Backdoor Mitigation via Invertible Pruning Masks
Authors: Kealan Dunnett
Reza Arablouei
Volkan Dedeoglu
Dimity Miller
Raja Jurdak
Venue: NeurIPS 2025 poster ()
Keywords: backdoor attack
backdoor mitigation
model pruning
adversarial machine learning
machine learning security
Primary area: other

Abstract: Model pruning has gained traction as a promising defense strategy against backdoor attacks in deep learning. However, existing pruning-based approaches often fall short in accurately identifying and removing the specific parameters responsible for inducing backdoor behaviors. Despite the dominance of fine-tuning-based defenses in recent literature, largely due to their superior performance, pruning remains a compelling alternative, offering greater interpretability and improved robustness in low-data regimes. In this paper, we propose a novel pruning approach featuring a learned \emph{selection} mechanism to identify parameters critical to both main and backdoor tasks, along with an \emph{invertible} pruning mask designed to simultaneously achieve two complementary goals: eliminating the backdoor task while preserving it through the inverse mask. We formulate this as a bi-level optimization problem that jointly learns selection variables, a sparse invertible mask, and sample-specific backdoor perturbations derived from clean data. The inner problem synthesizes candidate triggers using the inverse mask, while the outer problem refines the mask to suppress backdoor behavior without impairing clean-task accuracy. Extensive experiments demonstrate that our approach outperforms existing pruning-based backdoor mitigation approaches, maintains strong performance under limited data conditions, and achieves competitive results compared to state-of-the-art fine-tuning approaches. Notably, the proposed approach is particularly effective in restoring correct predictions for compromised samples after successful backdoor mitigation.

Backdoor Mitigation via Invertible Pruning Masks
Kealan Dunnett', Reza Arablouei", Dimity Miller!, Volkan Dedeoglu', and Raja Jurdak'
Queensland University of Technology, Brishane Australia Dataó1, CSIRO, Pullenvale QLD, Australia
Abstract
Model pruning has gained traction as a promising defense strategy against backdoor attacks in deep learning. However, existing pruning- based approaches often fall short in accurately identifying and removing the specific parameters responsible for inducing backdoor behaviors. Despite the dominance of fine-tuning-baat baaidd defenses in recent literature, largely due to their superior performance, pruning remains a compelling alternative, offering greater interpretability and improved robustness in low-data regimes. In this paper, we propose a novel pruning approach featuring learned selection mechanism to identify parameters critical to both main and backdoor tasks, along with an invertible pruning mask designed to simultaneously achieve two complementary goals: eliminating the backdoor task while preserving it through the inverse mask. We formulate this as a bi-level optimization problem that jointly learns selection variables, sparse invertible mask, and sample-specific backdoor perturbations derived from clean data. The inner problem synthesizes candidate triggers using the inverse mask, while the outer problem refines the mask to suppress backdoor behavior without impairing clean-task accuracy. Extensive experiments demonstrate that our approach outperforms existing pruning-based backdoor mitigation approaches, maintains strong performance under limited data conditions, and achieves competitive results compared to state-of-the-a fine-tuming approaches. Notably, the proposed approach is particularly effective in restoring correct predictions for compromised samples after successful backdoor mitigation.
Introduction
The widespread adoption of deep learning across various sectors has brought increased scrutiny to its associated security vulnerabilities. While the performance benefits of modern deep learning methods are well recognized, their inherent opacity makes them susceptible to various forms of exploitation [T. Notable examples of such threats are adversarial 2 and data poisoning
attacks. In classification tasks, backdoor attacks are critical concern. First introduced by [4) these attacks compromise model integrity by injecting a hidden behavior: inputs containing a specific trigger are misclassified into target class, while clean inputs (i.e., those without this trigger) remain correctly classified. This allows the adversary to embed malicious functionality without disrupting the model's performance on benign data.
The potential impact of backdoor attacks is especially severe in safety-critical applications that rely on automated decision-making For example, driver assistance systems often depend on image classi- fication modules to detect critical objects such traffic signs. subtle physical modification, such as placing sticker on stop sign, may exploit backdoored model to induce targeted misclassification with catastrophic consequences [5]. These risks are exacerbated scenarios where model training is outsourced to third parties. A recent survey by [6] revealed that 48.1 %% of respondents rely on third-part third-party models, typically fine-tuning them for their specific use cases.
39th Conference on Neural Information Processing Systems (NcurIPS 2025)

---

A
B
STOP
STOP
STOP
STOP
Unmazked
Max
Inwerse
Speed Limit
Stop Sign
Stop Sign
Speed Limit
Component
Backdoor
Unselected
Selected
Figure 1: The unpruned backdoored model (A), conventional model pruning (B), and model pruning via an invertible mask (C).
Backdoor mitigation aims to remove the malicious functionality induced by such attacks while preserving the model's original classification capabilities. Within image classification, this has proven particularly challenging, as demonstrated by the recent studies 7 g] Existing backdoor mitigation approaches generally fall into two broad categories: model pruning and fine-tuning 7 Pruning-based based approaches seek to identify and remove model components (e.g.. convolutional filters) associated with the backdoor behavior, whereas fine-tuning-bet parameters through retraining process. To date, fine-tuning approaches have generally outperformed pruning approaches S 7 establishing fine-tuning as the dominant paradigm in backdoor mitigation literature.
approaches adjust model
However, has been observed in [ that the performance of fine-tuning approaches degrade more significantly when limited data is available. Moreover, although fine-tuning approaches exhibit robust capabilities in removing backdoor behaviors, their ability to restore correct classification of mackdoor-triggeen inputs remains persistent challenge 7 g
To address these limitations, we introduce a novel pruning-based approach to backdoor attack mitigation that aims to narrow the performance gap between fine-tuning and pruning. Our core contribution lies in rethinking the pruning paradigm through the introduction of two new principles: mask invertibility and component selection.
Current pruning-bascl approaches solely focus on removing model components associated with the backdoor task. While this perspective is essential, relying on it in isolation yields inconsistent and often brittle performance across different attack scenarios 7 In contrast, we propose using an invertible mask that unifies the standard pruning perspective with complementary one to enhance robustness: selectively removing clean components while retaining those related to the backdoor. Specifically, we evaluate model behavior under two opposing conditions: (i) pruning clean-task components (via the inverse mask) and (ii) pruning backdoor-task components (via the standard mask). This dual-view approach enables more principled dissection of model components, revealing their respective roles in clean and backdoor tasks. To ensure the invertible mask remains practical and avoids excessive pruning, we introduce selection mechanism that identifies components highly relevant to both the clean and backdoor tasks, marking them as eligible for pruning. Subsequently, components not selected by this mechanism automatically preserved and excluded from both pruning processes. Fig. iilluttrate the key differences between our approach (C) and traditional pruning (B).
To realize this idea, we develop a bi-level optimization framework inspired by SAU 9. Similar to SAU, we address the lack of ground-truth backdoor data by synthesizing adversarial examples, additively perturbed versions of clean inputs that are misclassified the same way by both the original model and pruned variant obtained using the inverse mask (i.e., with clean components removed and backdoor components retained). Subsequently, we estimate a pruning mask aimed at suppressing the influence of these synthesized triggers. In contrast to SAU, our approach replaces fine-tuning with pruning for both trigger synthesis and backdoor mitigation. Accordingly, we reformulate the objective to move beyond incremental parameter adaptation, focusing instead on structurally disentangling the model components associated with backdoor and clean behaviors. This enables a more robust and interpretable mechanism for jointly identifying and mitigating backdoor behaviors.
Through extensive experiments, we demonstrate that our approach significantly outperforms existing pruning- based defenses. Additionally, we show that it remains robust with limited data, highlighting

