Circumventing Backdoor Space via Weight Symmetry
Authors: Jie Peng
Hongwei Yang
Jing Zhao
Hengji Dong
Hui He
Weizhe Zhang
Haoyu He
Venue: ICML 2025 poster (2025)
Keywords: AI security
backdoor defenses
mode connectivity
permutation invariance
Primary area: social_aspects->security
TL;DR: We propose a defense leveraging neural networks' weight symmetry to remove backdoors, with theoretical guarantees of effectiveness across various learning settings.

Abstract: Deep neural networks are vulnerable to backdoor attacks, where malicious behaviors are implanted during training. While existing defenses can effectively purify compromised models, they typically require labeled data or specific training procedures, making them difficult to apply beyond supervised learning settings. Notably, recent studies have shown successful backdoor attacks across various learning paradigms, highlighting a critical security concern. To address this gap, we propose Two-stage Symmetry Connectivity (TSC), a novel backdoor purification defense that operates independently of data format and requires only a small fraction of clean samples. Through theoretical analysis, we prove that by leveraging permutation invariance in neural networks and quadratic mode connectivity, TSC amplifies the loss on poisoned samples while maintaining bounded clean accuracy. Experiments demonstrate that TSC achieves robust performance comparable to state-of-the-art methods in supervised learning scenarios. Furthermore, TSC generalizes to self-supervised learning frameworks, such as SimCLR and CLIP, maintaining its strong defense capabilities. Our code is available at https://github.com/JiePeng104/TSC.

Circumventing Backdoor Space via Weight Symmetry
Jie Peng'
Hongwei Yang'
Jing Zhao
Hengji Dong'
Hui He
Weizhe Zhang
Haoyu He
Abstract
Backdoored Image
Model/Encoder
Clean Image Modee/fncoder
Encoder
Classifier
Deep neural networks are vulnerable to backdoor attacks, where malicious behaviors are implanted during training. While existing defenses can effec- tively purify compromised models, they typically require labeled data specific training proce- dures, making them difficult to apply beyond su- pervised learning settings. Notably, recent studies have shown successful backdoor attacks across various learning paradigms, highlighting a crit- ical security concern. To address this gap. we propose Two-stage Symmetry Connectivity (TSC), novel backdoor purification defense that oper- ates independently of data format and requires only small fraction of clean samples. Through theoretical analysis, we prove that by leverag- ing permutation invariance neural networks and quadratic mode connectivity, TSC amplifies the loss on poisoned samples while maintaining bounded clean accuracy. Experiments demon- strate that TSC achieves robust performance com- parable to state-of-the-ar methods in supervised learning scenarios. Furthermore, TSC generalizes to self-supervised learning frameworks, such as SimCLR and CLIP, maintaining its strong defense capabilities. Our code is available https: //ggthub....///// com/ wwtp/eegeeeeeeeeeeeeeeeee /TSC..
Image-Label
Implanting Bacadoars
Dolnset
Algortthn
Final Model
Label
Obtaining small fraction of clean samples
Traditional Supervise Learning
Final
Image on-Pair Dataset
Backdoors
Model
Sim
SmmL
Tuning
SimCUR Training
limage Tn--ees
Implanding Backdoors
Algoritho
Final Model
pipootoo of Swann
CUP
CLIP
(Zero-shot)
CUI Training
Figure I. Illustration of the application of TSC in three popu- lar learning settings. We assume adversaries perform either data-poisoning attack or training-manipulation attack to implant backdoor into the weights of classification model encoder. Unlike most existing defenses requiring specific training proce- dures, TSC provides framework to remove backdoors using only small fraction of clean samples and the original training process, For instance, in SimCLR (Chen al., 2020) setting. a TSC defender can directly remove the backdoor hidden in the image encoder by combining TSC with the SimCLR training pro- cedure. This allows for training the downstream classifier without the adversarial influence inherited from upstream.
attack). For instance, recent advancements in self-supervised learn- ing strategies often rely on large volumes training data, which, while cireumventing the need for eurated or labeled datasets, be time-intensive and incur high computational costs (Radford et al., 2021; He et al., 2022; Chen al., 2020). Therefore, many users prefer to delegate model train- ing to third-party providers or fine-tune publicly available models on downstream tasks. This practice exposes mod- els to backdoor attacks. For example, malicious providers can manipulate the training process to implant backdoors and then force downstream classifiers output adversarial labels (Yao et al., 2019; Saha et al., 2022; Li et al., 2023).
Nguyen & Tran, 2020) (i.e.,
1. Introduction
Modern classifiers require substantial data and computa- tional resources to achieve high accuracy, providing adver- saries with opportunities to implant backdoors into deep neural networks (Gu et al., 2017; Chen et al., 2017). This vulnerability arises from either injecting poisoned data (Gu et al., 2017: Turner et al., 2019) (i.e., data poiaonois attack), or manipulating the training process (Pang et al., 2019;
School of Cyberspace Science, Harbin Institute of Technol- ogy, Harbin, China. *Pengcheng Laboratory, Shenzhen, China. 'Department of Data Science and AI, Faculty of IT, Monash University, Melbourne, Australia. Correspondence to: Hui He <hehui hit.ecu.cn.....
Consequently, many defenses have been developed to elim- inate backdoors hidden within models. One of the most prominent mechanisms is post- post-purification defenses, which remove backdoors through post-training processes (Liu
Proceedings of the 4dnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Circumventing Backdoor Space via Weight Symmetry
et al., 2018; Wang et al., 2019; Wu & Wang. 2021; Zeng al., 2022). Usually, post- post-purification defenses require only small amount of clean data and are effective against both tata-poisoning and training- manipulationn attacks. However, existing approaches focus primarily on supervised learning scenarios and rely on training methods requiring labeled data (Wang et al., 2019; Wu & Wang, 2021; Li et al., b02 Chai & Chen, 2022) (e.g. methods working as analogues to adversarial training). Thus, they are not directly appli- cable to learning regimes like self-supervised or unsuper- vised learning. Moreover, some studies have shown that most current defense mechanisms, whether categorized as post-purification defenses or not, are vulnerable to attacks using small poisoning rates or adaptively designed triggers (Hayase et al., 2021; Qi et al., 2023; Min et al., 2023).
trates how TSC operates across different learning settings, using only small fraction of clean samples and a proce- dure aligned with the original training process. Overall, our contributions are as follows:
We discover that the property of weight symmetry en- able effective backdoor space circumvention. Based on this insight, TSC provides a unified framework for backdoor defense across various learning settings.
Through analysis of the mechanisms behind permu- tation invariance and mode connectivity, we provide theoretical guarantees that TSC can amplify the up- per bound of loss values on poisoned samples while maintaining accuracy on the initial task.
Experiments on CIFARIO (Krizhevsky, 2009), GT- SRB (Houben et al., 2013), and ImageNet100 (Deng et al., 2009) under supervised learning demonstrate that TSC achieves performance comparable state-of- the-art methods while maintaining robustness against various attack settings, including small poisoning rates and adaptively designed attacks. Moreover, TSC suc- cessfully counters attacks on image encoders across different learning frameworks.
Previous studies have intentionally unintentionally tried to address the challenges of robustness and transferability in backdoor defense. Recent work by Min et al. (2023) re-investigated fine-tuning (FT) based methods, proposing to enhance robustness under low poisoning rates. While achieving promising performance, their methods remain confined supervised learning settings. The mode connec- tivity repair (MCR) (Zhao et al., 2020), which leverages quadratic mode connectivity (Garipov et al., 2018), offers data-formal agnostic procedure but shows limited robustness against various attack methods. To address all these chal- lenges, in this paper, we explore a robust post- puriiffiiict defense that operates independently of the data format.
2. Related Work
Mode Connectivity. Merging two models with different initializations usually involves the concept of mode connec- tivity, which lies at the heart of finding a low-loss linear or nonlinear path connecting two models (Frankle et al., 2020; Garipov et al., 2018; Gotmare et al., 2018; Draxler et al., 2018). Empirical studies have shown that aligning two models through permutation before merging can greatly enhance the generalization of models along a linear path (Entezari et al., 2022: Simsek et al., 2021), or a quadratic curve (Tatro et al., 2020). Notably, recent research demon- strates that models aligned within the same loss basin can be merged effectively by averaging their weights (Ainsworth et al., 2023; Singh & Jaggi, 2020; Jordan et al., 2023).
We propose Two-stage Symmetry Connectivity (TSC), a novel defense mechanism that leverages weight symme- try in neural networks to guide compromised models away from backdoor behaviors without directly unlearning back- door patterns (i.e,, circumventing the backdoor space). Our approach builds upon two key properties: permutation in- variance, which allows equivalent model representations through weight layer permutations (Entezari et al., 2022): and quadratic mode connectivity (Garipov et al., 2018), which connects model states through low-loss quadratic paths.
Backdoor Attacks. A backdoor adversary aims to make the victim model maintain accuracy on clean inputs while assigning target labels to trigger-embedded inputs (Gu et al., 2017; Chen et al., 2017). Based on the attacker's 's capabili- ties, backdoor attacks can be categorized as data-poisoning attack and rraining-manipulee attacks, the adversary poisons a portion of the training set by injecting pre-designed triggers and modifying their labels. The trigger patterns can range from pixel squares to real- world objects (Wenger et al., 2022) or invisible patterns (Li et al., 2021a; Saha et al., 2020; Li et al., 2021c). To avoid detection of mislabeled samples as outliers, some studies have developed backdoor attacks that maintain original la- bels (Turner et al., 2019; Barn et al., 2019; Shafahi et al., 2018: Zhu et al., 2019).
Our defense process begins by projecting a copy of the com- promised model into a distinct yet symmetrical loss basin, leveraging the permutation invariance property of neural networks. These two models serve as endpoints for Bézier curve that is trained using small clean dataset. We then pick a point on this trained curve as the purified model, which completes the first stage of our defense. As the end- points are in different loss basins and this curve training utilizes only clean samples, we show that the loss of poi- soned samples along the curve is amplified. Subsequently, we merge the purified model and the backdoored model in the original loss basin to maintain clean accuracy, which completes the second stage of our defense. Figure I illus-
attack. In data- sata-poisoniig
attackers
2

---

Circumventing Backdoor Space via Weight Symmetry
have full access the training process, enabling them to effectively inject backdoors through specific training-based methods (Nguyen & Tran, 2020; Pang et al., 2019).
where the pea.e (t) is the distribution for sampling the mod- els on the curve indexed by t. For simplicity in computa- tion, the uniform distribution U UO, 1) is typically chosen as a. (.). To characterize the parametric curve Yea,.a an (t) for L. E [0, 1). the Bézier curve with 3 bends is commonly employed and is defined as follows:
Most backdoor attack studies focus on supervised learning scenarios. However, recent work has indicated that models in self-supervised learning settings are vulnerable to back- door attacks, which may involve the adversary controlling the training process (Jia et al., 2022). or merely injecting poisoned samples (Saha et al., 2022; Carlini & Terzis, 2022; Li et al., 2023; Carlini et al., 2023).
n (t) = (1 0) + 20(1 1)0 + POB.
(2)
More details about mode connectivity can be found in Ap- pendix B.
Backdoor Defenses. Current backdoor defenses can be divided into three categories: training-tine defenses, test- time defenses, and cost-uurification defenses. Training-tine time defenses require training clean models on polluted dataset to counteract data-poisoning attacks (Chen et al., 2018; Tran et al., 2018; Hayase et al., 2021; Li et al., 2021d; Khaddaj et al., 2023). A recent approach, ASSET (Pan et al., 2023), extends this concept to handle various attacks and learning settings. Test-time defenses aim to filter out malicious inputs during inference rather than directly eliminating backdoor threats (Gao et al., 2019; Guo et al., 2023; Hou et al., 2024).
3.2. Permutation Invariance
For simplicity, we consider an L-layer feedforward neural network with an clement-wise activation function and weights O. We use Wi to denote the weight of the 1 layer, Do E Io to represent the input data and y E R to indi- cate the output logits (or features). The L-layer feedforward network can be expressed as:
f (z 0) = y = W,, o WT.-1 o.. 0r Wi (3)
Moreover, we denote the 1 intermediate feature as 2 R4 and x Wi x1-1.
In this study, we focus on pest-purification defenses (Liu et al., 2018; Wu & Wang, 2021; Zeng et al., 2022; Wang et al., 2019; Min et al., 2023) aiming to remove the backdoor injected into the weights of a model. Existing visual post- purification defenses mostly require labels accompanied with the training images, such as adversarial training based methods (Wu & Wang, 2021; Zeng et al., 2022), limiting their applicability to other training frameworks without la- bels. While Feng et al. (2023) proposed method to identify backdoors in self-supervised learning settings, it focuses on detection rather than removal. Recently, Zheng et al. (2024) extended unlearning methods to self-supervised settings. Instead of unlearning backdoor patterns, our method lever- ages weight symmetry purify models while preserving performance, generalizing robustly across various learning scenarios and attack settings.
One of the key techniques central to our defense method is permutation invariance of neural networks (Entezari et al., 2022; Tatro et al., 2020; Ainsworth et al., 2023). Let Pi E IT, be a permutation matrix that permutes output feature 2i of the 1th layer, where II,, is the set of all pos- sible de di permutation matrices. Since P,T Pt I, without changing the final output y. can permute Wi to P.W.P.T. We denote this operation as π (6,, S(P)), where S(P) = (Pi, P2 .2.,.. Pr--1} is the set of permutation ma- trices. Consequently, we obtain a new network with weights OS(P) = T0, SP)) defined as:
w/S(P) P:W1; WS(P) W.P...i
W/S(P) P.W.P.,, VIE (2.3, I. 1}.
(4)
The property of neural network that allows it to be trans- formed by such permutation, resulting in s OS(P)) f(zo, 0), is known as permutation invariance. This prop- erty implies that two networks can be functionally identical even if the arrangement of their neurons within each layer differs. For example, two parameter sets, O, and 0R, sat- isfy f 4A) f 0g) for any input wo E Ido, per- mutation invariance implies that their corresponding layer weights, W,A and Wi", can differ. This observation moti- vates the concept of neuron alignment.
3. Preliminaries
3.1. Minimum Loss Path
Here, we consider the connecting method with respect to quadratic mode connectivity (Garipov et al., 2018: Tatro et al., 2020). Let O and 0g be the weights of two trained models, and let Yo (t) denote a parametric curve connecting O and On such that ( (0) O and Yoa.. (1) = B. To train Ye..s (1), Garipov et al. (2018) proposed finding the set of parameters OA,B that minimizes the expectation of the loss L(YeA,n (t)) over the distribution p (+) on the curve,
3.3. Neuron Alignment
Previous studies have found that two functionally identical networks, 0 and 0R. when trained independently with the same architecture but using different random initializations or yielding different SGD solutions, can be misaligned (i.e.,
((OA.)) = S'' (tTe)a()))Po dt,
(1)
3

---

Circumventing Backdoor Space via Weight Symmetry
their parameters, A and 0g. correspond to different neuron arrangements). As result, the loss obtained from a linear interpolation of their parameters can be quite large.
model using the original training procedure. A discussion about the applicability of the proposed defense setting can be found in Appendix A.
Recently, research (Entezari et al., 2022; Singh & Jaggi, 2020; Ainsworth et al., 2023; Jordan et al., 2023) has shown that such misaligned networks could be projected to the same loss basin using specific set of permutation matrices S(P). To identify such permutation set S(P) and achieve alignment, we can minimize cost function ej I& x R4 - R2+ with respect to the intermediate features æf and af to get the P; for each layer. In practice, given dataset D containing samples, we minimize the sum of a across D. The optimal Pt can then be found by solving:
To evaluate the performance of various backdoor defenses, we consider two primary metrics: Attack Success Rate (ASR), the proportion of attack samples misclassified as the target label, and Clean Accuracy (ACC), the prediction accuracy on benign samples. An effective defense should achieve a high ACC while maintaining low ASR.
4. Method
Before formally describing our approach, we first provide the intuition behind TSC. Removing the implanted backdoor in a model is equivalent to inducing the model to have high loss value for the poisoned samples (i.e., adversarial loss). However, performing a procedure similar to unti-backdoor learning (Li et al., 2021d) to increase the loss of the poisoned samples could be challenging for a post-time defender, as the trojan method is unknown, and the adversary could inject various trigger patterns that are difficult to recover (Li et al., 2021c).
P arg min Piell,
Σ Ca Pi (...)-
(5)
This problem is classic example in the field of optimal transport (Villani et al., 2009; Singh & Jaggi, 2020), which could be solved via the Hungarian algorithm (Kuhn, 1955). Following previous work, we adopt the alignment method proposed by Li et al. (2015), where et = 1 - corr(u, =) and corr(:, .) denotes the correlation between two vectors. This makes the minimization procedure is equivalent to ordinary least squares constrained to the solution space Il (Ainsworth et al., 2023; Tatro et al., 2020). Thus, problem (5) can be specified as:
To remove the backdoor, we propose a repairing method consisting of two stages of mode connectivity, In the first stage, we amplify the adversarial loss by un-aligning the malicious model Oudo with its own copy oady' on the loss landscape and then training a curve 71 connecting Oade and Oado' with the given benign samples. Since this unalign- ment process is designed to place the endpoints (Bads and a in different loss basins, and the curve V1 is trained exclusively with benign samples, models 0, along this curve are expected to exhibit high adversarial loss but low loss on benign samples. This outcome is consistent with established properties of quadratic mode connectivity (Garipov et al., 2018; Tatro et al., 2020). In the second stage, to recover the clean accuracy, we train another curve that connects the aligned Oudi and O, This procedure aims to find a curve 72 with descending adversarial loss along the curve but a much lower loss for benign samples compared to 71
A = arg min
E1 - Pt R. PIell.,
(6)
Throughout the paper, we define (f, pg; D) to measure the L2 norm feature distance of the 1th layer between 0 and 0g given dataset D:
| x 11.
(7)
Therefore, P7 can be regarded as the optimal solution which has the smallest (0,, ((,,,S(P)): D) among all Pt- E HI. Additionally, if we denote aa, and af, as samples from two distributions IPA1 and P/S the mini- mal distance in (6) corresponds to the 2- Wassersstei dis- tance (PA,, P.P; D) between P/A and PPP. Thus, we have WPPA, PPP: D) Mi(OA. (0 S(P)); D). A brief ex- planation can be found in Appendix D.
4.1. Ad Adversarial Loss Amplification
We present case in the left of Figure 2, where the model is attacked by SSBA (Li et al., 2021c), and the defender sim- ply trains a Bézier curve connecting the initial backdoored model Oudv and its slightly fine-tuned version, θUc (Zhao et al., 2020). As shown, if the poisoned model 0udv and 0y: lie in the same loss basin, eliminating the backdoor through model connection or fusion is diffieult, as the adversarial loss along the curve remains low. To amplify the adver- sarial loss, we utilize the permutation invariance property to project Audo to a distinct loss basin to obtain the other endpoint, Oadv', rather than fine-tuning Oade- This can be achieved by finding a set of permutation matrices S(P') that maximize the cost function e for each layer. In con-
3.4. Threat Model and Evaluation Metrics
We consider a scenario where an adversary can manipulate portion of the training data access the model training procedure. The backdoor is assumed to be implanted into the parameters of a standard neural architecture rather than a model with specific malicious modules (Bober-Irize et al., 2023). A TSC defender requires access to a small fraction of clean training samples and and the ability to retrain the
4

---

Circumventing Backdoor Space via Weight Symmetry
Adversarial Loss Amplification (TSC)
Clean Accuracy Recovery (TSC)
Loss of Paismed Sumples
14
12
25
>23
bedoo ed Enpoot
15
1.5
2.0
Beoittone Expace
81
04
14
44
31
22
64
60
31
60
0001
6002
0.13
Loes Benign Samples
Bacer Cate
>24
2.0
Dapar oe wer
22
1.5
008
1.0
3.0
0.90
64
05
0.0
3.0
0.2
044
6.6
3.8
(Settings)
Dutnsel: CIFARIO, Mudel Architecture: Resdst- Atlack: SSBA, Poisoning Rate: 5%
Figure 2. Loss landscape for poisoned and benign samples, along with trained quadratic curves connecting distinct models. The backdoored model is a PreAct-ResNet18 trained CIFAR-IO, which contains 5% SSBA poisoned samples (Li al., 2021c). Left: the curve identified by MCR. Middle: the curve identified by the first stage of TSC. Right: the curve identified by the second stage of TSC.
trast to neuron alignment in problem (5), our goal is to find the permutation P/ for all layers to project the backdoored model into a distinct loss basin. Specifically, we formulate the following optimization problem to obtain S(P"):
along the curve from Addo to = and the model point along this curve could also attain a lower loss on benign samples than 01=0.4. A model along the curve with a high loss for poisoned samples and a low loss for benign samples can be selected the ideal purified model.
P/ = arg max PIEITa
Σ || - Pt P, add
(8)
Additionally, as shown in Figure 3, we find that performing one round of TSC is insufficient to remove the backdoor. In practice, we slightly fine-tune the model obtained from the second stage of TSC, then use this fine-tuned model as the input for the next round to mitigate the backdoor threat step by step. It is evident that as the global epoch Ersc increases, the ASR of model points along the second stage curve of TSC decreases. Empirically, setting Ersc = 3 can effectively eliminate the backdoor while maintaining good performance on the benign task.
Then, we get the updated model Oudo' = (Onde, S(P')) It's important to note that this procedure does not alter the output of the backdoored model for any input; consequently, it does not increase the loss for any sample, though here we are dealing with a maximization problem. To amplify the adversarial loss, we then train a Bézier curve, Y1. con- necting O Oude and Oadv', and subsequently select a model corresponding to a middle point on this curve.
As shown in the middle of Figure 2, when connecting Onde and Oude', the loss of poisoned samples increases signifi- cantly along the Bézier curve 7/1 (i.e., circumventing the backdoor space). As expected, the loss landscape becomes symmetric for both poisoned and benign samples. However, compared to MCR, we observe an increase in the loss of benign samples, implying that the models selected from the curve connecting Oude and Oudo' would perform poorly the initial task.
We give the pseudocode in Algorithm Since we as- sume the defender only has access small fraction of clean samples D... both the computation of the permu- tation and the training of the curve are conducted over De. The function PERMUTELAYERS the pseudocode returns model by permuting the layers of 0g. aligning or un-aligning it with O The function FITQUADCURVE(O,, OB, F. D, e) returns the quadratic Bézier curve connecting 0 and 0B. trained using method F over D for e epochs. Moreover, F can be various train- ing methods tailored to the corresponding data format, as shown in Figure 1. The function RETRIEVEPOINT((A.. t) returns the model point along YA.B at index t, as described in Equation (2). See more details in Appendix F.
0z. D. OPT) in
4.2. Clean Accuracy Recovery
To ensure that the purified model maintains better perfor- mance on benign data, we re-align the model O, found on Yi to the benign loss basin of the backdoored model Oado. We denote the corresponding permutation set Pt. Fur- thermore, empirically, when setting ( = 0.4, the model O, typically exhibits higher loss on both poisoned and benign samples. We then train another curve 7/2 connecting 0anr and 00= = x (0. S(P)). The right side of Figure 2 shows that the loss of poisoned samples gradually increases
4.3. Theoretical Analysis of TSC
We consider two feedforward neural networks, as defined in Equation (3), with weights O, and 0,. We say that Op and 0, are Lg-norm-consisse if they satisfy the following condition:
5

