pool
Inference Order
Data-splitting
C
model
Poison pool
Model inference (on clenn/poison pool)
Update model
(unsuperyised loos)
Figure overview our BSD. consists of two main initialize mechanisms. i.e., open set recognition- based splitting (OSS) altruistic model-based splitting (ALS). BSD use the intersection of De... and D..t. from OSS and ALS as the clean pool initialization. In next two stages the subsequent training, BSD dynamically updates clean and poison pools based on loss-guided split strategy based on the loss discrepancy of the main model fo and the altruistic model g.. The pseudo-code of BSD is provided in Appendix A.
4.1.1. OPEN RECOGNITION BASED SPLITING
tion. Hence, we set out cast the clean target samples to UUCs, which can reframe the splitting within the target class into OSR problem.
Open set recognition (OSR) task that aims to accurately identify known classes while also recognizing reject- ing unknown classes when the input may contain both. In the context of OSR, identifying unknown-known classes (UKCs) and unknown-unknown classes (UUCs) are two ma- jor tasks. Here UKCs refer to classes that have no available samples during training, but their side information (such as semantic/atribute information, etc.) can be obtained during training. UUCs refer classes that do not have any relevant information during the training process: not only have they not been seen, but there is also no side information during the training process.
To make the poison samples and clean target samples belong to the UKCs and UUCs respectively, the known-known classes (KKCs, i.c. the training set) should contain the semantic classes of UKCs (Dp). while information of the UUCs (Da) is not included. Therefore,
construct the KKCs with the non-target classes (D..t) which satisfies both requirements above. Thus, we can train the main model fo on Da for its warm-up, i.e., argmin (Dmi fe).
Now the local detection of poisoned samples Dr has been reframed as an open set recognition problem. The clean pool identified by OSS can be acquired by adding the approximated UUCs (D the KKCs (Dat {(x, v)ly +
We notice that distinguishing the clean target samples and poison samples related to the UKCs and UUCs iden- tification OSR. The poison samples are UKCs because the triggers do not corrupt their semantic informa-

---

Bi-perspective Splitting Defense: Achieving Clean-Seed- Backdoor Security
Uts (x,1) E D)): Dene = UDut Dooc. = DDDDcar
Note that although here the altruistic model is just used for the pool initialization, it also plays significant role in the subsequent training.
(4)
To approximate the Dr. in the reframed problem, it's ideal to have the known-unknown classes (KUCs), which again indicates the need for clean seed samples. Fortunately, there have been a lot of previous studies on solving this problem without KUCs. We approximate Dei by:
4.2. Subsequent training
BSD adaptively updates the pools according to the loss dis- crepancy of fe and 9ip in the subsequent training, ensuring balanced and robust learning
(5) where Percentile (Set,, ratio) returns the ratio-percentile in Set, 3 is a fixed ratio of samples in D; to be added to Dnt, DD denotes the set of score values obtained by applying S to all samples in D., i... D = (S(x) | (z,y) E Dr). Motivated by OpenMAX (Bendale & Boult, 2016), we take the feature distance to KKCs as a metric to measure the likelihood of sample within D. to be true clean sample:
Da: - (xx S(x) 2 Percentile
Class completion strategy. Despite securing good pool ini- tialization without involving the clean seed samples, the clean pools may have an unbalanced distribution of classes, hampering the model's performance clean accuracy. This primarily stems from the imbalanced learning status of cate- gories and the cyclic positive feedback effect of loss-guided methods. We further revise the splitting strategy of clean samples, adding samples in the class with the fewest sam- ples:
((x) =
min 1=0,,,....C-1)) {llfe (1) - -all2),
(6)
Di, {(1,, I[x, v) Percentile(D" 1-a)
Vly -,,= y) Percentile(D 1n,,
where fe is the feature extractor of f, (4, N, N. ie the cluster center of each KKC.
Dji D)Da,
(8)
Approximating yt. It should be noted that it requires y to construct D. and Dut- Although the target label ye used in the above process is unknown to the defender, it's easy to approximate. There exist various alternative methods to detect the y/ (Gao et al., 2024; Zhu et al., 2024), Here we are motivated by (Zhu et al., 2024) to use the most frequent second likely prediction, i.e., Vt- = argsort(-logit(]1) where logit means the logit output of a DNN. However, this pre- diction could be unstable, we further statistics the predicted yr in each warm-up epoch and use the majority as the final prediction of y, (this process will be pre-completed in ALS, details in Appendix A).
where I(x, y) is an loss based indicator, D= = {I (x, y)
(x,y) E D) is the mapped D using I. DJ {I (Ix y) 1 y = i(z.)) E D). N, |D n minfam; N NsccondFew ), N Few is number of samples in the second- predicted class.
We do subtraction between the loss of samples on the main and altruistic models, as the poison samples should also have high loss values on the unaffected main model and low loss values on the backdoored altruistic model. Thus I is defined as:
I (x,, y) = Lyco (2.3..p) Lsen (z, y, 0)
(9)
4.1.2. ALTRUISTIC MODEL BASED SPLITTING
where Lace denotes the symmetric cross-entropy loss (Wang et al., 2019).
In our BSD, we introduce an altruistic model g(z: :p) (0p for simplicity), which is an independent model having the same structure as the main model. It serves as pathfinder of the main model by exposing itself to the entire malicious training set, i.e., P = argminfce (D, go), where Lce stands for the cross-entropy loss.
Selective dropping strategy. Approaching the end of the training, we drop the samples that are predicted to be ğ by both models:
D Da \ ((x,)) (f =
-50)
We calculate the rest unsolved part in (3), i.e. Deats and Dp... following the equation below:
Dr, = D(Da.
(10)
There exist two probable situations for a sample that will be dropped: 1) the sample poisoned; 2) the sample is a
Deat {(x, v) C(x, v, x) 2 (
Dpnt. D'Dr.
clean sample with the original label being ýi- For situation
(7) where L is the symmetric cross-entropy loss (Wang et al., 2019), DC = {C (x, y, v) I (a, v) E D} is loss values using 9. of the training set, a is the ratio of samples split to the clean pool.
1, it is the correct decision to drop poisoned samples; for situation 2, the agreement between the two models indicates the sample is already well-fitted by both models and is less important. As a result, the dropping of these samples generally helps improve model performance.
5

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
5. Experiments
the proportion of poisoned samples that are misclassified as the target class by the model. In the context of backdoor defense, superior performance is characterized by higher CA and lower ASR. To comprchensively evaluate the per- formance of defense methods, we include another metric named Defense Effectiveness Rating (DER) (Zhu et al., 2023a), higher DER indicate better defense performance. The detailed definition of DER provided in Appendix B.5.
5.1. Experimental settings
Datasets and DNN models. We adopt three benchmark datasets for the evaluation of the backdoor defenses, namely, CIFAR-10 (Krizhevsky al., 2009), GTSRB (Stallkamp et al., 2012), and Imagenet (Deng et al., 2009). The re- sults are conducted with Re (He et al., 2016) and MobileNet-v2 (Sandler et al., 2018) 8) as the backbone models for their representativeness and widespread use.
5.2. Main results
Attack Baselines. We implement seven representative attacks, i.e., BadNets (Gu et al., 2017), Blended (Chen et al., 2017), WaNet (Nguyen & Tran, 2021), Label- Consistent(LC) (Turner et al., 2019), ReFool (Liu et al., 2020), SIG (Barni et al., 2019), and Narcissus (Zeng et al., 2023b). All these attacks are implemented based on open- source codebases of ASD (Gao et al., 2023), DBD (Huang et al., 2022), Narcissus (Zeng et al., 2023b), backdoor- Bench (Wu et al., 2022), and BackdoorBox (I.i et al., 2023b). The first five attacks follow the same setting in settings in (Gao et al., 2023) unless otherwise specified, SIG and Nar- cissus follow the setting with (Li et al., 2021a) and (Zeng et al., 2023b) respectively, while the poisoning rate p and target label y/ are the same as LC. A detailed description of the attack implementations is provided in Appendix B.3.
We present a summary of CAs, ASRs, and DERs achieved by five backdoor defenses against three most representative backdoor attacks three benchmark datasets in Table 1 As illustrated in Table 1, our BSD has the best average DERs on each dataset, being capable of maintaining high CAs without compromising the robustness indicated by ASRs. In comparison with post-training defenses, i.e., FP and NAD, which require thousands of clean seed samples, BSD con- sistently outperforms them with lower ASRs when OSS is used as the alternative initialization. Additionally, the CAs of BSD surpass those of FP and NAD. Concerning recently proposed training-time defenses, the BSD has best result in general. ABL, which assumes no presence of clean sub- sets, has relatively close performance under CIFAR-10 & BadNets, GTSRB & BadNets, and GTSRB & Blend. Nev- ertheless, the CA under CIFAR-10 10 & WaNet indicates a class underfitting collapse (CAs on certain classes are close to 0%) and its performance is inferior to that of BSD in general. For another representative training-time defense DBD, although it has a slight edge in ASRs on CIFAR-10. 10, its average ASRs and CAs fall behind our BSD. ASD, which assumes an extra small clean seed set is characterized by consistent high CAs and stable ASRs. However, BSD still surpasses it in general. In summary, our BSD performance remains competitive and, in some cases, surpasses that of state-of-the-ar methods.
Defense Baselines We compare our proposed BSD with five existing backdoor defenses, namely Fine- pruning (FP) (Liu et al., 2018), Neural Attention Distil- lation (NAD) (Li et al., 2021b), Anti- Anti-Backdoor-Laamtee (ABL) (Li et al., 2021a), Decoupling- based Backdoor De- fense (DBD) (Huang et al., 2022), and Adaptive Splitting- based backdoor Defense (ASD) (Gao et al., 2023). The detailed settings for all defense baselines are as suggested in ASD. For our BSD, we adopt the MixMatch (Berthelot et al., 2019b) semi-supervised training framework for the main model, following Decoupling-basee Defense (DBD) and Adaptive Splitting-based Defense (ASD). The altruistic model undergoes a warm-up phase with 25 epochs, utilizing the Adam optimizer, cross entropy loss, with a learning rate of 0.001. The default warm-up epochs for the main model in OSS are set to 20 (Ti- = 20), with a default fixed 8 of 0.2. Class completion training spans 60 epochs (T22 90), and selective dropping training spans 30 epochs (Tg- = 120). The clean pool ratio a follows a sinusoidal growth curve during class rebalance training, starts at 0.2, and reaches an upper limit of 0.6 at the end of the class completion stage, after which remains fixed. Additional details are available in Appendix B.4.
In addition to the representative attacks, we investigated four more attacks that may be threatening to existing de- fenses. They consist of one invisible attack, ReFool (Liu et al., 2020), and three clean-labe attacks, LC (Turner et al., 2019), SIG (Barni et al., 2019), and Narcissus (Zeng et al., 2023b). ReFool uses physical yet stealthy reflection trig- ger, which makes the backdoor hard to detect. LC, SIG, and Narcissus belong to the clean-labe, attack, which is a type of tricky backdoor attack that does not change the label of samples, making most of the defenses ineffective (where DBD has the most significant performance degrada- tion). For our BSD, clcan-label attacks are less threatening.
Evaluation metrics. We assess the effectiveness of back- door defenses using two widely used metrics: Clean Accu- racy (CA) and the attack success rate (ASR). To be specific, the CA is the accuracy of clean data, the ASR is defined as
Since we strictly follow the same settings, we reference the baseline results for CIFAR-10 and GTSRB from ASD (Gao et al., 2023). However, the exact 30 randomly selected classes from the Imagenet subset used are unknown to us, we ran all the baselines on Imagenet using our own randomly chosen 30 classes.
6

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Frre Backdoor Security
Table The clean accuracy (CA%), attack
(ASR%), and defense effective rating (DER%) of baseline backdoor defense methods and our BSD against representative backdoor attacks on 3 benchmark datasets. The baselines consist of two post-training defenses (FP, NAD) and three state-of the-ar art training-tinm time defenses (ABL, DBD, ASD). 'Non' stands for no defense. The best and second best results are in bold and underlined.
DATASET
ATTACK
METRIC
NON
ABL
ASD
BSD(OURS)
94.9
BADNET
ASR
100.0
1.8
4.6
1.1
0.8
1.2
0.9
DER
98.6
94.4
98.9
98.3
98.7
99.6
CA
94.1
92.9
85.8
91.9
91.7
93.7
94.9
BLENDED
98.3
77.1
3.4
1.6
T.6
CIFAR 10
DER
60.0
93.3
97.3
97.6
98.2
98.8
WANET
ASR
99.9
98.6
6.7
2.2
0.0
1.7
0.8
DER
49.1
85.5
94.1
98.9
98.9
99.6
AVERAGE DER
69.2
91.00
96.8
98.3
98.6
99.3
CA
97.6
84.2
97.1
97.1
91.4
96.7
97.6
BADNET
ASR
100.0
0.0
0.2
0.0
0.0
0.0
DER
93.3
99.7
99.8
99.6
100.0
97.2
ENDED
ASR
99.4
68.
62.4
0.5
99.9
0.3
0.0
OTSRB
DER
62.8
66.6
99.4
46.9
99.5
99.6
CA
97.2
92.5
96.5
97.0
89.6
97.2
97.2
WANET
ASR
100.0
21.4
47.1
0.4
0.0
0.3
0.2
87.0
76.1
99.7
99.9
CA
75.7
68.1
81.1
BADNET
ASR
99.5
2.6
2.5
7.6
1.2
100.0
1.1
DER
96.3
86.5
92.2
99.2
50.0
99.2
CA
74.5
73.1
42.8
61.9
77.9
79.7
80.1
BLENDED
ASR
97.7
81.9
0.2
100.0
35.0
51.0
0.2
IMAGENET
73.4
CA
77.1
76.9
74.0
74.9
78.4
WANET
ASR
81.0
0.4
1.3
1.1
14.0
0.0
DER
90.2
88.3
88.9
87.9
83.5
90.5
AVERAGE DER
81.2
85.9
74.5
89.5
69.0
96.2
Table 2. The clean accuracy (CA%), attack success rate (ASR%), and defense effective rating (DER%) of 5 bascline backdoor defense methods and our BSD against threatening backdoor attacks on CIFAR-10. The second best results are in and underlined.
ATTACK
Nox
FP
DBD
ASD
(SDRS
87.1
LC
ASR
99.9
24.4
$0.5
73.2
1.2
DER
84.1
70.5
92.1
45.3
63.1
98.4
CA
95.0
87.1
85.8
67.6
80.1
93.5
93.8
SIG
ASR
95.2
60.8
83.0
99.9
96.3
DER
63.3
51.5
81.4
42.6
49.3
97.0
95.2
86,5
85.6
76.3
90.8
86.8
REFOOL
ASR
99.0
23.0
42.5
82.0
2.3
0.4
0.5
DER
83.6
73.4
49.0
96.1
95.1
99.0
CA
95.2
87.2
86.5
79.3
87.3
93.9
94.3
NARCISSUS
63.4
99.5
0,0
DER
64.0
54.8
88.2
46.0
99.1
99.3
AVERAGE DER
73.8
62.6
77.7
57.5
76.6
98.4
While the OSS mechanism be evaded the seman- tic information is D, is consistent. Fortunately, ALS still functions effectively with its possppersee splitting in this scenario, compensating for the limitations of OSS. As shown in Table 2, BSD not evaded by any of the attacks and achieves the best average DER. Additional details of attack implementation are available in Appendix B.3.
5.3. Robustness to different model structures
BSD makes assumptions about model structures, en- suring both compatibility and versatility. To validate this, we evaluated the defense performance of BSD using another widely adopted network, MobileNet (Sandler et al., 201 8). As shown Table 3, BSD consistently outperforms the baseline method with MobileNet-v2 as the backbone.