---

its practicality and generalizability in real-world scenarios. Compared to its fine-tuning sree-ttunnn--beee based contenders, our approach more effectively restores correct classifications of backdoor samples following mitigation. This suggests that pruning, when augmented with mask invertibiity and component selection, can offer more refined and resilient solution for backdoor mitigation.
2 Related Work
The seminal BadNets attack [4] demonstrated how embedding backdoor task into a model could be achieved by manipulating subset of training data, such as adding a colored square to specific input samples. Building this foundational concept, subsequent research has led to increasingly sophisticated backdoor attacks. For example, [10] introduce an encoder-decoder based approach that generates sample- -eappe-speccficc triggers by jointly optimizing the encoder-decode network and the classification model. Beyond rigger-based techniques, alternative strategies such as relabeling attacks have also been explored. For instance, [I]] present an all-to-all attack that disrupts multiple classes simultaneously. In this work, we focus on the targeted attack setting, where the objective is to consistently misclassify samples toward fixed target class t.
Backdoor Attacks:
Backdoor Defense: Mitigating backdoor attacks has predominantly involved model pruning and fine-tuning using clean training data, as initially proposed in [[2]. Subsequent research, such
as [13 [4], has further refined these techniques. Among pruning-based approaches, ANP [15),
AWN [6,. and RNP (17 closely align with our approach as ANP and AWN employ bi-level optimization to estimate optimal masks for channel-wise pruning of convolutional layers. Recent approaches, such as FMP [18] and NFT [9)), utilize adversarial examples and the MixUp protocol to
learn pruning masks that effectively suppress backdoors. FT-SAM 20) and SAU (9) state-of-the-ar fine-tuning approaches, mitigate backdoors by utilizing sharpness aware aware minimax optimization and modified adversarial training via shared examples, respectively. Moreover, BTI-DBF (2] trains a generative model via initial pruning to generate samples for fine-tuning, then applies an inverse- binary mask maximize the classification error on clean samples as part of its mitigation strategy. For comprehensive benchmarks and comparative analyses of these approaches, we refer readers to
While existing pruning approaches primarily focus on mask optimization (e.g.. ANP, AWN, and RNP), and fine-tuning approaches solely rely on parameter adaptation (e.g.. FT-SAM and SAU), our approach bridges these strategies, using mask invertibility and component selection to systematically disentangle backdoor components from clean behavior, achieving robust mitigation even with limited data.
Preliminaries
Channel-wise masking of convolutional neural networks has been widely em- ployed in backdoor mitigation literature [75] 19, [8]. Pruning-based approaches operate on the premise that specific subsets of convolutional components are responsible for backdoor behaviours. Empirical evidence supports this assumption 22
Model Pruning:
16 [2], motivating the use of channel-wise masking to isolate and eliminate these deleterious components. This approach involves channel-wise multi- plication of the kernel weights of each convolutional layer by a set of learned parameters bounded between O and 1, denoted as the mask vector a.
When an entry of a is zero, the corresponding channel in the kernel tensor is effectively pruned through the application of the mask. However, in practice, most model pruning approaches do not directly apply masks to model parameters. Instead, is commonly applied to the activation maps produced by each layer during the forward pass. Given the model parameters and the set of pruning masks A {a,," ... aN for N convolutional layers, we represent the masked model as 0 @ A, where 3 denotes the channel-wise application of each mask in A to its corresponding layer in 0.
Threat Model: In targeted attack scenario, the adversary embeds a backdoor task into the model,
causing inputs å containing specific trigger pattern p to be classified designated target class This achieved by training the model using two datasets: the clean dataset D. {xx y)), comprising original inputs with correct labels y, and the backdoor dataset D, {(2@ ). In certain
3

---

cases, such as in [23], is dynamic, varying for each ž. The adversary's 's goal is to train set of model parameters 6' that correctly classify both D. and Db.
We consider a range of attacks documented in the literature without imposing any additional constraint beyond those outlined in the original works. For instance, in extreme cases like in (24). the attacker is assumed to have complete control over the training process. From the defender's perspective, we assume access limited set of correctly labelled clean inputs 2m = {(x,)) (i.e., inputs with no backdoor trigger) and the backdoored model parameters 0'. In practice, the reliance on outsoureed training often restricts defenders to limited set of clean samples, underscoring the need for mitigation strategies that remain affective under such constraints
Furthermore, while evaluation primarily focuses convolutional neural networks, we also explore how IMS can be adapted for use with wransformer-basee architectures. Given the growing significance of Vision Transformers (ViTs) and the lack of existing pruning-based defenses tailored to them, we provide preliminary results demonstrating that ViTs can be successfully pruned using IMS to mitigate backdoor behaviour.
4 Proposed Approach
In this section, we introduce Invertible Masking using Selection (IMS), a novel model-pruning-basse -based approach for backdoor mitigation. We begin by defining the characteristics of an invertible mask and elucidating the importance of component selection. We then describe the proposed IMS approach within the context established in section
4.1 Invertible Masking using Selection
To overcome the limitations of existing pruning-based methods, we introduce more flexible pruning paradigm termed invertibility, aimed at more effectively distinguishing between model components critical to backdoor and clean tasks. Unlike conventional pruning (e.g.. ANP, AWN, and RNP), which is treated as a one-way subtractive process focused solely on removing backdoor components, we leverage invertibility to contrast the model's behaviour under two com- plementary pruning configurations: one in which clean components are pruned while backdoor components are retained (using the inverse mask), and another where the standard pruning mask is applied. This dujl-objective approach serves two purposes: it verifies the correct identification of critical clean components, preventing their removal, and assesses whether the backdoor behavior persists when only backdoor components are retained and the clean components are pruned. Thus, enforcing mask invertibility enables more nuanced distinction between components associated with clean and backdoor behaviors.
Invertibility:
Selection:
Existing approaches generally categorize model components as being associated with either the backdoor task or the clean task. In contrast, we relax this binary assumption through selection, allowing most model components to be shared between the two pruned models generated by applying the mask and its inverse. Specifically, we identify subset of model components that are most relevant to both backdoor and clean tasks and apply the mask and its inverse exclusively to these selected components. The remaining unselected components form a shared backbone that supports both backdoor and clean tasks and are thus excluded from pruning by both the mask and its inverse, as depicted in Fig. (C). Consequently, the selection mechanism helps prevent over-pruning and enables the practical construction of the mask and its inverse. In the absence of shared components, the mask and its binary complement must partition the model into two commetiivtt-preserving subnetworks without entirely pruning any layer. However, this requirement conflicts with the objective of sparsity, imposing a prohibitive constraint.
Selective Invertible Masking: To extend channel-wise masking to support invertibility through
selection, we introduce a learned selection parameter vector [0. 1 Ceu for each layer
l. This
selection vector, combined with the preliminary pruning mask a E [0, 1 Can (introduced section defines the mask a' and its inverse a' for the 1th layer
a' aAk [a 0.5)) +so [ - a) 0.5l)
(1)
n' = ( - a) 0.5)) + tsoo [a 0.5))
(2)

---

Subgroblen
STOP
STOP
STOP
STOP
STOP
STOP
STOP
STOP
Masi
CR
Agins
Figure 2: Summary of the bi-level optimization framework, illustrating the agreement and disagreement loss terms and their role in updating the mask or perturbation for each described subproblem. Dashed lines in the Outer Subproblem diagram indicate objectives shared with Mask Initialisation and Inner Subproblem.
where (-)) represents the sigmoid function applied element-wise, k is a scaling parameter that refines channel selection, o denotes element-wise multiplication, and additiion/subraacioon performed element-wise. Note that, ă' * a' * when O (element-wise) meaning the inverse mask is not simply the binary complement mask, as is the case in BTI-DBF [21]
In Fig. 7 (Appendix AA), we visualize the relationship between a' and a' across various a and values. Moreover, we also provide theoretical analysis of the invertibility the proposed mask in Appendix A Shared components (Unselected in Fig. I correspond to entries of with values near one, while selected components, which may be pruned by either the mask or its inverse (Selected in Fig. I have corresponding entries in with values close to zero. For the selected parameters, the mask and its inverse function as opposing counterparts, each targeting complementary subsets (one retaining what the other prunes), illustrated in Fig. 7
4.2 Optimization Framework
To estimate the optimal values of and S S1, SN, we minimize a composite objective within a bi-level optimization framework. The inner subproblem synthesizes sample-specific perturbations d for clean inputs x E Dm using the inverse mask A' = a'.". .... ay.. capturing the dynamic nature of potential backdoor triggers. As the defender lacks access actual backdoor data, these perturbations act as proxies for the adversarial manipulations. The outer subproblem then updates A and to suppress backdoor behaviors while preserving clean-task functionality. During the initialization phase, we estimate AA and S to identify components crucial only for the clean task, We provide further details of the optimization procedure in the subsequent sections, and an overview in Fig. 2 Moreover, in Appendix B we summarize the training procedure of IMS.
Given model parameters 6, the model mask A'' {a a'y} } and its inverse A', the softmax model outputs [denoted using the function f(-)] for a clean input and its perturbed version = r are expressed as
Model Outputs:
p fxx PA f A"), Px f A'), p f(, PX f(z.0 A), Px =
(3)
Loss Functions: The optimization framework incorporates agreement and disagreement loss functions, defined for given softmax outputs q and q as LDisagree
log(1 (q. 4)) and LAgre q) = - log( 4)), where (Q.g) = E Ge Ge denotes the dot product and C is the number of classes. Minimizing the agreement loss promotes alignment between model outputs, while minimizing the disagreement loss encourages their divergence.
Mask Initialisation: To estimate the initial values of the mask and its inverse, we use the clean data to identify the model components critical solely to the clean task. As shown in Fig. 2 this involves updating A and S such that p aligns with PA while diverging from p.r Thus, we formulate the initialization optimisation problem as
A [S]
min Lagree (PA. + Disagree (P...P) + S.A
|
(4)
5