---

Circumventing Backdoor Space via Weight Symmetry
ASR of the 1st Stage
ASR of the 2nd Stage
ASR of MCR
ACC the 1st Stage
ACC the 2nd Stage
ACC of MCR
Ersc
Ersc 2
Ersc
Ersc -
Ersc
Ersc =
100
02-
Tout ASR//1
80
60
Than NOCINA
00-
75
40-
60
40
70
20
20
0.50
0.25
0.50
0.75
1.50
0.00
0.25
0.30
0.75
1.00
0.00
0.25
0.50
0.75
1.50
0.00
0.23
0.30
0.75
1.00
0.50
0:25
0.50
0.73
1.00
0.00
0.25
0.30
0.75
3.00
(Sellings] Dalasel: CIFAR1O, Model Architeclure: Prekct-ResNelB,, Allack: SSBA, Polsoning Rate: 5%
Figure 3. Test attack success rate (ASR) and accuracy (ACC) on benign samples are evaluated as functions of the points along the Bézier curve found by MCR and TSC. We assess the performance against SSBA CIFAR-10 with 5% poison rate using PreAct-ResNet1 8. We select model points along the curve at t 0.4 for each stage and round. Since MCR only trains a single curve for model purification, we plot the results of MCR each round of TSC for better comparison.
Algorithm Ttae Symmetry Connectivity
(t). Similarly, we can reformulate Yea.c (t) to To reformulation allows us to express the Bézier curves in a considerably simpler form, thus facilitating theoretical anal- ysis. The detailed derivation is provided in Equation (14). Moreover, we refer the quantity M (O OB; D), de- fined in Equation (6), which measures the L2 norm of the feature distance at the 1th layer between models O and O3 for given dataset D. We can then derive the following theorem:
Such
Require: backdoored model 0 aude clean dataset De, global epoch Ersc, curve index i, curve training epoch e, train- ing method F;
Ensure: purified model pp: Initialize 6, + iudoi
for i to Ersc do
D Adversarial Loss Amplification
0g PERMUTELAYERS(6. 0p. De, MAX);
ye P.2l
+ FITQUADCURVE((A. ,p, F, Do,e);
Theorem 4.2. We assume that the activation function a in Equation (3) and the loss function L in Equation (1) are Lipschitz continuous. Let Tā (1) and Tox. (1) be two Bézier curves defined in Equation (9), Then, under the following conditions:
0, + RETRIEVEPOINT(T0, p.p! t);
> Clean Accuracy Recovery
0,- + PERMUTELAYERS 02, De, MIN);
y0, < FITQUADCURVE F. FD,,. D),
8 < RETRIEVEPOINT(Te,. t):
end for
(1) Mi 0B; D) S Mi(Os, D). VI E (1,2,...... L}; (2) 0B and Oc are L2-norm- -onosst-onnsstten:: (3) θA,B and A are fa-normm-cnnisteen there exists upper bounds UA and U A,C. for E(-) such that: ((0 S UA,B ((0,.c) S UAC., where UA,B S UA.C.
Definition 4.1 (Weight L2-norm consistency condition). Let WT and Wtt be the parameters of the 7th layer of 6, and 01, respectively. We define that the parameters satisfy the condition that the La norms of the corresponding layer weights are equal: ||W = || VI E {1,2, L}. where the L2 norm of the matrix refers to the element-wise L2 norm (i.e,, Frobenius norm).
Proof. See Appendix E.I.
A similar theorem can be found in (Tatro al., 2020). is important to note that the theorem demonstrated in (Tatro et al., 2020) provides only the upper bound relations be- tween linear paths connecting aligned and unaligned mod- cls, despite Tatro et al. (2020) claiming that their theorem pertains to quadratic Bézier curves. Moreover, their the- orem represents only the left inequality of Corollary 4.3, which is special case of Theorem 4.2 and is insufficient for theoretical analysis of TSC.
This condition implies that the magnitude of the weights in each layer is preserved between the two models. Conse- quently, both models effectively operate at the same scale, which can be critical for their comparative performance.
Next, considering three optimal independent feedforward networks with weights A, On and 0c, we can present a theorem regarding the upper bounds of the loss f(() in Equa- tion (1) over the quadratic curves .o... (t) and ~e,,c (t) across dataset D. Before stating the theorem, we first refor- mulate the parametric Bézier curve 70 (t) by replacing AABB with its deviation ÒA.B:
Increasing the Adversarial Loss. Now, redirect focus to our method and compare the scenarios where one endpoint is fixed by model 0 while the other is settled by 0g. 0 = π (0 p. S(P) or 0. = (0 S(P))) S(P) and S(P') correspond to the solutions in problems (6) and (8), respectively. Then, we have the following corollary:
Toan n (t) (1 A
A + 10 20(1 A.
6

---

Circumventing Backdoor Space via Weight Symmetry
Corollary 4.3. We assume that the activation function fnnncttooonnnniionn and the loss function L are Lipschitz continuous. Let Yoa,,. n (t), "ā 'o, (1) and ,. (!) be three Bézier curves defined in
ond stage exhibit significantly lower ASR than MCR while maintaining moderate ACC decline compared to the first stage. These observations support our theoretical analysis.
Equation (9). We also assume that AA,B, O A. and O A,, are La-norm-consistr upper bounds U.B. U UA,B and UA,B for E(-) such that:
5. Experiments
with each other. Then, there exists
5.1. Experimental Settings
UA S AUABB B.BB. S UA
Attack Setup. (1) Supervised Learning. We consider
Proof. See Appendix E.2.
eleven typical backdoor attacks, including eight label- flipping attacks (BadNee (Gu et al., 2017), Blended (Chen et al., 2017), SSBA (Li et al., 2021c), LF (Zeng et al., 2021), WaNet (Nguyen & Tran, 2021), Inputaware (Nguyen & Tran, 2020), SBL (Pham et al., 2024) and SAPA (He et al., 2024)) and three clean label attacks (LC (Turner et al., 2019), SIG (Barni et al., 2019) and Narcissus (Zeng et al., 2023)). These attacks are conducted on CIFAR1O (Krizhevsky, 2009) us- ing 8 (He al., 2016a) and Iet (Deng et al., 2009) using ResNer50 (He et al., 201 with various poisoning rates. (2) Self-Supervised Learning. We evaluate two self-supervised learning attacks: BadEncoder (Jia et al., 2022) and CTRL (Li et al., 2023). BadEncoder is conducted using two typical SSL training methods, SimCLR (Chen et al., 2020) and CLIP (Radford et al., 2021). For Sim- CLR, we utilize publicly available backdoored ResNet18 and ResNet50 encoders on CIFAR1O and ImageNet, respec- tively, evaluating ACC and ASR through linear probing (Alain & Bengio, 2017) on downstream datasets STL10 (Coates et al., 2011), GTSRB, and SVHN (Netzer et al., 201 1). For CLIP, following (Jia et al., 2022), we fine-tune a pre-trained CLIP ResNet50' on ImageNet100 using Sim- CLR to inject backdoors. and assess performance through linear probing and zero-shot evaluation on STL10, Food 101 (Bossard al., 2014), and VOC2007 (Everingham et al.). The CTRL attack is evaluated using the same SimCLR set- tings. Implementation details are provided in Appendix L.
Intuitively, to increase the loss with respect to poison sam- ples along the curve, we can project the copy of backdoored model add to loss basin different from that of the origi- nal. Theoretically, Corollary 4.3 implics that applying the permutation by S(P") can enlarge the upper bound of the backdoor loss over the curve, resulting in more robust model on the curve when faced with attack samples.
However, Corollary 4.3 also indicates that permuting the layers via S(P",, leads to a looser upper bound for the loss on benign samples compared to models that reside in the same loss basin. Therefore, an extended method is needed to ensure that the purified model maintains strong performance on clean samples.
Reducing the Clean Loss. In the second stage, we train another curve connecting the origianl backdoored model and re-aligned model found previously. As demonstrated in Corollary 4.3, re-aligning the model found on the curve to the original loss basin of the backdoored model can reduce the upper bound of loss value along the curve. When align- ing the model with benign samples, the curve is more likey to be trained in a loss basin of benign data rather than poi- soned ones. Thus, the second stage successfully improves the performance on benign task.
Moreover, let Oudu+ be model satisfies the follow- ing three conditions: (1) it is aligned with oado; (2) it is (3) it achieves higher accuracy on the poisoned dataset Dade than 00.=0.4. Also, consider a curve Vade that connects Oudox and Oade. We can say that the 2- Wasserstein distance (2PPP adv IP, adux; Dade) is smaller than (TP, adu, ,T,," 1P,=0.4; Dudv) for each layer, as Oudv is more functionally identical to Oadv over Dadv. Thus, we have Mi(Oude Oudvx; Dade) < Mf(dadr 0y-=0.1; Dedv). According to Theorem 4.2, if the parameters of Yado and 722 are fy--oorm-consiteen we conclude that the upper bound of 72 is higher than that of Yndo over the poisoned dataset. This finding implies that a high loss can be maintained for poisoned samples along the curve 7/2-
with the model =0-=0.; and
Defense Setup. In our experiments, we focus on post- purification defenses methods and provide all defenses with 5% of the clean training dataset, except for the defenses for the CLIP model. To address the backdoored CLIP visual model, we employ the entire MS-COCO dataset (Lin et al., 2014). (1) Supervised Learning. We evaluate six post- purification defenses methods as baselines: FP (Liu et al., 2018), NC (Wang et al., 2019), MCR (Zhao et al., 2020), ANP (Wu & Wang, 2021), FT-SAM (Zhu et al., 2023), I- BAU (Zeng et al., 2022), and SAU (Wei et al., 2023). For
TSC, we set the global epoch Ersc = 3, curve index = 0.4, and curve training epoch 200. (2) Self-Supervised Learning. We consider MCR (Zhao et al., 2020) and SSL-
Figure 3 compares model performance along curves iden- tified by MCR and TSC. For each epoch of TSC, as t ap- proaches 0.5, both ACC and ASR of model points from the first stage decrease more rapidly than those of MCR and TSC's s second stage. Besides, model points from the sec-
hntpps//github..om//ppo cow/opena//LLLP
AA the dataset used to train CLIP (Radford et al., 2021) is not publicly available and involves 400M images, we conduct defenses with the much smaller MS-COCO-2017 dataset (Lin al., 2014), which contains approximately 120K images with 5 captions each.
7

---

Circumventing Backdoor Space via Weight Symmetry
Table 1. Results on CIFARIO and ImageNet100 under supervised learning scenarios. Attack Success Rates (ASRs) below 15% are highlighted in blue to indicate successful defense, while ASRs above 15% are denoted in red as failed defenses.
Alaaka
Poison
Deferse
ANP
FT
L-BUU
TSC (ours)
ACEETS
ASK(L
ACC11)
ASRL1
ADC(T)
ASRLL
ACC0()
ASRL1)
(400/7)
AS5R(1)
ASR(L
(ACD1)
ASBLL
ACCD1)
ASR(L)
ACC11)
ASRLL)
BodtNrr
5%
1%
95.14
92.64
B8.74
74.73
92.59
92.36
3.29
1.37
92.07
90.53
0.77
1.01
92.90
92.17
18.05
7.52
83.92
96,45
0.04
0.02
92.39
92.19
3.50
1.57
67.80
88.65
0.92
2.20
$9.32
65.35
2.06
1.74
90.71
59.19
1.26
1.50
Biended
19.61
93.57
03:25
18.70
10.17
10.55
1%
95.76
04.35
92.92
09.24
93.76
94.85
93.62
95.10
$9,60
60.52
93.00
49.36
89.02
25.74
90.02
36,16
91.12
12.46
I.2
3%
93.36
98.03
92.4
99.12
90.88
2.45
03.37
97.32
$4.30
2.46
92.59
7.44
88.64
45.66
50.60
1.71
$6.50
3.78
91.56
41.09
90.51
11.67
CIPAR30
SSBA
5%
95.27
94.91
92.55
16.27
93.27
94.11
92.94
92.05
55.72
0.13
92.71
2.87
19.65
1.54
91:30
2.06
59.43
2.18
116
95.43
73.44
95.01
7.68
91.64
0.46
43.35
05.55 16
35.35
0.31
93302
1.09
19.55
4.87
91.35
0.55
91.18
2.18
90.79
93.45
92.59
92.22
92.26
91.82
51.63
90.67
91.31
0.00
1.12
1%6
91.71
83.64
93.10
51.27
91.82
0.72
93.23
16.11
82.71
$1.48
92.77
59.53
90.63
2.00
92.90
1.01
91.54
1.83
SAPA
116
96.01
09.07
96.54
00.23
91.80
2.14
91.83
100000
$0.06
92.06
91106
79.80
30.00
15:17
91.81
1.90
50.57
7.41
$4.80
62.76
92.74
93.78
51.52
90.15
91.75
0.68
7.32
LC
95.31
06.33
92.19
72.99
02:32
91.94
99.94
88.15
13.63
92.39
57.18
90:15
91.33
1.50
90.04
2.38
196
95.79
75.05
92.86
29:86
43.31
0.68
91.67
$2.54
86.18
11:46
99.81
19.40
89.74
0.71
92.16
3.77
50.08
5.78
Narcisuu
95.64
K2.87
92.29
44:85
93.00
03.51
49:79
27.01
95305
90.23
91.36
3.24
90065
7.88
0.5%
93.63
60.55
92.94
20.59
93.67
32.57
93.59
32.96
89.35
16.78
93.05
14.08
89.16
21.09
91.74
5.81
91.71
8.02
BodtNer
0.5%
$4.56
$4.30
99.36
99.75
$5.30
9.50
91.92
$1.92
0.52
85.06
85.24
99.05
78.44
93.64
94,18
63.70
24.14
9.45
71.46
73.70
6.34
72.84
73.86
0.33
0.26
50.20
0.14
0.22
Wleneed
0.9%
94.13
$2.00
61:25
84.44
04.31
85-38
97
14.15
93.22
81.00
25.45
14.21
61.14
7134
3.72
76.55
12.6
196
$4.10
96.04
$3.36
01:21
80.21
70
85.04
97.54
$4.54
97.70
K3386
82.00
73.10
61.25
54.24
0.53
75.54
6.35
I.
0.5%
$4.24
98.87
50.26
$4.24
97.70
36.20
70.48
74.35
75.22
0.18
5.39
196
$3
99.56
83.00
76.76
49.87
85.30
99.07
81.10
56.53
83.40
20.59
71.05
21.32
57.58
2.93
78.54
5.41
SSBA
0.5%
$4.30
15.31
$5.54
46.75
$4,30
95.31
85.34
95.13
R0,56
6.18
K3.16
15.70
71.53
1.19
76.13
0.89
79.50
1.45
99.43
75:47
85.14
97.72
22:77
72.55
73.94
0.36
-Ntemdod
0.5%
07.56
35.10
80.29
13.53
97.56
81.54
92:63
15.35
07:05
83:4
89.07
70.75
73.06
14:57
7.18
196
72.68
09.17
$3.41
68.24
71.42
70.14
82.52
95.75
72.72
99:15
63.92
92.69
73.52
20.30
76.76
39.29
77.16
8.67
SAPA
0.594
35.04
96.33
K3.4
20:53
18.57
4.20
85.50
95.05
19:41
96. 94
K1322
30.04
09.33
18.14
15.51
1.02
79:00
1.7g
$5.50
96.83
27:66
77.42
M5.42
K3.12
93.76
09:12
75.43
1.23
78.14
1.41
14:
0.5%
1.6
$4.22
$4.10
$2.97
0.61
93.34
$3.48
0.20
4.78
$1.13
84.22
0.61
0.42
85.48
85.04
76.75
0.93
84.22
$4.48
32.42
0.57
63.58
63.86
8.06
0.24
73.52
69.72
0.36
1.76
70.55
76.20
0.79
0.16
50.18
30.36
0.57
0.22
$3.30
16:33
1.32
78.43
85.18
15.00
10.75
0.11
196
$4.16
70.08
$3.40
20.48
79.58
0.89
85,02
77.84
90.40
65.68
83.36
44.81
70.95
19.98
73.76
0.30
30.22
9.98
Cleanse (Zheng et al., 2024) as baselines. For TSC, we set the global epoch Ersc 2, curve index t = 0.25, and curve training epoch e = 200 for both SimCLR and CLIP. Comprehensive settings for all defenses are provided in Appendix L. For the following experiments, we consider a defense against an attack successful if the ASR is reduced
their performance diminishes on ImageNet100, particularly against Blended, Inputaware and LF attacks. While TSC oc- casionally yields lower initial task accuracy than FT-SAM, it outperforms ANP and I-BAU in most cases.
To further explore the impact of TSC on ACC, we provide results for ACC drops on non-backdoored models in Ap- pendix K. These results indicate that the ACC drop for TSC is acceptable in scenarios without data poisoning.
to below 15%
5.2. Results for Supervised Learning
Table compares the performance of TSC with existing defenses on CIFARIO and ImageNet100 under supervised leamning scenarios. Comprehensive results for GTSRB and of other attack settings are provided in Appendix I.
5.3. Results for Self-supervised Learning
Tables 2 and 3 show the results against BadEncoder attacks under SimCLR and CLIP training scenarios, respectively. We employ different settings for SimCLR and CLIP to showcase the flexibility of TSC. For SimCLR, encoders are trained and backdoored independently with specific target labels for each downstream task. For CLIP, we backdoor a single visual encoder using 'truck' as the target label/caption and evaluate performance before and after defenses across downstream tasks. Since Food 101d101 and VOC2007 lack the 'truck' label, we augment their training sets with truck im- ages from 10 for evaluation of linear probing. Results indicate the attack remains effective even without targeting specific downstream datasets. More results for CTRL attack and SSL- -SL-CCeanse are provided in Appendix J.
It's clear that TSC successfully reduces the ASR to below 15% for all attacks on CIFARIO GTSRB and ImageNet100, demonstrating its robustness and effectiveness. Among all attacks, Blended attack with small poisoning rates proves most challenging to defend against. While other defenses struggle to contain ASRs below 25%, TSC reduces the ASR to 12.46% on CIFARIO (1% poisoning rate) and 12.63% on ImageNet1 00 (0.5% poisoning rate). SAU shows strong backdoor removal capabilities against most attacks but suf- fers from ACC instability. For example, under BadNet Attack with 1% poisoning rate on CIFARIO, SAU'S accu- racy falls below 70%. We attribute this behavior to SAU'S aggressive unlearning strategy, which leads to catastrophic decreases in both ACC and ASR. ANP, FT-SAM, and I-BAU also demonstrate effectiveness, reducing ASRs to below 15% for most attacks on CIFAR10 and GTSRB However,
Under SimCLR, while MCR successfully removes back- doors targeting STL1O and GTSRB downstream tasks, it fails against attacks targeting the SVHN dataset. In con- trast, TSC effectively reduces the ASR to below 11% across
8