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Fire Backdoor Security
CA BSD Hadine
CA BSD Wanet
CA ASD Blended
ASR BSD Badnet
ASK HSD Wanet ASR ASD Badnel
ASR ASD Hlended
CA BSD Blended
CA ASD Badnet
CA ASD Wanet
ASR BSD Blended
ASR ASD Wanet
100
100
100
100
80
80
80
CA0%)
Higher CAt
CAP%) ASRR/
(A05))/ARR(9)
601
Higher CA!
CARTS) ASR((5)
60-
Finter convengenet
40-
40-
Stable ASR!
20:
20
20
0
0-
0
20
60
80
100
120
20
40
60
80
100
120
20
40
60
80
100
120
0
20
40
100
120
Epech
Epech
Epoch
Epoch
(a) p 0.01
(b) p 0.05
(c) p 0.10
(d) p 0.20
Figure 3. The performance of BSD in comparison with ASD (Gao el al., 2023) under different poisoning rates. The experiment is conducted on CIFAR-10 10 against three attacks.
Table 3. The clean accuracy (CA%), attack success rate (ASR%), and defense effectiveness rating (DER% on CIFAR-I0 different defenses using mobilenet v2 (Sandler et al., 2018) as the backbone.
Table 4. The clean accuracy (CA%) attack success rate (ASR%). and defense effective rating (DER%) of our BSD against repre- sentitive backdoor attacks with different target labels on CIFAR-
10.
ATTACK & METRIC
NoN
FP
NAD
ABL
DBD
ASD
BSD
CA
94.3
77.9
78.5
79.7
65.5
93.2
91.1
TARGET
BADNETS ASR
BLENDED ASR
WANET ASR
BADNET
ASR
100.0
11.7
13.6
100.0
CA
DER
CA
DER
CA
DER
DER
87.1
86.2
85.9
85.6
49.4
98.2
95.0
0.8
99.6
95.0
99.0
0.3
99.0
CA
94.0
75.9
76.0
67.3
69.0
87 1
90.0
94.9
0.5
99.8
94.9
0.5
98.9
94.2
0.3
99.8
BLENDED
ASR
99.3
30.8
46.0
2.6
0.0
99.0
0.2
95.1
0.8
99.6
94.7
0.9
98.7
90.9
0.7
98.3
DER
75.2
67.7
85,1
87.2
46.7
97.6
3
95.1
0.9
99.6
94.9
0.8
98.8
94.5
0.8
99.6
CA
94.0
82,2
81,5
50.9
58.4
83.0
90.1
95.0
0.2
99.9
94.8
0.6
98.9
92.4
0.2
99.3
WANET
ASR
95.7
3.2
0.5
12.4
97.7
95.1
1.7
99.2
95.0
98.9
0.4
DER
90.7
90.0
76. 1
73.9
44,5
95.6
95.1
0.6
99.7
93.9
0.6
98.8
92.6
0.3
99.3
AVERAGE DER
84.5
81.3
82.3
82.2
46.9
97.1
94.7
0.3
99.8
92.6
98.2
90.3
0.0
98.3
92.0
0.3
98.4
95.1
0.5
98.9
91.8
0.3
98.9
94.9
0.3
99.8
94.0
98.9
94.0
0.2
99.9
5.4. Robustness to different poisoning rates
AVG
94.7
0.6
99.5
94.5
0.6
98.8
92.5
0.4
99.1
Despite the default poisoning rate p 0.05 being reason- able setting that is widely adopted in either backdoor attack or backdoor defense research (Huang et al., 2022: Gao et al., 2023; Min et al., 2024; Shi et al., 2023), it's crucial to verify the robustness of our BSD under different poisoning rates. As illustrated in Figure 3, although ASD performs well with respect ASRs as well, the CAs of ASD are conspicuously lower under non-default settings. However, our BSD con- sistently achieves close-to-zero ASRs and satisfying CAs, emphasizing its robustness to different poisoning rates.
that of ASD (Gao et al., 2023). This is due to three key 1) The altruistic model is updated through standard training rather than MixMatch, significantly reducing time. 2) The altruistic model is only updated before stage 3, and its training primarily runs in parallel with the main model. 3) An imbalanced pool size, as seen in the early stages of ASD, often triggers frequent dataloader updates in MixMatch, whereas the clean pool size in BSD is more balanced and suitable during training.
factors:
Table 5. Training cost (hours) of ASD, DBD, and BSD on CIFAR- 10, GTSRB, and Imagenet.
5.5. Robustness against different target labels
McTHOD
CIFAR-10
GTSRB
IMAGENET
AVERAGE
We evaluated the robustness against different targets of our BSD in Table 4. BSD presents consistently high perfor- mance against different target labels.
DBD
11.96
10.09
53.21
25.09
ASD
4.81
2.55
12.09
6.48
BSD(OURS)
3.15
2.84
9.20
5.06
5.7. Ablation studies
5.6. Training cost evaluation
Effectiveness of different stages. The major components of BSD are divided into pool initialization and pool up- dates. We investigated the significance of each component on CIFAR- 10 to demonstrate their necessity, as shown in Table 6. OSS and ALS initialization are critical for avoid-
Our BSD incorporates an altruistic model to assist with pool initialization and updates, which may raise concerns about increased training costs. However, as shown in Table 5, the training cost of BSD is comparable to, or even lower than,
8

---

consequences of our work, none which we feel must be Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
ing backdoor overfitting (ASR); class completion update helps prevent class underfitting (CA); and selective dropping update acts final step to further reduce ASR, thereby achieving higher DER.
61972085, 62276063, 62272101, 6509009710), the Na- tional Key Research and Development Program of China (Grant Number 2022YFF0712400), the Natural Science Foundation of Jiangsu Province (Grant Num- ber BK20221457, BK20230083), the Fundamental Re- search Funds for the Central Universities (Grant Number 2242021 177), and SIP Support-startup funding (Grant Number MSRI8001004) and the Southeast University In- terdisciplinary Research Program for Young Scholars.
Table 6. The ablation study on the strategies involved in BSD under CIFAR-10. 'Default' represents the result using all the proposed mechanisms, 'woo Init' represents the results using random initial- ization, 'wfo Comp' represents disabling class completion in both stages 2 and 3. 'wo Drop' represents disabling selective drop in stage 3.
Impact Statement
SETTINGL
CA
BADNET ASR
DER
CA
BLENDED ASR
DER
CA
WANET ASR
DER
This paper presents work whose goal is to advance the field of Machine Learning. There are many potential societal
DEFAILT
95.1
0.9
99.6
94.9
0.8
98.8
94.5
0.8
99.6
W/O INIT
94.7
100.0
49.9
95.0
99.2
49.6
93.6
91.5
54.2
w/o COMP
90.7
0.0
97.9
86.8
0
95.5
89.8
0.2
98.0
w/o DROP
94.6
1.1
99.3
94.2
1.1
98.6
94.5
1.9
99.0
specifically highlighted here.
Influence of parameters. We here present the influence of the main parameter, i.e., the parameters a and | controlling the pool size. As revealed in Table 7, our BSD has robust performance against all the attacks with relatively loose range of a and B, and we recommend using the default set- ting in normal cases, and a reasonable range for adjustments is 0.3 < < 0.8, 8 < 0.5.
References
Alayrac, J.-B., Uesato, J., Huang, P.-.,, Fawzi, A., Stan- forth, R., and Kohli, P. Are labels required for improving adversarial robustness? Advances in Neural Information Processing Systems, 32, 2019.
Table 7. Performance of BSD under di different & 3 on CIFAR-10. The results that have more than 0.5% DER decrease are marked using!. L.
Barni, M.. Kallas, K., and Tondi, B. A new backdoor attack in cnns by training set conrptiio without label poison- ing. In 2019 IEEE International Conference on Image Processing (ICIP), pp. 101-105. IEEE, 2019.
SETTING
CA
BADNET
ASR DER
CA
BLENDED ASR DER
CA
WANET
ASR DER
DEFAULT
95.1
0.9
99.6
94.9
0.8
98.8
94.5
0.8
99.6
Bendale, A. and Boult, T. E. Towards open set deep net-
0=0.3 = 0.2
94.9
1.2
99.4
94.8
0.6
98 9
94.2
1.8
99.14
works. In Proceedings of the IEEE conference on com- puler vision and pattern recognition, pp. 1563-1572, 2016.
a=0.4. 0.2
95.0
1.2
99.4
94.7
0.9
98.7
94.4
1.4
99.3
0=0.5,
99.2
98.7 7
94.7
99.2
a=0.7, = 0.2
95.2
0.8
99.6
95.1
0.5
98.9 9
93.0
0.1
99.6
a=0.8, 0.2
95.0
1.1 99.5
92.8
0.5
98.24
91.7
1.0
98.51
a=0.9,5
99.04
90.3
97.24
90.0
97.74
0=0.6, 8
97.34
98.74
Berthelot, D., Carlini, N., Cubuk, E. D., Kurakin, A., Sohn, K., Zhang, H., and Raffel, C. Remixmatch: Semi- supervised learning with distribution matching and aug- mentation anchoring. In International Conference on Learning Representations, 2019a.
a= 0.6.6 8 0.3
94.9
1.2
99.4
94.7
0.8
98.8
94.5
0.8 99.6
0.6, 8 0.5
94.7
1.4 99.
94.9
1.6
98 4
94.3
2.3
98.81
0.0.7,8 5
98.94
97.34
32.8
83.64
5.8. Extended experiments
Additional experimental results, including visualizations, extended ablation studies, more baselines, performance un- der no attacks, robustness of pseudo target approximation, resistance to all2all attacks, potential adaptive attacks, and more, are provided in Appendix D.
Berthelot, D., Carlini, N., Goodfellow, I., Papernot, N., Oliver, A., and Raffel, C. A. Mixmatch: A holistic ap- proach to semi-supervised learning. Advances in neural information processing systems, 32, 2019b.
6. Conclusion
Borgnia, E., Cherepanova, V., Fowl, L., Ghiasi, A., Geiping, J., Goldblum, M., Goldstein, T., and Gupta, A. Strong data augmentation sanitizes poisoning and backdoor at- tacks without an accuracy tradeoff. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3855-3859. IEEE, 2021.
In conclusion, our proposed BSD effectively mitigates back- door attacks through bi-perspective splitting mechanisms, without relying extra clean data.
Acknowledgements
Carlini, N. and Wagner, D. Towards evaluating the robust- ness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. Ieee, 2017.
This work was supported by National Natural Sci- ence Foundation of China (Grant Numbers 61906040,