---

The last term is a regularization penalty, defined as the & norm of S scaled by the parameter À and normalised by the number of its entries S). This term encourages sparsity in S, mitigating the risk of excessive pruning. By initializing the mask such that it preserves correct classification of clean data while its inverse leads to their misclassification, we compel the inner subproblem to rely on the unselected and backdoor components to estimate the backdoor trigger.
Inner subproblem: To synthesize perturbed inputs that elicit the backdoor behavior, we estimate 5 for all available clean data instances by utilizing the outputs of the unmasked and inverse-masked models. Specifically, we aim to encourage disagreement between & and while simultancously promoting agreement between and P.x. as illustrated in Fig. 2 Since the inverse mask prunes components critical to the clean task, this objective drives the estimation of perturbations to rely on components not associated with the clean task. Therefore, this effectively biases perturbations towards utilising backdoor components to induce misclassification, a phenomenon supported by our experimental results. We express the inner subproblem as
min Disaaree (p.P) + Aagre (p. P.x); Ko
(5)
where the for norm constraint ||ō||> < restricts perturbations remain bounded within specified tolerance. We set e = in all experiments. Note that, due to the use of the Adam optimizer rather than signed gradients, e serves hard upper bound on the perturbation magnitude rather than a target value.
Outer subproblem: Using the estimated perturbations the outer subproblem optimizes S and A to mitigate the effect of 8. Specifically, we design it to minimize the agreement loss for P. and p. thereby restoring the correct classification of f when the mask AA is applied. To maintain consistency with the objectives of the mask initialization and the inner subproblem, we incorporate their respective loss terms into the outer subproblem's objective function, as indicated by the dashed lines in Fig. 2 Their integration ensures that the updated S and A effectively mitigate the impact of the perturbations during inference, without compromising the objectives established in the preceding steps. Consequently, we define the outer optimization subproblem as
A [S]
min S.A
L +
|1S||
(6)
L = LAgreo (PA' + (pA P) + Disagree (PA. + (A + LDssagree (P P).
(7)
We solve the outer subproblem by initially setting X = 0 and then increasing it to = 10.
5
Evaluation
In this section, we evaluate the effectiveness of the proposed IMS approach in mitigating backdoor attacks within the BackdoorBench (7] evaluation tool. Adopting the benchmarking methodology of we conduct comprehensive evaluation across diverse experimental settings. These include backdoor attacks, 4 model architectures, 3 datasets, and poisoning ratios, total of 288 distinct test cases.
8)
5.1 Experimental Setup
We consider a range of representative backdoor attacks, including BadNets 4 Blended 25 Signal (26). LF (27). SSBA [0), IAB [23], BPP [24], and WaNet (28). We use the default attack configurations, specified by BackdoorBench 77. with poisoning ratios of 1 1%, 5%, and 10%. In each case, the first class (indexed by 0 in Python) is the backdoor attack target class. We utilize the CIFAR- 10. German Traffic Sign Recognition Benchmark (GTSRB), and Tiny-ImageNe datasets, which contain 10, 43, and 200 classes, respectively. Moreover, we consider the VGG-19 with batch normalisation (VGG), EfficientNet-B3 (EfficientNet), and Vo (MobileNet) model architectures. For each dataset, we consider three data settings based on sample per class (SPC) values of 2, 10 and, 100.
(ResNet),
We benchmark IMS against ANP 15). ANW 16] and RNP given their methodological align- ment with our approach. Additionally, we include FP [2] as a foundational bascline and the more

---

0.57
0.00
450
101.
401
BER
4BR
ASR
RDn
A0n
ASR
16n
Ain
ASR
103.
AGA
A51
RER
ARR
ASR
AR1
ASR
Rön
AM
45R
nön
AiR
A5R
Figure 3: Box plots illustrating ASR, RDR, and ARR results of IMS against various pruning and fine-tuning approaches across tested settings. t: Pruning, Fine-tuning.
recent related approaches NFT 19 and FMP 18] To provide broader perspective, further evaluate IMS against state-of-the-art fine-tuning based approaches FT-SAM [20] and SAU [9]. We also include BTI-DBF (21) due its of inverse-like mask. We provide the implementation of IMS on GitHub
Performance Measures: To assess the effectiveness of backdoor mitigation, we adopt three performance measures as defined in [8]
Accuracy reduction ratio (ARR), which quantifies the impact mitigation on original classifi- cation task. Lower ARR values indicate minimal disruption to the model's primary functionality. Attack success ratio (ASR), which measures the extent to which the backdoor trigger continues to induce misclassifications after mitigation. An effective mitigation strategy results in low ASR. Recovery difference ratio (RDR), which evaluates how effectively the mitigation restores correct classification of samples containing the backdoor trigger. A low RDR signifies better recovery from backdoor contamination.
Ideally, all three measures (ARR, ASR, and RDR) approach zero, indicating minimal impact of mitigation on the original task (low ARR), effective neutralization of backdoor behavior (low ASR), and accurate classification of backdoored samples (low RDR). We provide detailed mathematical formulations of these measures in Appendix Moreover, in Appendix K we extend the experimental analysis presented in section 5.2 with supplementary plots and discussions. We further present additional evaluations of IMS, including a computational complexity analysis, performance on an ImageNet subset, the role of mask initalization, the impact of X, the effect of k. the significance of selection, and robustness against Backdoor Reactivation (29) These are detailed in Appendices and respectively.
G
5.2
Results
In Fig. 3] we provide an overview of the performance of IMS relative to prominent pruning- and fine-tuning- approaches. We use box plots summarize the distribution of ASR, RDR, and ARR values across all considered experimental scenarios. The results indicate that IMS consistently outperforms existing pruning approaches, FP, ANP, AWN, RNP, NFT, and FMP, both ASR and RDR performance. Moreover, IMS demonstrates competitive ASR and improved RDR and ARR performance relative to state-of-tee the-hhhrr art fine-tuning approaches, BTI-DBE, FT-SAM, and SAU. In particular, IMS's 's superior ARR and RDR performance represent critical advantage, enhanced RDR, particularly when ARR remains largely unaffected, signifies a defence that not only suppresses the backdoor behaviour and restores correct classification of compromised samples but also preserves clean task performance.
In Fig. 4 we compare the performance of the evaluated approaches across different SPC settings, with the corresponding median values of ASR, RDR, and ARR provided Table I Compared to other pruning-based approaches, IMS consistently achieves higher ASR and RDR performance across all data availability settings, with only a marginal increase ARR. When benchmarked against fine-tuning- based approaches, IMS demonstrates superior RDR performance in the 2 and 10 SPC settings, accompanied by lower median ARR and reduced variance. the 100 SPC setting, IMS outperforms BTI-DBF and SAU in terms of RDR and remains competitive with FT-SAM in terms of ARR and RDR. These findings underscore the robustness of IMS in mitigating backdoor attacks, especially under limited data conditions, effectively narrowing the performance gap between pruning- and fine-tuning- based defenses. Importantly, IMS substantially closes the performance gap

---

Table I: Median ARR, ASR, and RDR results (x100) for IMS and various existing pruning and fine-tuning approaches with different SPC values. Bold values indicate the hest performance among pruning fine-tuning approaches, while underlined values represent overall best performance.
Pruning RNP
Fine- Tine-Tuning
SPC
Metric
FP
ANP
AWN
NFT
FMP
IMS
BTI-DBF
FT-SAM
SAU
ARR
3.2
0.0
8.6
5.4
17.3
26.0
19.0
23.5
ASR
29.5
51.4
79.0
71.1
48.6
76.7
5.6
4.6
4.6
1,9
RDR
66.5
65.8
87.2
90.2
75.0
90.5
38,9
56.4
55.3
$7.7
ARR
6.2
0.0
0.0
0.0
3.8
3.3
9.8
14.7
3.6
11.6
10
ASR
6.0
25.2
74.7
80.6
52.0
59.0
4.7
2.4
4.8
2.0
RDR
56.1
58.5
93.3
70.3
80.6
28.5
45.2
33.7
42.1
ARR
0.4
0.0
0.4
0.0
1.4
0.4
6.5
0.0
100
ASR
12.4
16.7
66.5
80.6
34.5
32.0
4.2
1,9
3.3
2.3
RDR
36.7
56.9
82.1
89.6
59.0
55.7
21.2
24.4
15.5
37.1
ANP
RNP
NFT!
FMP
IMST
BTH
FT-SAM
SAU?
AS5
0.33
6.00
RDR
1.00
0.67
100
Figure 4: Box plots illustrating ASR, RDR, and ARR results for IMS and various existing pruning and finc-tuning approaches with SPC values of 10, and 100. Pruming, Fine-tuning.
leading fine-tuning-basee based approaches, while maintaining the interpretability benefits inherent to
pruning- gruseng-based approaches.
In Fig. compare the performance of IMS with that of the pesstpeerfoming pruning approaches from Fig. for various attack types and model architectures. The results in Fig. showw that, unlike ANP and NFT, IMS exhibits competitive performance across all considered architectures. Notably, AWN and NFT show large variations in RDR and ASR performance, highlighting the challenges of designing pruning-batt based approaches that are robust architectural changes. From Fig. [b we observe that IMS is less affected by attack variations compared to other pruning approaches. Specifically, the ASR and RDR performance of ANP and NFT varies considerably under different attack scenarios. While IMS also experiences some performance fluctuations, its overall consistency substantially higher. In Appendix K.I we provide a comprehensive comparison of IMS with fine-tuning baselines, revealing that RDR performance patterns of IMS, BTI-DBF, FT-SAM, and SAU are similar across attack types, with IMS exhibiting lower variance and better median RDR performance in most cases. These findings suggest that certain attacks (e.g., Blended, LF, Signal, SSBA) pose similar challenges for both pruning and fine-tuning approaches.
In Fig. 6 we present the scatter plots of the proportion of (the perturbed inputs found by solving the inner subproblem) classified as the target class post mitigation and the ASR achieved by IMS, for each dataset. Note that knowledge of the proportion of î classified as the target class is not accessible the defender during mitigation, as the target class is presumed be unknown. The results indicate that as the proportion of å samples classified as the target class increases, ASR decreases. Moreover, we observe that mandating mask invertibility effectively biases å toward the backdoor task, as in most cases, the target class proportion exceeds its expected frequency, as indicated by the dashed lines Fig. [6] The results support the intuition outlined in Section 4. suggesting that the inverse mask directs perturbations to utilize backdoor components. Given that IMS reduces ASR significantly when the target class proportion is high, future work can focus on further intensifying this effect to improve robustness.