---

Circumventing Backdoor Space via Weight Symmetry
Table 2. Defense results under SimCL R training scenario, where linear probing used evaluate the downstream tasks.
advanced attacks, including SBL (Pham al., 2024), Narcis- sus (Zeng al., 2023), and SAPA (He et al., 2024). These modern backdoor attacks aim to optimize flatter loss land- scapes or entangle benign and backdoor features. The results demonstrate that TSC effectively reduces the ASR to below 15% even against these sophisticated attacks.
Pre-traiming Pattsset
Downddream Dataset
No Defense
MCR
TSC (vMrs)
ACCXT)
ASR(()
ACC(T)
ASR(L)
ACC(T)
ASR())
STT.10
76.74
99.65
74.93
7.92
71.11
4.44
CIFARIO
GTSRB
75.51
77:57
SVHN
63.12
98.71
57.35
65.58
64.13
10:26
STLIO
90.20
66.99
ImageNNet
GTSRR
75.94
99.76
72. 28
0.13
69:47
6.47
5.5. Ablation Studies
SVHN
72.64
71.27
66.44
3.64
We conduct comprehensive ablation studies to analyze the impact of TSC's key hyperparameters: the number of global epochs Ersc and the curve index t. Through extensive experiments, we find that increasing / (up to 0.5) and Ersc improves backdoor removal performance but meanwhile reducing accuracy on benign samples. Moreover, a larger Ersc leads to more stable performance. Based on empir- ical results, we recommend = 0.4 and Frsc 3 for supervised learning scenarios, and t 0.25 and Ersc = 2 for self seff-supervised learning. Detailed analysis and addi- tional experimental results can be found in Appendix H.I.
Table Defense results under CLIP training scenario, where lin- car probing and zero-shot learning are used to evaluate the down-
stream tasks.
training Dutese
Downetrcam Dataset
No Defease
MCR
TSC (ours)
ACC()>
ASR(1)
AOC(1)
ASR(
ACC(1)
ASR(()
CLIP (lincar prolec
Food101
STLI0
97.07
72.58
99.33
97.91
96.43
72.36
99:86
96.62
91.15
69.33
0.67
1.04
VOC 2007
76.07
99.83
75.47
99.92
78.42
0.34
(2ero-shox)
CLIP
Food101
STL,0
94.06
67.72
99.96
99.86
66.51
91.51
99.56
99:85
61.69
90.25
0.28
0.88
VOC
71,22
70.09
99.12
75.08
all downstream tasks. For CLIP, TSC achieves remarkable performance, reducing ASR below 2%, while MCR proves ineffective against BadEncoder attacks.
To validate the stability of TSC, we conduct experiments with VGG19-BN (Simonyan & Zisserman, 2014) and In- ception (Szegedy et al., 2016) on CIFARIO. Results in Appendix H.2 show the robustness of TSC across different model architectures.
5.4. Resistance to Potential Adaptive Attacks
The previous experiments demonstrate the effectiveness of TSC against existing backdoor attacks. However, it is es- sential to consider adpative attacks against TSC. The core defense mechanism of TSC relies on increasing adversarial loss along the quadratic Bézier curve by projecting model Ondo to a distinct loss basin to find Ondy' during the first stage. An adaptive attack would attempt to train and back- door a model that maintains low backdoor loss along the curve identified by TSC.
We opt to use the same t for both stages to maintain a simpler parameter design. Employing distinct t values for each stage would lead to numerous parameter combinations, potentially complicating the algorithm's 's overall structure. Moreover, as shown in Figure 3, the ACC/ASR values in the first stage exhibit roughly symmetric pattern with respect to I, whereas in the second stage, they decrease as /. increases. Although the overall trends for the two stages differ across ( E [0, 1]. they both demonstrate a decreasing tendency within t E [0, 0.5). Notably, in Stage 2, ASR decreases effectively while ACC remains high for t values near 0.5. Considering this observation from Stage 2, the symmetry in Stage 1, and the consistent trend within E [0, 0.5), we suggest selecting t from this range for both stages.
To design such adaptive attack, we build upon the neural network subspace learning approach proposed in (Wortsman et al., 2021), originally developed for improving accuracy and calibration. Our strategy involves simultaneously train- ing a curve and updating its endpoints Oudo and Oudv' using the mixture of benign and poisoned data (i.e. learning a backdoored subspace). After training, we select one end- point as the final model. We convert all previously evaluated attacks into adaptive versions under both supervised and self- supervised learning settings. Experimental results reveal that TSC remains robust against such attack. The implemen- tation details and results are provided in Appendix G.
6. Conclusion and Limitation
In this paper, we propose TSC, a novel defense mecha- nism leveraging permutation invariance. Unlike previous post-purification defenses, TSC utilizes weight symmetry to remove backdoors and is applicable to both supervised and self-supervised learning scenarios, with potential extensions to other learning paradigms. Our experiments demonstrate the robustness of TSC under diverse attack settings, achiev- ing comparable or superior performance to existing defenses. However, TSC occasionally trades off accuracy on benign samples for backdoor removal. Future work could focus on optimizing such trade-off to maintain high ASR reduction while improving ACC.
To further validate the robustness of TSC against adaptive attacks, we present corresponding loss landscape visual- izations in Appendix G.3. The analysis reveals that the combination of the permutation mechanism and training exclusively with benign samples contributes to amplifying the loss on poisoned samples, even for adaptive attacks. Moreover, given that our defense involves the concept of loss landscapes, we also conduct experiments against more

---

Circumventing Backdoor Space via Weight Symmetry
Acknowledgements
Chai, S. and Chen, J. One-shot neural backdoor erasing via adversarial weight masking. In Thirty-Sixh Confer- ence on Neural Information Processing Systems (NeurIPS 2022), 2022.
This work was supported in part by the National Key Re- search and Development Program of China (Grant No. 2024YFB3INL00101,, the National Natural Science Foun- dation of China (Grant No. U22A2036), and the Na- tional Natural Science Foundation of China (Grant No.
Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Ed- wards, B., Lee, T., Molloy, I., and Srivastava, B. Detecting backdoor attacks deep neural networks by activation clustering. ArXiv, abs/1811 1.03728, 2018.
62472122).
Impact Statement
Chen, T., Kornblith, S., Norouzi, M., and Hinton, G. A simple framework for contrastive learning of visual rep- resentations. In Proceedings of the 37th International Conference on Machine Learning, volume 119 of Pro- ceedings of Machine Learning Research, pp. 1597-1607. PMIR, 2020. URL https: http:s::/poooeeddeeee mml.. press/v119// wttp://cccccccccceee.e
This paper aims advance the field of Machine Learning Security by proposing novel purification method for re- moving implanted backdoors. The potential societal benefits include providing framework for eliminating backdoor be- havior across various machine learning scenarios, thereby enhancing model security. However, new attacks target- ing our method may emerge in the future. Further work is needed to validate the effectiveness of our approach on a broader scale.
Chen, X., Liu, C., Ci, B., Lu, K., and Song. D. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv: arXiv:1712.005: 17l..05522.. 2017.
References
Coates, A., Ng. A., and Lee, H. An analysis of single- layer networks in unsupervised feature learning. In Pro- ceedings of the Fourteenth International Conference on Artificial Intelligence and Statisties, volume 15 of Pro- ceedings of Machine Learning Research, pp. 215-223, Fort Lauderdale, FL, USA, 11-13 Apr 2011. PMLR. URL https://ppoceeeddng .mr. press saaresssv55 vv15/ coateslla.htm.
Ainsworth, S., Hayase, J., and Srinivasa, S. Git re-basin: Merging models modulo permutation symmetries. In The Eleventh International Conference Learning Represen- tations, 2023. URL https: /ttps:://pppenee wptp//ppee.e....eee/ forum? 1 d=CQsmMYm1PPT.
Alain, G. and Bengio, Y. Understanding intermediate layers using linear classifier probes, 2017. URL https: openreview beeenreveewnet//foreee www.ruuuumu/eeee id=
Deng. J., Dong, W., Socher, R., Li, L.-.,, Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE Conference Computer Vi- sion and Puttern Recognition, pp. 248-255-25 2009. doi: 10. 200.CCCVR..200.5206666
Barni, M., Kallas, K., and Tondi, B. A new backdoor attack in cnns by training set corruption without label poison- ing. In 2019 IEEE International Conference on Image Processing, pp. 101-105, 2019.
Draxler, F., Veschgini, K., Salmhofer, M., and Hamprecht, F. Essentially no barriers neural network energy land- scape. In Proceedings of the 35th International Confer- ence Machine Learning, volume 80, pp. 1309-1318. PMLR, 10-15 Jul 2018
Bober-Irizat, M., Shumailov, I., Zhao, Y., Mullins, R., and Papernot, N. Architectural backdoors in neural networks. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), pp. 24595- 24604, 2023.
Entezari, R., Sedghi, H., Saukh, O., and Neyshabur, The role of permutation invariance in linear mode con- nectivity of neural networks. In International Confer- ence Learning Representations, 2022. URL https: / //openreview.o net. httee/oorrmmiidddiiitttettttttee
Bossard, L., Guillaumin, M., and Van Gool, L. Food-101 mining discriminative components with random forests. In European Conference on Computer Vision, 2014
Carlini, N. and Terzis, A. Poisoning and backdooring contrastive learning. In International Conference on Learning Representations, 2022. URL https:// openreview www.rrvviw.net/forrrre www.://en///nniieeeeoo hett///ouumm//---0000000OOOO.
Everingham, M., Van Gool, L., Williams, C. K. I., Winn, J., and Zisserman, A. The PASCAL Visual Object Classes Challenge 2007 (VOC2007) Results. htt:://www.pascal- hatpookwww//aalggesee//////////a
Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., and Tramèr, F. Poisoning web-scale training datasets is practical, arXiv preprint arXiv:2302. 10149, 2023.
Feng, S., Tao, G., Cheng, S., Shen, G., Xu, X., Liu, Y.. Zhang, K., Ma, S., and Zhang, X. Detecting backdoors in pre-trained encoders. 2023 IEEE/CVE
10

---

Circumventing Backdoor Space via Weight Symmetry
Conference on Computer Vision and Putlern Recog- nition (CVPR), pp. 16352-16362, 2023. URL
He, K., Chen, X., Xie, S., Li, Y., Dollár, P., and Girshick, R. Masked autoencoders scalable vision learners. In Pro- ceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR), pp. 16000-16009, June 2022.
bttps://doi.. http::///b....eeecmmme http://dl..eeeccoppttrrroree./ 10. 10.1109/ www.:1///VV922222..220
Foret, P., Kleiner, A., Mobahi, H., and Neyshabur, B. Sharpness- aware minimization for efficiently improving generalization. In International Conference on Learning Representations, 2021.
He, P., Xu, H., Ren, J., Cui, Y., Zeng. S., Liu, H., Aggarwal, C., and Tang, J. Sharpness-aware data poisoning attack. In International Conference on Learning Representations, 2024.
Frankle, J., Dziugaite, G. K., Roy, D., and Carbin, M. Lin- ear mode connectivity and the lottery ticket hypothesis. In Proceedings of the 37th International Conference on Machine Learning, volume 119, pp. 3259-3269. PMLR, 2020. URL https: htt.ttttsppppoceeeiiiiiee pttpeeeecceeeese.ccoo www.mmll.p.prr.... mll.pprss/ v119 h119/fraakle200 html.
Hou, L., Feng, R., Hua, Z., Luo, W., Zhang, L. Y., and Li, Y. IBD-PSC: Input-level backdoor detec- tion via parameter-oriented scaling consistency. In Proceedings of the 41st International Conference on Machine Learning, pp. 18992-19022. PMLR, 2024. URL URL httt:t/::/// httphttpp//prroceemiiggeee http://poooeeeng.ceeeeee/o ml wtt.eeeeddnnssmm....e...... v235 2235/hou2440 html.
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., and Nepal, S. Strip: A defence against trojan attacks on deep neural networks.
Proceedings of the 35th Annual Computer Security Applications Conference, pp. 113-125, 2019. ISBN 9781450376280.
Houben, S., Stallkamp, J., Salmen, J., Schlipsing, M., and Igel, C. Detection of traffic signs in real-world images: The German Traffic Sign Detection Benchmark. In Inter- national Joint Conference on Neural Networks, number 1288, 2013.
Garipov, T., Izmailov, P., Podoprikhin, D., Vetrov, D. P., and Wilson, A. G. Loss surfaces, mode connectivity, and fast ensembling of dnns. In Advances in Neural Information Processing Systems (NeurIPS 2018), volume 31. Curran Associates, Inc., 2018.
Jia, J., Liu, Y., and Gong, N. Z. BadEncoder: Backdoor attacks to pre-trained encoders in self-supervised learning. IEEE Symposium on Security and Privacy, 2022.
Gotmare, A. D., Keskar, N. S., Xiong, C., and Socher, R. Us- ing mode connectivity for loss landscape analysis. ArXiv, 2018.
Jordan, K., Sedghi, H., Saukh, O., Entezari, R., and Neyshabur, B. REPAIR: REnormalizing permuted tivations for interpolation repair. In The Eleventh In- ternational Conference on Learning Representations, forum?
Gu, T., Dolan DolintGavitt, B., and Garg, Badnets: Identify- ing vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv: h 708.067373333 2017.
2023, URL 1 @==gU5sJ67ggcx
Guo, J., Li, Y., Chen, X., Guo, H., Sun, L., and Liu, C. SCALE-UP: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. In The Eleventh International Conference on Learning Representations, 2023, URL https: /tte::///ppeeee oppnreview..e net forum? wtt F=0.FF
Khaddaj. A., Leclere, G., Makelov, A., Georgiev, K., Salman, H., Ilyas, A., and Madry, A. Re- thinking backdoor attacks. In Proceedings of the 40th International Conference ing, volume 202 of Proceedings of Machine Learn- ing Research, pp. 16216-16236. PMLR, 23-29 Jul 2023. URL https: hwtptttt:////oeeeeeee http///peocccecspeeeeeeeeees..ee mil.ppress. v202 /khadda 22a.. html.
Machine Learn-
Hayase, J., Kong, W., Somani, R., and Oh, S. Spectre: de- fending against backdoor attacks using robust statistics. In Proceedings of the 38th International Conference on Machine Learning, volume 139 of Proceedings of Ma- chine Learning Research, pp. 4129 413999139, PMLR, 18-24 Jul 2021.
Kirkpatrick, J., Pascanu, R., Rabinowitz, N., Veness, J., Des- jardins, G., Rusu, A. A., Milan, K., Quan, J., Ramalho, T., Grabska-Barwinske. A., Hassabis. D., Clopath, C., Ku- maran, D., and Hadsell, R. Overcoming catastrophic for- getting in neural networks. Proceedings of the National Academy of Sciences, 1 114(13):35113322 2017. doi: 10. 1073/pnas. 161 1835114. URL https: /tt:://wwwww /twp//wwwwwp///t/po///////. www.wpw......................... .nas. org hts:/doi/aan abs /10. 1073 //p...aa...... 1611835114.
He, K., Zhang, X., Ren, S., and Sun, J. Identity mappings in deep residual networks. ArXiv, (00111003000220 2016a.
He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp- 770-778, jun 2016b.
Krizhevsky, A. Learning multiple layers of features from tiny images. 2009.

---

Circumventing Backdoor Space via Weight Symmetry
Kuhn, H. W. The hungarian method for the assignment problem. Naval research logistics quarterly, 2(1-2):83-- 97, 1955.
Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., and Ng. A. Y. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsuper- vised Feature Learning 2011, 2011. URL http:
Li, C., Pang, R., Xi, Z., Du, Ji, S., Yao, Y., and Wang, T. An embarrassingly simple backdoor attack on self- supervised learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 4367-4378, October 2023.
/ //ufldl. stanford. htw.u//houueuubbrss.... .ddf.
Nguyen, T. A. and Tran, A. Input-aware dynamic backdoor attack. In Advances in Neural Information Processing Systems (NeurlPS 2020), volume 33, pp. 3454-3464. Cur- ran Associates, Inc., 2020.
Li, S., Xue, M., Zhao, B. Z. H., Zhu, H., and Zhang, X. Invisible backdoor attacks deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, 1422088-105, 2021a.
Nguyen, T. A. and Tran, A. T. Wanet imperceptible warping- based backdoor attack. In International Confer- ence on Learning Representations, 2021. https:
Li, Y., Yosinski, J., Clune, J., Lipson, H., and Hopcroft, Convergent learning: Do different neural networks learn the same representations? In Proceedings of the 1st International Workshop on Feature Extraction: Modern Questions and Challenges NIPS 2015, vol- ume 44 of Proceedings of Machine Learning Research, pp. 196-212 Montreal, Canada, 11 Dec 2015. PMLR. URL www.thtps:// http://oooeddnnnddl// press//4r 1i15convergent html.
/ /oopenreveew.oo net wiw.mmittdedeeeee....
Pan, M. Zeng, Y., Lyu, I.., Lin, X., and Jia, R. ASSET: Robust backdoor data detection across a multiplicity of deep learning paradigms. In 32nd USENIX Security Symposium (USENIX Se- curity 23), pp. 2725-2742, Anaheim, CA, 2023. USENIX Association. ISBN 978-1-939133-37-33
URL httptt/s:///wwt wwtp://wwwwwwww...o/// www.useeni..... wwwp///wwww.ggoooeeeeennc..mmmee ueenixseourity33/preeettaaooo
Li, Y., Koren, N., Lyu, L., Lyu, X., Li, B., and Ma, X. Neu- ral attention distillation: Erasing backdoor triggers from deep neural networks. ArXiv, abs/2101.05930, 2021b.
Pang, R., Shen, H., Zhang, X., Ji, S., Vorobeychik, Y., Luo, X., Liu, A. X., and Wang. T. tale of evil twins: Adversarial inputs versus poisoned models. Proceedings of the 2020 ACM SIGSAC Conference Computer and Communications Security, 2019.
Li, Y., Li, Y., Wu, B., Li, L., He, R., and Lyu, S. Invisible backdoor attack with sample-specifie triggers. In IEEE International Conference on Computer Vision (ICCV), 2021c.
Pham, H., Ta, T.-A., Tran, A., and Doan, K. D. Flatness- aware sequential learning generates resilient backdoors. In Computer Vision ECCV 2024, pp. 89-107, Cham, 2024. Springer Nature Switzerland.
Li, Y., Lyu, X., Koren, N., Lyu, Li, backdoor learning: Training clean models on poisoned data. Advances Neural Information Processing Systems (NeurIPS 2021), 34: 14900-149912, 2021d.
Li, B., and Ma, X. Anti-
Qi, X., Xie, T., Li, Y., Mahloujifar, S., and Mittal, Revis- iting the assumption of latent separability for backdoor defenses. In The Eleventh International Conference Learning Representations, 2023.
Lin, T.-Y, Maire, M., Belongie, S., Hays, J., Perona, P., Ra- manan, D.,, Dollár, P.. and Zitnick, C. L. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740- 755. Springer, 2014.
Radford, A., Kim, W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, I. Learning trans- ferable visual models from natural language supervi- sion. In Proceedings of the 38th International Confer- ence on Machine Learming, volume 139 of Proceedings of Machine Learning Research, pp. http///oooeeeeceoeoooo ngs. mag..m. ml .prsss//
Liu, K., Dolan Gavitt, B., and Garg, S. Fine-pruning: De- fending against backdooring attacks on deep neural net- works. In RAID, 2018
Loshchilov, I. and Hutter, F. Sgdr: Stochastic gra- dient descent with warm restarts. arXiv preprint arXiv:1608.03998. 2016.
PMLR,
2021. URL htttst/:::/ htt..ttttpss://prreeeee v139/ rtw.orrdfoddaaaaaaaoaa html.
Min, R., Qin, Z., Shen, L., and Cheng, M. Towards stable backdoor purification through feature shift tuning. In Thirth-seventh Conference on Neural Information Pro- cessing Systems, 2023.
Saha, A., Subramanya, A., and Pirsiavash, H. Hidden trigger backdoor attacks. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp. 11957 11965, 2020.
12

---

Circumventing Backdoor Space via Weight Symmetry
Saha, A., Tejankar, A., Koohpayegani, S. A., and Pirsiavash, H. Backdoor attacks self-supervised learning. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 13337-13346, 2022.
Turner, A., Tsipras, D., and Madry, A. Label-consistent backdoor attacks. ArXiv, abs/1912.02771,, 2019.
Villani, C. et al. Optimal transport: old and new, volume 338. Springer, 2009.
Shafahi, A.. Huang, W. R.. Najibi, M., Suciu, O., Studer, C., Dumitras, T., and Goldstein, T. Poison frogs! tar- geted clean-label poisoning attacks on neural networks. In Advances in Neural Information Processing Systems (NeurIPS 2018), volume 31. Curran Associates, Inc., 2018.
Wang. B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng. H., and Zhao, B. Y. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. 2019 IEEE Symposium on Security and Privacy (SP), pp. 707- 723, 2019.
Simonyan, K. and Zisserman, A. Very deep convolu- tional networks for large-scale image recognition. CoRR, abs/1409.1 1556,, 2014.
Wei, S., Zhang, M., Zha, H., and Wu, B. Shared adversarial unlearning: Backdoor mitigation by unlearning shared ad- versarial examples. In Thirty-seventh Conference on Neu- ral Information Processing Systems, 2023. URL https: / //openreview.ccc net for 2g-
Simsek, B., Ged, F,, Jacot, A., Spadaro, F,, Hongler, C., Gerstner, W., and Brea, J. Geometry of the loss landscape in overparameterized neural networks: Symmetries and invariances. In Proceedings of the 38th International Con- ference on Muchine Learning, volume 139 of Proceedings of Machine Learning Research, pp. 9722-9732. PMLR, 18 24 Jul 2021. URL http::s:://prreeeeeeeeeeeeeeeeee http///ooceeen.n...eo mllr. press /aaass/v133 v11///11/////// simsek21a html.
Wenger, E., Bhattacharjee, R., Bhagoji, A. N., Passananti, J., Andere, E.,, Zheng. H., and Zhao, B. Finding nat- urally occurring physical backdoors in image datasets. In Advances in Neural Information Processing Systems, volume 35, pp. 22103-22116, 2022.
Wortsman, M., Horton, M. C., Guestrin, C., Farhadi, A., and Rastegari, M. Learning neural network subspaces. In Proceedings of the 38th International Conference on Ma- chine Learning, volume 139 of Proceedings of Machine Learning Research, pp. 11217-11227, PMLR, 18-24 Jul 2021. URI http::ttts//oo html.
Singh, S. P. and Jaggi, M. Model fusion via optimal trans- port. In Larochelle, H., Ranzato, M., Hadsell, R., Balcan, M., and Lin, H. (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 22045-22055. Cur- ran Associates, Inc., 2020.
v139/b Utt.httpss://rroeeeeee /pwoce///o/eeeeooeooooooooooecec ngs ml p.ress/
Souri, H., Fowl, L., Chellappa, R., Goldblum, M., and Gold- stein, T. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. In Advances in Neural Information Processing Systems (NeurIPS 2022), volume 35, pp. 19165-19178. 2022.
Wu, B., Chen, H., Zhang, M., Zhu, Z., Wei, S., Yuan, D., and Shen, C. Backdoorbench: A comprehensive bench- mark of backdoor learning. In Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2022.
Szegedy, C., Vanhoucke, V., loffe, S., Shlens, J., and Wojna, Z. Rethinking the inception architecture for computer vi- sion. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2818-2826, 2016.
Wu, D. and Wang, Y. Adversarial neuron pruning purifies backdoored deep models. In Advances in Neural Infor- mation Processing Systems (NeurIPS 202/), J, volume 34, pp. 16913-16925. Curran Associates, Inc., 2021.
Tancik, M., Mildenhall, B., and Ng, R. Stegastamp: Invisi- ble hyperlinks in physical photographs. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 21 1114 2123, 2020.
Yao, Y., Li, H., Zheng, H., and Zhao, B. Y. Latent backdoor attacks on deep neural networks. In Pro- ceedings of the ACM SIGSAC Conference on Com- puter and Communications Security, CCS '19, pp. 2041-2055, 2019. URL https://doi. org/10. 1145/3319588 3354209.
Tatro, N., Chen, P.-Y., Das, P., Melnyk, I., Sattigeri, P., and Lai, R. Optimizing mode connectivity via neuron align- ment. In Advances in Neural Information Processing Sys- tems, volume 33, pp. 15300-15311. Curran Associates, Inc., 2020.
Zeng. Y., Park, W., Mao, Z., and Jia, R. Rethinking the back- door attacks' triggers: A frequency perspective. In 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 16453-16461, Los Alamitos, CA, USA, 2021. IEEE Computer Society.
Tran, B., Li, J., and Madry, A. Spectral signatures in back- door attacks. In Neural Information Processing Systems (NeurIPS 2018), 2018.
13