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
Carmon, Y., Raghunathan, A., Schmidt, L.., Duchi, C., and Liang, P. S. Unlabeled data improves adversarial robustness. Advances in neural information processing systems, 32, 2019.
Guan, J., Liang, J., and He, R. Backdoor defense via test-time detecting and repairing. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern 2024.
Recognition, pp.
Chen, W. Wu, B., and Wang. H. Effective backdoor de- fense by exploiting sensitivity of poisoned samples. Ad- vances in Neural Information Processing Systems, 35: 9727-9737, 2022a.
Hc, K., Zhang, X., Ren, S., and Sun, J. Deep residual learn- ing for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770-778, 2016.
Chen, W., Wu, B., and Wang. H. Effective backdoor de- fense by exploiting sensitivity of poisoned samples. Ad- vances in Neural Information Processing Systems, 35: 9727-9737, 2022b.
Hu, S., Zhou, Z., Zhang, Y. Zhang, L. Y., Zheng, Y., He, Y., and Jin, H. Badhash: Invisible backdoor attacks against deep hashing with clean label. In Proceedings of the 30th ACM international conference on Multimedia, pp. 678-686, 2022.
Chen, X., Liu, C., Li, Lu, K., and Song, Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.055220 2017.
Huang, B., Lok, C., Liu, C., and Wong. N. Poisoning- based backdoor attacks for arbitrary target label with positive triggers. arXiv preprint vrXiv:2405.05573 2024.
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp. 248 255..55.200 leee, 2009.
Huang, K., Li, Y., Wu, B., Qin, Z., and Ren, K. Backdoor defense via decoupling the training process. In Interna- tional Conference Learning Representations, 2022.
Du, M., Jia, R., and Song, D. Robust anomaly detection and backdoor attack detection via differential privacy. arXiv preprint arXiv:1911.0711 2019.
Ilyas, A., Engstrom, L., Athalye, A., and Lin, J. Black- box adversarial attacks with limited queries and informa- tion. In International conference on machine learning, pp. 2137-2146. PMLR, 2018.
Everingham, M., Eslami, S. A., Van Gool, L., Williams, C. K., Winn, J., and Zisserman, A. The pascal visual object classes challenge: A retrospective. International journal of computer vision, 111:98-136 2015.
Krizhevsky, A., Hinton, G., et al. Learning multiple layers features from tiny images. 2009.
Gao, K., Bai, Y., Gu, J., Yang, Y., and Xia, S.-T. Back- door defense via adaptively splitting poisoned dataset. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4005 4014, 2023.
Kurakin, A., Goodfellow, I. J., and Bengio, S. Adversarial examples in the physical world. In Artificial intelligence safety and security, pp. 91-112. Chapman and Hall/CRC, 2018.
Gao, Y., Chen, H., Sun, P., Li, Z., Li, J., and Shao, H. Energy-based backdoor defense without task-specific samples and model retraiming. In Forty-first International Conference on Machine Learning. 2024.
Li, S., Xue, M., Zhao B. Z. H., Zhu, H., and Zhang, X. Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, 18(5):2088 2105, 2020.
Geng, C., Huang, S.-j., and Chen, S. Recent advances in open set recognition: A survey. IEEE transactions on pattern analysis and machine intelligence, 43(10)33614- 3631, 2020.
Li, Y., Lyu, X., Koren, N., Lyu, L.,, Li, B., and Ma, X. Anti-backdoor learning: Training clean models on poi- soned data. Advances in Neural Information Processing Systems, 14:11400--4919 2021a.
Goldblum, M., Tsipras, D., Xie, C., Chen, X., Schwarzschild, A., Song, D., Madry, A., Li, B., and Goldstein, T. Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses. IEFE Trans- actions on Pattern Analysis and Machine Intelligence, 45 (2):1563-1580, 2022.
Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., and Ma, X. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In International Conference on Learning Representations, 2021b.
Gu, T., Dolan Gavit,, B., and Garg, S. Badnets: Identify- ing vulnerabilities in the machine learning model supply chain, arXiv preprint arXiv: / 7008. 06733, 2017.
Li, Y., Jiang, Y., Li, Z., and Xia, S.-T. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems, 2022.
10

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Fres Backdoor Security
Li, Y., Lyu, X., Ma, X., Koren, N., Lyu, L.., Li, B., and Jiang, Y.-G. Reconstructive neuron pruning for backdoor de- fense. In International Conference on Machine Learning, pp. 19837-19854, PMLR, 2023a.
Shafahi, A., Huang, W. R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., and Goldstein, T. Poison frogs! tar- geted clean-label poisoning attacks neural networks. Advances in neural information processing systems, 31, 2018
Li, Y. Ya, M., Bai, Y., Jiang, Y., and Xia, S.-T. Backdoor- Box: A python toolbox for backdoor learning. In ICLR Workshop, 2023b.
Shi, Y., Du, M., Wu, X., Guan, Z., Sun, J., and Liu, N. Black- box backdoor defense via zero-shot image purification. Advances in Neural Information Processing Systems, 36: 07336657366, 2023.
Liu, K. Dolan-Gaan Gavitt, B., and Garg, S. Fine-pruning De- fending against backdooring attacks on deep neural net- works. In International symposium on research in attacks, intrusions, and defenses, pp- 273-294. Springer, 2018.
Sohn, K., Berthelot, D., Carlini, N., Zhang, Z., Zhang, H., Raffel, C. A., Cubuk, E. D., Kurakin, A., and Li, C.-L. Fixmatch: Simplifying semi-supervised learning with consistency and confidence. Advances in neural informa- tion processing systems, 33:596-608, 2020.
Liu, M., Sangiovanni- Sangiovanmi-Vincenellli A., and Yue, X. Beating backdoor attack its own game. Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4624-462922 2023.
Stallkamp. J., Schlipsing, M.. Salmen, J., and Igel, C. Man vs. computer: Benchmarking machine learning algo- rithms for traffic sign recognition. Neural Networks, (0):
Liu, Y., Ma, X., Bailey, J., and Lu, F. Reflection backdoor: A natural backdoor attack on deep neural networks. In Computer Vision-ECCV 2020: 16th European Confer- ence, Glasgow, UK, August 23-28, 2020, Proceedings, Part X 16, pp. 182 199. Springer, 2020.
2012. ISSN 0893-6080. doi: 10.10166j.cumme2221222222 016. URL http://ww..ccieneed.eeeee com/ science/article/ /ttpa////.rrtceee////////s000000
Sur, I., Sikka, K., Walmer, M., Koneripalli, K., Roy, A., Lin, X., Divakaran, A., and Jha, Tijo: Trigger inversion with joint optimization for defending multimodal backdoored models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 165-175, 2023.
Min, R., Qin, Z., Shen, L., and Cheng, M. Towards stable backdoor purification through feature shift tuning. Ad- vances in Neural Information Processing Systems, 36, 2024.
Tran, B., Li, J., and Madry, A. Spectral signatures in back- door attacks. Advances in neural information processing systems, 31, 2018.
Moosavi- Moosavi-Dezfoolii S.-M., Fawzi, A., and Frossard, P. Deep- fool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2574-2582, 2016.
Turner, A., Tsipras, D., and Madry, A. Clean-label backdoor attacks. 2018.
Nguyen, A. and Tran, A. iapee-impee warping- based backdoor attack. arXiv preprint arXiv:2102.10366 2021.
Turner, A., Tsipras, D., and Madry, A. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771,, 2019.
Pan, M.. Zeng, Y., Lyu, L., Lin, X., and Jia, R. {ASSET):
Wang. H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-y., Lee, K., and Papailiopoulos, D. Attack of the tails: Yes, you really can backdoor federated learning. Advances in Neural Information Processing Systems, 33:16070-16084 2020.
Robust backdoor data detection across a multiplicity of deep learning paradigms. In 32nd USENIX Security Sym- posium (USENIX Security 23), pp. 2725-2742, 2023.
Qi, F. Li, M., Chen, Y., Zhang, Z., Liu, Z. Wang, Y., and Sun, M. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. arXiv preprint 11X1:22105.12400, 2021.
Wang, Y., Ma, X., Chen, 7.,, Luo, Y., Yi, J., and Bailey, J. Symmetric cross entropy for robust learning with noisy labels. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 322-330, 2019.
Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., and Chen, L.-. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4520-4520, 2018.
Weber, M., Xu, X., Karlaš, B., Zhang, C., and Li, B. Rab: Provable robustness against backdoor attacks. In 2023 IEEE Symposium on Security and Privacy (SP), pp. 1311- 1328. IEEE, 2023.

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
Wenger, E., Passananti, J., Bhagoji, A. N., Yao, Y., Zheng, H., and Zhao, B. Y. Backdoor attacks against deep learn- ing systems in the physical world. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 6206-6215, 2021.
Zhu, M., Wei, S., Zha, H., and Wu, B. Neural polarizer: A lightweight and effective backdoor defense via purify- ing poisoned features. Advances in Neural Information Processing Systems, 36, 2024.
Zhu, X. and Goldberg, A. B. Introduction to semi- supervised learning. Springer Nature, 2022.
Wu, B., Chen, H., Zhang, M., Zhu, Z.., Wei, S., Yuan, D., and Shen, C. Backdoorbench: comprehensive benchmark of backdoor learning. Advances in Neural Information Processing Systems, 35:10546-10555 2022.
Zhu, Z., Wang, R., Zou, C., and Jing, L. The victim and the beneficiary: Exploiting a poisoned model to train a clean model on poisoned data. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 155-164, 2023b.
Wu, D. and Wang, Y. Adversarial neuron pruning purifies backdoored deep models. Advances in Neural Informa- tion Processing Systems, 34: 16913-1695,, 2021.
Xie, Q., Dai, Z., Hovy, E., Luong, T., and Le, Q. Un- supervised data augmentation for consistency training. Advances in neural information processing systems, 33: 6256-6268, 2020.
Zeng. X., Liu, C., Wang, Y.-S., Qiu, W., Xie, L., Tai, Y.- W., Tang, C.-K., and Yuille, A. L. Adversarial attacks beyond the image space. In Proceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition, pp. 4302-4311 2019.
Zeng. Y. Chen, S., Park, W., Mao, Z. M., Jin, M., and Jia, R. Adversarial unlearning of backdoors via implicit hypergradient. arxiv preprint arXiv:2 10.00335 2021.
Zeng, Y., Pan, M. Jahagirdar, H., Jin, M., Lyu, L., and Jia, R. (Meta-Sift): How to sift out clean subset in the presence of data poisoning? In 32nd USENIX Secu- rity Symposium (USENIX Security 23), pp. 1667-1684, 2023a.
Zeng, Y., Pan, M., Just, H. A., Lyu, L., Qiu, M., and Jia, R. Narcissus: A practical clean-label backdoor attack with limited information. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp. 771-785, 2023b.
Zhang, Z., Jia, J., Wang, B., and Gong, N. Z. Backdoor attacks to graph neural networks. Proceedings of the 26th ACM Symposium Access Control Models and Technologies, pp. 15-26, 2021.
Zhang, 7., Liu, Q. Wang, 7., Lu, 2., and Hu, Q. Backdoor defense via deconfounded representation learning. Proceedings of the IEEE/CVF Conference on Computer Vision and Putlern Recognition, pp. 12228-12238, 2023.
Zhu, M., Wei, S., Shen, L.,, Fan, Y., and Wu, B. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision, pp. 2023a.
12

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Frye Backdoor Security
A. Algorithm outline
The pseudocode the proposed method BSD listed as Algorithm
Algorithm Pseudocode for BSD
Poisoned training set D; main model f: main model warm-up ends at epoch Ti, main model training stage2 ends at epoch T2, main model training stage3 ends epoch T3, max clean pool ratio a, OSS split ratio B.
Input:
Output: Clean model fer
1: # Initialization & warm-up
2: Initialize the weights of f as
3: Generate an altruistic model g having the same architecture as f. initialize the weights as y
4: Prepare for ALS
5: for 1 to 25 do
6: for each sample (z, v) in D do
7: loss t Lee (I,, V.9e)
8:
x V loss
9: end for
10: end for
# Prepare for OSS
12: Set ye the majority of most frequent second likely prediction, i.e., yt Majority(argsoot[ (logitt;)
13: Calculate D, and D.. with Y1 according to Section 3.2
14: # Main Training Loop
15: while T <T3s do
16: T < <T then
17:
# Data used for the main model warm-up
De +- Dnt
else =TT";;; then
20:
# Pool initialization using ALS and OSS
21:
D. Dats U D.sss
22:
else T; + 10 T < <T then
23:
# Pool update based on loss discrepancy of fo and gp. enabling class completion
T' + T-
24:
-
Current clean ratio or +- B (a B) x (1 cos(T π x T" /22)
Set ar in (8)
27:
Calculate D.; according to (8)
28:
D. De,
29:
else T " Tz then
30:
# Pool update based on loss discrepancy of fa and Pp. enabling class completion and selective drop
31:
Current clean ratio oT +- a
32:
Set a as aT in (10)
Calculate D& according to (10)
34:
D. Dūg
35:
end if
36:
Dp D),2 D.
37:
# Models updating
38:
0 -- VoLsemi Train the model on D.(labeled) and DD, by semi-supervised learning
39:
IT T2 then
Loe Train the altruistic model by supervised learning
41: end if
42: end while
13

---

Bi-perspective Splitting Defense: Achieving Clean-Seed- Backdoor Security
B. Implementation details
B.1. Environments
We run all the experiments using PyTorch on a Linux server with an AMD EPYC 7HI2 64-core Processor, 256GB RAM, and 8x NVIDIA GeForee RTX 3090 GPU.
B.2. Illustration the poisoned samples
Figure 4 illustrates the seven attack types used in this study, displaying both the original and poisoned images along with the corresponding trigger patterns. For attacks involving a different trigger in the Imagenet dataset, the specific trigger is also shown the bottom.
BadNet
Blended
Wa.Ntt
ReFool
Narcissus
Raw
Poisoned
Trigger
Trigger
(Imageset)
Figure 4. Illustation of the backdoor attacks. We present the examples on CIFAR- 10, alternative triggers (if used) on Imagenet are shown the bottom.
B.3. Attack settings
Training settings. For all the attack implementations, follow that ASD (Gao et al., 2023). On the CIFAR-10 and GTSRB datasets, perform backdoor attacks ResNet-18 for 200 epochs with batch size 128. We adopt the stochastic gradient descent (SGD) optimizer with learning rate of 0.1, momentum of 0.9, and weight decay 5 10-4 The learning rate is divided by 10 at epoch 100 and 150. For attacks not achieving reported performance in ASD (Gao et al., 2023), we continue the training for another 100 epochs, and the learning rate is divided by 10 at epoch 200 and 250. On the Imagenet (Deng et al., 2009) dataset, we train ResNet-18 for 90 epochs with batch size 256. We utilize the SGD optimizer with learning rate of 0, momentum of 0.9, and weight decay x 10-4, The learning rate decreased by a factor of 10 at epoch 30 and 60. The image resolution will be resized 224 224 X 3 before attaching the trigger pattern.
Settings for BadNets. As suggested by (Gu et al., 2017; Huang et al., 2022: Gao et al., 2023), set a 2 x 2 square the upper left corner the trigger pattern CIFAR-10 and GTSRB. For ImageNet and VGGFace2, we use 32x32 apple logo on the upper left corner. The poisoning rate p is set to (50%..%)
Settings for Blended. Following (Chen et al., 2017; Huang et al., 2022; Gao et al., 2023), we choose"Helle Kitty" pattern on CIFAR-10 and GTSRB and the random noise pattern on ImageNet and VGGFace2. The blend ratio is set to 0.1. The poisoning rate p is set 0.05(5%).
14