---

IMS
ANPT
NFT!
ANPT
NFT!
1.00
1.00
ASR
0.67
0.33
0,00
1.00
1.00
RDR
0.67
0.33
0.33
0.00
0.00
1.00
ARR
0.67
0.67
0.33
0..33
11
0.00
A
c
(a) Model
(b) Attack
Figure 5: Box plots illustrating ASR. RDR. and ARR results for IMS, ANP, and NFT, across diffferent model and attack settings. In (A) A: VGG, B: ResNet. C: EfficientNet, D: MobileNet. In (B) E: BadNet. F: Blended, G: LF, Signal, BPP. Inputaware, K: SSBA, L: WaNet.
10
12.5
40
0.75
10.0
30
7.5
0.5
4
0.25
2.5
0
0.25
0.75 Prop Target Class
0.5
0.25 0.5
0.75
0.25
0.5
0.75
Prop Targel Class
Prop Target Class
(a) CIFAR-10
(b) GTSRB
(c) Tiny
Figure 6: Scatter plots of the proportion of & classified the target class ASR of IMS for cach dataset. The vertical dashed lines represent the expected frequency of the target class 4. with being the number of classes, 10, 43, and 200 CIFAR-10, GTSRB, Imae-lm respectively.
5.3 Adapting IMS to ViTs
Vision Transformers (ViTs) have gained significant popularity in image classification tasks in recent years. Similar CNNs, several studies have shown that ViT's are highly overparameterized and can be pruned to improve efficiency. Notably, in [30]. it is demonstrated that ViTs can sustain high levels of pruning while maintaining strong performance. Building on this insight, pruning encoder blocks appears to be promising strategy for extending pruning-based -ased approaches to ViT architectures. We hypothesize that backdoor behavior in ViT' may be encoded within specific embedding dimensions of each encoder block. Therefore, applying mask to selectively prune these embedding dimensions represents a natural and effective starting point for backdoor mitigation.
To evaluate this strategy, we apply IMS to ViT-B/16 models trained on GTSRB with the BadNet, BPP, and IAB attacks, using poisoning ratio of 10%. Table reports the median performance (ARR, RDR, and ASR) of IMS across different SPC values. Since it is observed 30 that ViT's tolerate substantial pruning, we omit the sparsity regularization term from Equation (6) in this adaptation.
IMS performs strongly on BadNet and BPP, maintaining low ASR, RDR, and ARR (all below 10) SPC is reduced. On IAB, IMS is less effective, though modest reductions in ASR and RDR are still observed.
This preliminary investigation highlights the potential of IMS and more broadly pruning based defenses for application to ViTs. Future work can explore which components within the transformer architecture are most suitable for pruning, as the embedding dimension is only one of several possible targets. For example, the query, key, and value projection matrices may offer promising pruning opportunities, suggested by recent feature selection methods such [1].

---

Table 2: Median ASR, RDR, and ARR of IMS when adopted for ViTs.
SPC =
SPC 10
SPC 100
Attack
ASR
RDR
ARR
ASR
RDR
ARR
ASR
RDR
ARR
BadNet
2.2
6.3
4.0
6.9
9.8
3.5
4.9
6.9
2.0
BPP
0.0
7.3
0.8
0.1
9.1
2.2
0.1
8.3
1.6
IAB
67.4
67.8
3.1
73.4
73.5
2.7
67.3
67.4
1.9
Concluding Remarks
The experimental evaluations presented in SectionSddmmonstraci the superiority of IMS over state- of-the-art prwning-basea approaches. particular, IMS outperforms the seminal pruning approach FP [2] across range of challenging settings, contrasting prior observations, notably those S which indicate that subsequent pruning-basse approaches rarely achieve consistent improvements over FP. These results underscore the effectiveness of our proposed invertible pruning mask and selection mechanism for robust backdoor mitigation convolutional neural networks, especially in data-scarce settings.
Comparisons with recent pruning approaches, including ANP, AWN, RNP, NFT, FMP, and BTI-DBF, emphasize the advantages of introducing mask invertibility. Our performance gains, supported by the results in Fig. validate the intuition that invertible masks enable more principled decomposition of model components based on their roles in clean versus backdoor tasks. This decomposition isolates the impact of pruning on each task, improving performance and interpretability. However, IMS's varied effectiveness against certain attack types, such as Blended and SSBA, indicates opportunities for future refinement.
When benchmarked against leading fine-tuning-basee defenses such as FT-SAM and SAU, IMS delivers competitive results. While FT-SAM and SAU typically achieve stronger suppression of backdoor behavior, as reflected in their shorter and lighter ASR distribution tails, IMS consistently achieves superior RDR performance and better preserves ARR performance. This suggests that IMS excels in restoring classification accuracy post-mitigation, capability less consistently observed FT-SAM and SAU. This trade-off between backdoor suppression and classification recovery is especially evident in data-limited settings, underscoring the unique strengths of model pruning via selective and invertible masks. Although the performance improvements over fine-tuning are modest, achieving such results through pruning alone is notable. As fine-tuning has dominated recent research this area, our findings provide renewed motivation for considering pruning-base based alternatives.
Looking ahead, combining model pruning via selective and invertible masks with fine-tuning ap- proaches such as FT-SAM SAU holds promise for developing more effective backdoor defenses. By integrating the structured removal of backdoor-related components, facilitated by invertible mask- ing, with the adaptive optimization of fine-tumi tinettnnin, such hybrid approaches can achieve more effective backdoor mitigation while preserving high classification accuracy. Although BTI-DBF makes an initial attempt to bridge this gap by using pruning to initialise fine-tuning, its limited success, often underperforming compared to FT-SAM, suggests that more sophisticated strategies are required. Our work lays the groundwork for such future innovations.
Finally, our preliminary evaluation of ViT-based models suggests that pruning-bain based approaches developed for CNNs may be transferable transformer architectures. Future work can investigate which components of transformers are most effective targets for pruning in the context of backdoor mitigation.
7 Acknowledgement
Dimity Miller acknowledges ongoing support from the QUT Centre Robotics. acknowledge the support of QUT cResearch for providing the computing facilities required to run experiments.
10

---

References
[1] X. Liu, L. Xie, Y. Wang, J. Zou, J. Xiong, Z. Ying. and A. V. Vasilakos, "Privacy and security issues in deep learning: A survey," IEEE Access, vol. 9, pp. 1566-4599 2020.
[2] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, Goodfellow, and R. Fergus, "Intriguing properties of neural networks," arXiv preprint arXiv:1312.6199, 2013.
[3] F. A. Yerlikaya and Ş. Bahtíyar, "Data poisoning attacks against machine learning algorithms." Expert Systems with Applications, vol. 208, p. 118101, 2022.
[4] T. Gu, B. Dolan-Gavitt, and S. Garg, "Badnets: Identifying vulnerabilities in the machine learning model supply chain," arXiv preprint arXiv: 06733, 2017.
[5] S. Pouyanfar, S. Sadiq, Yan, H. Tian, Y. Tao, M. P. Reyes, M.-L. Shyu, S.-C. Chen, and S. S. Iyengar, "A survey on deep learning: Algorithms, techniques, and applications," ACM Computing Surveys (CSUR), vol. 51, no. 5, pp. 1-36, 2018.
[6] K. Grosse, L. Bieringer, T. R. Besold, and A. M. Alahi, "Towards more practical threat models in artificial intelligence security," in 33rd USENIX Security Symposium (USENIX Security 24), pp. 48914494449 1-988, 2024.
[7] B. Wu, H. Chen, M. Zhang. Z. Zhu, S. Wei, D. Yuan, and C. Shen, "Backdoorbench: A comprehensive benchmark of backdoor learning," Advances in Neural Information Processing Systems, vol. 35, pp. 10546-10559, 2022.
[8] K. Dunnett, R. Arablouei, D. Miller, V. Dedeoglu, and R. Jurdak, "Countering backdoor attacks in image recognition: A survey and evaluation of mitigation strategies," arXiv preprint arXiv:2411. 12200, 2024.
[9] Wei, M. Zhang, H. Zha, and B. Wu, "Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples," Advances in Neural Information Processing Systems, vol. 36, pp. 25876-25909, 2023.
[10] L. L. B. Wu, I. Li, R. He, and S. "Invisibbe backdoor attack with sample-specific trig- gers," " in Proceedings the IEEE/CVF international conference computer vision, pp. 16463- 16472, 2021.
[11) P. Zhao, P.-Y. Chen, P. Das, K. N. Ramamurthy, and X. Lin, "Bridging mode connectivity in loss landscapes and adversarial robustness," arXiv preprint arXiv:2005.0000 00060, 2020.
[12] K. Liu, B. Gavitt,, and S. Garg, "Fine- Fiine-prunin: Defending against backdooring attacks on deep neural networks," in International symposium research in attacks, intrusions, and defenses, pp. 273-294, Springer, 2018
[13] B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, "Neural cleanse: Identifying and mitigating backdoor attacks in neural networks," 2019 IEEE Symposium on Security and Privacy (SP), pp. 707-723, IEEF, 2019.
[14] R. Zheng, R. Tang, Li, and L. Liu, "Data-free backdoor removal based channel lipschitz- ness," in European Conference on Computer Vision, pp. 191, Springer, 2022.
[15] D. Wu and Y. Wang, "Adversarial neuron pruning purifies backdoored deep models," Advances in Neural Information Processing Systems, vol. 34, pp. 16913 16913-16925, 2021.
[16] S. Chai and Chen, "One-shot neural backdoor erasing via adversarial weight masking." Advances in Neural Information Processing Systems, vol. 35, pp. 22285-22299, 2022.
[17] Y. Li, X. Lyu, X. Ma, N. Koren, I.. Lyu, B. Li, and Y.G. Jiang, "Reconstructive neuron pruning for backdoor defense," " in International Conference on Machine Learning, pp. 19837-19854, PMLR, 2023.
[18] D. Huang and Q. Bu, "Adversarial feature map pruning for backdoor," in International Confer- ence on Learning Representations, 2024.
11