---

Circumventing Backdoor Space via Weight Symmetry
Zeng, Y., Chen, S., Park, W., Mao, Z., Jin, M., and Jia, R. Adversarial unlearning of backdoors via implicit hy- pergradient. In International Conference Learning Representations, 2022.
Zeng, Y., Pan, M., Just, H. A., Lyu, Qiu, M., and Jia, R. Narcissus: practical clean-label backdoor attack with limited information. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communicationn Security, pp. 771-785, 2023, ISBN 9798400700507. doi: 10.1145535769115366666777
Zhao, P.. Chen, P.-Y., Das, P., Ramamurthy, K. N., and Lin, X. Bridging mode connectivity in loss landscapes and adversarial robustness. In International Conference on Learning Representations, 2020.
Zheng, M., Xue, J., Wang, Z., Chen, X., Lou, Q.. Jiang, L., and Wang, X. Ssl-cleanse: Trojan detection and miti- gation in self-supervised learning. In Computer Vision ECCV 2024, 2024.
Zhu, C., Huang, W. R., Li, H., Taylor, G., Studer, C., and Goldstein, T. Transferable clean-label poisoning attacks on deep neural nets. In Proceedings of the 36th Interna- tional Conference on Machine Learning, volume 97, pp- 7614-7623. PMLR, 09-15 Jun 2019.
Zhu, M. Wei, S. Shen, L., Fan, Y., and Wu, B. Enhanc- ing fine-tuning based backdoor defense with sharpness- aware minimization. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 4466 4477, October 2023.
14

---

Circumventing Backdoor Space via Weight Symmetry
A. Applicability of the Defense Setting of TSC
As stated in Section 3.4, this paper considers two attack scenarios: one where an adversary can only poison portion the training data, and another where the adversary gains control over the training procedure. our defense setting, we assume that the defender has knowledge of the original basic training methods such Stochastic Gradient Descent (SGD) using Cross-Ente posss-Enrropy loss function. To address potential concerns about the practical relevance of this defense setting, we provide here detailed discussion of how our proposed defense approach applies in real-world scenarios.
A.1. Data-poisoning Attacks
For adversaries employing data poisoning (who have control over the training process), defenders may repair the backdoored model post-training using defenses such as TSC or other post-purification techniques. In this scenario, the defender has control of the training it's natural the defender has the knowledge of the training procedure. Thus, the setting in our paper is applicable in such data poison scenario.
A.2.
Attack
For adversaries have control over the training, we provides two common examples here:
Public Pre-trained Models: Public repositories or research papers release pre-trained models that may contain backdoors. Since these sources typically provide detailed descriptions of the model-training procedure, defenders can leverage this information to apply TSC effectively. Using public large-scale image encoders for downstream tasks is increasingly common, making our setting practically relevant. Advanced zero-shot deployment models (e.g., CLIP) further exemplify this applicability.
Internal Adversary in Organizations: Consider an internal adversary scenario within an organization where malicious attackers backdoor a model without others' awareness. Typically, benign team members possess knowledge of the basic training process but lack insight into the malicious manipulations. In this context, defenders within the organization can deploy TSC to purify the model without taking retraining from scratch.
Moreover, beyond traditional learning scenarios, our method shows potential for application in other settings. For example, in federated learning, models are trained collaboratively across many distributed devices, with participants computing and sending their local gradients for global aggregation. Malicious participants could inject poisoned updates into this system, thereby introducing backdoors, even without direct access to the overall training procedure. Since common underlying training methodology is typically employed by both clients and the server in such federated architectures, defenders in this setting could apply our method to remove backdoors using only a small amount of data.
B. Quadratic Mode Connectivity
In Section 3.1, we can find a path connecting A and 0g using Equation (I). However, since pe depends on OA.B,
intractable to compute the stochastic gradients of ((OA.B) B) in Equation (1). To address this, Garipov Garipov et al. (2018)
choose the uniform distribution UO, 1) over the interval [0, 1] replace y (!), leading to the following loss:
(0(0A.)) - [[o - C(70A. (1) dt = (en0ro.,)((70....
(10)
The primary contrast between (1) and (10) is that the former calculates the average loss L(YOA, a (t)) over a uniform distribution along the curve, while the latter calculates the average loss over a uniform distribution within the interval [o, 1] for the variable t. To minimize (0 A. each step one randomly select a sample i from the uniform distribution over
the interval [0, 1] and update the value of A based on the gradient of the loss function L(7oA.. (i). This implies that we can use Vea C(re. (f) estimate the actual gradient of L (O
Vo (() VOl, B2-U((, ((TO,, (t)
(11)
En-U(0.1) V Von.. L(TO,, (t)) C(70 (i)
(12)
(13)
15

---

Circumventing Backdoor Space via Weight Symmetry
We can choose the Bézier curve as the basic parametric function characterize the parametric curve Je.. (1). And could initialize AA with (0 0g). A Bézier curve provides convenient parametrization of smooth paths with given endpoints. We can reform the parametric Bézier curve A. in Equation (2) by replacing A, with its deviation 0 A.BB
70 (1) = (1 - 0) A + 21(1 - A, +0,
= (1 (1=t) + 2t - - A +
AA.B) + +B0
2
(1 t)0 t0g 2t(1 t) v0A.n (t).
(14)
C. Permutation Invariance and Neuron Alignment
After applying the permutation operation π (0,S(P)) the feedforward neural network defined in Equation (3) is transformed to:
y = W, 00. PLPPL-WWL-- 0.0000 P.W
(15)
= - coc.P. P 00 Wia0.
The second equation in (15) follows from the fact that a is an element- wise function. The weights of the permuted network can then be obtained as defined in Equation (4).
Previous studies have found that two functionally identical networks A and 0g. trained independently with the same architecture but different random initializations or SGD solutions, could be misaligned. And the loss of their linearly interpolated network, represented by 0, 1 (1 t)0B (where 0 S / 1), could be quite large (Entezari et al., 2022; Frankle al., 2020). However, Entezari et al. (2022) conjecture that if the permutation invariance of neural networks is taken into account, then networks obtained by all SGD solutions could be linearly connected.
Recently, reserach (Singh & Jaggi, 2020; Ainsworth et al., 2023; Jordan et al., 2023) has shown that such misaligned networks 0 and 0g could be projected to the same loss basin using a specific set of permutation matrices S(P). Subsequently, these networks can be fused through a linear path, i.e,, they are linear mode connected. For example, one can let On re-aligned with A by permuting On (SPP) enabling the linearly interpolated network of O and ((P) to exhibit performance similar to both A and Øg.
To solve the problem defined in Equation (5), various cost functions Q can be employed to compute P (Li et al., 2015; Singh & Jaggi, 2020; Ainsworth et al., 2023). One commonly used ej is defined as q = =1 - corr(v, =) in (Li et al., 2015), where the corr compute the correlation between v E RRd: and 2 E Rdd. Singh & Jaggi (2020) utilized optimal transport to soft-align neurons before model fusion. Ainsworth et al. (2023) introduced two novel alignment algorithm and compared them with the method in (Li al.. 2015). Jordan et (2023) proposed enhancing the linear mode connectivity after alignment by renormalizing the activations. While these studies aimed to apply neuron alignment for linear interpolated networks, Tatro et al. (2020) found that alignment could improve both robustness and accuracy along the quadratic curve connecting advers adversarially robust models. Following previous work, we continue to use this alignment method proposed by Li et al. (2015).
D. Wasserstein distance
Wasserstein distance, key concept in optimal transport (OT) theory, measures the distance between probability distributions by considering the cost of transforming one distribution into another (Villani et al., 2009). It provides geometric perspective on comparing distributions. Formally, let IP, and Pg be two probability distributions, and 2(P, IP,)) denote the set of all joint distributions w that have P, and IP y as their marginal distributions. Then the p- Wasserstein distance can be expressed as:
1/P
WP.PP. Ppy)
inf (..)(P.....))))
E E( ||
vll'
(16)
The joint distribution w can be regarded as the optimal transport solution (i.e., the minimal distance) between IP, and P When we solve the problem outlined in Equation (6) to find the optimal permutation P., we are essentially seeking the optimal transport w E TT, that corresponds to the Wasserstein distance between TP/4 and IP...
16

---

Circumventing Backdoor Space via Weight Symmetry
E. Omitted Proofs
E.1. Proof Theorem 4.2
Proof. For clarity, we first introduce some notation about (t). These notations can also be applied to (t, by substituting appropriate symbols.
We (!) denote the point sampled from the curve Vo (l). Meanwhile, consider dataset containing single the condition can be reformulated as:
sample 2g. Then, AI E f1.2...., L}.
(0 B: za) S Mi(OA. vc:
(17)
Moreover, we use W.A.B to indicate the weight of the 1th layer of A.,B. This allows to construct a feedforward network respect (t): f(z,, 0t,((t)) (1 (1-t) t) W) + + + 2t(1 t)
t) - + ( 28 -
(1 (1- W :
B + 21 W/ z7n-
(18)
Then, we define the pre- activatioo and post-activation for each layer as follows:
# 11) (1)
(11 () W 21(1 .) vo:
(19)
A.B (1) (
= -(1
w 20(1 t) ) (t).
(20)
Now, we consider the L2 norm distance between a A.B (t) and the endpoints defining the following distances:
(1,0( = -1101 (t) #1 A.B (0)
A.B -It((z/AB(11 (1) - (0)) 2t(1 t)W, xoll,
(21)
dA (t, 1) || |a.11. (t) x A.B A.B (1)]l
= =1[(1 - (²;
A.B (1) - x
21 (0) + 21(1 - t)W, zoll.
(22)
Then, Triangle Inequality and -Seuway Inequality get upper bound U(d for BA. (t,0);
0):
(t,00 S =||=1 (.))) (1) x11 [0]l 2f W) 4,8 zoll
(Triangle Inequality)
I St|l 1tll2/.B11 (1) -1) A. (0)
21(1 - t)| |
|
(Cauchy-Schwar) Inequality)
(0 0n: + 21(1 - 1))1
U(d (t,0))
(23)
Similarly, we can get
U(d A...B.. (t, 1)) (0A. + 24
- -) W,, -
(24)
U(d (1,0)) -IM (0,, 0c:wn) + 2/(1 1) |||
(25)
U(d (t, 1)) =(1 = t) 0c: + 2f(1 W,
||xo|l
(26)
Since θA.B and A are I-=noor-cooniistent, and given that A 0B and 0 satisfy the condition (17), we can conclude that:
Bid (t, 0)) ((dfA((t,)))
(27)
17

---

Circumventing Backdoor Space via Weight Symmetry
U(d (1, (I) s u((
(28)
We also consider the L2 norm distance 6,,B((t, (t,0) 0) between the post-activation ox1.000 is Lipschitz continuous, we have:
and the endpoints. Assuming that (t)
br. = 1 (10)).((t) owi cx)13(00)]
(t,
S Lo Ud4 (.A..B((,.0) (1,0))
(29)
where the L is the Lipschitz constant of o. This property holds for other post-activations as well. Thus, both pre-activation distance dít d/A.B/ (1, and post-activation distance b1 (1, 0) for the first layer of 0 (()) have tighter upper bounds than those
for ct))
Let 21 A.A.B (t) = ozi A. (t) be the post-activation for the 1th layer of (t. We can also derive the the upper bound for the pre-activation distance d. (t, 0) for deep layer:
A.B
& (t, 0) = =|101 A.B (1) - 2 (. (0)
-.- -1 (1)
+ -)
2/ (= 21-1 =
+ + -2(1=:) -0)
(30)
(1 - 1M
di A.B (1,0)
+ +11 - 1) 10 (1,0) 21()))2111111111 1), |
S (1 - (1) +1, (t, 1)) + (0,, 0b:
+ 2t(1 - t)). (1 21 W
A.B |
= Udd,"((t,))
(31)
To streamline the proof, we ignore the other upper bounds here. Similar to our demonstration for the first layer, we have:
U(d (t, 0)) s ((( (t,0)) Uld (t, 1)) s U(d (t.
(32)
(33)
Finally, since we assume that C is Lipschitz continuous, there exists a constant Le such that:
((f(2))0x.((1) - y) S Lells (2o, (,,((() yll Lellær A.B (I) yll
S LLU(11 A.B (t) yl)
UA,,(!),
(34)
where y is the ground truth label (or feature). As A 0g, and Oc three optimal networks, can find constant and specify them as optimal networs such that (aro, O,, (1)) y|1. for E (A, B, C). Then, we have:
|| A.B (1) - yll = |I1 W)
- + (W - (1))
+ +(1
11-tt) +1 -01-t]
-) y) + + (x
2/ -AA0(
(35)
S - 44
1)) +e
+ 21(11 - t) 11
28
=U[[ B. -1)-
(36)
18

---

Circumventing Backdoor Space via Weight Symmetry
Following the above scaling, also get (l,((I) and derive UA.B(() S UA,c((). Thus, for the upper bounds of loss value over the curves "oa.. (t) and Vox.c (t), we have ((0A,B) S UA.B, ((0A,c) & UA.C, where UA,B S UA... finishing the proof.
E.2. Proof Corollary 4.3
Proof. Since S(P") and S(P) are the sets consisting of permutation matrices, the Frobenius norms of the weights each layer of f and 0gr are identical those of 0g. Thus, f.. 0 and 0g are -----ooo-ooosssse with each other, according Definition 4.1.
As S(P) and S(P") are solutions to the optimization problems (6) and (8), respectively, we derive the following relations for all E (1. L}:
M,(0A.033 D) x M,(0A, 0b: D) v Mi(OA, 0B: D).
By Theorem 4.2, we conclude that UA S UAAB & UA, completing the proof.
F. Practical Algorithm
F.I. Computing the Permutation for Each Model Layer
PERMUTELAYERS 0g. D, OPT) in Algorithm I returns model by permuting the layers of 0g. aligning or un-aligning it with A To compute the permutation of the 1h layer of A for alignment with θB, we first obtain the corresponding activations æ; and Φ for each sample 2.()) E D. We then employ the cost function = - corr(v, =) and compute the
sum of the cross-correlation matrices Rí of the normalized æ; and x. follows:
D
DD]
F,,1 B
Mm Σ
R
(37)
Σx
Finally, we use the Hungarian algorithm (Kuhn, 1955) to solve the maximization problem (or equivalently the minimization problem) according to OPT. It is noteworthy that, to stay consistent with previous work, we compute the cross- corseloorel matrix here rather than the cost funetion defined in Equation (6) Equation (8). This minimization or maximization procedure is still equivalent ordinary least squares constrained to the solution space IId (Ainsworth et al., 2023; Tatro et al., 2020). We give the pseudocode of computing the permutation matrices for feedforward networks in Algorithm 2. For more complex model architectures, the same principles apply. but the implementation details may vary. We refer readers to Ainsworth et al. (2023) and Jordan et al. (2023) for more details on computing the permutation matrices for other architectures, such as ResNet-18 (He et al., 2016b) and VGG19-BN (Simonyan & Zisserman, 2014).
Algorithm 2 PERMUTELAYERS (Compute Permutation Matrices for Layer Alignmen/UUn-alignmenng
Require: model A, model OB, dataset D, optimization OPT; Set assignment problem O with minimizatiionmaxiiizzaa for each layer / in {1, 2, ..., L - 1 do
objective according to OPT;
for each sample 2;, in dataset do
Compute x f a W.A. o... o WAA., 0. af. f o WPS o... oo WFa, a o:
end for
Compute the correlation matrix R; using Equation (37);
Compute P. by solving the O with R₁ using Hungarian algorithm;
Update WBB < P.W.S. WB t+ WBB PT:
end for
Ensure: permuted model 0b:
F22 Training the Quadratic Bézier Curve
FirQUADCURVE((A, 0z. e,e) returns the quadratic Bézier curve connecting 0 and θg. trained using method F over D for epochs. As mentioned in Appendix B, at each step, we randomly select sample i from the uniform distribution
19

---

Circumventing Backdoor Space via Weight Symmetry
over the interval [0, 1] and update the value of A.B B based on the gradient of the loss computed using the training method F. This is achieved by computing the loss of 0 over the dataset D using F, and then calculating the gradient of 0 A, (i.e., the weights of the curve Yea.. (f) via the chain rule. The pseudocode is provided in Algorithm 3.
Algorithm 3 FITQUADCURVE (Train Quadratic Bézier Curve)
Require: model A model 0g. training method F, dataset D, curve training epoch Initialize 0A,B < (0 + 0B);
Initialize parametric curve Yea.. (t) < <1 0 + 21(1 A, +120g;
for i = to e do
Sample / from the distribution (0, 1);
0: f- (ETTRIEVEPOINT(T0.. t); Update AA the weights of the curve y (f), using the loss computed by JF with respect to O₃ over the dataset D;
end for
Ensure: quadratic Bézier curve T
G. Evaluating TSC's Robustness Against Adaptive Attacks
G.1. Apdative Attack Design
The key defense mechanism of TSC relies on increasing adversarial loss along the quadratic Bézier curve by projecting model edde a distinet loss basin find Oado' during its first stage. An adaptive attack would aim to create a backdoored model maintaining low backdoor loss along this defensive curve.
Here, we assume the adversary has access to the model training procedure. Building upon the neural network subspace learning approach from (Wortsman et al., 2021), originally developed for accuracy and calibration improvements, we design an adaptive attack strategy. The key insight is to place oudv and its symmetric point auder in a subspace that minimizes loss on poisoned samples. Our approach simultaneously trains a curve and updates its endpoints Oudo and Ondo' using mixed benign and poisoned data (i.e., learning a backdoored subspace). After training, we select one endpoint as the final model.
The implementation details are provided in Algorithm 4. We first project the backdoored model Oudo symmetric loss basin to obtain Oudv' by solving Equation (8), similar to TSC's initial process. We then train the curve connecting Onde and Ondo' over Dade without fixed endpoints, ensuring the curve lies within the backdoored subspace. Finally, we return Ondo as the output model, which is expected to achieves lower loss along the curve found by TSC compared to the original model.
Algorithm 4 Adaptive Attack against TSC
Require: backdoored model addv. training method FF, poisoned dataset Dodv, curve training epoch e; D Projecting backdoored model symmetric subspace
Oado! +- PERMUTELAYERS/ (adde Oado, Dadv; MAX);
Initialize Om- 1 (Oad + Oadw);
Initialize parametric curve Yoaso (t) + (1-t)200u + +2t(1 - +)0mmado + + 0
> Learning Symmetric Backdoored Subspace
for í 1 to e do
Sample i from the distribution U(0,1);
0i,dd + RETRREVEEPLINT(T.... E);
Update the weights of Oados mm-ade and Oudor simultaneously, using the loss computed by F with respect to 0 ia over the dataset Dudvi
end for
Ensure: backdoored model Oadvi
G.2. Empirical Evaluation Against Adaptive Attack
To evaluate TSC's robustness against adaptive attacks, we apply Algorithm to convert models backdoored by BadNet (Gu et al., 2017), Blended (Chen et al., 2017). SSBA (Li et al., 2021c), LF (Zeng et al., 2021), WaNet (Nguyen & Tran, 2021). Input-aware (Nguyen& & Tran, 2020), LC (Turner al., 2019), and SIG (Barni et al., 2019) under supervised learning. We
20

---

Circumventing Backdoor Space via Weight Symmetry
Table 4. Performance of TSC against adaptive attacks CIFAR-10 under supervised learning.
Table 5. Performance of TSC against adaptive attacks Im- ageNet100 under supervised learning.
CIFARIO
No Defense
TSC
ImageNet100
Defense
TSC
(Poisoning rate-5%)
ACC(T)
ASR()
ACC(T)
ASR(L)
(Poisoning 19)
ACC(t)
ASR(L)
ACC(1)
ASR())
Adap-Badle BadNet
92.43
91.47
2.07
Adap-BadNe BadNet
83.64
99.47
78.22
0.23
sduup-Blended
93.12
99.23
90.88
7.26
Adap-Blended
84,42
98.15
78.85
9.61
Adap-Inputaware
92.11
90.18
90.21
4.85
Adap-Inputaware
79.42
70.44
77.04
0.82
Adap-LC
93.27
98.14
89.87
2.92
Adap-LC
84.22
42.67
80.44
0.36
Adap-1.F
92.46
97.91
88.66
3.39
Adap-I.F
83.61
99.66
78.18
3,26
Adap-SIG
92.33
94.99
90.34
1.82
Adap-SIG
83.39
69.86
79.55
5.61
Adap- SSBA
92,39
94.87
89.33
2,68
Adap-SSBA
83.13
99.32
80.19
7.67
Adap-Wabe
92.61
87.29
90.19
Adap-Wahe WaNet
81.75
88.04
80.31
0.26
Table Performance of TSC against adaptive attacks using SimCLR with CIFAR-10 and ImageNet100 pretraining (selr-sue learning).
Pre-training
Downstream
No Defense
TSC (ours)
Dataset
Dataset
ACC(1)
ASR(J)
ACC(T)
ASR(L)
STL10
76.51
99.80
72.62
4.83
CIFARIO
GTSRB
82.47
98.94
77.77
1.90
SVHN
64.90
98.74
64.41
5.13
STL10
94.94
98.87
88.24
3.42
ImageNet
GTSRB
75.81
99.90
70.94
6.13
SVHN
73.62
99.32
68.18
3.42
conduct experiments on CIFAR10 using PreAct-ResNet with 5% poisoning rate and ImageNet using ResNet50 with 1% poisoning rate.
For self-supervised learning, we adapt BadEncoder (Jia et al., 2022) into our adaptive attack framework. Using SimCLR, we utilize publicly available backdoored ResNet18 and ResNet50 encoders on CIFAR 10 and ImageNet, respectively, evaluating ASR and ACC through linear probing on downstream datasets STL10, GTSRB, and SVHN.
Since our adaptive attack designed to exlpore the robustness of TSC. we do not consider other defenses here. For fair evaluation, we use the default settings of TSC: global epoch Érsc 3, curve index 0.4, and curve training epoch 200 for supervised learning: Ersc 2, t 0.25, and 200 for SimCLR. We provide defenders with 5% clean samples. Additional experimental settings follow Appendix L.
The defense results are presented in Tables 4 to 6. After retraining the backdoored models using Algorithm 4, we observe slight improvements in both ACC and ASR compared to the original models. We suspect that such improvements are due to the benefits of the subspace learning approach (Wortsman et al., 2021). Importantly, TSC maintains robustness against these adaptive attacks across both supervised and self-supervised learning settings.
G.3. Loss Landscape Visualization of Adaptive Attack
To further explore the effectiveness of our defense against adaptive attacks, we present a loss landscape visualization for Adap-BadNet
BadNet before and after applying TSC, as shown Figure 4. The left plot shows that the adaptive attack's curve training procedure successfully places its backdoored model, Oadv. and its corresponding symmetric point, Oadv', in subspace that minimizes loss poisoned samples. However, depicted in the middle plot, the curve identified by the first stage of TSC traverses loss basin characterized by considerably higher loss poisoned samples, rather than the basin exploited by the adaptive attack. We attribute this to TSC's training procedure, which exclusively uses benign samples, thereby guiding the curve to circumvent the loss basin optimized by the adaptive attack. Moreover, the permutation operation in the first stage of TSC could also find an endpoint in a different loss basin from both Oudo and Oadv', as there are multiple permutations matrices that satisfy the maximization objective Equation (8) (Entezari al., 2022).
21