---

Bi-perspective Splitting Defense: Achicving Clean-Seed-Free Backdoor Security
Settings for WaNet. Following (Gao al., 2023; Huang et al., 2022), we directly use the default warping- based operation to generate the trigger pattern. For CIFAR-10 and GTSRB, set the noise rate Pn to 0.2, control gird size i as 4, and warping strength as 0.5. For Imagenet, we use the same noise rate, but larger grid size k = 224, and warping strength 1.
Settings for cabel-Consistent Attack. Following (Gao et al., 2023; Huang et al., 2022; Turner et al., 2019), the noisy versions of samples are generated using adversarially trained models. The PGD parameters are as follows: for PGD training: <= 16, a = 2, steps = 7, and the pixel range is [0, 255]; for PGD attack: e 16, a = 1.5, steps = 30, with the same pixel range [0, 255]. The same trigger used in BadNets is applied for LC attacks, and the poison ratio set at 25
Settings for Refool. Following (Li et al., 2021a; Liu et al., 2020), we randomly choose 5,000 images from PascalVOC (Ev- eringham et al., 2015) as the candidate reflection set Reand and randomly choose one of the three reflection methods to generate the trigger pattern during the backdoor attack.
Settings for SIG. Following (Li et al., 2021a; Barni et al., 2019), we adopt the same sinusoidal pattern in ABL as the trigger and set the poisoning rate to match ICC, as SIG a clean-label attack.
Settings for Narcissus. We also incorporate the recent attack proposed by (Zeng et al., 2023b), which another clean-label attack. The parameter settings for generating the Narcissus trigger pattern the surrogate model is trained for 200 epochs with an initial learning rate of 0.1 and a warm-up period of 5 rounds. The trigger-generation learning rate is 0.01, and the generation process lasts for 1000 rounds. The poisoning rate is the same as LC, given that Narcissus is also a clean-label attack.
follows: the loo ball bound is set to 16/255,
B.4. Defense settings
Settings for FP. Following (Gao et al., 2023), we set two steps of FP (Liu et al., 2018) (i.c., pruning and fine-tuning' as follows. (1) We randomly select 5% clean training samples as the local clean samples and forward them to obtain the activation values of neurons the last convolutional layer. The dormant neurons on clean samples with the lowest a% activation values will be pruned. (2) The pruned model will be fine-tuned on the local clean samples for 10 epochs. In particular, the learning rate set as 0.01, 0.01, 0.1 on CIFAR-IO, GTSRB, and ImageNet. Unless otherwise specified, other settings are the same those used by (Liu et al., 20. For the hyper-parametee parameters of FP, we search for the best results by adjusting the pruned ratio a% E 20%, 30%, 40%, 50, 60%, 70%, 80%, 90%. In addition, we add another default setting in backdoorbench (Wu et al., 2022).
Settings for NAD. NAD (Li et al., 2021b) is also a post trianing method that repairs the backdoored model and needs 5% local clean training samples. We set the two steps of NAD as follows: (1) Use the local clean samples to fine-tune the backdoored model for 10 epochs. Specially, the learning rate is set as 0.01, 0.01, 0.1 on CIFAR-10, 10, GTSRB, and ImageNet. (2) The fine-tuned model and the backdoored model will be regarded the teacher model and student model to perform the distillation process. Unless otherwise specified, other settings are the same as those used by (Li al., 2021b). For the sensitive hyper-parameter parameter 3, we find the search space used by (Gao et al., 2023) too small. We search for the best results by adjusting the ppeer-prrmeterrree 3 from 500, 1000, 1500, 2000, 2500, 5000, 7500, 1e5, le6, 1e7, 1e8, 1e9, 1e10, 1el1. In addition, we add another default setting in backdoorbench (Wu et al., 2022).
Settings for ABL. ABL (Li et al., 2021a) contains three stages: (1) To obtaín the poisoned samples, ABL first trains the model on the poisoned dataset for 20 epochs by LGA loss and isolate 1% training samples with the lowest loss. (2) Continue to train the model with the poisoned dataset after the backdoor isolation for 70 epochs.
(3) Finally, the model will be unlearned by the isolation samples for 5 epochs. The learning rate is 5e-4 at the unlearning stage. Unless otherwise specified, other settings are the same as those used by (Li et al., 2021a). ABL is sensitive to the hyper-parameter y in LGA loss. We search for the best results by adjusting the syper-parameter y from 0, 0.1, 0.2, 0.3, 0.4, 0.5, In addition, we add another default setting in backdoorbench (Wu et al., 2022).
Settings for DBD. DBD (Huang et al., 2022) contains three independent stages: (1) DBD uses SimCLR to perform the self-supervised learning for 1,000 epochs. (2) Freeze the backbone and fine-tune the linear layer by supervised learning for 10 epochs. (3) Adopt the MixMatch conduct the semi-supervised learning for 200 epochs CIFAR- 10 and GTSRB for 90 epochs on ImageNet and VGGFace2. Unless otherwise specified, other settings are the same as those used by (Huang et al., 2022). Since DBD is a relatively stable backdoor defense and not sensitive to its hyper- parameter, we only add another group of default setting in backdoorbench (Wu et al., 2022).
15

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
Settings for ASD. We follow the exact settings for ASD as suggested by (Gao al., 2023). To name few settings, we adopt MixMatch the semi-supervised learning framework and use the Adam optimizer with learning rate of 0.002 and batch size of 64 for the semi-supervised training. The temperature T is set to 0.5, and the weight of the unsupervised loss Au is set to 15. The training stages are defined as follows: Tı 60, T2 = 90, and T3 = 120 for CIFAR- 10 and ImageNet, while T3= = 100 for GTSRB. Similarly, other parameters are the same as used by (Gao et al., 2023) as well.
For our BSD, we adopt the MixMatch (Berthelot et al., 2019b) semi-supervised training framework for the main model, -ased following recoupling-basee based Defense (DBD) and Adaptive Splitting based Defense (ASD). The semi-supervised learning parameters align with ASD, including 1024 training iterations, a temperature of 0.5, a ramp-up length of 120, and learning rate of 0.002. The altruistic model undergoes a warm-up phase with 25 epochs, utilizing the Adam optimizer, Cross Entropy loss, with learning rate of 0.001. The default warm-up epochs for the main model in OSS are set to 20 (followed by 10-epoch training on the initialized po = 20), with default 3 of 0.2. Class complction training spans 60 epochs (T2 = 90), and selective dropping training spans 30 epochs (T3 = 120). The altruistic model update uses the same loss and optimizer as in the warm-up on CIFAR-10 10 and Imagenet for efficiency, on lightweight datasets like GTSRB, we use the same semi-supervised loss and optimizer as the main model for better performance. The clean pool ratio a follows a sinusoidal growth curve during class completion training, starts B, and reaches an upper limit of a 0.6 at the end of the class completion stage, after which it remains fixed:
T Ti 10
T' = 72 - Ti -10 T2
(11)
oT = 3 + (a- - B3 (1 - cos T (T2))))
The baselines are implemented using:
BackdoorBench (Wu et al., 2022);
BackdoorBox (Li et al., 2023b);
Github repositories of corresponding papers.
We greatly appreciate these outstanding works.
B.5. Definition of DER
Defense Effectiveness Rating (DER) (Zhu et al., 2023a) is a comprehensive measure that considers both ACC and ASR:
DER = [max (0, AASR) max(0, AACC) + 1]/2,
(12)
where AASR denotes the decrease of ASR after applying defense, and AACC denotes the drop in ACC following the defense. Higher ACC, lower ASR and higher DER indicate better defense performance.
B.6. Details about semi-supervised loss
Semi-supervised learning (Berthelot et al., 2019a;b; Sohn et al., 2020; Xie et al., 2020; Zhu & Goldberg, 2022) studies how to leverage a training dataset with both labeled data and unlabeled data to obtain a model with high accuracy. In addition to its application in normal training, semi-supervised learning also serves as a powerful means for the security of DNNs (Alayrac et al., 2019; Carmon et al., 2019; Huang et al., 2022).
Here adopt the MixMatch (Berthelot et al., 2019b). Given batch X' De of labeled samples, and batch U DD of unlabeled samples, MixMatch generates guessed label distribution q for each unlabeled sample l and adopts MixUp to augment X' and U/ to X/ and Ur. The supervised loss L. is defined as:
C. = Σ H (Pz.9).
(13)
(x.q)EX"
where Pa the prediction of x, q is the one-hot label and H(..)) the cross-entropy loss. The unsupervised loss Cy defined
Lu Σ Ip 71.
(14)
(u.
16

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
where Pu is the prediction of
Finally, the MixMatch loss can be defined as:
L == Lis + A Lus
(15)
where is hyper-parameter for trade-off, we adopt the same À 15 in ASD.
C. Supplementary information of the background
C.1. Supplementary Overview of Backdoor Attack Research
The common implementation of backdoor attacks is realized by injecting a few poisoned samples into the training dataset, iee, data-pont tatta-possninn-baae -base backdoor attacks, inducing the model to build a link between the trigger (i.e., a visual particular pattern) and target class (Gu et al., 2017). Thus the model consistently outputs the target label once the trigger is attached to the inputs in the inference stage.
Poison-label backdoor attacks currently the most common attack paradigm, where the trigger pattern in the poisoned samples is directly connected to the target class by relabeling, inducing the model to treat the trigger as decision-making feature of the target class. Recent research (Hu et al., 2022; Li et al., 2020: Qi et al., 2021) focuses on more invisible trigger designs through generative models and feature space optimizations, as well as exploring backdoor attacks in wider tasks like natural language processing.
C.2. Extended related works
With the advance of clean subset extraction and backdoor detection, many works tries to split clean subsets from poison training sets. (Zeng et al., 2023a) proposed detecting poisoned data by identifying shifts in data distributions, which results in high prediction loss when training on the clean portion a poisoned dataset and testing on the corrupted portion. They solve a relaxed of the splitting optimization problem with the help of a weight-assigning network. Although promising empirical results were presented, the proposed META-SIFT only guarantees a relatively small subset ((Zeng al., 2023a), page 10, Figure 5). As result, META-SIFT still relies effective downstream defenses, such NAD and ASD, included in our baselines, while also increasing the hyperparameter search space. (Pan et al., 2023) are motivated by the same distributional shift phenomenon and proposed an effective splitting algorithm, ASSET. However, they assume that the defender has an extra set of clean samples (named "base set" in (Pan et al., 2023)), which doesn't 't suit the background of our paper, where no extra clean set available. Plus, ASSET is faced with the same problem that requires effective downstream defenses to conduct the defense.
In general, these works indeed provide valuable insights into the poisoned data splitting problem and could inspire future research. However, they faced with two major problems. 1) Cannot guarantee a 100% correct split that can be directly used for training: 2) Rely on an extra clean set which violates the constraints of our scenario.
C.3. Illustration of the model collapse
As presented in Figure 5, the splitting- based defenses (loss- gusss- ones specifically) encounter two kinds of model collapse. In backdoor overfitting collapse, poison samples take effect and have low loss values, which consistently corrupt the clean pool and lead to a backdoored model. Likewise, in class underfitting collapse, the rareness of certain classes will lead to higher loss values, making them less chosen to be clean samples, which forms a vicious cycle. Note that these two collapses are common other categories of defenses as well, while it's more explainable in splitting- based defense.
D. Extended experimental results
D.1. Illustration of pool update
To showcase the healthy clean pool acquired by our BSD, we plot the number of poison samples in the clean pool at each training epoch, well as reveal the accumulated number of poison samples. As shown in Figure 6, our BSD generally have fewer poison samples in the clean pool during training, with both the number of poisoned samples and the cumulative number of samples smaller than that fo ASD under different poisoning rates.
In addition, we plot the loss/distance distribution of samples of our BSD in Figure 7. In Figure 7.(a) and Figure 7.(b),
17

---

Bi-perspective Splitting Defense: Achieving Clean-Seed- Backdoor Security
Collapse Backdoor Overfitting
Collapse II: Class Underfitting
100
100
Target class
Ignored class
Prediction distribution (ASR test)
AGR
Prediction distribution
(CA test)
20
Figure 5. Typical model collapses in data-splitting backdoor defenses. I: Misclassification of low-loss poisoned samples as clean leads to steady increase in the poisoned sample proportion until 100% ASR. II: Higher losses for challenging classes reduce their presence in the clean pool, rendering the model unable to predict samples from those categories.
the main mechanisms, i.e., ALS and OSS for the pool initialization, successfully distinguished the poison samples. In Figure 7.(c), the poison samples are highlighted by the high loss discrepancy between the main model and the altruistic model. The final result shown in Figure 7.(d) reveals the high CAs (clean sample all having low loss values) and low ASRs (poison samples all having high loss values) of BSD.
Num prison (BSD)
Nam poisen (ASD)
Cumulative Num poison (BSD)
Cunulative Nom paison (ASD)
300
1750
14000
1500
12000
400
150
1250
10000
Count
Count
300
1000
Count
8000
100
200
6000
4000
250
2000
0
20
40
80
100
120
20
40
60
80
100
120
20
40
60
1000
120
20
40
60
80
100
120
Kpoch
Epoch
Epoch
Epoch
Figure 6. The number of poison samples in the clean pool of BSD and ASD at each epoch, the accumulated number in the dotted line. The subplots the results CIFAR-IO, p 0.01, 0.05, 0.10, 0.20.
0.8-
Pobon
0,175
Poison
Poisen
0.30
Peivan
0.10
0.25
Proprtinn
0.20
0.4
0.15
6.075
0.000
0825
0.05
0.0
6.000
0.00
0.00
10
(a) split
(b) split
Loss discrepency
(d) Main model
Figure 7. The split visualization BSD on GTSRB against the BadNet attack. (a) the loss distribution on the altruistic model after the ALS warm-up: (b) the distance distribution the main model after the OSS warm-up; (c) the loss discrepancy the last epoch; (d) the loss distribution on the main model at the last epoch.
D.2. Influence of different settings in OSS
Ablation on distance metric of OSS. We investigate the influence of the number of runs for the warm-up and three different distance calculations of OSS as shown Figure For the distance calculation, we take three approaches, i.e., the minimal,
18