---

[19] N. Karim, A. A. Arafat, U. Khalid, Z. Guo, and N. Rahnavard, "Augmented neural fine-tuning for efficient backdoor purification," in European Conference on Computer Vision, pp. 401-418. Springer, 2024.
[20] M. Zhu, S. Wei, L. Shen, Y. Fan, and B. Wu, "Enhancing fine-tuning based backdoor defense with sharpness-aae aware minimization." " in Proceedings of the IEEE/CVE International Conference on Computer Vision, pp. 4466-4477, 2023.
[21] X. Xu, K. Huang. Y. Li, Z. Qin, and K. Ren, "Towards reliable and efficient backdoor trigger inversion via decoupling benign features," in International Conference on Learning Representa- lions, 2023.
[22] R. Zheng, R. Tang, J. Li, and Liu, "Pre-activation distributions expose backdoor neurons," Advances in Neural Information Processing Systems, vol. 35, pp. 18667-18680, 2022.
[23] T. A. Nguyen and A. Tran, "Input-aware dynamic backdoor attack," Advances in Neural Information Processing Systems, vol. 33, pp.
2020.
[24] Z. Wang, J. Zhai, and S. Ma, "Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning," in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 15074-15084, 2022.
[25] X. Chen, C. Liu, B. Li, K. Lu, and D. Song, "Targeted backdoor attacks deep learning systems using data poisoning," arXiv preprint arXiv: arXiv:/7/2.05526, 2017.
[26] M. Barni, K. Kallas, and B. Tondi, "A new backdoor attack in cnns by training set corruption without label poisoning." " in 2019 IEEE International Conference on Image Processing (ICIP), pp. 101-105, IEEE, 2019.
[27] Y. Zeng, W. Park, Z. M. Mao, and R. Jia, "Rethinking the backdoor attacks' triggers: A frequency perspective," " in Proceedings of the IEEE/CVF international conference on computer vision, pp. 16473-16488) 2021.
[28] A. Nguyen and A. Tran, "Wanet- iiaeet-imeercpptible warping-based backdoor attack," arXiv preprint arXiv:2102. 10369, 2021.
[29] M. Zhu, S. Liang, and B. Wu, "Breaking the false sense of security in backdoor defense through re-activation attack," in The Thirty-eighth Annual Conference on Neural Information Processing Systems.
[30] K. Xu, Z. Wang, C. Chen, X. Geng, J. Lin, X. Yang, M. Wu, X. Li, and W. Lin, "L-vii: Low- power semi-structured pruning for vision transformers." in European Conference on Computer Vision, pp. 269-287, Springer, 2024.
[31] L. Huang. J. Zeng, M. Yu, W. Ding, X. Bai, and K. Wang, "Efficient feature selection for pre- trained vision transformers," Computer Vision and Image Understanding, vol. 254, p. 104326, 2025.
12

---

NeurIPS Paper Checklist
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification:
In the abstract, we make three main claims: the proposed approach outperforms existing pruning-based backdoor mitigation approaches, maintains robust performance under limited data, and achieves competitive results compared to fine-tuning-baset approaches. Our results section c.2ffir that IMS meets these claims. We evaluate IMS across 288 distinct test cases and on ImageNet subset, supporting its generalizability to broader settings. Additionally, we assert that the proposed invertible pruning masks enable IMS to steer the inner subproblem toward generating perturbations that effectively induce backdoor behavior. While formal theoretical proof is not provided, we include an empirical analysis of the perturbations generated during this step (ef Fig. 6 and discussion in section 5.2 demonstrating that they exhibit backdoor- trigger-like characteristics.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contribu- tions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We emphasize that our results are not universally superior and, in some cases, underperform compared existing fine-tuning baselines. We also highlight that our approach does not improve robustness against backdoor reactivation attacks.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to vi- olations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach only tested on few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or a speech-to- to-tett system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
13

---

While the authors might fear that complete honesty about limitations might be used by review- ers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't I acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: While some works, mostly those based on fine-tuning, are able to establish certain theoretical claims, the non-convexity associated with applying pruning masks to considered CNN architectures renders similar theoretical analyses intractable. Consequently, we refrain from making any strong theoretical claims and instead validate our approach empirically, consistent with standard practice in the backdoor mitigation literature. However, we provide a brief analysis of the proposed invertible and selective masks in section This analysis establishes that the proposed invertibility mechanism is achieved by the composition of the proposed channel selection parameters with the original pruning mask.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross-referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof' can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main experi- mental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: In the Experimental Results section, we describe the full range of considered settings. In addition, we provide the complete code required to evaluate our approach, along with README and configuration files for ease of implementation.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of large language model), releasing of model checkpoint, or other means that are appropriate to the research performed.
provide
While NeurlPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
14

---

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution a new model (e.g., a large language model), then there should either be way access this model for reproducing the results or way reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instructions to
faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: We provide the code and data required to reproduce the results presented in the paper, together with comprehensive instructions and implementation details.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines btctps://nips.cc//pep
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for
open-souree benchmark).
The instructions should contain the exact command and environment needed run to reproduce the results. See the NeurlPS code and data submission guidelines (https:// wwwsssolcoyyyyyl for more details.
nips.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information as possible in supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
Justification: Where relevant, we include essential details necessary to understand the presented results and the rationale behind them. As we provide the complete code, we have omitted additional implementation specifics from the main text.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
15

---

Answer: [Yes]
Justification: Where appropriate, we present the full distribution of results rather than relying solely on summary statistics. When summary statistics are employed, we include error bars to convey variability. reporting the median and median absolute deviation (MAD) to summarize and compare results, partieularly given the long-tailed distribution of some results.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims the paper.
The factors of variability that the eπror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1 I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma errоr bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric eтror bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
Experiments compute resources
Question: For each experiment, does the paper provide sufficient information the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experi- ments?
Answer: [Yes]
Justification: We provide computational complexity analysis of the proposed approach, detailing the computer resources utilized and demonstrating its scalability.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experi- mental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't 't make it into the paper).
Code of ethics
Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http::////errrssssc/pppp///cccco
Question:
Answer: [Yes]
Justification: We have carefully considered all relevant factors outlined in the NeurlPS ethics guidelines throughout the paper.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethies.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
16

---

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We establish the positive societal impacts of this work by emphasizing its relevance from security perspective. Given the significant potential for harm posed by backdoor attacks, advancing research in this area is critical to mitigating such threats and enhancing overall system security.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA No, they should explain why their work has societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deploy- ment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications. let alone deployments. However, if there is a direct path to any negative applications, the authors should point out. For example, is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put place for responsible release of data or models that have a high risk for misuse (c.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: In this work, we do not release any data or model that presents high risk of misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions access the model implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.
12. Licenses for existing assets
Question: Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
17

---

Justification: We acknowledge the contributions of the original authors of the BackdoorBench and the developers of the utilized benchmarking methodology. detailed in section
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, anperwwitccode com datasatsssts has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.
For existing datasets that re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Question:
Answer: [Yes]
Justification: We provide the complete implementation of the proposed approach, including all necessary code, configuration files, and documentation. The README file includes detailed instructions on running the experiments, reproducing the results, and understanding the data processing pipeline. Additionally, we clearly specify the datasets usage, model configurations, and any other relevant information to ensure reproducibility and transparency.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/moddl part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsoureing experiments and research with human subjects, does the paper include the full text of instructions given to participants and sereenshots, applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: This work does not involve any crowdsourcing experiment or research involving human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
18

---

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere to the NeurIPS Code of Ethies and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is important, original, standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the methodology, scientific rigorousness, or originality the research, declaration is not required.
Question:
Answer: [NA]
The core contributions of this research do not involve the use LLMs as essential, original, or non- -on-standard components. The methodology and experimental framework are inde- pendent of I.LMs, and any usage of L.LMs was limited to writing, editing, or formatting, which does not impact the scientific rigor or originality of the work.
Justification:
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer our LLM policy httt::///eeerppsscc///oooreeeees for what should or should not be described.
19