---

Circumventing Backdoor Space via Weight Symmetry
Bézier Curve after Adap-attack Training
Bezter Curve of Stage (ISC)
Böster Curve of (ISC)
Lass Poisured Samples
1.00
125
1.56
Iudidoond Cxpaors
300
1.0
Cive yun
22
1.50
Klg ned Oripolnn on Cone
vdd
25
2.15
1.00
542
130
6.38
534
0.00
052
325
1.00
024
0.00
-245
0.36
5:22 -9.5
(Settings)
Datnsel: CIFARIO, Model Architectere: PreAct-ReNNel8, Attack: Adap-BadNee Poisoning Rate: 5%
Figure 4. Loss landscape for poisoned samples of Adap-Badnet, along with trained quadratic curves connecting distinct models. The hackdoored model is a PreAct-ResNett trained on CIFAR-10, which contains 5% poisoned samples. Left: the curve identified by our adaptive attack. Middle: the curve identified by the first stage of TSC. Right: the curve identified by the second stage of TSC.
Overall, the combination of the permutation mechanism and training exclusively with benign samples contributes to amplifying the loss on poisoned samples.
H. Ablation Studies
/ H.1. Sensitivity Analysis on Global Epochs Frsc and the Curve Index
TSC has two key hyperparameters: the number of global epochs EtSC and the curve index L.
For supervised learning, investigate their impact through ablation studies on CIFARIO using PreAct-ResNet18 with a 5% poisoning rate under supervised learning. Figure 5 illustrates the purification performance of TSC under varying Ersc and 1. Each data point represents averaged results against twelve attacks: BadNet (Gu et al., 2017), Blended (Chen et al.. 2017), SSBA (Li et al., 2021c), LF (Zeng et al., 3021). WaNet (Nguyen & Tran, 2021), Inputaware (Nguyen & Tran, 2020), LC (Turner et al., 2019), SIG (Barni et al., 2019), SBL-BadNet, SBL-Blended (Pham al., 2024), Narcissus (Zeng et al., 2023) and SAPA (He al., 2024).
For self-supervised learning, we conduct experiments pre-training dataset CIFAR10 and downstream dataset STL10 using & 8 to evaluate the performance of TSC against BadEncoder (Jia al., 2022). Figure 6 shows the results of TSC under different Ersc and t values.
Importantly, each point in Figures 5 and 6 shows the final ACC and ASR values of TSC using different combinations of Ersc and f. This differs from Figure 3, Figure 7, and similar figures, which display ACC and ASR values evaluated along the curve at each round of Ersc with fixed
The results in Figure demonstrate that increasing the curve index t 0.5 enhances purification performance the cost of slightly reduced clean accuracy (ACC) per epoch. Similarly, as l increases from 0.5 to 0.95, ACC improves but purification effectiveness decreases. As previously noted, when I. 2 0.4 (or I. < 0.6), single epoch of TSC proves insufficient for backdoor removal. Furthermore, increasing the number of global epochs Ersc could enhance the stability of the defense performance against various attacks. Our empirical analysis suggests t = 0.4 and Ersc = 3 as optimal parameters for supervised learning settings.
We can observe that the performance of TSC on self-supervised learning is consistent with that of supervised learning, The key difference is that smaller curve index suffices for backdoor removal in self-supervised learning. Though Figure (left) demonstrates that setting 0.2 and Ersc = 1 achieves effective purification, opt for more conservative hyperparameters (t = 0.25 and Ersc- 2) to ensure robust performance across diverse attack scenarios.
Additional results for ACC and ASR along the curve with fixed = 0.4 are presented in Figures 7, 8, 11 and 12. While Eysc = 1 or Ersc = 2 can occasionally reduce ASR to near zero, Ersc provides more consistent robustness across different attacks. For conservative defenders, we recommend larger values of Ex sc and as the hyperparameters.
H.2. Analysis on Model Architecture
To evaluate the stability of TSC across different architectures, we conduct experiments using VGGI9-BN (Simonyan & Zisserman, 2014) and Inception V3 (Szegedy et al., 2016) on the CIFAR1O dataset under supervised learning settings. We
22

---

Circumventing Backdoor Space via Weight Symmetry
Ergr
Eror
Ergr
1.00
1.00
100
Test (SR(S)
80
TestAcC/ ASRR%)
80
TestACC ASR())
60
8
60
ACC
ACC
10
20
30
60
50
60
70
80
50
20
30
40
50
60
70
80
90
10
20
30
40
50
60
70
80
50
1XX10
4)
[x]1
TXX10
F)
Figure 5. (Supervised Learning) Effect of global epoch Ersc and the curve index on TSC defense. We evaluate the performance
TSC on CIFAR10 10 with 5% poisoning rate using PreAct-ResNetle Each point is averaged over the results of TSC against 12 attacks.
Frsr
Frg
Fry =3
ASR
ASR
ASR
Test ACC/ ASR(%)
Test ACC/ ASR(%))
Test ACC/ ASR()%)
ACC
10
10
[[x10-))
(x100))
(x100=)
Figure 6. (Self-Supervised Learning, SimCLR) Effect of global epoch Ersc and the curve index TSC defense. We evaluate the performance of TSC against BadEncoder on pre- training dataset CIFARIO and downstream datasct STL10 with ResNet18. We performed 3 defense runs for each point and averaged the results in the figure.
Table 7. (Supervised Learning) Performance of MCR and TSC on CIFAR-I0 with 5% poisoning rate using VGG19-BN.
Table 8. (Supervised Learning) Performance of MCR and TSC on CIFAR-10 with 5% poisoning rate using Inception-v3.
CIPAR1O
No Defense
MCR
TSC
CIBARIO
No Defense
MCR
TSC
(Poisoning mie-5%)
ACCX1)
()R(
ACC(T)
ASR(L)
ACC(T)
ASR())
(Poisoning rate-5%%
ACC(T)
ASR())
ACO(T)
ASR(1)
ACC(")
ASR(.)
BoiNet
91,19
93.92
90.44
55.21
90.69
1.76
Bailee
90.23
95.82
89,74
70.16
90,75
1.88
Blended
92.24
99:43
91.29
96.56
90:46
9.00
Blended
90.16
99.40
90.69
91.57
90.36
6.93
Impursoare
89.22
93.34
90.06
5.44
90.58
6.32
Engutiware
89.01
93.50
90.94
1.42
90.71
2.27
LC'
91.78
99.21
91.03
100.00
89.82
3.23
LC
92.19
99.31
90.06
96.37
90.76
3.09
LF
89.27
96.29
90.22
1.02
$8.97
1.38
91:43
93.12
90.28
22 32
91,00
1.31
91.91
91.09
99.57
39.25
90.59
91.29
92.04
2.36
SSBA
91.53
SSRA
89.22
62.65
3.85
WaNet
87.42
92.04
90.36
WaNet
89.34
91.25
5.44
1.87
set the poisoning rate to 5% for all attacks and employ the default hyperparameters for MCR and TSC. The results are presented in Table 7 and Table 8 respectively.
The results demonstrate that TSC maintains robust performance across different model architectures. While TSC occasionally shows marginally lower ACC compared to MCR, it consistently demonstrates superior robustness against all considered attacks.
I. Additional Results for Supervised Learning
In this section, we provide comprehensive results for supervised learning settings.
Figures to 10 illustrates the performance of TSC and MCR on CIFARIO with 10%, 5%, and 1 1% poisoning rates, respectively. Figures 11 and 12 present the results on ImageNet100 with 1% and 0.5% poisoning rates, respectively. Taking CIFAR10 an example, we observe that backdoors are more effectively eliminated by TSC when the poisoning rate is relatively high. When the poisoning rate is 10%, small number of global epochs ETSC is sufficient to remove backdoors implanted by attacks such as BadNet, InputAware, and LCC However, when the poisoning rate decreases to 1%, Ersc = 3 is required to defend against all attacks. TSC demonstrates similar behavior on the ImageNet100 dataset. These findings further indicate that conservative hyperparameter settings are reasonable in supervised learning scenarios.
Tables to 11 summarize the defense results of TSC and other baseline defenses on CIFAR1O, ImageNet100, and GTSRB,
23

---

Circumventing Backdoor Space via Weight Symmetry
respectively. Tables 9 to 11 summarize the defense results of TSC and other baseline defenses CIFARIO, ImageNer and GTSRB, respectively.
The experimental results reveal that while lower poisoning rates can increase the robustness of attack, excessively low poisoning rates sometimes result in diminished ASRs on the original model. For instance, with 1% poisoning rate, WaNet attack achieves only 12.63% initial ASR on CIFAR1O; 10; with a 0.5% poisoning rate, LC attack yields merely 0.61% % ASR on ImageNet100. Although these attacks are not considered successful backdoor attacks, we include them in our evaluation for completeness.
Notably, TSC successfully reduces the attack success rate of all attacks to below 15%. As mentioned in main paper, ANP (Wu & Wang. 2021), FT-SAM (Zhu et al., 2023), and I-BAU (Zeng et al., 2022) perform well on smaller datasets like CIFAR10 and GTSRB, particularly with higher poisoning rates. However, their effectiveness is limited on the ImageNet 100 dataset. While SAU (Wei et al., 2023) demonstrates good defense capabilities, sometimes reduces clean accuracy (ACC) to suboptimal levels. We attribute this phenomenon to the lack of theoretical convergence guarantees for the unlearning loss function employed by SAU.
Stage
Stage
Stage
ACC
Ersc
Ersc
Ersc
Ersc
Ergc
102
ACC (ASR/50)
10-
40-
Blended
restt AeCt-CCC/ AARRINA
1.0
60
10
83 23
80
90
12
040
0.35
6.5
0.75
1.00
0.00
0.5
0.50
0.75
1.00
080
635
0.5
6.75
1.00
0.8
633
050
5.75
1.00
0.50
0.55
0.50
0.15
1.50
0.08
0.25
2.50
0.75
Inoutaware
100
100
100
0.00
1.00
0.00
0.25
6.35
0/53
0.35
0.00
1.50
6.08
0.35
1.00
SIG
Test ACC. AARRNN
60
70
100
110
1000
Teat ACC (ARRIN)
00
20-
0.00
0.25
8.75
3.00
0.00
0.5
0.50
0.75
1.00
0.00
0.23
0.27
0.73
1.02
0.08
3.52
5.73
1102
0.00
0.50
0.75
1.50
0.00
0.25
3.30
5.7
3000
SBL-BadNoo
SBI-Blended
Figure 7. (Supervised Learning) Performance of TSC and MCR CIFAR-10 10 with 10% poisoning rate using PreAct-ResNett Test accuracy (ACC) on benign samples and the attack success rate (ASR) are evaluated as functions of the points along the quadratic Bézier found MCR and TSC. We select model points along the curve 0.4 for each stage and round.
24

---

Circumventing Backdoor Space via Weight Symmetry
1st Stage (TSC)
Stage
Stage (TSC)
2nd Stage (TSC)
Ersc
Ess #
Ersc =
Ersc
Ersc
Ersc
100
100
60-
13
53
42
14
20
22
0.00
3.00
0.25
0.75
0.00
0.00
1.00
F0
60
000
635
6.5
0.75
1.00
0.00
0.5
0.50
0.55
1.00
0.5
635
6.5
6.75
1.00
0.08
6.55
5.75
1.00
0.00
0.5
0.0
0.55
1.50
0.08
6.75
5.0
6.5
1.00
inoutoware
The ACC JASRIN
60-
70
ASRON
1.07
100
1.07
Test MCC. S
12
0.00
1.00
0.00
0.75
635
5.35
0.00
1.50
6.00
0.35
SSBA
WaNNet
0.50
0.22
0.75
3.00
0.2
0.50
0.75
1.00
0.25
0.52
1.00
0.50
5.75
0.00
0.50
0.75
1.00
0.00
0.25
0.75
2.00
SBL Baddet
SBL-Blended
100
50
60
42
Narcissus
Figure& 8. (Supervised Learning) Performance of TSC and MCR CIFAR-10 with 5% poisoning rate using PrsAct-ResNer1& We select model points along curve at = 0.4 for each stage round.
25

---

Circumventing Backdoor Space via Weight Symmetry
ASR of the 1st Stage (TSC)
ACC of the 1st Stage (TSC)
ASR of the 2nd Stage (TSC)
ACC of the 2nd Stage (TSC)
ASR MCR
ACC of MCR
Froc
Frsc
Frec
Ergc
Ersc
Erge
70-
0.50
0.25
0.75
2.00
0.00
0.23
0.50
0.15
1.00
0.2
0.5
1.00
0.0
5.73
0.00
0.50
0.75
1.50
0.03
0.75
1.00
Badnet
Blended
Thes ACC: (AGRUN)
That ACC: (ACR/15)
9
20
60-
12
70
Teee ACC ACR174)
12
0.0
5.25
6.55
0.75
3.00
0.00
0.5
0.50
0.75
1.00
0.00
5.2
0.35
0.75
3.02
0.08
0.55
5.75
1.00
0.00
0.25
0.50
0.15
1.50
0.00
0.23
2.0
5.79
1.00
SIG
12
12
0.50
0.22
6.52
0.75
3.00
0.00
0.20
0.50
1.00
0.00
0.25
0.52
3.00
0.00
2.73
1.00
0.00
0.50
0.75
1.50
0.00
0.23
0.75
2.00
SSDA
WaNett
That ACC: ACOR24)
80
20
80
2
60
12
20
3.00
5.75
009
SBL-Blended
GO
60
20-
20
0.00
0.25
0.35
0.75
2.00
0.00
0.2
0.50
0.75
1.00
000
5.25
0.50
0.75
1.00
0.35
0.25
2.50
2.75
2.00
0.00
0.25
0.50
0.15
1.50
0.00
0.25
2.50
0.75
2.00
Narcissus
SAPA
Figure 9. (Supervised Learning) Performance of TSC and MCR CIFAR-10 with 1% poisoning rate using Res We select model points along the curve at = 0.4 for each stage and round.
ASR the 1st Stage (TSC)
ACC the 1st Stage (TSC)
ASR of the 2nd Stage (TSC)
ACC the 2nd Stage (TSC)
ASR of MCR
ACC of MCR
Frsc
Frsc m2
Frec
Fryc
Erge
Frec
200
200
120
ACC (ARRNN)
Teck ACC (ASRUUS)
3. 13
40
40
20
20-
Narcissus
SAPA
Figure (Supervised Learning) Performance TSC MCR on CIFAR-10 with 0.5% poisoning rate using PreAct-ResNetJ3
against Narcissus and SAPA attacks. We select model points along the curve at 0.4 for each stage and round.
26

---

Circumventing Backdoor Space via Weight Symmetry
1st Stage (TSC)
the Stage
Stage (TSC)
2nd Stage (TSC)
Ersc
Ess #
Erg =
Ersc
Ersc
Ersc
Thei (C2 ASRINN
002
0.50
0.75
3.00
0.25
0.35
0.75
0.00
1.50
5.00
1.00
ACC
12
20
20
0.00
6335
6.52
0.75
1.00
0.00
0.55
0.50
0.55
1.00
0.00
6.3
6.50
6.75
1.00
0.38
635
6.50
5.75
1.00
0.00
0.5
0.5
0.55
1.50
600
6355
2.0
0.5
100
inoutoware
The ACC. (SSRIN)
10
33
12
Thet MCCC ASRON
102
Teit NCC:
0.0
1.00
0.25
635
850
535
0.00
1.50
6.08
5.35
SSBA
WaNNet
100
The ACC AADRANN
20-
0.00
0.22
0.75
3.00
0.25
0.50
1.00
0.2
0.22
1.00
0.50
5.75
0.00
0.50
0.75
1.00
0.00
0.75
2.00
SBL Bad-Bt
SBL-Blended
Teut ACC/ AARENN
20
Figure 11. (Supervised Learning) Performance of TSC and MCR ImageNetl 00 with 1% poisoning using ResNet50. We seleet model points along the curve at for each stage and round.
27

---

Circumventing Backdoor Space via Weight Symmetry
1st Stage (TSC)
the Stage (TSC)
Stage (TSC)
2nd Stage (TSC)
Ersc
Ess #
Erg
Ersc
Ersc
Ersc
Thet (C2 ASRIN0
002
0.50
0.75
3.00
0.25
0.35
0.75
0.00
0.75
1.50
0.00
1.00
Tert XCC. A3220
20
20-
0.0
635
6.52
0.75
1.00
0.00
0.55
0.50
0.5
1800
000
635
6.5
6.55
1.00
0.08
675
6.00
575
1.00
0.00
0.5
0.50
0.55
1.00
600
6.75
2.0
0.5
inoutoware
The ACC/ (SSRIN)
ACC- X00770
10
33
60
20
Thet ACCC ASRON
Test XCC/ ACDOIO
20-
8
0-
540
1.00
0.25
635
5.35
0.00
1.50
6.08
5.35
SSBA
WaNeet
100
100
The ACC AADRANN
20-
10
0.00
0.22
0.75
3.00
0.25
0.50
1.00
0.25
0.22
1.00
0.53
5.75
0.00
0.25
0.50
0.75
1.50
0.00
0.75
2.00
SBL Baddet
SBL-Blended
Teut ACC/ ASREIN
20
Figure 12. (Supervised Learning) Performance of TSC and MCR ImageNet100 with 0.5% poisoning rate using ResNet50. We select model points along the curve at for each stage and round.
28

---

Circumventing Backdoor Space via Weight Symmetry
Table 9. Results on CIFARIO under supervised learning scenarios. Attack Success Rates (ASRs) below 15% are highlighted in blue to indicate successful defense, while ASRs above 155 denoted in red failed defenses.
No Defene
FP
NC
MCR
ANP
FESAM
L-BAU
SAUI
TSC (sum)
Rate
ACC:T)
ASRL..
ASSR()
ASR(.)
.NCCTT
ASRU1
ASR(
ACCIT)
ACC(T)
ASRUL
10%
91.63
0.82
50.47
90.08
2.01
91.84
2.40
90.74
1.16
BadNet
5%
92.64
90.51
$9.52
229
92.07
92.39
2.29
65,38
90.71
1.26
10%
93.46
99.78
91.97
18:42
90.75
2.44
92.93
97.87
94.91
6.14
92.45
11.38
83.36
9.52
90.30
9.57
50.33
8.79
Bloidel
5%
03.66
09.51
92.70
40.4 47
93.67
99.61
03.23
90.01
$8.95
18.76
93.00
20
88.07
34.56
90.89
7.74
90.14
10.33
1%:
91.76
69.9
94.84
91
91. 10
19.59
95.00
89.65
90.02
15.30
3.11
Imputenon::
5%
1%
91.24
79.16
16
8.58
91.33
79.19
91.19
74.62
$3.95
1.92
99.81
10:47
90.95
6.56
91.50
2.51
92.04
9.59
1093
00.19
99.75
97.37
47. 14
91.43
3.50
M1.75
94.66
87.00
0.74
92.04
7.10
30.45
26.05
$5.40
2.01
90.65
3.50
1.F
5%
03.36
98.05
92.84
59.12
90.19
2.45
85.07
97.32
94.20
2.46
92.89
7.44
39.64
45.06
90.60
1.73
89.50
3.78
1%
93.56
85.44
92.45
$6.45
91.00
84.11
11.28
99:47
11:21
60-18
91.58
90.64
SSBA
5%
03.27
92.55
16.27
95.27
42.06
92.71
1.54
91.30
50.43
2.78
1%
03.43
73.44
93.01
7.65
91.60
0.46
93.33
65.88
85.33
0.31
93.02
1.49
99.56
4.87
91,38
0.99
91.15
2.18
107
10.56
96.90
95. 18
0.311
90:56
96.93
91.10
0.71
$9.11
0.43
91.71
0.14
91.94
11.44
91.73
0.90
92.00
0.98
WaNet
5%
91.76
85.50
93.06
7.51
91.70
85.50
05.25
20.83
87.64
0.72
95.85
1.00
90.06
4.43
91.70
1.98
90..0
1.34
CIFARR
1%
00:65
93.47
0.51
92.55
03.45
0.77
93.95
0.72
91.87
1.32
91.90
91.40
0.57
91.30
91.63
91.41
90.35
0.21
SBL- HadNet
5%
10.79
92.99
1.13
16
27.06
91.31
91
1%
M1.21
88.64
93.00
31.77
91.82
0.72
93.23
86.11
92.71
$1.48
92.77
51.58
90.63
2.00
92.52
1.03
91.54
1.98
10%
00:46
94.12
92.49
29.61
90.45
88.12
02.51
99.91
55.32
52.96
92:40
74.02
91.44
22.79
35.11
9.09
50.95
5:27
5%
91.30
92.07
79.74
91.
02.75
99.61
92:90
77.90
89.65
57.41
91.43
90.47
8:04
1%
12.07
93.43
92.07
43.37
95.02
85.30
93.31
90.67
64.08
92.34
90.11
6.70
5%
98.57
41.88
92.76
00.25
92.90
1.44
91.39
91.13
4.51
SAPA
1%
04.01
99.97
92.34
92.22
92.80
2.14
93.83
100.00
85.06
92.68
93.05
79.80
86.69
15.17
91.83
1.96
90.37
7.41
0.5%
00.77
$4.50
$8.82
$2.76
92.74
1.52
03.76
80.83
$7.90
$1.53
95:23
62.02
90.15
26.48
91.75
0.65
90.95
7.32
1073
84.49
2.83
89:05
13.02
90.01
91.5
86.78
38.75
LC
5%
00.31
72.09
92.32
92.94
99.94
92.99
57.18
1.99
91.53
2.38
92.31
92.83
92.16
1072
$4.4K
97.45
$0.05
0.60
64.43
97:41
90.16
1.53
$0.94
0.01
91.61
0.34
86.19
3.61
$9.40
2.87
39.67
0.64
SIG
5%
93.79
95.06
93.61
43.12
95:24
95.05
97.96
45.82
35.51
4.76
92.63
0.94
$7.9%
7.54
90.63
0.40
90.39
3.19
1%
03:82
83.40
95.00
70.51
93.82
83.40
03.56
96.31
91.40
52.69
93:20
57.24
88.16
35.01
91.07
33.71
91.67
10.97
93.73
66.61
96.64
49.27
95:19
73.79
90.72
91.35
0.55
M3A88
29.59
93.09
32,96
95.05
23.00
91.74
29