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
the maximal, and the mean &g distance to feature clusters of each non-target category. Intuitively, we set the minimal distance by default, because the poisoned samples we consider are characterized by being far away from all existing cluster centers, thus maximal and mean distances may misjudgment two categories whose original clustering centers are far apart from each other as poisoned samples. Whereas, all three approaches exhibit good separation under the default 20-epoch warm-up.
Ablation on warm-up epochs of OSS (Ti). Concerning the number of warm-up epochs, we investigate the score distribution of OSS under the min-distance calculation. As illustrated in Figure 8, the result exhibits poor separation with an insufficient warm-up. As the number of epochs goes up, it has a certain effect when the number of epochs equals 10, and perfectly separates some benign samples with larger epochs.
Figure& 8 is the complete result of the ablation study on different settings of the warm-up process of OSS. It verifies the effectiveness of all three distance metrics. Intuitively, the model should have a more separable and reliable initialization of the two pools with a long warm-up, whereas the result of a 40-epoch warm-up (especially when using the mean distance) violates this intuition by exhibiting less satisfying separation. A potential reason is that the model overfitted the non-target classes, thus the poison samples have less similarity to them.
Epoch- 5
Epech = 10
Epoch = 20
Epoch - 40
Choan Prlie
0.091
Clean
Paove
0.15
Cless Poisss
1.66
Peisss
Clas
0.825
0.14
0.6G
Trgeetin
0.003
6.10-
0.11
0 0.14
Min
4.85
0.615
0.009
0.31
0.085
6.01
0.003
0.0
116
Diaaase
Chee
0.200
Cina
0.175
0.300
0.000
0.150
0.64
Max
0.825
4200
0.855
0.100
0.125
4.15
e.7s-
6.40
0.000
0.655
0.01
0.25
0.300
24
0.800
2B
38
0.000
389
158
0.00
20
39
0.00
0.000
E.IT
4.4-
Deperia
Mean
4.3-
0.80
0.955
0.05
8.50
15
20
25
36
25
0.000
38
15
20
25
30
50
75
100
125
0.00
18
20
30
1hhrance
Figure 8, The ablation results on the number of warm-up epochs and diffcrent distance calculation methods for OSS.
In general, the default setting of BSD is a suitable choice.
D.3. Influence of different settings in ALS
Ablation study on warm-up epochs of the altruistic model As our y, estimation method takes the majority within the warm-up epuchs in ALS, we visualize the prediction in each single epoch in Figure 9. As seen in this figure, all the final majority predictions and the most internal majority prediction of ye are the same (Y+- = 3), which is the ground truth target
19

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
label.
BodNet curspeed
I BadNet mest-pred
Blended cur-pred
Blended most-pred
WaNet cur-pred
WaNet most-pred
LC cur-pred
LC most-gred
Prodieted targer label
16
21
Epech
Figure The result of the alternative method for y/ approximation. In the default 25 epachs of warm-up, we count the pred yr each epoch and the most pred by that epoch respectively. The experiment is conducted on CIFAR-10 10, against BadNet, Blended, WaNat, and LC.
Alternative method for approximating For unseen failures that we failed to correctly approximate Yt, we provide an alternative method for approximating against new backdoor attacks that may appear in the future. We here adopt lightweight solution by just slightly modifying the warm-up of the altruistic model. We add local gradient ascent (Li et al., 2021a) and local voting process: V/2 arg max. (xx y) y = c A (ax, y) Digall where Diga denotes the isolated 1% samples having the smallest loss values after local gradient ascent training the altruistic model. In common scenarios where the dataset is large but well-known benchmark dataset, the number of samples in each class is known the public, yr can be just approximated through label statistics.
Notably, for this alternative estimation method, if the detection precision exceeds 50%, it indicates that more than half of the isolated samples are poison samples, thus we can obtain y/- Although the experimental results presented by (Li et al., 2021a) la) their Figure page 16 has already verified more than 50% against most common attacks, we further check its robustness to the warm-up epochs in Table 8.
Table 8. The prediction of ye under different warm-up epochs. The 'num" represents the number of poison samples in the isolated set.
BADNET
BLENDED
WARM-UP EPOCUS
NUM
y.l
POISON
y
WRONG
WRONG
15
461
CORRECT
457
CORRECT
370
CORRECT
344
CORRECT
85
CORRECT
126
WRONG
45
177
CORRECT
114
CORRECT
D.4. Additional baselines
We added two recent defense, VaB (7hu et al., 2023b) and D-ST/D-BR (Chen et al., 2022b). The additional baselines are implemented based on the official implementation. We use CIFAR-10 as the dataset. Since the label-consistent attack is not consistently implemented, we use SIG as a clean label attack here. As shown in Table 9, VaB has the most competitive result against poison label attacks, but struggles to defend against SIG.
D.5. Performance under no attacks
Most backdoor defense research focuses on performance under attack, while it is concerning that these defenses may degrade model performance in the absence attacks. Therefore, we evaluated the performance of BSD in scenarios without attacks. There are no poisoned samples in the training set, we test the clean and poisoned samples (BadNets trigger) for
20

---

Bi-perspective Splitting Defense: Achieving Clean-Seed- Feeee Backdoor Security
Table The clean accuracy (CA%), attack success rate (ASR%), defense effective rating (DER%) and time cost (hours) of additional backdoor defense methods and our BSD against threatening backdoor attacks on CIFAR-10. 10. The best and second best results are in bold and underlined.
METHOD
BADNETS ASR
BLENDED ASR
WANET ASR
SIG ASR
AYG DER
TIME COST
CA
DER
CA
DER
CA
DER
CA
DER
VAB
94.0
1.3
98.9
94.2
1.1
98.6
93.6
1.7
99.1
94.0
66.6
63.8
90.1
5.5
D-ST
5.7
83.1
65,0
76.0
87.9
95.1
46.5
4.3
D-BR
87.5
0.8
95.9
83.0
80.7
53.2
16.9
14.6
54.3
85.7
0.1
92.9
74.1
BSD(OURS)
95.1
0.9
99.6
94.9
0.8
98.8
94.5
0.8
99.6
93.8
0.0
97.0
98.7
3.2
inference. As shown in Table 10, it is worth noting that even in the absence of attacks, there be low attack success rate (ASR). where these samples are just being misclassified to the target label. As Table 10 reveals, our method achieves lower ASR compared to the baseline, effectively suppressing natural backdoors. Additionally, our method shows significant improvements in accuracy over the baseline.
Table 10. The clean accuracy (CA%) and attack success rate (ASR%) of BSD and ASD under no attacks.
CIFAR-10
GTSRB
ACC
ASR
ACC
ASR
No DEFENSE
95.3
1.9
97.7
0.2
93.2
1.8
BSD (OURS)
94.9
0.6
97.6
0.0
D.6. Robustness of pseudo target approximation
Pseudo target approximation test on GTSRB. We evaluated the approximation of y/ on the GTSRB dataset with various ground truth target labels, as shown in Table 11 (using the main approximation method). The results demonstrate that yr was successfully approximated for all the first 10 classes in GTSRB.
Table II. Testing the y. approximation on different target labels (the first 10 classes) on GTSRB.
ATTACK
2
7
BADNETS BLENDED
LC
Performance under forced incorrect pseudo target label. We conducted interesting additional tests by forcing y: to be assigned to an incorrect class and observed the model's 's performance (on CIFAR-10, against BadNets). As illustrated in Figure 10, BSD retained partial defensive capabilities even when the pseudo-label was deliberately set incorrectly, In most cases presented, BSD managed to purify the model successfully, leveraging the loss-guided splitting based on the Altruistic model.
It is worth noting that in experiments where the ground truth target class was 5 (dog), forcibly setting the pseudo-label to 3 (cat) led to a significant failure of the defense. This may be attributed to the inherent difficulty in distinguishing between these two classes. Furthermore, when faced with broader attack scenarios and dataset settings, relying solely on loss statistics may not be sufficient to ensure effective defense. Fortunately, our experiments demonstrate the strong robustness of the proposed Pseudo Target Approximation method. The OSS mechanism functioned as expected, enabling resilient bi-perspective defense under challenging conditions.
Insurance for the worst cases We have intensively investigated Ye approximation method in both the main text (Section 5.4, Section 5.3, Section 5.5) and all the Appendix above. As the insurance, we have to state that, in the worst cases (if encountered), we could have the last resort that turns to relatively weak assumption that is broadly applicable in common scenarios: In common scenarios where the dataset is a large but well-known benchmark dataset, the number of samples in each class is known to the public, and ye can be directly detected through label distribution.
D.7. Resistance to Potential Adaptive Attacks
In the above experiments, we assume that attackers have no information about our backdoor defense. In this section, we consider a more challenging setting, where the attackers know the existence of our defense and can construct the poisoned dataset with an adaptive attack.
21

---

Bi-perspective Splitting Defense: Achieving Clean-Seed- Backdoor Security
Force pseudo target 0->3
pseudo target 1->3
Force pseudo target 2->3
100
100
100
CA(%)) CAA9))/ASR(MM) ASR(5)) (RA(5)
80
CA(%)) (AA0%)/ASRCS ASR(%)) RA(0%)
80
CA0%) CA(%))/AR((*M)) ASR((%) RR((%)
60
CA
60
CA
CA
ASR
ASR
ASR
RA
RA
40
100
120
20
60
100
120
40
80
100
120
Epoch
Epoch
Epoch
Force pseudo target 4->3
Force pseudo target 5->3
Force pseudo target 6-23
100
100
CA(%)) ASR(())) /RA(55)
CA(%)) ASR(()) (RA(%))
80
CA(%)) ASR(%%) /RA(1%)
CA
CA
ASR
ASR
ASR
RA
RA
RA
20
0
20
40
60
80
100
120
20
40
60
80
100
120
20
40
60
80
100
120
Epoch
Epoch
Epoch
Figure 10. The clean accuracy (CA% attack success rate (ASR%), and robust accuracy (RA%) of BSD when Forcing the pscudo target from x(ground truth)
22

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Free Backdoor Security
Threat model for the attackers. Following existing work (Gao et al., 2023; Chen et al., 2017; Gu et al., 2017; Tumner et al., 2018), assume that the attackers access the entire dataset and know the architecture of the victim model. However, the attackers can not control the training process after poisoned samples are injected into the training dataset.
Method for adaptive attack. Our method initializes the clean pool using bi- pi-pesspeetive splitting through OSS and ALS, which separate poisoned samples based on semantic and loss statistics, respectively. In general, there is a contradiction between increasing the loss values of poisoned samples (to bypass ALS) and achieving backdoor objectives. Furthermore, maintaining high semantic similarity to the target class (to bypass OSS) adds the complexity. To craft such a trigger pattern that satisfies the above objectives, we use PGD optimization search for an average noise (among non-target classes) that is semantically close (judged by a proxy model) to the target class (to bypass OSS). Meanwhile, we control the to ball bound as 8/255 and the poisoning rate as 0.01 prevent it from being obvious trigger that will be easily fitted (to bypass ALS). Settings.
We conduct experiments on CIFAR-10 with the following parameters: number of iterations, 15; step size, 1.5/255; perturbation magnitude, 8/253; trigger size, 32x32; and poisoning rate, 0.01. Although the attacker assumed to have no knowledge of the model structure, we adopt more challenging setting where the adversary uses the same model structure as the proxy model.
Results. The Clean Accuracy (CA) and Attack Success Rate (ASR) of this adaptive attack are 94.422% and 2.421 1, respectively. While the ASR is slightly higher than that of other attacks on CIFAR-10, our defense clearly demonstrates strong resistance to the adaptive attack. Furthermore, when we increase the poisoning rate to 0.2 (20%), the CA and ASR remain at 91.040% and 0.903%, respectively, which is still within an acceptable range.
D.8. Robustness against all2all attacks
All-to-all (all2all) attacks may pose challenges to certain components of our defense, particularly OSS and selective drop. However, all2all attacks are not typically considered essential scenarios in backdoor defense research currently (Li et al., 2021a; Huang et al., 2022; Zhu et al., 2023b; Guan et al., 2024; Zhang et al., 2023), for the following reasons: 1) The increased number of trigger-target pairs all2all attacks requires significantly more training epochs for success. And all2all attacks reduce clean accuracy and exhibit slower convergence, making them easier detect. ((Huang et al., 2024), Page 2: "As the number of classes increases, the accuracy and the attack success rate will decrease.") 2) Research all2all attacks remains limited ((Li et al., 2022), Page 10: "However, there were only a few studies on all-to-all attacks. How to better design the all-to-all attack and the analysis of its properties remain blank."). 3) In practical applications, all2all attacks do not allow attackers to arbitrarily control predictions to specific targets, limiting their real-worke threat.
Nevertheless, we still conducted supplementary experiments on BadNets with an all2all setting.
Attack setting: Following BadNets, with y,: (y 1)% where n. is the number of classes.
Defense setting: To handle multiple target labels, BSD incurs additional computational costs by iterating through all classes as pseudo-targets during OSS. Clean indices from each pseudo-target are intersected to form the final OSS result. Additionally, we early stop at Stage 2 to avoid meaningless cost in Stage 3.
Since all-to-all attacks do not fundamentally change the nature of poison-label attacks, OSS remains effective for each individual classes. We visualized OSS spliting results in Figure 11, which reveals effective separation of clean samples of OSS. The CA, ASR, and DER performance are presented in Table 12, demonstrating significant DER improvement compared to baseline methods. Notably, while BSD's ASR increases under all-to-all attacks, it effectively limits the attack success rate to the level of random prediction (1/ne 10%).
In conclusion, our BSD method remains effective against all-to-all attacks. Furthermore, the OSS module can serve as a highly effective component for identifying clean samples in other backdoor defense methods.
Table 12, The clean accuracy (CA%), attack success rate (ASR%) %), and defense effective rating (DER%) of ASD and our BSD against Bad on C0
BADNETS-ALI2ALL ASR
METHOD
No DEPENSE
91.8
93.8
ASD
70.2
2.4
84.9
RSD (OURS)
91.2
10.5
91.3
23