---

A Invertible Mask and Selection Dynamics
A.1 Theoretical Analysis
Below, we provide a theoretical analysis demonstrating that, in the limit + 0 and & + oc, the learned mask a' and its inverse a' converge to binary partition (i.e., they become exact complements), thereby ensuring the invertibility of the masking operation.
Lemma 1, Let a E [0, 1] E [0, 1j8, 1: >> O, and define the learned mask and its inverse as a' = a ( (K(a 0.5)) + + t [ a) 0.5))
á' a (N:(1 a) - 0.5)) + s o (kiaa 0.5)),
where 1 e e) Consequently, in the limit - 0, have limg- (a' a') 1. Moreover, in the joint limit k + J0, we obtain
denotes the sigmoid function. Then, we have a + á' -1| S 2s.
1(a 0.5), + 1(a
0.5}.
where 1 denotes the indicator function. In other words, the mask a' becomes a hard thresholding function and the inverse mask a' its exact binary complement.
Proof. First, consider the
0. In this setting, the learned mask and its inverse simplify to = a [kaa 0.5)) and a' = a [k((1 - a) - 0.5)) = o- 0.5)) = - a (klaa - 0.5)). Hence,
for 0, we have
a' + a' σ (k|a 0.5)) + [1 (k(a- 0.5)] = 1.
Now, for s > 0, we observe that aa okkla 0.5)) S and Ja' - o 0.51) S Thus, the sum can be bounded as
a + a' - 1|=
ck(a 0.5])] + | - o(-kaa 0.5))] < 2s.
Therefore, + O, recover the exact complementarity: lim (a' a') 1. Finally, consider the limit 1 + co. For any entry a of the mask a, the sigmoid function satisfies the following asymptotic behavior k: oo:
if > 0.5,
lim a (k(aa 0.5) (0 if a < 0.5. k
Hence, we obtain
a' + 1(a 0.5), a' 1' 0.5).
Therefore, in the joint limit - 0, k the mask a' converges to hard threshold at 0.5, and a' converges to its exact binary complement. This completes the proof.
A.2 Empirical Evaluation
In Fig. 7 we examine the relationship between the mask and its inverse (a' and a') across different values
to validate the above result. Note that when an element of a' or a' approximately zero, it is considered pruned. These heat plots illustrate that the mask prunes the selected components (s 0) when a < 0.5, whereas the inverse mask prunes them when a > 0.5. unselected components (s R 1) remain unaffected by a and are thus preserved by both the mask and its inverse. As discussed in Section 3 these unselected components constitute a shared backbone retained across both pruning perspectives. This analysis supports the theoretical results presented above.
contrast, the
20

---

Mask
0. 0. 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0
0.6
0.2
0.0 0.1 0.2 0.3.3.44... 0.7 0.8 1.0 0.0 0.1 0.2 0.5 0.6 0.7 0.9 Selection Value
Selection Value (s)
Figure 7: Values of a' and a' functions of and for k 20. The boundaries >> 0.5 and s < 0.5 delineate components shared and selected, respectively.
B Algorithms
In Algorithm we summarize the training procedure IMS.
Algorithm Training of IMS
Require: Dataset D {-x J/N mask parameters A and S, step size v). round R1,2,3, and bound c.
1: for -=ri=1 to Rg do # Mask Initialisation
2: Sample minibatch (z,, 3) C
3: Compute gA and gs. the gradients of the objective in (4) w.r.t. and S
4: A, Adam W (A4, g,,..
5:
A 4 clip(A 0,
6:
S S 01,)
7:
end for
8:
for to Rg do # Outer Subproblem
9:
Sample minibatch (x, y) C D
< zeros zeros_like(r) for i = 1 to R3 do # Inner Subproblem
11:
Compute gs, the gradient of the objective in (5) w.r.t. 5
13:
+ (0. g))
14:
8 clip(5 6),
15:
end for
Compute gA and gs, the gradients of the objective in (6) w.r.t. and S
17:
A,S + Adam W (A, g.A. gs,
18:
A A+ + Clip(A, 0, 1)
19:
S clip(A,,,)
20: end for
C Performance Measures
To evaluate the effectiveness backdoor mitigation, adopt three performance measures: accuracy reduction ratio (ARR), attack success rate (ASR), and recovery difference ratio (RDR).
ASR assesses the efficacy of the backdoor attack by computing the accuracy on backdoor test samples, which are clean inputs modified with the trigger and labeled as the target class. Samples originally belonging the target class are excluded from ASR computation.
ARR quantifies the impact of mitigation on clean accuracy, defined as:
ARR 0²
where Op and a, denote clean accuracy before and after mitigation, respectively. The normalization by Op accounts for baseline accuracy differences between datasets, such as the lower baseline accuracy
21

---

typically observed in Liny-ImageNe compared to CIFAR-10. A lower ARR (closer to zero) indicates minimal degradation in clean accuracy due mitigation.
RDR evaluates the effectiveness mitigation in restoring backdoor-affected samples to their correct labels, defined as:
7/ ap
RDR
where 7/s represents recovery accuracy after mitigation. Similar to ARR, RDR is normalized by the pre-mitigation clean accuracy. An ideal mitigation strategy would result in an RDR close to zero, indicating that the model effectively restores correct classification even for inputs previously manipulated by a trigger.
D Computational Complexity
In Fig. B we analyze the computational complexity of IMS across various datasets and SPC settings. The first row represents the median number of mask initialisation (blue) and outer subproblem (orange) optimization rounds required for convergence, with the error bars indicating variability based on the median absolute deviation. The second row illustrates the median time complexity of single mask initialisation (blue), inner subproblem (green), and outer-subproblen (orange) round, plotted on the logarithmic scale. The third row shows the median total runtime of each simulation. All experiments were run on a 4-core CPU with 32GB of RAM and a H100 GPU. The key takeaway from this analysis is that IMS is scalable to larger datasets. While increased data availability generally raises computational complexity, beyond a certain point, the increase complexity offset by a reduction in the number of rounds needed for convergence. Notably, in the low SPC settings of CIFAR-10 10, small batch sizes result in substantial computational savings. Moreover, the primary computational cost is incurred during the estimation of perturbations in each step. The complexity trends for GTSRB and threefold increase in runtime, yet this does not hinder the applicability of IMS to ImageNet-sized datasets.
suggest that doubling the image size results in approximately
CIFAR-10
GTSRB
Tiny-lmageNet
Rounds
300
300
300
250
200
200
200
Round Time (s)
10
10-1
10-1
10-2
10-1
10
10-2
250
250
Total Time (s)
700
200
200
600
T
500
150
150
400
100
100
300
50
50
200
100
2
10
100
2
10
100
10
100
SPC
SPC
SPC
Figure 8: Median number of optimization rounds, per-round time, and total time complexity of IMS across three datasets. Error bars represent variability hased on median absolute deviation. Blue: Mask Initialisation, Green: Inner Subproblem, Orange: Outer Suhproblem, and Red: Total.
22

---

E ImageNet Subset
To assess the scalability of IMS to real-world datasets with larger image sizes, we evaluate its performance on ImageNette, a subset of ImageNet. In Table 3 we compare the median ARR, ASR, and RDR performance of IMS on ImageNette using MobileNet with those obtained on the other datasets considered in Section [ The results indicate that IMS effectively scales to larger image tasks, as its ARR, ASR, and RDR performance on ImageNette closely aligns with that observed across the other three datasets.
Table 3: Median ARR, ASR, and RDR performance of IMS (x100) across different datasets.
ARR
ASR
RDR
Attack
SCP
CIFAR-10
GTSRB
Tiny- Poy-ImageNN
ImageNette
CIFAR-I0
GTSRB
Tiny- ImageNct
ImageNette
CIFAR-I0
GTSRB
Tiny- Mny-ImmaeNNt
ImageNette
24.6
16.4
37.7
17.9
16.1
2.5
14.6
92.4
40.9
19.4
48.9
92.3
BadNet
10
21.7
12.9
14.1
14.3
90.1
31.6
14.4
89.4
100
6.4
7.7
4.2
7.6
2.4
0.5
9.5
63.0
7.8
8.6
15.3
60.0
1
27.0
13.9
12.6
12.6
2.4
0.4
0.3
4.7
28.0
17.7
15.3
16.1
BPP
10
14.3
6.6
0.0
8.3
2.8
0.3
3.1
16.3
11.9
2.9
10.2
100
3.2
4.0
2.6
0.4
1.9
5.8
9.2
1.4
29.5
17.4
14.6
13.5
9.7
0.2
0.7
2.3
39.7
24.4
32.3
19.6
Inputaware
10
15.0
8.4
2.9
7.0
7.5
0.2
1.0
1.1
27.7
16.1
20.1
12.8
100
4.9
3.7
0.2
1.7
1.0
18.8
11.1
6.1
Mask Initialization
As part of IMS, propose two main phases part of our optimization framework. As mentioned in Section 4.2 our framework first initializes the mask, and then alternates between solving an inner and outer subproblem. To show the interdependence between these phases, compare the performance of IMS with and without mask intialization. This analysis uses the ResNet architecture, the GTSRB dataset, with poisoning ratio of 10% and SPC of 10. The results, shown in Table 4 demonstrate that including mask initialization substantially improves ASR and RDR performance of IMS under IAB and WaNet attacks, offers modest gains in RDR performance under SSBA attack, and has a negligible effect on performance under BadNet and BPP attacks. In general, Table 4 shows that mask initialization plays critical role in harder-to-defend attack scenarios, justifying its inclusion.
Table 4: Comparison of ASR, RDR, and ARR across different attacks when IMS is used with and without mask initialization (w/o Init).
Attack
Defense
ASR
RDR
ARR
IMS w/o Init
56.1
57.3
4.5
IAB
IMS
1.1
7.1
4.7
IMS w/o Init
21.8
21.7
0.0
WaNet
IMS
1.7
1.9
0.0
IMS w/o Init
2.3
27.5
3.0
SSBA
IMS
1.0
26.0
4.0
IMS w/o Init
0.3
4.0
3.8
BadNet
IMS
0.1
4.0
3.9
IMS w/o Init
0.0
7.6
1.8
BPP
IMS
0.0
7.6
23