---

Circumventing Backdoor Space via Weight Symmetry
Table 10.
Results on ImageNet100 under supervised learning scenarios.
Attack
Posson Rate
Defeese
MCR
FI-SAM
BBAU
(ous))
ACC(T>
ASR(1]
ACI2()
ASR(_)
ACCC1)
ASBLC)
ACC(T)
ASS([]
ACC(T)
ASR(()
ACCX))
ASR(1)
ACTOT)
ASB())
ADD(1)
ASR(()
ACCIT)
ASR()
BadNNet
0,55
64.30 30
99. 76
61.36
9.61
81.92
0.53
55.24
59..9 96
78 64
94.15
63.20
9.45
73.70
6.54
73.86
0.25
$0.20
0.22
18
$4.56
09.85
83.10
9.58
$1.92
0.49
85.08
99.86
70.4 19.48
93.64
$3.25
24.14
71.46
43.66
72.84
0.26
78.06
0.14
Bizadal
0.5%
04.32
63.25
94.46
94.32
94.07
$4.56
93.27
75.43
74.22
62.34
73.84
3.72
76.58
80:31
70.21
92.70
63.35
82.00
73.10
75.68
0.5%
76
09.94
67.96
16.57
26.62
69.00 04
83.56
11.59
13.87
42.50
K7.95
99.3 51
71.80
43.1
26.16 16
50
461
Irpassore
13
77.00
05.13
K7.54
25
72.66
43.62
$3.50
08.55
70.50
56.24
X2.00
54.40
73.64
50.55
70.86
24.03
76.46
1099
1F
0.5%
64.24
08.87
63.10
50.25
84.34
08.67
55.70
97.70
$1.52
66.20
63.80
70-45
74:36
74.07
75.22
0.18
78.78
5.39
19
83.90
99.50 56
81.00
19.83
26.76
49.67
99.03
61. 10
08.51
83.40
70.69
71.06
63.18
2.9
98.98
SSRA
0.1%
05.31
14.70
95.31
76.90
6.18
15.70
71:53
76.13
0.88
79.50
bangeeee 100
$4.02
75.47
70.7%
90.22
22.77
20.30
72.55
0.36
79.88
WaNet
0.5%
$3.34
53.92
$4.04
0.95
77.34
22.56
85.30
14.34
79.66
0.00
$3.90
0.12
72.46
0.00
76.18
0.18
80.70
0.25
18
79.62
00.69
84.00
4.87
75.34
14.12
$5.44
25.52
78.96
0.04
63.25
0.26
71.24
1.56
76.42
1.23
$0.20
0.32
SRI--aaNa
0.55
12.50
100.00
85.10
67.07
70.15
3.02
92.76
18.61
05 40
$9.09
K3.95
20.71
72.34
5.52
78.54
2.57
80.52
0.34
18
72.64
100,00
65.36
79.82
69.97
1.95
90.44
67.36
$9.49
$3.69
64.97
74,02
19.33
78.14
0.36
77.48
SBL-Blended
0.5%
72.52
90.56
72.52
97.56
82.54
68.26
97.05
70.76
73,56
14.57
79:42
1%
72.65
99.17
63.41
68.24
71.42
70.14
82.82
95.78
72.72
99.15
63.92
92.69
73.52
20.30
26.78
30.20
27.16
8.87
SAPA
0,55
65.04
08.83
63.44
30.55
76.57
9.20
35.60
95.05
60:42
06
99
69:87
90.04
68:12
15:34
73.34
1000
79.00
1.74
1%
$5.90
98.79
83.34
27.86
77.42
3.52
85.42
95.80
53.12
93.76
$3.95
45:85
09.12
41.64
25.42
1.23
78.14
1.41
LC
0.5%
64.22
0.61
84.22
0.61
14.43
0.57
0.24
69.72
0.56
26.20
0.16
$0.36
12:97
76.25
64:22
21.52
0.9%
64:20
16:23
63.76
7.22
75.48
0.43
15:18
18:54
$4.00
15.86
63.84
70.76
3.43
75,22
0.11
77.30
0.55
13:
84.16
70.05
83.40
20,48
79:58
11.89
45.02
77.84
50.00
05.64
83.36
64.81
70.95
19:98
73.76
0.30
$0.22
998
Table II.
Results on GTSRB under supervised learning scenarios.
No Defenee:
FP'
NC
MCR
ANP
FI-SAM
1-BAU
SAU
TSC (ouns)
Rate
ASRLL
ASRR1
ACCYT)
.DC11)
A.88LL
ACCCIT
(CC(T)
ASRLL
ACDI1
ASRU.
ACC(T)
ASR(D
10/
97.6 62
0.09
97.48
96.00 63
4.16
95.36
0.00
96.47
0.02
97.75
0.02
98.05
BadNer
99.
1%
0.01
98 32
3.35
0.00
98.73
0.02
10.30
98.20
107
96.62
100.00
98.38
100.00
97.76
8.00
96 62
100.00
95.35
42.80
98.35
49.82
92.35
$5.35
15.15
6.51
97.67
1.95
Blanded
5%:
94.66
00.96
96 79
99 41
96.64
14
98 79
90.87
91.02
68.09
96
25.18
84.65
0.00
90.00 90
4.5%
97.18
13.99
1%
08.80
96.95
98.71
95:87
07.00
10.58
98.75
96.00
92.78
79.88
98.57
38.01
03.98
27.65
95.32
2.55
97.11
12.98
1072
09.76
4.46
93.76
59.00
05.19
0.00
99.45
97.09
0.52
06.37
0.06
99.11
aapuzonure
96.76
96.91
4.07
19:
96.75
7.05
99.45
0.05
15
11.13
95.48
0101
59.07
97.87
0100
96.41
0.37
99:40
10%
07.59
99.36
96.29
62.25
97.25
0.27
97.93
98.81
95.07
0.00
98.03
3.98
95.78
15.15
16.45
0.76
98.35
3.91
LF
5%
98.16
03.81
97.80
08:17
99.74
0.02
07.95
98.90
89.00
2.16
96.47
0.09
80.54
1:40
95.88
0.01
98.31
2:05
1%
08.17
96.11
97.63
71.5 56
97.55
0.48
11
99.85
84,00
15. 49
98
1:78
96.70
68.50
94.24
0.01
97.52
CTSR0
1073
07.00
99.47
97.75
09.4 46
97.72
0.29
97.95
83.47
0.00
58.3 98.32
34.21
96.14
1.88
0.32
97.63
SSBA
5%
98.01
97.97
97.65
0.00
98.08
19:
98.34
94.51
96 24
91.3 38
97.51
0.11
96.35 74
95
80.37
0.02
98:40
6.55
86.37
0.96
01.94
1.96
97.48
0.64
10%
07.74
94.25
97.02
$8.07
98.25
0.00
98.52
1.94
97.08
0.00
0.00
0.00
96.72
0.00
96.91
0.04
98.71
0.00
WaNet
5%
07.42
02.85
96.00
12:34
97.42
92.65
08.67
5.80
97.09
0.00
98.97
0.00
97.83
0.25
06.11 19
0.05
98.56
0.00
1%
99.08
96.08
1.54
9.67
96 51
$3.94
97.66
0.00
99.04
96.32
0.00
07.21
0.06
98.50
0.00
10%
83.54
95.47
97.50
0.13
96.44
0.04
96.95
0.00
03.52
0.00
92.05
97.13
0.00
0.50
97.56
SBL BtdNNt
5%
80.21
97.78
0.18
97.67
51.52
92.84
93.73
0.00
98.09
1%
83.05
80.72
92.96 06
56
90.05
0.00
97.4 47
21
93.45
8.64
92.29
0.00
96.35
0.03
96.68
0.05
98.05
0.00
5%
96.31
100.00
98.00
97.31
96.18
0.83
98.24
100.00
95.03
0.02
96.12
0.00
96.42
0.05
96.42
0.06
98.18
0.10
SATA
1%
06.28
100.00
96.10 16
59.42
09.00
0.25
06:27
99.95
95.06
0.02
90.67
0.00
96:22
0.00
96.22
0.00
97.56
0.64
0.5%
95.44
100.00
55.10
97.95
98
0.00
98.63
0.00
95.15
63.65
0.21
0.37
97.64
0.51
0.01
0,1%
96.46
0.00
96:53
0.01
96.27
0.03
95.34
98.10
0.5%
96.52
21.33
96.55
71
98.52
21.50
98:57
68.54
94.34
58.47
97.94
0.63
63.45
0.00
$6.90
0.79
98.08
3.31
0.14
04.69
$8.09
96.94 94
16.11
08.69
1k.00
96:30 70
$7.91
91.31
31.44
94.34
0.91
94.07
0.57
89
16
0.16
98.32
0.08
30

---

Circumventing Backdoor Space via Weight Symmetry
J. Additional Results for Self-supervised Learning
J.1. Self-supervised Learning with SimCLR
Figure 13 illustrates the performance of TSC and MCR against BadEncoder (Jia al., 2022) on CIFARIO and ImageNet using SimCLR (Chen et al., 2020). Table 12 presents the corresponding ultimate defense results of TSC and other baseline defenses. Table 12 shows the defense results against CTRL (Li et al., 2023) on CIFARIO and ImageNet100.
Notably, for the BadEncoder attack, we utilizze publicly available backdoored model checkpoints 3 as the original model, which was trained on ImageNet containing 1,000 classes with image dimensions of 224 x 224. As the original model for the CTRL attack not publicly available, we follow the settings described in the original paper and train the corresponding encoder on ImageNet-100, 100. This version of ImageNet-I00 contains 100 classes. During training, we scale the image dimensions 64 64. Furthermore, we adopt the evaluation methodology from the BadEncoder paper, which employs linear probe evaluation on downstream tasks. For the CTRL attack, also follow the evaluation methods from the original paper: in addition using linear probe, employ the K-Nearest Neighbor (KNN) method to evaluate ACC and ASR on the pre-training dataset.
In defending against BadEncoder attacks, we observe that MCR, SSL-Cleanse (Zheng et al., 2024), and TSC all successfully reduce the ASR values. However, MCR fails to counter backdoor attacks targeting SVHN downstream task. SSL-Cleanse and TSC show similar defense effectiveness, successfully defending against BadEncoder attacks while maintaining high ACC values on downstream tasks. For CTRL attacks, MCR only effective against STL10 dataset. In contrast, both SSL-Cleanse and TSC consistently maintain strong defense performance.
J.2. Self-supervised Learning with CLIP
Table 14 presents the defense results of TSC and MCR against BadEncoder under CLIP (Radford et al., 2021). Since the unlearning algorithm used in SSL-Cleanse defense is based on the simCLR training method, and the original paper of SSL-Cleanse did not conduct experiments in the CLIP learning scenario, we do not test the defense performance of SSL-Cleanse against BadEncoder in this work.
We test on downstream datasets (STL.10, GTSRB, CIFARIO, Food101 (Bossard et al., 2014), and Pascal VOC 2007 (Everingham al.)) and report ACC and ASR using zero-shot nd linear probe methods. TSC maintains strong defense performance against BadEncoder, though it shows lower ACC GTSRB and CIFARIO. In contrast, it outperforms the backdoored model Pascal VOC 2007. This may be due to the use of MS-COCO (Lin et al., 2014) for post-training. MS-COCO shares more similarity with Pascal VOC 2007, while its images differ from those in GTSRB and CIFAR10, leading the CLIP model to "forget" features for the latter datasets.
ASR 1st (TSC)
ACC the 1st (TSC) ASR the 2nd (TSC)
ACC the 2nd (TSC) ASR
ACC
morrinnng Downstrea
training
THEE 20C0--1-00 100001
5
Pretrrinng-CIAA8 Dowestream-S0 SWNN
Text A0L.ACC/A
855
02
04
82
68
35
00
05
10
83
04
Pro trainnng maggNet, Downstream GTSRB
Pro training ImageNot Downstroam SWHN
Figure 13. (Self-supervised Learning, SimCLR) Performance comparison of TSC and MCR against BadEncoder (Jia et al., 2022)
attacks using CIFARIO and ImageNet as pre-training datasets. Model checkpoints are selected at t 0.25 for each stage round.
31

---

Circumventing Backdoor Space via Weight Symmetry
Table 12. Defense results under self-supervised learning (SimCLR) settings. evaluate MCR (Zhao et al.,
2020), SSL-Cleans, (Zheng et al., 2024), and TSC against the BadEncoder attack (Jia et al., 2022).
Pre-training
Downstream Dataset
No Defense
MCR
SSL-Cleanse
TSC (ours)
Dataset
ACC(1)
ASR(L)
ACC(t)
ASR())
ACC(1)
ASR(L)
ACC(1)
ASR(C)
STLIO
76.74
99.65
74.93
7.92
70.51
2.44
71.11
4.44
CIFARIO
GTSRB
81.12
98.79
75.51
0.54
75.50
1.23
77.57
1.68
SVHN
63.12
98.71
57.35
65.58
61.01
7.95
64,
10.26
STLI0
94.93
98.99
90.20
2,08
88.72
1.69
86,99
3.11
ImageNet
GTSRB
75.94
99.76
72.38
0.13
67.55
1.81
69.47
6.47
SVHN
72.64
99.21
71.27
34.15
67.96
66.44
Table 13. Defense results under self-supervised learning (SimCLR) settings. We evaluate MCR (Zhao et al.,
2020), -SL-nleanse (Zheng et al., 2024), and TSC against the CTRL attack (Li et al., 2023). Following CTRL's evaluation methodology, also assess ACC and ASR the pre-training dataset using K-Nearest Neighbor (KNN) classification.
Pre training
Evaluation
No Defense
MCR
ASI.-Cleanse
TSC (ours)
Dataset
Dalaset
ACC(T)
ASR())
ACC(t)
ASR(J)
ACC(1)
ASR(()
ACC(t)
ASR())
CIFARIO (KNN)
84.66
93.84
81,45
82.25
3.95
CIFARIO
STL10 (linear probe)
74.69
25.60
70.48
13.72
70.55
1.28
71.29
2.45
(Poisoning rate-5%)
GTSRB (linear probe)
72.65
41.80
71.05
24.54
69.55
4.16
70.95
4.25
(linear probe)
ImageNet100 100 (KNN)
43.66
42.53
42.39
34.24
41.20
1.86
41.80
0.24
ImageNet100
STLIO (lincar probe)
74.96
17.27
70.24
12.33
69.47
72.05
3.37
(Poisoning mtte55)
GTSRB (lincar probe)
63.58
60.73
SVIN (lineur probe)
56.73
90.77
56.27
52.77
$3.70
10.04
54.39
1.21
Table 14. Defense results under self-supervised learning (CLIP) settings. We evaluate MCR (Zhao al., 2020) and and TSC against the BadEncoder attack (Jia al., 2022).
Pre-training
Downstream Dataset
No Defense
MCR
TSC
Dutaset
ACC(f)
ASR(L)
ACC(t)
ASR(.)
ACC(1)
ASR(J)
STL10
97.07
99.33
96.43
99.86
94.15
GTSRB
82,36
99.40
78.22
99.21
72.42
5.32
CLIP (linear probe)
CIFARIO
86.36
99.98
84.36
99.45
79.31
1.32
Food101
72.58
97.91
72.36
69.33
1.04
Pascal VOC 2007
76.07
99.83
75.47
99.92
78.42
0.34
STI.10
94.06
99. 99.86
91.51
99.85
90.25
0.88
GTSRB
29.94
99.44
24.66
99.34
17.24
2.01
CLIP (zcro-shot)
CIFARIO
69.95
99.39
62.51
99.10
41.59
1.28
Food101
67.72
99.96
66.51
99.56
61.69
0.28
Pascal VOC 2007
71.22
99.92
70.09
99.12
75.08
1.45
J.3. Evaluation of I-BAU and SAU in Self-supervieed Learning
Previously, have presented the defense results of TSC against BadEncoder and CTRL attacks. Our defense, as shown in Figure 1, specifically targets self-supervised learning (SSL) scenarios by directly purifying the encoder. The other SSL defenses we evaluated, such as MCR and SSL-Cleanse, also follow this workflow. This design enables TSC to be effectively applied to zero-shot scenarios, such CLIP, where neither a linear classifier nor fine-tuning is required.
might be noted that other defenses designed for supervised learning (SL) settings, such as I-BAU and SAU, could also be applied to the combined encoder and linear classifier after fine-tuning. Initially, we excluded those defenses from SSL comparisons to maintain fairness and methodological consistency. To address this, we conducted additional experiments
32

---

Circumventing Backdoor Space via Weight Symmetry
evaluate the performance of I-BAU and SAU against BadEncoder with 5% clean downstream training data. The other defense settings are consistent with the SL scenarios involving models trained on CIFARIO and ImageNer100. Table 15 presents the corresponding results.
It's clear that while I-BAU and SAU reduce the ASR, they significantly degrade benign accuracy (ACC). For instance, on CIFARIO-STLAN 10-STL10 settings, the ACC dropped from 76.73% to 30.13% with I-BAU and further to 21.52% with SAU. We suspect this decline occurs because I-BAU and SAU employ post-training methods analogous to adversarial training in SL, potentially harming the representation extraction capability of encoders trained via SSL methods like SimCLR. As these specific findings extend beyond the primary scope of this paper, we reserve more extensive exploration for future work.
Table 15. Defense results of I-BAU (Zeng et al., 2022) and SAU (Wei et al., 2023) under SimCLR training scenario, where linear probing is used evaluate the downstream tasks.
Pre-training Dataset
Downstream
No Defense
I-BAU
SAU
ACC(")
ASR(L)
ACC(1)
ASR())
ACC(t)
ASR(L)
STLI0
76.74
99.65
30.13
12.42
21.52
7.22
CIFARIO
GTSRB
81.12
98.79
22.36
15.10
47.45
5.52
SVHN
63.12
98.71
43.44
17.11
24.07
7.25
STLIO
94.93
98.99
74.62
10.32
81.24
11.83
Im0
GTSRB
75.94
99.76
39.85
7.34
10.75
0.80
72.64
99.21
25.27
13.70
24.37
4.10
K. Clean Accuracy Drops for Non-backdoored Models
To illustrate the impact of TSC on non-backdoored models, this section, we provide additional results on the clean accuracy (ACC) drops for no poison scenarios when applying TSC and other baseline defenses. Tables 16 and 17 present the clean ACC drops of nonobackdoored models under supervised learning and self-supervised learning (SimCLR). respectively.
Except for settings specific to the attacks, the experimental configurations are consistent with those detailed in previous tables. While the ACC drops for TSC are not the lowest among all defenses, they are considered acceptable. Furthermore, the reason why NC always achieves the same ACC as the original model is that NC would check if the model is backdoored before applying it's corresponding unlearning method. The intermediate results of Table 16 show that NC successfully classifies the model as -on-backdoored, thus does not apply any unlearning method.
Table 16. (Supervised Learning) Clean Accuracy (ACC) drop results of various defenses on 11, GTSRB and ImageNet 00 with poisoning rate of (no poison).
Dataset
No Defense
FP
NC
MCR
ANP
FT-SAM
I-BAU
SAU
TSC (ours)
CIFARIO
93.12
92.10
93.12
90.98
91.32
87.47
89.97
91.12
GTSRB
99.20
99.11
99.20
98.14
95.43
98.04
95.40
96.84
98.31
Iet
84.32
82.22
84.32
81,46
77.78
82,90
77.10
76.93
81.44
Table 17. (Self-supervised Learning) Clean Accuracy (ACC) drop results for SimCLR of various defenses on CIFARIO and ImageNet100 with poisoning rate of 0 (no poison).
Pre-training
Downstream
No Defense
MCR
SSL-Cleanse
TSC (ours)
STL10
79.50
77.63
73.01
74.60
CIFARIO
GTSRB
83.68
78.02
78.30
80.39
SVHN
66.57
60.19
63.55
63.41
STL10
95.62
90,92
89,27
89.81
ImageNet100
GTSRB
77.58
74.41
69.90
71.74
SVHN
74.98
72.98
70.14
68.10
33