---

Bi-perspective Splitting Defense: Achieving Clean-Seed- Backdoor Security
clean Peisen
0:16
Clean Poisen
Cleon Poosn
0:03
clean Poisen
Claan Polson
6:06
6.12
6.54
0.55
0:34
0.00
Propertion
0.25
0.03
0.00
0.08
0.05
0.02
0.02
0.04
0.00
0:23
6:22
0.00
-0
6.2
Distance
Distance
Distance
Discance
Distance
6.08
Clean Polson
0:23
Clean
0.65
Clean Polon
Clean
Clenn
6.06
0.64
0.00
Progerten
0.44
0.04
6:04
0.35
0.03
6:02
8:03
0.00
0.92
6:02
6:03
-2
0.00
2.5
5.0 "55" 5,5
15.0
6.02
20" Bistance
50
20
Distance
Distasce
Pistance
Distaace
Figure 11. Visiualization fo the effectiveness of OSS against BadNet-all2all attack.
D.9. Searching the best result of baselines
Notably, some baseline methods sensitive to their typer-paramette settings. The results reported in Table I represent their best performance obtained through grid search, outlined in ASD (Gao et al., 2023). Similarly, for the additional attack settings, the results in Table 2 and Table are based on their best outcomes (ranking on DERs) after grid search. For DBD, which not sensitive to parameters, we report the best result using the default settings from BackdoorBench and the same configuration as ASD.
Table Grid search for FP against additional attacks on ResNet18 (Default represents the result under the default setting provided by backdoorbench).
REFOOL
NARCISSUS
RATIO
CA
ASR
CA
ASR
CA
ASR
CA
ASR
DEFAULT
87.1
24.4
87.1
60.8
86.5
23.0
87.2
63.4
0.1
87.3
79.8
87.2
81.4
86.8
25.6
87.4
72.4
77.8
0.3
86.7
51.6
87.0
83.2
86,5
27.6
87.2
73.9
0.4
87.0
49.0
87.2
85.7
86.4
28.8
87.2
77.6
85.7
67.3
86.2
86.1
85.2
29.6
86.7
79.0
0.6
86.0
73.6
86.7
90.1
85.6
31.6
86.6
80.7
86.3
80.0
86.8
88.5
86.1
31.0
79.6
0.8
87.0
74.9
86.9
87.7
86.4
28.3
87.3
78.5
62.0
80.3
86.5
72.3
24

---

Bi-perspective Splitting Defense: Achieving Clean-Seed- Backdoor Security
Table Grid search for FP against representative attacks Mobilenetv2 (Default represents the result under the default setting provided by backdoorbench).
BADNET
BLENDED
WANET
RATIO
CA
DEFAULT
77.9
8.3
82.2
2,4
0.1
80.8
58.3
78.4
57.9
79.3
3.0
79.6
84.0
78.6
56.1
80.1
3.8
0.3
80.6
99.8
79.0
51.8
77.2
5.8
0.4
79.5
73.5
77.8
53.7
77.3
4.4
79.5
0.6
79.7
19.3
76.6
67.3
78.6
2.0
79.1
61.7
76.3
79.1
1.9
0.8
79.7
12.7
77.3
66.1
78.3
1.2
0.9
80.4
99.2
78.4
62.6
79.3
2.5
Table 15. Grid search for NAD against additional attacks ResNet18 (Default represents the result under the default setting provided by backdoorbench).
LC
SIG
REFOOL
NARCISSUS
BETA
CA
ASR
CA
ASR
CA
ASR
CA
ASR
DERAULT
86.2
69.7
86.0
83.6
85.3
49.3
86.1
84.9
100
87.3
98.7
95.9
86.5
66.9
86.8
93.3
500
86.2
83.6
85.3
49.3
84.9
1000
86.2
69.7
86.0
83.6
85,3
49.3
86.1
84.9
2000
86.2
69.7
86.0
83.6
85.3
49.3
86.1
84.9
86.2
5000
86.2
69.7
86.0
83.6
85.3
49,3
86.1
84.9
7500
86.2
69.7
86.0
83.6
85,3
49.3
86.1
84.9
1,E+04
86.2
83.6
85.3
84.9
1,E+05
86.2
69.7
86.0
83.6
85,3
49.3
86.1
84.9
84.9
I.E077
85.9
50.5
85.7
84.5
85.5
46.5
86.5
$1.0
1.E+08
86.0
73.9
88.7
85.6
42.9
86.1
83.2
1,E+09
85.3
68.2
85.7
87.0
85.6
44.8
86.5
84.1
1.+100
85.9
69.5
85.8
83.0
85.4
47.7
86.2
1.E+11
85.9
65.6
85.7
86.3
85.6
42.5
86.4
83.4
Table 16. Grid search for NAD against representative attacks on Mobilenetv2 (Default represents the result under the default setting provided by backdoorbench).
BADNET
BLENDED
WANET
CA
ASR
CA
ASR
CA
ASR
DEPAULT
78.5
11.7
76.2
51.6
81.1
4.2
99.1
S00
78.5
11.7
76.2
51.6
81.1
4.2
78.5
1500
78.5
11.7
76.2
51.6
81.1
4.2
2000
78.5
11.7
76.2
51.6
81.1
4.1
2500
78.5
11.7
76.2
51.6
81.1
4.1
5000
78.5
11.7
76.2
$1.6
81.1
4.1
1.E+04
78.5
11.7
76.2
51.6
81.1
4.1
29.1
76.1
1,E+06
78.5
23.0
75.9
49.4
81.5
3.2
1.E+07
79.3
25.4
76.8
47.6
81.0
3.8
1.E+08
78.8
14.8
76.8
58.9
81.0
3.2
L.E+09
78.9
17.9
76.0
46.0
80.7
3.4
1.E+11
78.8
41.5
76.7
56.9
81.3
4.3
25

---

Bi-perspective Splitting Defense: Achieving Clean-Seed-Frye Backdoor Security
Table 17. Grid search for ABL against additional attacks on ResNet18 (Default represents the result under the default setting provided by backdoorbench).
LC
SIG
REFOOL
NARCISSUS
GAMMA
ASR
DEFAULT
71.1
4.3
37.5
0.0
63.3
94.0
62.7
0.4
81.2
7.3
74.6
79,4
76.7
0.1
81.2
6.0
79.7
41.5
72.0
93.5
80.3
35.1
76.3
32.7
0.3
78.1
0.9
76.1
14.4
76.0
86.5
79.3
7.1
80.2
71.4
0.5
78.7
1.0
67.0
6.9
75.2
93.8
78.3
17.5
Table 18. Grid search for ABI. against representative attacks Mobilenetv2 (Default represents the result under the default setting provided by backdoorbench).
BADNET
BLENDED
WANET
GAMMA
CA
ASR
CA
ASR
CAA
ASR
DEFAULT
68.0
24.4
67.3
2.6
50.9
0.5
0.0
81.3
36.9
77.3
21.6
68.9
74.8
81.3
36.9
77.3
74.8
0.2
81.3
36.9
77.3
21.6
68.9
74.8
36.9
0.4
79.7
13.6
78.4
15.1
68.9
74.8
81.3
Table 19. Result DBD against additional attacks on ResNet18 (Default represents the result under the default setting provided by backdoorbench, Default2 represents the recommended setting used in ASD).
LC
SIG
REFOOL
NARCISSUS
SETTING
ASR
DEFAULT
83.2 82.46
98.1
77.6
99.9
87.0
87.3 80.73
99.6
DEFAULT2
99.42
80.12
99.9
90.84
2.34
99.61
Table 20. Result of DBD against representative attacks Mobilenetv2 (Default represents the result under the default setting provided by backdoorbench, Default2 represents the recommended setting used in ASD).
BADNET
WANET
SETTING
CA
ASR
CA
ASR
CA
ASR
DEFAULT
65.5
0.0
69.0
58.4
12.4
DEFAULT2
54.34
0
64.22
57.22
14.11
26