---

G
Impact of
As part IMS, we use weight the f1-based sparsity term included in Equation and 6 evaluate the sensitivity of our approach to the value of X, we have conducted experiments across range of values using the ResNet architecture, the GTSRB dataset with a poisoning ratio of 10% and SPC of 10. The results, presented in the Table show that performance remains stable for values of up to 2x the default value of in most cases. Exceptions being IAB and WaNet, which exhibit more sensitivity. For BadNet and BPP, performance remains robust even when À is increased by factor of 10.
To
Table 5: Performance of IMS across varying À values.
Attack
Metric
A=5
10
15
20
25
50
75
100
ASR
0.0
0.0
0.0
0.0
0.1
1.3
3.5
13.5
BadNet
RDR
3.7
4.4
4.2
6.0
4.5
4.7
6.5
14.1
ARR
3.8
4.2
4.1
6.0
4.6
3.7
3.8
2.8
ASR
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
BPP
RDR
7.6
7.6
7.1
7.4
7.7
7.6
6.9
6.4
ARR
1.8
1.4
1.5
1.7
1.6
1.0
0.5
ASR
0.2
1.1
52.1
87.9
54.5
51.6
86.3
73.2
IAB
RDR
5.1
7.1
54.3
88.5
55.5
53.2
86.7
73.2
ARR
4.2
4.7
5.6
6.5
4.1
3.9
2.5
2.8
ASR
0.7
1.0
1.0
2.1
2.7
60.7
47.8
85.2
SSBA
RDR
32.2
26.0
26.1
30.4
27.4
73.0
69.4
89.8
ARR
4.4
4.0
4.3
4.3
2.8
3.1
2.5
2.7
ASR
22.9
17.2
10.1
41.8
64.1
61.1
73.0
75.8
WaNet
RDR
22.1
16.9
10.5
41.6
63.9
61.0
73.0
75.9
ARR
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
H
Impact of
As part of IMS, & to enforce selection. To evaluate the sensitivity of IMS to the value of k. conducted experiments across a range of values using the ResNet architecture, the GTSRB dataset with poisoning ratio of 10% and SPC of 10. The results show that performance remains largely stable the range 10 < & < 30. When I < 10, binarisation of the selection parameters is less sharp, which reduces pruning specificity and degrades performance. Conversely, when 30, the steepening of the inflection point amplifies the gradient of the E regularization term, discouraging selection and limiting pruning effectiveness.
BadNet
BPP
IAB
SSBA
WaNeet
100
100
100
100
100
ARR
75
75
75
40
20
40
Figure 9: ARR, ASR and RDR performance of IMS for different values of lt. Red line indicates the chosen value 20 used in experiments.
I Impact of selection
To empirically examine the trade-off between selection and ARR, we measured the relationship between the effective sparsity of S and ARR performance across each tested setting. We define

---

Table 6: Selection statisties across datasets and models. p= Spearman's p. Min/Max proportion of values 0.5 0.5 across all tested settings.
Dataset
Model
Significant
p
Min
Max
CIFAR-10
VGG
False
0.053
1.07
12.52
CIFAR-10
ResNet
True
-0.164
1.71
13.03
CIFAR- 10
EfficientNet
True
-0.496
0.38
2.98
CIFAR- 10
MobileNet
True
-0.310
0.24
2.81
GTSRB
VGG
True
0.705
2.31
10.65
GTSRB
ResNet
True
0.384
2.59
9.85
GTSRB
EfficientNet
True
-0.222
0.54
5.32
GTSRB
MobileNet
True
0.466
0.45
5.70
Tiny
VGG
True
0.680
2.65
12.95
Tiny
ResNet
True
0.577
2.62
11.14
Tiny
EfficientNet MobileNet
True
0.681
0.24
5.40
Tiny
True
0.926
0.16
4.27
effective sparsity as the proportion of entries in S that fall below 0.5. Using Spearman's we assessed how sparsity relates ARR across each dataset-model pair, and also report the observed sparsity ranges. As hypothesised, GTSRB and Tiny ImageNet show monotonic increasing association between the proportion of selected values and ARR (p > 0.4 most cases), which aligns with the corresponding sparsity minima and maxima. In contrast, CIFAR-10 typically exhibits a weaker, monotonic decreasing relationship. Notably, the narrow spread between the minimum and maximum values across all settings suggests that, in absolute terms, the extent of pruning remains modest relative to the total model size. While increasing À could thcoretically drive higher sparsity, our analysis in Appendix SenudixGSshow shows that large À values substantially harm ASR and RDR, while yielding only marginal gains in ARR.
Backdoor Reactivation Attack
The recent work [29] introduces method for reactivating backdoors by optimizing the adversary's trigger after a defense has been applied. In the black-box setting considered, the attacker is allowed unlimited queries the defended model and receives the corresponding softmax outputs. Leveraging this information, the adversary computes sample-specis perturbations that, when applied to backdoor inputs, aim restore misclassification to the original target class.
In Table 7 we report the reactivation ASR and RDR of IMS, FT-SAM, and SAU using the GTSRB dataset with 100 SPC as the evaluation setting. Overall, while IMS exhibits slightly higher suscepti- bility to backdoor reactivation compared SAU, its vulnerability is comparable to FT-SAM. Notably, in 50% of the evaluated scenarios, IMS maintains reactivation ASR below 50%.
Regarding reactivation RDR, which the recovery accuracy of reactivation samples using their origi- nal (clean task) labels relative to the original model's 's accuracy, we observe only minor differences across the three defenses. This suggests that while SAU more effectively prevents targeted misclassi- fication through backdoor reactivation, it does not necessarily mitigate untargeted misclassification. In contrast, IMS and FT-SAM exhibit similar RDR performance to SAU, with a larger proportion of reactivation samples being misclassified as the target class. Although the primary focus of this work not on reactivation attacks, we highlight this finding as critical consideration for future research in backdoor mitigation.
K
Additional Results and Plots
K.1
Model and Attack Plots
In Fig. 10 we provide the complete version of the summary results provided in the main text as Fig. As discussed in section 5.22 IMS significantly improves the inconsistent ASR and RDR performance of existing pruning methods across different model architectures and attack types. However, compared
25

---

Table 7: ASR and RDR (x100) of IMS, FI-SAM, and SAU under backdoor reactivation attack GTSRB dataset with SPC=100. Columns Asau and AFT-SAM represent the performance difference of TMS compared SAU and FT-SAM, respectively, negative value signifies better performance IMS (lower ASR, higher RDR).
ASR
RDR PT-SAM
Allack
Model
IMS
SAU
FT-SAM
ASAU
ÄFT
IMS
SAU
ASAU
AFT
ResNet
61.39
0.41
58.45
60.99
2.94
63.13
23.91
60.62
39.22
2.51
BadNet
MobileNet
78.18
44.07
58.01
34.11
20.17
79.32
74.64
60.89
4.69
18.43
ResNet
19.06
43.75
-22.58
-24.69
42.13
51.50
48.57
-9.37
-6.44
ВPP
MobileNet
28.34
26.53
44.14
1.81
-15.81
49.14
60.13
52.02
-10.99
-2.88
ResNet
44.15
22.81
73.90
21.34
-29.75
53.93
68.55
75.48
-14.62
-21,55
Inputaware
MobileNet
37.86
22.90
51.04
14.96
-13.18
58.85
70.30
59.10
-11.44
-0.24
ResNet
98.19
70.68
27.51
13.85
98.31
95.00
87.53
SSBA
MobileNet
94.42
67.27
94.47
27.15
-0.05
95.49
89.26
95.73
6.23
-0.25
ResNet
91.59
63.94
49.86
27.65
41.73
91.42
71.81
52.14
19.61
39.28
WaNet
MobileNet
51.03
43.16
52.83
7.88
-1.80
57.87
63.33
55.19
-5.46
2.68
Mcan Diff'
20.08
-0.66
Mcan Dift
2.12
4.23
to BTI-DBE, FT-SAM, and SAU, IMS exhibits slightly higher ASR variance across the considered attacks. Interestingly, the RDR performance patterns of IMS, BTI-DBF, FT-SAM, and SAU generally similar across attack types, with IMS showing slightly lower variance and median RDR in most cases.
K.2 Density Plots
In Fig. II we present a scatter plot of the ASR vs RDR and ARR performance of each method. Note, that ideal performance is in the bottom left-hand corner of each plot. Consistent with the findings presented in Section 5.2. these plots show that IMS substantially enhances the performance of existing pruning-based methods. This is evident from the pronounced shift in result density away from the top right and bottom left corners when comparing IMS to FP, ANP, AWN, RNP, NFT, and FMP. Compared to fine-tuning works, IMS trades off some ASR performance, as indicated by greater variance along the ASR axis, for improved RDR and ARR performance. This is supported by the ARR and RDR results of BTI-DBE, FT-SAM and SAU exhibiting greater variance along these axes compared to IMS.
Figure 12 presents scatter plots of ASR versus RDR and ARR for IMS and each fine-tuning method at SPC levels of 2, 10, and 100. In line with the results discussed in Section 5.2 these plots demonstrate that IMS maintains notably
stable ARR and RDR performance under reduced data availability compared to fine-tuning methods. In particular, the ARR and RDR performance fine-tuning methods becomes varied compared to IMS as SPC is reduced.
26