---

Circumventing Backdoor Space via Weight Symmetry
L. Experimental Setup
Our deep learning training algorithm is implemented using PyTorch. All experiments were run on one Ubuntu 18.04 server equipped with four NVIDIA RTX V100 GPUs. Our implementation for supervised learning mainly based on BackdoorBench (Wu al., 2022). For self-supervised learning, we use the official implementation of BadEncoder (Jia al., 2022) and CTRL (Li et al., 2023) conduct attacks and defenses experiments.
L.1. Attack Settings
(a) BadNets (SBLeBBadNets)
(b) Blend (SBI.Bllended)
(c) SSBA
LFF
(e) InputAware
(f) WaNet
(g) LC
(h) SIG
(i) SAPA
(j) Narcissus
Figure Examples of supervised learning backdoor trigger patterns on ImageNett00. triggers of SBL-BadNets and SBL-Blended are as same as those of BadNets and Blend, respectively.
(I) Supervised Learning. We employed the stochastic gradient descent (SGD) optimization method with batch size of 256. We set the initial learning rate 0.01 and decayed using the cosine annealing strategy (Loshchilov & Hutter, 2016). For the CIFAR-10 and GTSRB datasets, trained for total of 100 epochs. In the of the ImageNet100 dataset, trained for 200 epochs.
Generally, on the CIFAR10, ImageNet100 and GTSRB datasets, the target label for all backdoor attacks is class 0, corresponding to the specific class names "airplane", "tench" and "Speed limit 20km/h". The CIFARI0 and GTSRB images are resized to 32 x 32, while the ImageNer100 images are resized to 224 x 224.
The trigger patterns for BadNet (Gu et al., 2017), Blended (Chen et al., 2017), SSBA 2021), WaNet (Nguyen Tran, 2021), Inputaware (Nguyen & Tran, 2020), LC (Turner al., 2019), SIG (Barni al., 2019), SBL (Pham al., 2024), Narcissus (Zeng et al., 2023) and SAPA (He et al., 2024) are shown in Figure 14. BadNet, Blended, SSBA, LF, WaNet, Inputaware, SBL and SAPA are label-flippigg attacks, which turns the original label of the poisoned data to the target label. LC, SIG and Narcissus are clean label attacks, which utilize the data beloning to the target class to generate poisoned samples. The implementation details for each backdoor attack are as follows:
al., 2021c). LF (Zeng et al.,
BadNets attack (Gu et al., 2017) employs white square placed at the bottom-right corner as the trigger pattern.
Blended attack (Chen al., 2017) poisons the data by introducing Hello Kitty image trigger. We implement the blended injection strategy, denoted as at aar to incorporate the trigger into the benign sample with value
34

---

Circumventing Backdoor Space via Weight Symmetry
of 0.2.
SSBA (Li al., 2021c) utilizes the StegaStemp algorithm (Tancik al., 2020) to generate specific triggers for poison samples across various classes.
LF (Zeng et al., 2021) employs frequency domain analysis and optimization algorithms to create poison samples.
InputAware (Nguyen & Tran, 2020) attack requires the attacker to control the entire training process. During training, the attacker not only trains the model but also trains a generator to produce unique triggers for different samples. The generator continuously optimizes the trigger design while minimizing its size, ensuring high attack success rate.
WaNet (Nguyen & Tran, 2021) uses image embedding to generate invisible triggers for poisoned samples. To enhance attack robustness, WaNet introduces Gaussian noise to poisoned samples with certain probability during training and restores the original labels of these poisoned samples.
LC attack (Turee et al., 2019) utilizes a checkboard pattern positioned in the four corners as the trigger. To establish link between the trigger and the target label, LCC attacks initially employ the Projection Gradient Descent (PGD) method to introduce adversarial perturbations to the images before incorporating the trigger.
SIG attack (Barni al., 2019) utilizes sinusoidal signal that is seamlessly integrated into the image as the trigger.
SBL-BadNet and SBL-Blended attacks (Pham et al., 2024) employ continual learning algorithm to fine-tune poisoned models to generate backdoors that are resilient against previous fine-tuning defenses. We used EWC (Kirkpatrick et al., 2017) the continual learning algorithm, with BadNet and Blended as base attacks.
Narcissus attack (Zeng al., 2023) optimizes universal trigger pattern based a the surrogate (target) model. For fair comparison, used the open-source trigger for CIFARIO from Zeng et al. (2023), with target label "bird".
SAPA attack (He al., 2024) combines sharpness-aware minimization (Foret al., 2021) with the Sleeper-Agent (Souri et al., 2022) backdoor attack to smooth the poison loss landscape. We utilized the colorful patch from (Souri et al., 2022) as the trigger. For CIFAR10 10 and GTSRB, we used an 8 x 8 pixel patch; for ImageNet100, 16 x 16 pixel patch was employed. Other recommended parameters for generating the poisoned samples were adopted from the SAPA and Sleeper-Agent. These included: sharpness sigma = 0.01, number of source samples = 1000, = 250 optimization steps, T retraining periods, and an -nom perturbation bound of 16/255.
Self-Supervised Learning.
(a) BadEncoder
(b) CTRL.
Figure 15. Examples of self-supervised learning backdoor trigger patterns on STL10.
We use publicly available backdoored ResNet18 and ResNet50 models as encoders with SimCLR in the BadEncoder attack (Jia et al., 2022). For CLIP, following the BadEncoder approach, we fine-tune a pre-trained CLIP ResNet50 on ImageNet 100 using SimCLR for 200 epochs to inject backdoors. For the CTRL (Li et al., 2023) attack with SimCLR, we apply the cosine annealing strategy for the learning rate. For the CIFARIO dataset under CTRL, we set the initial learning rate to 0.06 and run for 800 epochs. For the ImageNet100 dataset under CTRL, the initial learning rate is set 0.02 with 1000 training epochs.
Tables 18 and 19 show the dataset and target class settings for BadEncooer and CTRL in different learning scenarios. The post-training dataset refers to the fine-tuning dataset used by each defense method. When the downstream dataset lacks the target class, we add the corresponding class and include target class data from the pre-training dataset to evaluate ACC and ASR. To align with the CTRL paper's settings, we use a 64 x 64 ImageNet100 100 dataset as the pre- me--raining dataset.
The implementation details for BadEncoder and CTRL, attacks are as follows:
35

---

Circumventing Backdoor Space via Weight Symmetry
Table 18. Dataset and larget class settings for BadEncoder attack. the "Requiring extra data" column is marked ' it indicates that
the downstream dataset lacks the target class and we manually add the target class and data to the datasct for evaluating ACC and ASR.
Method
Image Size
Pre-training
Downstrcam
Post-training
Target class
Requiring extra data
simCLR
32x32
CIFAR10
STL10
CIFARI0
truck
simCLR
32x32
CIFARIO
GTSRB
CIFARIO
priority road sign
x
simCLR
32x32
CIFARIO
SVHN
CIFARIO
X
simCLR
224x224
ImageNet
STLI0
ImageNet100
truck
X
simCLR
224x224
ImageNet
GTSRB
ImageNet100
priority road sign
X
simCLR
224x224
ImageNet
SVHN
ImageNer100
X
CLIP
224x224
CLIP
STLI0
MS-COCO
truck
X
CLIP
224x224
CLIP
GTSRB
MS-COCO
stop sign
X
CLIP
224x224
CLIP
SVHN
MS-COCO
0 truck
X
CLIP
224x224
CLIP
Food101, VOC 2007
MS-COCO
Table Dataset target class settings CTRL attack.
Method
Image Size
Pre-training
Downstream
Post-training
Target class
Requiring extra data
simCLR
32x32
CIFARIO
STLI0
CIFARI0
airplane
simCLR
32x32
CIFARIO
GTSRB
CIFAR10
airplane
simCLR
32x32
CIFARIO
SVHN
CIFAR10
airplane
simCLR 64x64
ImageNet100
STLI0
ImageNet100
tench
simCLR 64x64
ImageNet100
GTSRB
ImageNet100
tench
simCLR
64x64
ImageNec100
SVHN
ImageNet100
tench
BadEncoder attack (Jia et al., 2022) requires the attacker to control the training process. During training, the attacker uses the SimCLR loss function to optimize the similarity between poisoned samples and target class images. Similar to BadNets, we use white square in the bottom-right corner as the trigger. The loss function assigns equal weight clean and poisoned samples, i.e., A Aa
CTRL attack (Li al., 2023) uses invisible frequency trigger generate poisoned samples. Following the ommended settings, we set the poisoning rate to 0.5% and the trigger window size to 32. For CIFAR1O, the trigger magnitude is set to 100. For ImageNet100, we use magnitude of 100 for the first 700 epochs and magnitude of 200 for the remaining 300 epochs.
L.2. Defense Settings
We allocate 5% of the clean training samples from each dataset to the defender. For all other settings not specified below, we follow the default settings outlined in their publications public implementation.
Since we use the original mathematical symbols from each publication, please note that some symbols and terms may conflict with each other. All symbols and terms below are specific to the parameters in their respective papers.
(I) Supervised Learning.
FP (Liu et al., 2018): In the experiment, pruning rate for all models is set to 1,, and the number of fine-tuning epochs is 100.
SGD the base fine-tuning method with learning rate of 0.01. The
NC (Wang et al., 2019): We set the threshold of the Anomaly Index at 2 for all the datasets. For models with an Anomaly Index higher than 2 (marked as attacked), we conduct the unlearning procedure for 40 epochs, utilizing 5% of the training data and applying the reversed trigger to 20% of these samples.
ANP (Wu & Wang, 2021): We set the learning rate to 0.2 for optimizing the neuron mask with SGD. After optimization, neurons with a mask value smaller than the threshold of 0.2 are pruned. Additionally, we set the tradeoff coefficient a to 0.2 and the perturbation budget e 0.4 for a total of 2000 iterations.
36

---

Circumventing Backdoor Space via Weight Symmetry
FT-SAM (Zhu al., 2023): SGD is used as the base fine-tuning method with learning of 0.01. The label smoothing rate is set to 0.1, and the SAM (Sharpness-aware Minimization) (Foret al., 2021) optimization method uses a Neighborhood size of p 0.2. The number of fine-tuning epochs is 100.
I-BAU (Zeng al., 2022): We follow the default settings provided the public implementation of I-BAU. We use Adam with learning rate of le- to optimize the outer loop. And, we the maximum number of unlearning rounds to 5 and the maximum number of fixed-point iterations to 5.
SAU (Wei et al., 2023): We iterate 5 times to compute the adversarial perturbation, using an &o norm with perturbation bound 0.2 and adversarial learning rate 0.2. The total epochs for CIFARTO and GTSRB are 100, and for ImageNet100, 50 epochs. We the unlearning weights A X2 24 and X 0.1.
TSC (ours): We set the global number of epochs Ersc = 3, curve index t = 0.4, and curve training epochs = 200. The initial learning rate is set to 0.02, with cosine annealing used for post- post-training. After every round of TSC, we slightly fine-tune the model extracted from the second stage for 5 epochs with learning rate of 1e-
MCR (Zhao et al., 2020): For a fair comparison with TSC, we set the curve index - 0.4 and curve training epochs = 200. The initial learning rate is 0.02, and cosine annealing is used for post-training.
(2) Self-Supervised Learning.
SSL-Cleanse (Zheng et al., 2024): This method is specifically designed for defending against backdoors in self- supervised learning. Similar NC, first attempts to restore the trigger pattern and then applies an unlearning method to remove the backdoor. We the initial value of 0.01 and use learning of 0.01.
TSC (ours): We set the global number of epochs Ersc = 2 and the curve index = 0.25. All learning rates use a cosine annealing strategy for iteration. (1) For SimCLR, we set the batch size to 256, the curve training epochs e = 200, and use Adam with an initial learning rate of 5e for CIFAR1O and 2e for ImageNet100. After every round of TSC. we slightly fine-tune the model extracted from the second stage for 5 epochs with a learning rate of 5e-5, (2) For CLIP, follow the training method proposed by Radford et al. (2021), setting the batch size 32768 and using Adam with an initial learning rate of 1 (81 = 0.9, $2 = 0.999). For such a large batch size, we use gradient accumulation to update the model, with each stage training for only 2 epochs. After every round of TSC, we do not fine-tune the model extracted from the second stage.
MCR (Zhao al., 2020): We set the curve index t 0.25. All other parameters the same as those used in TSC.
37