Reviews:
[{"review_id": "bqJHg3Iilq", "reviewer": "Reviewer_2zkR", "summary": "This paper introduces a clean-data-free method, named BSD, to defend against backdoor attacks in deep neural networks. BSD employs two complementary perspectives: Open Set Recognition-based Splitting (OSS) which uses semantic information, and Altruistic Model-based Loss Splitting (ALS) which leverages loss statistics. The approach includes pool initialization, class completion, and selective dropping strategies. Extensive experiments across multiple datasets and attack types show BSD achieves an average 16.29% improvement in Defense Effectiveness Rating compared to five state-of-the-art methods, while demonstrating robustness to different model architectures, poisoning rates, and target labels.\n\n## Update after rebuttal.\nThe explanation of the author has resolved my concern and I have also read the commet of other reviewer. The novelty may indeed be a weakness.  But I will keep my score of Accept since I did not found any major defects.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful and constructive feedback. We appreciate your recognition of our contributions. \n\nWe address your remaining concerns in the following sections.\n\n# Potential Failure of Target Label Estimation\n\nWe would like to kindly emphasize that while target label estimation is an important part of our method's success in defending against backdoor attacks, we believe that based on existing literature and our experimental results, target label estimation is a relatively less challenging task compared to the defense itself. We have verified its robustness through extensive evaluations (Table 4, Figure 9, Table 8, Table 11). Moreover, target label estimation is not the primary contribution of our work. Our main contribution is the innovative reconstruction of the backdoor defense task into an Openset Recognition-like task.\n\nFor potential failure cases, we have summarized four mitigation solutions:\n\n1. In common scenarios where (1) the dataset is large and well-known with publicly available information on the number of samples per class, or (2) the dataset is well-balanced, target labels can be reasonably approximated using label statistics alone. This simple yet effective strategy ensures reliable target label estimation in practice.\n2. We propose more than one target label estimation approach. Specifically, we introduce an alternative method based on local gradient ascent in Appendix D.3 (line 1012), which has proven effective against most of the discussed attacks. Furthermore, this alternative method may offer better target label estimation for unknown attack methods.\n3. In scenarios where computational overhead is not a concern, we can apply the OSS algorithm to all possible classes and then aggregate the clean samples identified across all classes as the final OSS result. This approach has demonstrated effectiveness in our experiments (Figure 11).\n4. For easy attacks, even if target label estimation fails, our pool update strategies can effectively correct the model through subsequent iterations (Figure 10).\n\n# The selection of OSS and ALS\n\nWe sincerely appreciate your insightful comments. Our decision to adopt OSS and ALS was primarily driven by considerations of computational overhead, as well as the challenges posed by the non-clean subset and model-agnostic defense settings.\n\nRegarding gradient-based metrics, we agree that they can be effective. In fact, during the early stages of our research, we explored using per-sample gradient information and techniques like Grad-CAM to identify poisoned sample triggers. We further considered combining inpainting and denoising techniques in reverse diffusion to remove both local triggers (e.g., BadNets) and global triggers(e.g., Blended attacks). However, we ultimately abandoned these approaches as they significantly increased training time, particularly when performing adaptive pool updates.\n\nRegarding alternative feature distributions, most of them are designed for backdoor detection, often assuming a clean subset. However, this violated the clean-data-free scenario. Additionally, potential feature extraction from intermediate layers will undermine the model-agnostic feature of the algorithm. Defenders would require knowledge of the model structure to select intermediate layers, undermining the practicality of defenses.\n\nIn contrast, our chosen OSS and ALS methods effectively integrate the defense task into the training process without making model-specific assumptions. Empirically, we observed that the OSS module, inspired by open-set recognition, complements the loss-based ALS, leading to robust defense performance.\n\n# Extreme hyperparameter situations\n\nWe sincerely apologize if the statements(lines 434-439, page 8) caused concerns regarding the extreme hyperparameter scenarios. Our intention was to demonstrate the robustness of our method to the settings of the two key hyperparameters, $\\alpha$ and$\\beta$ . We believe the results presented in Table 7 provide a solid reference for choosing hyperparameters, offering practical guidance for defenders and future researchers. Specifically, both values can be set as floating-point numbers within the range of (0,1), with $0.3<\\alpha<0.8$ and $\\beta<0.5$ being relatively safe choices.\n\nTo better clarify our points, we have revised the relevant section (lines 434-439, page 8) as follows:\n\n> We here present the influence of the main parameter, i.e., the parameters $\\alpha$ and $\\beta$ controlling the pool size. As revealed in Table 7, our BSD has robust performance against all the attacks with a relatively loose range of $\\alpha$ and $\\beta$ , and we recommend using the default setting in normal cases, and a reasonable range for adjustments is $0.3<\\alpha<0.8$,$\\beta<0.5$.\n\n# Minor issues\n\nOur adjustment allows the figure to be displayed at a larger scale on the page, see this anonymous link: https://postimg.cc/bsztqjQS.", "claims_and_evidence": "The paper's core claims about BSD's effectiveness are generally well-supported by extensive experimental evidence across multiple datasets, attack types, and comparison with state-of-the-art methods. However, some claims lack sufficient support:\n\n- The paper asserts that the bi-perspective approach is superior but doesn't fully explore why these two specific perspectives are optimal compared to other possible perspective combinations—such as those involving gradient-based metrics, alternative feature distributions, or multi-modal representations.\n\n- BSD emphasizes that it does not rely on additional clean data and instead achieves precise segmentation of clean samples through OSS and ALS. Although the paper circumvents the need for external clean data by initializing a pseudo-clean pool based on OSS and ALS, the estimation process for the target label (yt) and the introduction of the altruistic model involve implicit assumptions; if, in certain scenarios, the target label is misestimated or the sample distribution deviates significantly from that of standard datasets, the segmentation performance may deteriorate, ultimately affecting the overall defense efficacy.\n\nDespite these limitations, the extensive experimental results across various settings do provide substantial evidence for BSD's effectiveness as a clean-data-free backdoor defense method.", "methods_and_evaluation_criteria": "The paper's methods and evaluation criteria are generally well-suited for addressing backdoor defense challenges, employing comprehensive experiments across popular attack methods (BadNets, Blend, SIG, and WaNet) and standard datasets (CIFAR-10/100, TinyImageNet). The evaluation framework effectively balances security and performance using ASR and accuracy metrics, while also introducing a useful DER or comparative analysis. The appendix D also includes a comprehensive hyperparameter analysis, and I believe that the evaluation are exceptionally robust.", "theoretical_claims": "I reviewed the derivations of theoretical indicators in the paper—such as loss difference and open set distance—and found that these derivations rely primarily on intuitive explanations and ideas borrowed from existing literature rather than on a rigorous theorem-proof structure. Specifically, the paper employs the loss difference $I(x,y) = L_{\\mathrm{sce}}(x,y,\\phi) - L_{\\mathrm{sce}}(x,y,\\theta),$ \nand an Euclidean distance–based scoring function $S(x) = \\min_{i \\in \\{0, 1, \\dots, C-1\\} \\setminus \\tilde{y}_t} \\| f_e(x) - \\mu_i \\|_2$ to distinguish clean samples from contaminated ones. These methods are intuitively reasonable and consistent with previous work rather than strict mathematical proofs. Currently, the validity and robustness of the approach are mainly supported by extensive experimental results.", "experimental_designs_or_analyses": "In this paper, the experimental design and analysis validate the effectiveness and robustness of the BSD method from multiple perspectives. This is accomplished by evaluating the approach on several datasets (such as CIFAR-10, GTSRB, and ImageNet) and using a variety of mainstream network architectures (including ResNet-18 and MobileNet-v2), as well as by testing against an array of backdoor attacks—namely BadNets, Blended, WaNet, Label-Consistent, SIG, Refool, Narcissus, and even clean-label and all-to-all attacks. Furthermore, experiments conducted under different poisoning rates and target label settings demonstrate that the method can consistently maintain high clean accuracy (CA) and a low attack success rate (ASR). Additionally, ablation studies and hyperparameter grid searches on key components—such as OSS (semantic-based sample splitting), ALS (loss-statistics-based sample splitting), class completion, and selective dropping—confirm the critical contributions of these modules to improving the defense effectiveness (DER), while training cost evaluations underscore the practical advantages of the method. **However, the results also indicate that setting certain hyperparameters to extreme values can significantly degrade performance, and the method’s reliance on accurately estimating pseudo target labels might affect its efficacy when confronted with unusual data distributions or novel attack method.**", "relation_to_broader_scientific_literature": "Prior research in backdoor defenses—such as ABL, DBD, and ASD—has largely depended on clean-data-dependent strategies or single-perspective methods (e.g., loss-guided splitting) to mitigate poisoning attacks. In contrast, the BSD integrates two complementary ideas from the broader literature. On one hand, it draws on open-set recognition techniques (similar to those used in OpenMAX) to harness semantic similarity and effectively distinguish benign samples from those that have been poisoned. On the other hand, it employs an altruistic model to capture differences in loss statistics, further refining the separation between clean and compromised data. By embedding these dual mechanisms within a semi-supervised learning framework inspired by MixMatch, the method overcomes the limitations of relying solely on extra clean data or a single detection perspective, thereby addressing issues observed under high poisoning rates and clean-label attack scenarios. This synthesis not only builds on established findings in robust deep learning and open-set recognition but also advances the state-of-the-art with a more scalable and cost-effective backdoor defense approach.", "essential_references_not_discussed": "The paper adequately covers the essential references needed to understand the context for its key contributions.", "other_strengths_and_weaknesses": "The paper offers an innovative approach by creatively combining open-set recognition and loss-guided splitting techniques, thereby eliminating the need for extra clean data—a common and restrictive assumption in many earlier works. This originality is complemented by solid empirical evidence demonstrating its effectiveness across multiple benchmark datasets even under high poisoning rates and clean-label attack scenarios, highlighting its potential significance in real-world applications. The clarity of the experimental design and the thorough ablation studies are commendable, providing a well-documented analysis of the contributions of each module.  This is a good paper and I did not find any other weaknesses.", "other_comments_or_suggestions": "The text font in Figure 1 is a bit small.", "questions_for_authors": "- Could you elaborate on the rationale behind choosing the OSS and ALS perspectives over other alternatives such as gradient-based metrics, alternative feature distributions, or multi-modal representations? Have you considered or performed ablation studies comparing these different combinations?\n\n- Could you provide more insight into the robustness of the target label(yt) estimation process? For instance, what are the failure modes if yt is misestimated, and can you quantify the impact on BSD’s segmentation and overall defense performance?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KewN6zYaaK", "reviewer": "Reviewer_Mmmu", "summary": "This paper introduces ​Bi-perspective Splitting Defense (BSD), a novel in-training backdoor defense framework designed to train robust models from poisoned datasets without requiring clean data. By integrating semantic and loss-based perspectives, BSD addresses critical limitations in existing defenses, particularly their reliance on impractical clean subsets or computationally expensive feature analysis, by proposing the OSS and ALS techniques for splitting datasets. The experimental results validate its effectiveness across various settings.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Thank you for your constructive feedback and for recommending our paper for acceptance. We sincerely appreciate your thorough review and valuable insights. In response to your remaining concern, we present more baselines.**\n\n# Additional results\nAs you suggested, which aligns with other reviewers, we added the PIPD as an additional baseline, together with NAB [1] and NPD [2]. As presented in **Extended Table 1**, while these methods demonstrated exceptional defense performance against specific attacks, our implementation suggests that they fail to achieve consistent defense across all seven attacks under a single set of parameter settings. We believe that with attack-specific parameter tuning, they could potentially achieve the performance claimed in their paper. However, we must emphasize that such attack-specific tuning is impractical for defenders in real-world scenarios.\n\n**Extended Table 1. Addition baselines on CIFAR-10. Since the table is too large, we present the full version in this anonymous link: https://postimg.cc/ftmSjbvR.** **PIPD1** uses the Adam optimizer (learning rate = 1e-3), **PIPD2** resets the optimizer (clearing momentum and resetting the learning rate) before the Selective Training stage, and **PIPD3** applies both a larger penalty ($\\lambda = 5$) and the optimizer reset. \n| Attack |  <   | BadNet |  >   |  <   | Blend |  >   |  <   | WaNet |  >   |  <   | Refool |  >   |  <   |  LC  |  >   |  <   | SIG  |  >   |  <   | Narcissus |  >   | Avg  | Avg  |\n| :----: | :--: | :----: | :--: | :--: | :-----: | :--: | :--: | :---: | :--: | :--: | :----: | :--: | :--: | :--: | :--: | :--: | :--: | :--: | :--: | :-------: | :--: | :--: | :--: |\n| Metric |  CA  |  ASR   | DER  |  CA  |   ASR   | DER  |  CA  |  ASR  | DER  |  CA  |  ASR   | DER  |  CA  | ASR  | DER  |  CA  | ASR  | DER  |  CA  |    ASR    | DER  | ASR  | DER  |\n| PIPD1  | 86.8 |  24.8  | 83.6 | 86.8 |  88.5   | 51.3 | 95.9 |  0.2  | 99.9 | 79.4 |  61.9  | 61.5 | 87.5 | 89.7 | 49.0 | 81.0 | 88.7 | 48.0 | 84.2 |   36.2    | 76.1 | 55.7 | 67.1 |\n| PIPD2  | 78.9 |  36.0  | 74.0 | 83.5 |  55.7   | 66.0 | 94.3 |  0.5  | 99.7 | 76.6 |  70.6  | 55.7 | 73.3 | 29.6 | 72.0 | 80.3 | 87.6 | 48.2 | 73.3 |   29.6    | 73.9 | 44.2 | 69.9 |\n| PIPD3  | 85.0 |  13.1  | 88.5 | 73.6 |   6.4   | 85.7 | 94.1 |  0.2  | 99.8 | 67.5 |  62.2  | 55.4 | 70.9 | 12.3 | 79.4 | 72.8 | 85.5 | 45.6 | 75.8 |   35.0    | 72.5 | 30.7 | 75.3 |\n|  BSD   | 95.1 |  0.9   | 99.6 | 94.9 |   0.8   | 98.8 | 94.5 |  0.8  | 99.6 | 92.4 |  1.2   | 98.4 | 93.8 | 0.0  | 97.0 | 94.8 | 0.5  | 99.0 | 94.3 |    0.0    | 99.3 | 0.6  | 98.8 |\n# Implementation Description\nThe rationale for excluding PIPD in the previous submission:\n- Methodologically, while PIPD's approach appears intuitively feasible, it relies on good starts from Pre-isolation using Local Gradient Ascent (LGA), proposed in ABL. Facing varying backdoor attacks, we found that it may require attack-specific tuning of hyper-parameters, which is not allowed for defenders. This concern, also supported by our early experimental observations, was one of the reasons we ultimately replaced our old version $y_t$ estimation (basically based on LGA).\n- Before incorporating every method as a baseline, we conduct preliminary experimental validation to assess its reproductivity, such as evaluating its defense performance on the typical CIFAR10-BadNet combination. However, we observed that PIPD has not provided comprehensive open-source code. Specifically, after reviewing the main text, appendix, and GitHub repository of PIPD, we found PIPD: **(1)** provides empty README files and has no demos; **(2)** does not include any attack implementation (not even BadNet); **(3)** does not provide the implementation of Pre-isolation and Selective training stage; and **(4)** omits several critical training parameters, including optimizer selection, learning rate, the choice of the $\\gamma$ in the Pre-isolation stage, the choice of $\\lambda$ in selective training, and whether the optimizer/learning rate needs any resetting during the training.\n\nSettings:\n- To ensure experimental fairness, we merge the poisoned training data from BackdoorBench to generate datasets aligning with PIPD’s PyTorch dataset definition. \n- For the non-open-sourced components of PIPD, we implement them based on their pseudocode and equations. For key parameters not explicitly specified in PIPD, we set $\\gamma = 0.5$ in LGA for Pre-isolation, as recommended in ABL, and applied a default penalty of $\\lambda = 1$ in Selective Training. \n- Besides PIPD, we add two more baselines, namely NAB and NPD, with NAB being an in-training backdoor defense and NPD being a recent post-training defense. \n---\n\\[1\\]: Liu M, Sangiovanni-Vincentelli A, Yue X. Beating backdoor attack at its own game, ICCV 2023.\n\n\\[2\\]: Zhu M, Wei S, Zha H, et al. Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features, NIPS 2023.", "claims_and_evidence": "The claims in this paper are supported by convincing evidence.\n\n- Open-set recognition task and poison sample detection are similar.\n    - Section 4.1.1 discusses the open set recognition setting and the relationship to poison and clean sample detection in detail.", "methods_and_evaluation_criteria": "This paper has no problem in the method and evaluation following the previous settings.\n\n**Methods**:\n- The proposed methods make sense for the problem, where the feature distance, target-label approximation, and loss-based sample selection techniques are commonly used in the literature for backdoor learning.\n- The in-training defense targeting on splitting the dataset for training is reasonable and practical.\n\n**Evaluation**:\n- The evaluation metrics (CA, ASR, and DER) and three benchmark datasets are considered adequate in the literature to fully evaluate clean and backdoor performance.", "theoretical_claims": "There is no theoretical claim in this paper.", "experimental_designs_or_analyses": "The experiments are comprehensive and the experimental settings are thoroughly illustrated in this paper.", "relation_to_broader_scientific_literature": "The relation to the literature is well elaborated in this paper.", "essential_references_not_discussed": "It seems that the paper [1] on in-training defense with similar data isolation techniques is not compared and discussed as the baseline. The latest defense method *ASD* is from CVPR-23, which is behind the current SOTA method.\n\n[1] Progressive Poisoned Data Isolation for Training-Time Backdoor Defense, AAAI-24.", "other_strengths_and_weaknesses": "Pros:\n\n- The paper is well-structured and easy-to-understand with dedicated figures.\n- The extensive experiments on the method details are conducted thoroughly.\n- The defense performances are promising in both CA and ASR.\n\nCons:\n- See the *Essential References Not Discussed* above.", "other_comments_or_suggestions": "None.", "questions_for_authors": "None.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "r4kbdFEDp5", "reviewer": "Reviewer_apHg", "summary": "This paper proposes a backdoor attack defense method, Bi-perspective Splitting Defense (BSD), which does not rely on additional clean subsets. BSD utilizes semantic characteristics through open set recognition-based splitting (OOS) and loss statistics characteristics through altruistic model-based data splitting (ALS) to distinguish clean samples. In their experiments, BSD demonstrates its superiority compared to five state-of-the-art defenses.\n\n## update after rebuttal\n\nThanks for the authors' feedback. After reading the response, I would like to maintain my original score.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your comments. \n\n**Extended Figure/Tables in anonymous link: https://postimg.cc/68rDsgN3.**\n\n# R1 Understanding BSD's Robustness Against Clean-Label Attacks\n\nFirst, in response to `Given that clean-label...single benchmark dataset?`, we provided the experiment results of BSD on GTSRB (**Extended Table 1**).\n\nThe primary reason BSD resists clean-label backdoor attacks: **1) MixMatch could properly process unlabeled poisoned clean-label data; 2) BSD effectively split poisoned samples.** Specifically, MixMatch's mixup operation visually weakens the trigger in the unlabeled data, preventing trigger-target label association. So, as long as the poisoned samples are correctly placed into the poison pool (unlabeled data), BSD effectively mitigates their impact. \n\n**We start by investigating semi-supervised involved defenses like ASD and DBD.** These works report counterintuitive good performance against clean-label attacks. DBD included a brief explanation of its effectiveness against clean-label attacks (in their Appendix O, page25). Reproducing ASD showed that failures occurred when poison samples remained in the clean pool. Reviewing logs from two failed ASD experiments, we found many poison samples misclassified into the clean pool(**Extended Table 2**).\n\n**This led us to hypothesize that MixMatch could properly process unlabeled poisoned clean-label data, but DBD and ASD failed for not robust split methods instead.** \n\nFurther investigation highlighted MixMatch’s mixup operation as critical. MixMatch removes original labels and mixes multiple inputs on the image level, effectively weakening the visual impact of the trigger:\n\n$$ \\tilde{x} = \\lambda' x_l + (1 - \\lambda') x_u, \\quad \\tilde{y} = \\lambda' y_l + (1 - \\lambda') y_u, \\quad\\lambda\\sim Beta(\\alpha,\\alpha),\\quad \\lambda'=\\text{max}(\\lambda,1-\\lambda). $$\n\nWith $\\alpha=0.75$ by default, expectation of $\\lambda'$ ≈0.78, reducing trigger prominence in $x_u$. We visualize the mixed samples in **Extended Figure 1** to better present this operation. Plus, we follow ASD set a 5x smaller $\\lambda_u$, further reducing the influence of unlabeled data and mitigating clean-label attacks.\n\n**To experimentally verify this hypothesis, we enforced a secure clean-poison split where no poison samples were included in the clean pool.** Under this condition, MixMatch effectively nullified the impact of clean-label attacks, as shown in **Extended Table 3**.\n\n**That said, it's still a necessity that we do not split poison samples into clean pools.** Therefore, since the final model does not collapse (Table 2, page6), it supports the reliability of ALS’s split results. Moreover, while OSS seems ineffective against clean-label poisoned samples, it still serves two important purposes: 1) It provides a secured warm-up phase for the main model, preventing an immediate collapse (see our definition in Appendix C.3); 2) Although OSS may not directly identify poison samples, it selects samples from $D_t$ that are farthest in feature space from those in $D_{nt}$, i.e., representitive samples of $D_t$. This result intersects with the clean pool identified by ALS, improving the quality of init clean samples. Therefore, our statement is that ALS “compensates for the limitations of OSS”(line 375, page7), instead of ALS alone is sufficient. \n\n---\n\n# R2 Important Baseline\nRespecting the reviewers’ suggestions, we made efforts to implement PIPD(**Extended Table 4**).\n\nNote that we did not intentionally avoid citing higher-performing works. The exclusion of PIPD (AAAI24) was due to:\n\n- We conduct reproductive evaluations before adding any baselines, and PIPD's reproductivity is poor. Specifically, across its paper, appendix, and GitHub repository, we found many essential code/parameters/setting omissions.\n- Methodologically, while PIPD’s approach is intuitively good, it relies on good starts from pre-isolation using LGA. However, our analysis suggests LGA alone may require attack-specific adjustments to hyperparameters (e.g., optimizer choice/learning rates). That's also why we replaced our early version of LGA-based $y_t$ estimation.\n\n---\n\n# R3 Estimation of y_t\n\nWe would like to emphasize that the estimation method for $y_t$ is not our major contribution, and we have verified its robustness(Table 4, page7; Figure 9, page19; Table 8, page19; Table 11, page20) and discussed multiple insurance measures(line 1011-1032, page19). To answer how this method performs when the number of poisoned samples is relatively small, see Figure 3 (a), page8.\n\n---\n\n# R4 Others\n\nModel structures: Since we have no model-specific assumptions, our method is inherently model-agnostic. Additionally, our experiments on MobileNet further support this claim(Section 5.3). We also add a brief experiment in **Extended Table 5**.\n\nPresentation: We appreciate your insights about strengthening the presentation of our work. We will update our modifications accordingly in our revision (once we get a chance).", "claims_and_evidence": "The authors define backdoor samples as Unknown Classes (UKCs) in their proposed BSD. However, they also admit that clean-label attacks are not UKCs, which makes me question the soundness of their defense claims. This raises doubts about whether their definition is accurate enough—doesn't this create an inconsistency?\n\nIf clean-label attacks are not UKCs, it implies that OSS is useless against clean-label attacks. The authors also claim that ALS is strong enough to defend against clean-label attacks, so why not simply use ALS for splitting? If that's the case, would applying ALS alone be effective against all types of backdoor attacks? And if so, is OSS even necessary?", "methods_and_evaluation_criteria": "Based on the results of their experiments, they did propose a promising backdoor defense. However, the experimental validation is not robust enough to convincingly demonstrate its effectiveness.", "theoretical_claims": "Yes, for clean-label attacks, the theoretical foundation of OSS does not hold!", "experimental_designs_or_analyses": "Yes, I believe this work requires more experiments to demonstrate its soundness and validity. In the case of clean-label attacks, semi-supervised learning lacks the ability to correct mislabeled samples. Both DBD and ASD incorporate semi-supervised learning in their defense mechanisms, yet they struggle to defend against clean-label attacks. So why would BSD be effective against them?\nFor clean-label attacks, it is evident that OSS is ineffective because, in such attacks, poisoned samples are also UUCs (Unknown Unknown Classes). However, the authors claim that ALS alone is strong enough to separate poisoned samples in clean-label attacks. This assertion requires an ablation study to confirm whether ALS alone is truly capable of achieving this. Moreover, if ALS can effectively defend against clean-label attacks, its effectiveness against poisoned-label attacks should also be evaluated.\n\nAdditionally, the authors should analyze the performance of the target label select mechanism, as it raises concerns about the reliability of target label distinction. Given that clean-label attacks are notoriously difficult to defend against, why did BSD only get evaluated on a single benchmark dataset?\n\nFurthermore, the study lacks experiments evaluating the defense performance across different model architectures, which is crucial for demonstrating the robustness and generalizability of BSD.", "relation_to_broader_scientific_literature": "The key contributions of the paper are closely related to the security of artificial intelligence.", "essential_references_not_discussed": "The key contribution is the proposal of a high-performance backdoor defense that does not rely on a clean subset. However, the paper only cites some backdoor defenses with worse performance while overlooking a state-of-the-art approach that also does not require a clean subset—namely, Progressive Isolation of Poisoned Data (PIPD), which was published in AAAI 2024.", "other_strengths_and_weaknesses": "Other Strengths: Framing the backdoor attack problem as an open-set recognition issue offers a novel perspective.\nOther Weaknesses: The writing is confusing; the concepts of Known Unknown Classes (KUCs) and Known Known Classes (KKCs) are not clearly introduced, and the figures are also quite disorganized.", "other_comments_or_suggestions": "None.", "questions_for_authors": "Q1. How effective is the experimental method for determining y_target? Can it reliably identify y_target? How does this method perform in attack scenarios where the number of poisoned samples is relatively small?  \n\nQ2. Clearly, in the case of a clean-label attack, OOS becomes ineffective since the poisoned samples in clean-label attacks do not have modified labels. However, the authors claim that the ALS stage alone can achieve effective separation. If that is the case, why was there no ablation study on BSD to verify whether the ALS stage truly performs as well as claimed? If ALS alone is sufficient, should it also be capable of defending against poison-label attacks? Is it really as effective as the authors suggest?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HdnnWemJje", "reviewer": "Reviewer_FTAm", "summary": "This paper addresses poisoning backdoor attacks. Specifically, the authors aim to challenge the assumption of accessing clean data in current backdoor defense literature, with the main idea of utilizing both easier-to-obtain target labels and clean, hard samples. They propose a Bi-perspective Splitting Defense (BSD) which relies on semantic and loss statistics through OSS and ALS, respectively. The proposed method is evaluated on benchmark datasets to demonstrate its effectiveness.\n\n## Update after rebuttal.\n\nI thank the authors for their rebuttals. It appears that my original review was accurate in stating:\n\n> implicitly assumes the existence of a feature that can reliably distinguish clean data from backdoor data.\n\nAs a result, I find it quite confusing to understand how your approach can be described as clean-data-free. I strongly recommend revising the wording to reflect this more accurately.\n\nRegarding the experiments, I do not find them comprehensive enough—especially concerning the attack part—given the vast body of literature on backdoor attacks, as I mentioned in [2].\n\nWith that being said, I will adjust my rating to a borderline score.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your comment.\n\n# R1 Assumption&Novelty\n\nThe so-called implicit assumption that `implicitly assumes ... backdoor data` was not a weakness of our paper, and it does not influence the novelty when taking [1] into account. See below for details.\n\n## R1.1 Clarification\n\nAs the reviewer may have interpreted the background differently, we would like to re-clarify the defense scenario. Our focus is on a practical scenario where defenders attempt to train a benign model using partially poisoned backdoor datasets without **known to be clean** subsets (**See lines 41-76, Introduction; lines 94-121, Preliminary**). \n\nTo formally define, the defender has a training set $D = D_{c} \\cup D_p$ , but the defender doesn't know which part of the samples is clean, and has neither known clean samples $D_{c*}$($D_{c*} \\subset D_c$) nor external clean samples $D_{extra}$($D_{extra}\\cap D=\\varnothing$). \n\nIn our previous submission, we consistently use the terms *clean subsets / extra clean subsets / clean seed* rather than *clean data* throughout the main text and explicitly formulate the training set as $D = D_{c} \\cup D_p$ instead of $D = D_p$ (**Line 107, Preliminary**). While other reviewers have not raised concerns regarding this aspect, we appreciate the opportunity to refine our explanation and will further clarify this definition in our revision.\n\n## R1.2 Free clean-data assumption\n\nAs we re-clarified above, we didn't make such an assumption as you interpreted, thus it does not constitute a weakness.\n\nTo understand why our BSD works on mixed datasets without known-clean samples, that's because we leverage general attack-related priors, including: **1)** From the perspective of loss statistics, neural networks tend to overfit backdoor samples, resulting in lower loss values(ALS); **2)** From the perspective of semantic information, identifying poisoned samples from backdoor attacks can be reframed as an open-set recognition problem(OSS). (**See lines 152-160, page 3**)\n\nFor your claim that `without any information ... filtering-based defenses`, there may be a misunderstanding regarding our background:\n\n- It seems that you are referring to a scenario where there is absolutely no clean data in the training set, **it's indeed an impossible task**. But this scenario is not what our paper focuses on, “no clean data at all” is quite different from the “no additional clean subsets” scenario we address. Your comment below, `In other words ... no clean data is available at all` seems to suggest that we should solve a task that just described as impossible.\n\n- > If you mean that the defender has no assumptions regarding clean data information but is dealing with a mixed dataset, whether defense is possible depends on how you define “clean data information” and whether general attack-related priors count. Your [1] is a good case. It proposes a method that does not require known clean subsets but distinguishes between samples within a mixed dataset. It managed this using attack-related priors, treating poisoned samples as the minorities within each category.\n\n## R1.3 Novelty\n\nOur novelty is already claimed (**lines 75-98, Introduction**), and Ref[1] doesn't affect our novelty, in detail:\n\n- While [1] also assumes no extra clean sets, the core defense mechanism differs. It detects poisoned samples as intra-class outliers, considering **only** the samples within each current class. In contrast, our OSS module innovatively reframes the problem based on open-set recognition, OSS **jointly** considers the target class and all other classes for effective distinction. After identifying $y_t$ and warming up the main model, the OSS module distinguishes samples based on different feature distances between the target class $D_{t}$ (i.e., UKCs + UUCs) and the remaining classes $D_{nt}$ (i.e., KKCs). (Details in **Section 4.1.1**)\n- [1] relies on the assumption that **poisoned samples are intra-class minorities**. As the intra-class proportion of poison samples($\\approx\\rho$) increases, class-wise mean representation goes closer to poison samples, reducing detection effectiveness. When poisoned samples became the intra-class majority (for large $\\rho$ values or in imbalanced datasets like GTSRB), clean samples became outliers instead. In contrast, our method is robust against this issue and is verified by experiments under a larger $\\rho$ range (**Figure 3, page 8**).\n- Additional differences in other aspects: adaptive vs. one-time partitioning and a semi-supervised framework vs. detect-and-retrain framework, etc.\n\n---\n\n# R2 Additional Experiments \n\nOur experiments already cover 7 attacks in the main text and more attack variants in the appendix, along with 6 defenses and additional recent defenses like VaB, D-ST, and D-BR. **This is sufficiently comprehensive since** 1) the threat model specifies poisoning-based attacks; 2) related works like ABL and DBD evaluate fewer cases. **More results in https://postimg.cc/DSn6S9nG.**", "claims_and_evidence": "The claims are supported by either textual and mathematical elaborations or empirical evidence.", "methods_and_evaluation_criteria": "I believe the paper has some methodological weaknesses, which I will elaborate on below.  \n\n- **Free clean-data assumption**: First, I find this assumption invalid. Theoretically, it can be shown (and I can provide a proof if the authors are interested) that **without any information** about the clean data, it is impossible to perform detection or filtering-based defenses. In this sense, the assumption effectively states that, although direct access to clean data is unavailable, a proxy for it is accessible.  \n\nIn particular, while your method operates on mixed data, it **implicitly assumes the existence of a feature that can reliably distinguish clean data from backdoor data**. This idea has already been extensively explored in previous literature [1]. In other words, the paper does not address the scenario where no clean data is available at all. \n\nBuilding upon the previously mentioned implicit assumption, the proposed bi-perspective approach does not appear novel to me. Overall, I find the paper's novelty and originality to be limited.\n\nRefs: [1] https://arxiv.org/abs/1811.00636", "theoretical_claims": "There is no theoretical proof provided. However, the paper includes some mathematical derivations, which I believe are correct.", "experimental_designs_or_analyses": "Given the extensive body of literature on backdoor defenses, the evaluations in the current version require significant improvement. For instance, the number of evaluated attacks and defenses is not comprehensive enough. I suggest that the authors follow the setup in [2], where more than 10 attacks and 7 defenses were tested.\n\nRefs: [2] https://arxiv.org/abs/2205.13616", "relation_to_broader_scientific_literature": "Backdoor attacks and defenses fall within the broader domain of core machine learning.", "essential_references_not_discussed": "I have listed some missing references in previous sections.", "other_strengths_and_weaknesses": "- Please check my previous comments", "other_comments_or_suggestions": "- Please check my previous comments", "questions_for_authors": "- Please check my previous comments", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The paper received 2 Accept, 1 Weak Reject, and 1 Reject scores pre-rebuttal. After the rebuttal, only Reviewer FTAm changed his score from Reject to Weak Reject, after getting clearer on the paper's claims and settings. 

Reviewers 2zkR and Mmmu applauded the paper for its interesting idea, clear writing, extensive experiments, and promising results. In contrast, Reviewers at apHg and FTAm found the writing unclear and required more clarification. Reviewer apHg questioned the method's effectiveness against clean-label attacks and the robustness of the target label estimation process. The rebuttal attempted to address his concerns but did not help to change the score. Reviewer FTAm found the novelty limited and required more comprehensive experiments.

The ACs checked the paper and the discussions. The rebuttal seemed to address the concerns raised by Reviewer apHg. As for the experiment comprehensiveness concern from Reviewer FTAm, we found the tested attacks (7) and defenses (6) sufficient in terms of both quantity and diversity. However, we agreed that the novelty was not strong and that the writing needed to be improved.

The ACs found the benefits of the paper outweigh its shortcomings. Hence, we agreed to accept the paper to ICML. The authors should consider the reviews to improve their camera-ready version.
Decision: Accept (poster)