Reviews:
[{"review_id": "pB8f9rwACo", "reviewer": "Reviewer_nnZL", "summary": "This paper proposes a new method for removing backdoor attacks from trained models post-training. Specifically, it maps the network to a different basin resulting in an functionally equivalent model and then shows that the bezier curve that cnnects the original and new model greatly reduces the adversarial samples loss. However, performing a single bezier curve also hurts the performance on clean samples, and another bezier curve from the original model to a point on the first curve is needed to fix that. This process is repeated a few times to get the clean model.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your insightful comments! We address your concerns as below.\n\n**W1: Applicability of the Proposed Setting (Threat Model)**\n\nAs clarified in Section 3.4, we specifically consider two practical scenarios where defenders either face partial data poisoning or do not control the initial training procedure:\n\n(1) Data Poisoning Scenario: When an adversary poisons only a portion of the training data, defenders typically retain control over training. Consequently, they possess complete knowledge of the training process. This allows them to effectively apply post-training purification defenses like our proposed method.\n\n(2) Adversarial Training Control Scenario: We agree this scenario warrants additional clarification. Here are two real-world examples:\n - **Public Pre-trained Models**: Public repositories or research papers release pre-trained models that may contain backdoors. Since these sources typically provide detailed descriptions of the model-training procedure, defenders can leverage this information to apply TSC effectively. Using public large-scale image encoders for downstream tasks is increasingly common, making our setting practically relevant. Advanced zero-shot deployment models (e.g., CLIP) further exemplify this applicability.\n - **Internal Adversary in Organizations**: Consider an internal adversary scenario within an organization where malicious attackers backdoor a model without others' awareness. Typically, benign team members possess knowledge of the basic training process but lack insight into the malicious manipulations. In this context, defenders within the organization can deploy TSC to purify the model without taking retraining from scratch.\n\n**W2: Evaluation of SAU in Self-Supervised Scenarios**\n\nIndeed, supervised learning (SL) defenses such as SAU can be applied to the combination of encoder and linear classifier after fine-tuning. **However, as shown in Fig.1, our TSC approach specifically targets self-supervised learning (SSL) scenarios by directly purifying the encoder rather than the combined model. The other SSL defenses we evaluated, such as MCR and SSL-Cleanse, also follow this workflow**. This design enables TSC to be effectively applied to zero-shot scenarios, such as CLIP, where neither a linear classifier nor fine-tuning is required.\n\nInitially, we excluded SAU from SSL comparisons to maintain fairness and methodological consistency. Nevertheless, following your suggestion, we conducted additional experiments applying I-BAU and SAU to the combined model (SimCLR) using 5% downstream labeled data. The experiments were conducted under identical conditions as those in Appendix J.2, using the same backdoored models in Tab.2.\n\nThe results below indicate that while I-BAU and SAU reduce the ASR, they significantly degrade benign accuracy (ACC). For instance, on CIFAR10-STL10, the ACC dropped from 76.73% to 30.13% with I-BAU and further to 21.52% with SAU. We suspect this decline occurs because I-BAU and SAU employ post-training methods analogous to adversarial training in SL, potentially harming the representation extraction capability of encoders trained via SSL methods like SimCLR.\n\nWe will include these findings and discussions in the revised manuscript.\n|Pre-training|Downstream|No Defense||I-BAU||SAU||\n|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|\n|||ACC|ASR|ACC|ASR|ACC|ASR|\n|CIFAR10|STL10|**76.74**|99.65|**30.13**|12.42|**21.52**|7.22|\n||GTSRB|**81.12**|98.79|**22.36**|15.10|**47.45**|5.52|\n||SVHN|**63.12**|98.71|**43.44**|17.11|**24.07**|7.25|\n|ImageNet100|STL10|**94.93**|98.99|**74.62**|10.32|**81.24**|11.83|\n||GTSRB|**75.94**|99.76|**39.85**|7.34|**10.75**|0.80|\n||SVHN|**72.64**|99.21|**25.27**|13.70|**24.37**|4.10|\n\n**W3: Selection of t**\n\nActually, the curve index t used in our method was **consistently fixed** across experiments.\n - For experiments in SL (Tabs. 1, 4, 5, and 7-11), we set t=0.4. \n - For experiments in SSL (Tabs. 2, 3, 6, and 12-14), we set t=0.2.\n\nThe rationale behind these selections is detailed in Appendix G.1. We guess your confusion may have arisen from Fig.3, where our intention was to show the trend in accuracy across various t for analytical purposes. In practice, no experiment-specific tuning of t was performed.\n\n**C1: Clarity of Fig.3**\n\nWe agree that Fig.3 currently appears complex due to the multiple scenarios presented. In the revised manuscript, we plan to simplify Fig.3 by focusing on the results against SSBA, aligning with Fig.2 for consistency. Additionally, we will split the visualizations of ASR and ACC trends into two separate subfigures to enhance readability.\n\n**Q1:Details of Experiment in Fig.2**\n\nCurrently, detailed information regarding Fig.2 is provided in the caption text. \nThe experiment involves a PreAct-ResNet18 model trained on the CIFAR-10 dataset, with the SSBA backdoor attack (5% posion rate). Since the information is buried in the text, we will explicitly include these details within Fig.2 itself.", "claims_and_evidence": "I believe the claims presented in the paper are convincingly supported by evidence.", "methods_and_evaluation_criteria": "The evaluation criteria make sense to me for this problem.", "theoretical_claims": "The theoretical analysis seems valid to me.", "experimental_designs_or_analyses": "The experimental design seems valid to me.", "relation_to_broader_scientific_literature": "This paper aims to purify corrupted models which is important as neural network models are used for decision making, therefore we do not want to allow for backdoor attacks on them.", "essential_references_not_discussed": "-", "other_strengths_and_weaknesses": "Strengths:\n\n  - The paper is well written and easy to follow.\n  - The analysis (Figure 2) of the two loss landscapes over the curve between connecting the points from different basins is interesting. Moreover, the idea of transferring to a point on the connecting curve from another basin to remove the overfitting for adversarial examples is clever.\n  - The approach is applicable to both supervised and self-supervised settings.\n\nWeaknesses:\n  - The motivation for this problem is not very clear to me. On the one hand, the training procedure is known, but on the other hand I dont haver control over it. It seems like a niche scenario. Can the authors give a few examples for when is this setting applicable?\n  - In the supervised scenario the SAU baselines reaches comparable performance but it is not evaluated for self-supervised scenarios. However, since the self-supervised scenarios are evaluated by training a linear probing classifier on the backbone, it seems that SAU can be implemented over that linear probing classifier (i.e., in this scenario the purification happends after the fine-tuning of the model). As it shows strong performance in the supervised setting it would be helpful to add it to Tab. 2 and 3 as well.\n  - Different t values are chosen for different experiments, however, in practice this hyper-parameter tuning is not possible as the adversarial samples are not given.", "other_comments_or_suggestions": "- Figure 3 is very difficult to understand and could benefit from making the colors more clear / presenting less scenarios.", "questions_for_authors": "- Can the authors provide more details on the experiment performed in Figure 2? E.g., what dataset was used? which backdoor attacks?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2YHGS36bUR", "reviewer": "Reviewer_XfkX", "summary": "The authors proposed an extension to Mode Connectivity Repair (MCR) [Zhao et al. (2020)]. The task is to purify a backdoored model using a small number of clean samples. MCR uses the poisoned model and a fine-tuned model to find an intermediate model that can lower the attack effectiveness.\n\nThe proposed model introduces an extra stage to induce a more misaligned alternative model. This involves two stages:\n\nStage 1. Instead of using a fine-tuned model directly, permute the latent nodes to introduce a loss barrier between the new model and the original model (as shown in Figure 2b). Construct a curve through the barrier, and then along the curve, select an intermediate model that is more misaligned than a fine-tuned model.\nStage 2. Use the model from Stage 1, then construct another curve that allows us to find a different model with a low loss for clean data but likely a high loss for poisoned data. This stage is similar to MCR.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your insightful comments! We address your concerns as below.\n\n**Theoretical Claims: Lipschitz Condition**\n\nThe Lipschitz condition required in Theorem 4.2 and Corollary 4.3 specifically applies to the loss and activation functions, which is realistic and commonly satisfied by standard deep learning practices. For instance:\n\n- Softmax Cross-Entropy Loss: Although the original cross-entropy loss alone is not Lipschitz continuous, the softmax normalization—commonly used in classification tasks—renders the resulting softmax cross-entropy loss Lipschitz continuous with constant $\\sqrt{2}$ under the $\\ell_2$-norm. This condition is sufficient to derive Eq.34 (Line 830) in our proof.\n- Activation Functions:  \n  - ReLU: 1-Lipschitz  \n  - Sigmoid: $\\frac{1}{4}$-Lipschitz  \n  - Tanh: 1-Lipschitz  \n\nThus, the Lipschitz condition utilized in our analysis is practically relevant and aligned with typical neural network implementations.\n\n**W1: Difficulty with Notation and Writing Clarity**\n\nThank you for your valuable feedback. \nWe agree that some notations may have been unclear or inadequately explained. \nTo address this, we plan to revise the manuscript as follows:\n\n- **Clarifying Notation**: For notations defined in the preliminaries, such as $M_l(\\theta_A, \\theta_B;D)$, we will revisit their basic meaning when they are specifically employed in the analysis.\n\n- **Simplifying Complex Notations**: For notations involving complex symbols, such as $W_2(\\mathbb{P}\\_{x_l^{adv}}, \\mathbb{P}\\_{x_l^{adv*}}; D_{adv})$, we will simplify them by replacing the inner parts with more straightforward and clear symbols. \nFor example, we will denote the distribution $\\mathbb{P}\\_{x_l^{A}}$ as $\\mathbb{P}\\_l ^A$ and rewrite $W_2(\\mathbb{P}\\_{x_l^{ adv}}, \\mathbb{P}\\_{x_l^{adv*}}; D_{adv})$ as $W_2(\\mathbb{P}\\_l^{\\\\; adv}, \\mathbb{P}\\_l^{\\\\; adv*}; D_{adv})$ for better clarity.\n\nDue to space limitations in the initial version, certain details about mode connectivity and permutation invariance were placed in Appendices A-C. Additionally, some intuition and mechanisms behind our method were left out of the main text for brevity. \n\n**Given the additional page allowance in the final version, we will move relevant content into the main text to improve readability and ensure all essential details are more accessible.**\nThe concrete pseudocode for the function ***PermuteLayers*** will also be included in Appendix E.\n\n**Q1: ACC Drop Results for Poison Rate=0**  \n\nWe have included the ACC drop results for Poison Rate=0 (i.e., clean model) in the following tables:\n\n- Supervised Learning (SL): The first table shows the results for CIFAR-10, GTSRB, and ImageNet100 in supervised learning settings.\n\n- Self-Supervised Learning (SSL-SimCLR): The second table presents results for two pre-training datasets, CIFAR-10 and ImageNet100, along with their corresponding downstream datasets.\n\nThe training settings are consistent with those in Tabs.1 and 2, except for the attack settings.\n\nIt's clear that ACC drops for TSC are small at Poison Rate=0. We will include these results in the revised manuscript.\n\n|Clean Dataset (SL)|No Defense|FP|NC|MCR|ANP|FT-SAM|I-BAU|SAU|TSC (ours)|\n|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|\n|CIFAR10|93.12|92.10|93.12|90.98|83.09|91.32|87.47|89.97|91.12|\n|GTSRB|99.20|99.11|99.20|98.14|95.43|98.04|95.40|96.84|98.31|\n|ImageNet100|84.32|82.22|84.32|81.46|77.78|82.90|77.10|76.93|81.44|\n\n|Pre-training (SSL-SimCLR)|Downstream|No Defense|MCR|SSL-Cleanse|TSC (ours)|\n|:---:|:---:|:---:|:---:|:---:|:---:|\n|CIFAR10 (Clean)|STL10|79.50|77.63|73.01|74.60|\n||GTSRB|83.68|78.02|78.30|80.39|\n||SVHN|66.57|60.19|63.55|63.41|\n|ImageNet100 (Clean)|STL10|95.62|90.92|89.27|89.81|\n||GTSRB|77.58|74.41|69.90|71.74|\n||SVHN|74.98|72.98|70.14|68.10|\n\n\n**Q2: Use of Same $t$ for Both Stages in Algorithm 1**\n\nIn our original design, the parameter $t$ is used in both stages, with its values ranging from [0, 1]. We initially chose to use the same $t$ for both stages to maintain a simpler parameter design. Introducing different values of $t$ for each stage would increase the complexity of the design and lead to numerous potential parameter combinations, which could complicate the overall algorithm.\n\nMoreover, as shown in Figs.3 and 6–10, the ACC/ASR values in Stage 1 exhibit a roughly symmetric pattern with respect to $t$, whereas in Stage 2, they decrease as $t$ increases. Although the trends differ across the full range $t \\in [0,1]$, they remain consistent within $t \\in [0,0.5]$. Notably, in Stage 2, ASR decreases while ACC remains high around $t = 0.5$. Considering this and the symmetry in Stage 1, we select $t$ within $[0,0.5]$ for both stages. Within this range, both stages show a decreasing trend in ACC/ASR, making it reasonable to use similar $t$ values to balance high ACC and low ASR.  \n\n\nWe hope this explanation clarifies our design decision. We will include this discussion in the final version.", "claims_and_evidence": "Overall, there is a broad set of empirical evaluation, with reasonable results supporting the claims on performance gains.", "methods_and_evaluation_criteria": "yes.", "theoretical_claims": "I have not verified the proofs, although the Lipschitz condition seems unrealistic.", "experimental_designs_or_analyses": "The experimental designs seem reasonable with my cursory check.", "relation_to_broader_scientific_literature": "The work is related to purifying poisoned models through purification. Prior work uses mode connectivity to induce a high-quality fine-tuned model. This work uses permutation invariance to create a loss barrier targetting the poisoned samples. This overcomes the challenge of insufficient difference in a continuously fine-tuned model. The idea is novel and interesting.", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "Strengths:\n- Novel combination of permutation and mode connectivity \n\nWeaknesses:\n- I find the writing difficult to follow, with confusing notation choices and sometimes missing important information.", "other_comments_or_suggestions": "N/A", "questions_for_authors": "1. Can you include the ACC drop results for Poison Rate=0 (no poison)?\n2. In Algorithm 1, why use the same curve index t for both stages?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "zCdDxftdiW", "reviewer": "Reviewer_uSaT", "summary": "This paper introduces a backdoor purification method called Two-stage Symmetry Connectivity (TSC). The approach is devided into two stages, aiming to use permutation invariance and mode connectivity to circumvent backdoor spacenwhile maintaining clean accuracy. The method is designed to be applicable beyond supervised learning, including self-supervised learning frameworks such as SimCLR and CLIP. Theoretical analysis and empirical results is provided to support the approach.\n\n## update after rebuttal\nThe authors have addressed most of my concerns. So I decide to raise my score to weak accept.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your insightful comments! We address your concerns as below.\n\n**W1.Assumption of TSC and Advanced attacks**\n\nThe assumption that \"benign and backdoor samples occupy significantly different loss landscape basins\" does not fully correspond to our method. Instead, the underlying mechanism we rely on is based on research in the field of mode connectivity (Frankle et al., Tatro et al.). In these studies, it is observed that the curve connecting two aligned models (i.e., models lying in the same loss basin) typically exhibits lower loss compared to the curve connecting misaligned models. In Stage 1 of TSC, we leverage this mechanism to amplify the loss of poisoned samples.\n\nDue to time constraints, we included experiments against SBL [2] and Narcissus [3], and the results are discussed in **W2: Additional Advanced Attacks for Reviewer AW4n**. We are actively working with SPAP[1] and will include the results in a future discussion.\n\n**W1, W2, Q1, Q2 & Q4: Mechanism of TSC**\n\nDue to space limitations, some explanations were deferred to Appendices A-C. We explain the mechanism of TSC in the following workflow:\n1. Unalignment\n   - Eq.8 is used to compute the permutation $P_l'$, which projects the backdoor model $\\theta_{adv}$ into a different loss basin. As noted in Sec.3.2, the permutation operation does not change the original function output for the same input **(i.e., $f(x, \\theta_{adv}) = f(x, \\theta_{adv}')$). Thus, solving the optimization problem in Eq.8 does not increase the loss of poisoned or benign samples for $\\theta_{adv}'$**. \n   - Since solving Eq.6 (argmin) aligns two models, we aim to unalign $\\theta_{adv}$ and $\\theta_{adv}'$ by solving the opposite problem (argmax, Eq.8) in this step.\n\n2. Training the Curve $\\gamma$:\n   - We then train the curve $\\gamma$, connecting $\\theta_{adv}$ and $\\theta_{adv}'$, and pick a midpoint along $\\theta_t$ as the core step to increase the loss for poisoned samples.\n   -  As mentioned in rebuttal section *W1.Assumption of TSC and Advanced attacks*, unaligning the models increases the loss along the connecting curve.\n   - However, once trained, the curve (e.g., Bezier curve in our method) can find a low-loss path even between unaligned models (Garipov et al.). **As we only train $\\gamma$ with benign samples, the loss of benign samples remians low while the adversarial loss can be amplified along the curve.** As shown in the middle of Fig.2, adversarial loss is notably high along $\\gamma$. Meanwhile, the benign ACC of $\\theta_t$ we picked degrades as the endpoints are unaligned. Thus, we need Stage 2 to retain the clean accuracy.\n\n3. Second Stage: Re-aligning to Retain Clean Accuracy\n   - Inspired by model fusion literature (Tatro et al., Ainsworth et al.), we recover clean accuracy by re-aligning $\\theta_t$ with $\\theta_{adv}$.\n   - Given that $\\theta_t$ and $\\theta_{adv}$ may not lie in the same loss basin for benign samples, we re-align them using Eq.6. After alignment, the benign loss along the curve connecting $\\theta_t*$ and $\\theta_{adv}$ is expected to be low, which helps recover accuracy.\n   - Again, aligning does not alter the model's output for a fixed input. **Hence, after being aligned with $\\theta_{adv}$, $\\theta_t$ still exhibits high loss for poisoned samples. Since $\\theta_{adv}$ is the original poisoned model, the distribution difference between $\\theta_{adv}$ and $\\theta_t$ leads to an increase in adversarial loss as the point approaches the aligned $\\theta_t$.**\n\n**W4: Complex Notations**\n\nWe agree that some notations may be difficult to follow. A more detailed response can be found in the rebuttal section **W1: Difficulty with Notation and Writing Clarity for Reviewer XfkX**.\n\n**W3, Q3 & Q4: Contribution and Concerns of Theorem**  \n\nAs mentioned in Line 297, Tatro et al.'s work covers linear mode connectivity, but their result doesn't directly extend to quadratic mode connectivity, such as with Bezier curves. Our Theorem 4.2 addresses this gap by providing the proper analysis and incorporating $M$ for models with varying feature distances.\n\nEq.2 and Eq.9 are equivalent; we use Eq.9 for clarity, and the derivation is provided in Eq.14.\n\nAs mentioned above and to the right of Line 299, the distribution differences at the endpoints of Stage 2 account for these results. We will include the above discussion in the final manuscript.\n\n**W5 & Q5: Evaluation of Adaptive Attacks**  \n\nThe adaptive attack is indeed designed to learn a backdoored model that maintains a low backdoor loss along the defensive curve identified by Stage 1 of TSC. However, we find that, via Eq.8, TSC always finds an endpoint in a different loss basin from the both $\\theta_{adv}$ and $\\theta_{adv}'$ in Algorithm 3. We will include additional loss landscape visualizations (similar to Fig.2) in the revised version to illustrate how TSC locates a endpoint.\n\n**Typos**: We will correct these typos in the revised version.", "claims_and_evidence": "Yes. The core claims (i.e., TSC can effectively remove backdoors across different learning paradigms by utilizing mode connectivity and weight symmetry) are backed by empirical results in various settings. However, some theoretical claims (or assumptions) are not rigorously justified. Specifically, the assumption that the first-stage unalignment always increases backdoor loss and the second stage re-alignment would only decrease clean loss is not thoroughly explained, i.e.,\n\n- The claim that Eq. (8) optimization increases poisoned sample loss, despite being trained only on benign samples, is not well-supported.\n- Corollary 4.3 states that re-aligning the model with clean samples leads to selective clean accuracy recovery, but it lacks concrete justification.", "methods_and_evaluation_criteria": "Yes. The paper uses Attack Success Rate (ASR) and Clean Accuracy (ACC) as primary evaluation metrics, which are widely used in backdoor defense research. The experimental setup appears rigorous, covering a variety of datasets, attack strategies, and learning settings. The authors also evaluated their approach against potential adaptive attacks.", "theoretical_claims": "Yes, I briefly looked through the proofs. Overall, the claims align with intuition and the conclusions of previous studies. I skimmed the detailed proofs in the Appendix and did not notice any obvious issues, but I did not follow each step of the derivation in depth due to time constraints.", "experimental_designs_or_analyses": "Yes. The experimental setup appears rigorous, covering a variety of datasets, attack strategies, and learning settings. The authors also evaluated their approach against potential adaptive attacks. The results provide good empirical support for the method's effectiveness. However:\n\n- The paper does not fully explain why unaligning the model in the first stage effectively increases the backdoor loss. It assumes that benign and poisoned samples lie in easy-to-separate loss basins, but this may not always hold.\n- The paper proposes an adaptive attack but does not provide sufficient analysis of why it fails against TSC. Further exploration would strengthen the paper.", "relation_to_broader_scientific_literature": "This paper is relevant to the field of backdoor defenses and aligns with recent work on mode connectivity and weight permutation strategies. However, it does not sufficiently compare with backdoor defenses that actively disentangle benign and poisoned features or strengthen their resistance through finding flat backdoor minima — which might be critical in evaluating TSC’s generalizability.", "essential_references_not_discussed": "Yes. I recommend the authors to evaluate the method's effectiveness on modern adaptive backdoor attacks that optimize flatter loss landscapes or entangle benign & backdoor features, which may violate the assumption of the paper:\n\n[1]: He et al. Sharpness-Aware Data Poisoning Attack. ICLR 2024.\n\n[2]: Pham et al. Flatness-Aware Sequential Learning Generates Resilient Backdoors. ECCV 2024.\n\n[3]: Zeng et al. Narcissus: A practical clean-label backdoor attack with limited information. CCS 2023.", "other_strengths_and_weaknesses": "## Strengths:\n- Backdoor attacks are a major security risk in machine learning and defending against them is thus very important.\n- Unlike many existing defenses, TSC is applicable to learning paradigms beyond supervised learning (e.g., SSL), broadening its impact.\n- The experiments demonstrate that TSC effectively reduces ASR while maintaining competitive ACC.\n- Discovering defenses from the perspective of loss landscape and mode connectivity is quite interesting and valuable as it provides some level of interpretability.\n\n\n## Weaknesses:\n- The paper does not clearly explain why the first stage's unalignment effectively increases backdoor loss. It appears to rely on the assumption that benign and backdoor samples occupy significantly different loss landscape basins, making the interpolation likely to land in a high-loss region for backdoor samples. However, this assumption may not hold for all backdoor attack methods, particularly those that already tightly couple benign and trigger-related features or train models with flatter backdoor loss landscapes. Since the paper does not experiment with such methods and only provides a loose theoretical bound on the upper loss relationship, I suggest adding more experiments to validate the generalizability of the approach on more advanced backdoor attacks [1-3].\n- The authors claim that optimizing according to Eq. (8) can increase the loss of poisoned samples. However, in practice, the training process only involves benign samples. How does this ensure that poisoned samples experience a loss increase? Additionally, why does the method require an argmax operation? Would this not cause a significant degradation in benign sample performance for the adversarially updated model $θ'_{adv}$?\n- The theoretical contributions of the paper appear somewhat incremental. Theorem 4.2 mainly states that feature-aligned networks exhibit mode connectivity curves with smaller loss expectations, which has already been explored in prior work (Tatro et al.). The paper extends this idea but does not provide fundamentally new insights. Furthermore, Eq. (2) and Eq. (9) appear different in formulation—why is the latter necessary, and are they truly equivalent? Additionally, Corollary 4.3 claims that the proposed optimization increases loss along the mode connectivity curve for both clean and poisoned samples. However, in the second stage, when re-aligning to the original model’s basin, the authors assume that only the clean sample loss will significantly decrease. This claim lacks justification.\n- The notation is somewhat complex, making the paper difficult to follow to some extent. For example, Ml(θA, θB ; D) is introduced early (Line 170) but used much later, creating confusion. The PERMUTELAYERS function is also recommended to be presented as pseudocode for clarity.\n- The adaptive attack introduced in the paper appears to be a strong method against TSC. However, it fails against the proposed defense. Why does this happen? Additional analysis would improve the comprehensiveness of the paper's understanding of the method’s limitations.\n\n\nThe reviewer will actively participate in the rebuttal and would like to increase the score if the aforementioned concerns are alleviated properly.", "other_comments_or_suggestions": "Minor Issues:\n\nLine 297: \"similary\" → \"similar\"\n\nLine 324: \"origianl\" → \"original\"", "questions_for_authors": "- Why does the first stage’s unalignment procedure work effectively to increase backdoor loss? Could this assumption fail for attacks with highly entangled benign and backdoor features?\n- How does optimizing Eq. (8) ensure that poisoned samples receive a higher loss, given that training only involves benign samples?\n- Why is the formulation in Eq. (9) necessary, and is it equivalent to Eq. (2)?\n- Why does the second stage of the method selectively lower clean sample loss while maintaining high loss for poisoned samples?\n- The adaptive attack appears strong, yet it fails against TSC. Why is this the case? A deeper analysis would be beneficial.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "iBqVfgKUxg", "reviewer": "Reviewer_AW4n", "summary": "The paper highlights the vulnerability of deep neural networks to backdoor attacks, which can compromise model integrity and lead to unauthorized access or malfunction. The proposed method TSC leverages the concept of weight symmetry to purify models. It trains a quadratic Bezier curve in the parameter space, connecting two endpoint models, and selects a point along this curve as the final model to mitigate backdoor attacks.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely appreciate your insightful comments! We address your concerns as below.\n\n**W1: Adaptive Attack Design**\n\nDue to space limitations, the initial version includes implementation details and the design of the adaptive attack in **Appendix F**, with the attack process outlined in **Algorithm 3**, which provides a detailed intuition and workflow of our designed adaptive attack.\nMoreover, for Reviewer uSaT, the adaptive attack is considered strong. \n\nDuring the rebuttal period, we further analyzed the attack and found that, via Eq. (8), TSC consistently identifies an endpoint in a different loss basin from both $\\theta_{adv}$ and $\\theta_{adv}'$ in Algorithm 3. To better illustrate this, we will include additional loss landscape visualizations (similar to Fig. 2) in the revised version to demonstrate how TSC locates this endpoint.\n\n**If you have specific questions about our adaptive attack, we welcome further discussion.**\n\n\n**W2: Additional Datasets**\n\nIn addition to CIFAR-10, ImageNet100, and GTSRB, in the initial version, \na variety of other datasets in the self-supervised learning scenario were employed in our experiments. Detailed information on these datasets can be found in **Tables 15 and 16 of Appendix J**. \n\nFor instance, in the case of the CLIP model, we fine-tuned the backdoored CLIP model on the **MS-COCO** dataset and conducted downstream task experiments on **five datasets: STL10, GTSRB, SVHN, Food101, and VOC 2007** . \n\nWe believe the current results on these datasets sufficiently demonstrate the generalizability of our algorithm.\n\n**W2: Additional Advanced Attacks**\n\nFollowing your feedback and Reviewer uSaT's comments, we are also considering implementing attacks based on the loss landscape of poisoned samples, including SPSA [1], SBL [2], and Narcissus [3], in the supervised learning setting. These modern adaptive backdoor attacks optimize flatter loss landscapes or entangle benign and backdoor features.\n\nDue to time constraints, we included experiments against SBL [2] and Narcissus [3]. We are actively working on incorporating SPAP [1] and will provide results in a future discussion.\n\nFor the experiments with the PreActResNet18 on CIFAR-10, we present the following comparative results (we will also include similar experiments for ImageNet100 and GTSRB).  \n- For the SBL attack [2], we used EWC as the continual learning algorithm, with BadNet and Blended as base attacks, and experimented with poison rates of 10%, 5%, and 1%.\n- For the Narcissus attack [3], we used the open-source triggers from [3], with poison rates of 5%, 1%, and 0.5%. Other experimental settings were consistent with the original paper.\n\nThe results show that TSC effectively defends against these attacks. The Narcissus attack (poison rate = 5%) exhibits the strongest attack effect on our defense, but its ASR remains below 20%.\n\nWe plan to include the corresponding results in the revised version, along with ASR/ACC plots for these attacks as functions of t, similar to Figure 3.\n\n\n|Attack|Poison Rate|No Defense|||FP|||NC||||MCR|||ANP|||FT-SAM|||I-BAU|||SAU|||TSC (ours)||\n|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|\n|||ACC|ASR||ACC|ASR||ACC|ASR|||ACC|ASR||ACC|ASR||ACC|ASR||ACC|ASR||ACC|ASR||ACC|ASR|\n|**SBL-BadNet**[2]|10%|91.30|95.11||92.00|91.07||91.63|0.34|||91.37|70.99||90.72|0.00||91.41|89.13||88.99|17.09||90.63|1.52||**90.36**|**0.21**|\n||5%|90.79|93.48||92.59|1.13||92.22|0.59|||92.26|91.82||82.82|51.63||92.16|60.03||90.67|27.06||91.31|0.60||**91.02**|**1.12**|\n||1%|91.71|88.64||93.10|31.77||91.82|0.72|||93.23|86.11||82.71|81.48||92.77|59.58||90.63|2.00||92.32|1.01||**91.54**|**1.93**|\n|**SBL-Blended**[2]|10%|90.46|94.12||92.49|29.61||90.46|88.12|||92.51|99.91||86.32|52.96||92.40|74.02||91.44|22.79||88.11|9.09||**90.98**|**8.27**|\n||5%|91.70|97.67||92.97|79.74||91.70|97.67|||92.75|99.61||85.13|20.48||92.50|77.90||89.65|57.41||91.43|11.53||**90.47**|**8.94**|\n||1%|92.07|91.84||93.43|83.80||92.07|91.84|||93.37|95.02||85.30|58.19||93.31|82.64||90.67|64.08||92.34|16.31||**90.11**|**6.70**|\n|**Narcissus**[3]|5%|93.72|90.91||91.93|68.61||93.72|80.91|||93.63|86.64||87.87|49.27||93.19|27.92||87.82|73.79||90.72|1.57||**91.35**|**14.48**|\n||1%|93.68|82.87||92.29|44.88||93.68|47.87|||93.61|49.79||92.01|27.01||93.05|26.80||90.21|18.67||91.36|3.24||**90.65**|**7.88**|\n||0.5%|93.68|80.58||92.94|29.59||93.67|32.57|||93.69|32.96||89.35|16.78||93.06|14.08||89.16|21.09||91.74|5.81||**91.71**|**8.02**|\n\n[1]: He et al. Sharpness-Aware Data Poisoning Attack. ICLR 2024.\n\n[2]: Pham et al. Flatness-Aware Sequential Learning Generates Resilient Backdoors. ECCV 2024.\n\n[3]: Zeng et al. Narcissus: A practical clean-label backdoor attack with limited information. CCS 2023.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "Yes", "experimental_designs_or_analyses": "Yes", "relation_to_broader_scientific_literature": "/NA", "essential_references_not_discussed": "/NA", "other_strengths_and_weaknesses": "## Strengths\n\nThe paper emphasizes the potential societal benefits of enhancing model security by eliminating backdoor behavior across various machine learning scenarios.\n\nThe proposed method is evaluated against various backdoor attacks under both supervised and self-supervised learning settings. Results demonstrate TSC's robustness across different datasets and model architectures.\n\n## Weaknesses\n\nThe details on how the adaptive attacks were designed and implemented are sparse.\n\nThe evaluation is primarily conducted on CIFAR-10, ImageNet100, and GTSRB datasets. While these datasets are commonly used in the field, it would be beneficial to see the performance of TSC on a wider range of datasets, particularly in real-world scenarios where backdoor attacks may be more sophisticated.", "other_comments_or_suggestions": "/NA", "questions_for_authors": "/NA", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The paper received mixed scores pre-rebuttal. The rebuttal addressed the reviewers' concerns well, making both Reviewers uSaT and AW4n increase their scores. The final scores include 2 Weak Accept and 2 Accept.

The ACs checked and agreed to accept the paper. The authors should include the discussions and results in the rebuttal in the camera-ready version.
Decision: Accept (poster)