---

PPI
AND
AWNN'
KNPP
IFT
FMP!
IMS!
BTI-DBFF
FT:SAM
SAU!
1.00
3.00
RDR
6.67
0.33
0.00
ABCH
Model
En-0
SAL
00
D 490
(b) Attack
Figure 10: Box plots illustrating ASR, RDR, and ARR results for IMS compared to all tested methods, across VGG, B: ResNet, C: EfficientNet and D: MobileNet. In Plot
different Model and Attack settings. In Plot (A) A: (B) E: BadNet, F: Blended, G: L.,, H: Signal, BPP, J: Inputaware, K: SSBA and L, WaNet.
FP
ANP
AWN
RNP
NFT
1.00
-00
RDR
5l
0.33
5
0.00
0.66
Denulty (ARR)
ARR
0.00
0:33
0.66
1.00
ASR
ASR
ASR
ASR
ASR
FMP
IMS
STID8F-U
FT-SAM
SAU
1.00
Pandtty (RDR)
RDR
0.33
1.00
20
Denaity (ARR)
10
0.00
0.00
0.33
0.65
1.00
0.00
0.33
0.66
1.00
0.00
0.33
0.66
1.00
0.00
0.33
0.66
1.00
0.00
0.33
0.66
1.00
ASR
ASR
A5R
ASR
ASR
Figure 11: Scatter plots of ASR vs RDR and ASR vs RDR for IMS and various existing pruning and fine-tuning approaches. Green points denote the median values.
27

---

1.00
1.00
1 1 8
Dersit (ADR)
2.33
0.33
1.00
Ourife L400
0.33
0.33
0.00
0:33 0.65
3.00
0:00
3.33 5.66
1.00
0.00
2:30
0.68
1.50
0.20
0.33
046
1.00
5.00
5.33 8.66
1:30
0.03
0.33
0.56
1.02
ASR
ASA
ASA
ASA
ASR
ASR
(a) IMS
(b) BTI-DBF
SPC:
SPC: 10
SPC: 100
SPC:
SPC: 10
SPC:
100
Density (NOR)
0121
0.00
0.68
3.66
0.66
8 8
0.59
5.33
1.00
ASR
A5R
(c) FT-SAM
(d) SAU
Figure 12: Scatter plots of ASR vs RDR and ASR vs RDR for IMS and various existing pruning and fine-tuning approaches, with SPC values of 2, 10, and 100. Green points denote the median values.
28


Reviews:
[{"review_id": "ykF5zNsaFV", "reviewer": "Reviewer_gsLE", "summary": "This paper presents an improved pruning-based backdoor defense by introducing a dual-optimization framework that simultaneously searches for reverse-engineered triggers and identifies backdoor-related neurons in the model. The method leverages the behavioral differences between trigger and clean inputs to more accurately locate neurons associated with the backdoor. The authors conduct experimental evaluations and demonstrate the effectiveness of their design.", "questions": "1. Could the authors provide detailed ablation experiments for each loss term in Equation 7? \n2. There appears to be an inconsistency in notation in Equation 7 and line 224, where \\tilde{p}_{\\mathcal{A}'} should likely be \\hat{p}_{\\mathcal{A}'} based on the context. Could the authors clarify and correct this notation?\n3. Could the authors provide clearer visualizations for Figures 3 and 5?", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n1. The paper introduces an innovative approach to pruning-based backdoor defense by implementing a three-way classification of neurons (backdoor-related, clean-related, and unselected) and incorporating an invertible mask mechanism.\n \n2. The experimental results demonstrate that the proposed method can effectively remove backdoors compared to  existing pruning-based defenses, while preserving the clean accuracy.\n\n3. The paper provides thorough experimental validation across a wide range of attack methods and compares against multiple defensive approaches.\n\n4. The paper is well-written.\n\nWeaknesses\n\n1. The method incorporates multiple loss terms (particularly in Equation 7), but lacks ablation studies to demonstrate the individual contribution and necessity of each term. The authors should consider adding more ablation studies.\n\n2. The data visualization in key figures (e.g., Figures 3 and 5) suffers from small graph sizes, making it challenging to accurately interpret the results.", "was_revised": true, "final_justification": "The authors have addressed my main concerns, and I maintain my positive recommendation.", "rebuttal": "Thank you for your thoughtful and constructive feedback. We are encouraged by the positive reception of our work and appreciate the time and effort taken to evaluate our paper. In the responses below, we address each comment individually and indicate where clarifications or revisions will be made in the paper. Please let us know if you believe the changes are inadequate or if further clarification is needed. We are eager to work collaboratively with all reviewers during the discussion period to further improve the paper.\n\n**Comment 1.1: Additional ablation studies**\n\nWhile our method integrates multiple loss terms, we note that isolating the effect of each individual term is not straightforward due to their interdependence across the optimization phases (i.e., mask initialization, inner subproblem, and outer subproblem). Instead, as a practical compromise, we have conducted a phase-level ablation to assess the contribution of key components.\n\nSpecifically, since the goal of mask initialization is to encourage the inverse mask to prune clean-task-related components, thereby pushing the inner subproblem to rely more heavily on backdoor-related components, we evaluated the impact of omitting this step. We show the results in the below Table for a subset of scenarios using the ResNet architecture and GTSRB dataset, with a poisoning ratio of 10\\% and SPC of 10. The results demonstrate that including mask initialization substantially improves ASR and RDR performance of IMS under IAB and WaNet attacks, offers modest gains in RDR performance under SSBA attach, and has negligible effect on performance under BadNet and BPP attacks. These findings suggest that mask initialization plays a critical role in harder-to-defend attack scenarios, justifying its inclusion in our framework.\n\n|Attack |Defense       |ASR |RDR |ARR |\n|-------|--------------|----|----|----|\n|IAB    |IMS w/o Init  |56.1|57.3|4.5 |\n|IAB    |IMS           |1.1 |7.1 |4.7 |\n|WaNet  |IMS w/o Init  |21.8|21.7|0.0 |\n|WaNet  |IMS           |1.7 |1.9 |0.0 |\n|SSBA   |IMS w/o Init  |2.3 |27.5|3.0 |\n|SSBA   |IMS           |1.0 |26.0|4.0 |\n|BadNet |IMS w/o Init  |0.3 |4.0 |3.8 |\n|BadNet |IMS           |0.1 |4.0 |3.9 |\n|BPP    |IMS w/o Init  |0.0 |7.6 |1.8 |\n|BPP    |IMS           |0.0 |7.6 |1.4 |\n\n\n**Comment: 1.2** Figure Readability\n\nWe will include all figures in vector-based PDF format to support proper scaling and legibility for online readers. We will also increase the font size of figure text where appropriate to improve readability in print.\n\n**Comment: 1.3** Notation Error\n\nWe appreciate your attention to detail. We will correct the notation from $\\tilde{p}\\_{\\mathcal{A}'}$ to $\\hat{p}\\_{\\mathcal{A}'}$ in the mentioned equation and corresponding text."}, {"review_id": "EbZePOcEhr", "reviewer": "Reviewer_dLLr", "summary": "This paper introduces a novel model pruning-based strategy for defending against backdoor attacks in deep learning. While model pruning is recognized for its interpretability and robustness—especially valuable in low-data scenarios—existing methods struggle to precisely identify and remove parameters responsible for malicious backdoor behaviors. In contrast, fine-tuning-based defenses have gained popularity due to their effectiveness, but they often lack the same level of interpretability. The authors propose an innovative approach that incorporates two key components: (1) a learned selection mechanism to pinpoint parameters critical to both the main task and the backdoor behavior, and (2) an invertible pruning mask, which serves dual purposes—removing the backdoor while preserving it through its inverse for analysis. Through extensive experiments, the method demonstrates superior performance compared to existing pruning-based defenses and achieves results competitive with state-of-the-art fine-tuning approaches.", "questions": "1. **Missing Ablation Studies**\n   The proposed method comprises multiple components, including initialization, selection, masking, and perturbation generation. However, the individual contribution and effectiveness of each component are not adequately analyzed through ablation studies.\n\n2. **Unclear Choice of \\$\\lambda\\$**\n   The paper mentions that \\$\\lambda\\$ is initially set to 0 and later increased to 10. However, the rationale behind this choice, the schedule for its adjustment, and its impact on the final performance remain unclear and underexplained.\n\n3. **Scale of \\$\\epsilon\\$**\n   In adversarial perturbation-based methods, the magnitude of the perturbation \\$\\epsilon\\$ is a critical factor. If the trigger exceeds this perturbation scale, its effectiveness cannot be ensured. In this work, \\$\\epsilon\\$ is set to 1, which allows unrestricted modifications to the image. Based on prior experience, such a large value may lead to ill-posed perturbations and result in unrealistic or uninformative adversarial examples.\n\n4. **Unexplored Parameter Choices**\n   Important hyperparameters, such as the number of rounds \\$R\\_1\\$, \\$R\\_2\\$, and \\$R\\_3\\$, are introduced but not analyzed or justified. Their influence on performance should be investigated.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "### **Strengths**\n\n1. **Effective Backdoor Mitigation**\n   The proposed method outperforms existing pruning-based defenses and achieves performance comparable to state-of-the-art fine-tuning approaches. This makes it a competitive and practical solution for mitigating backdoor behaviors.\n\n2. **Innovative Use of Invertible Pruning Mask**\n   The introduction of an *invertible pruning mask* is a novel contribution. It enables dual functionality—removing backdoor effects while preserving them in an inverse form. This not only enhances defense but also provides interpretability and facilitates analysis of backdoor mechanisms.\n\n3. **Comprehensive and Rigorous Experiments**\n   The paper presents a thorough experimental evaluation across diverse models, datasets, attack types, and poisoning ratios. Notably, the authors run repeated trials and report statistical results using box plots—an important but often overlooked practice in this domain.\n\n---\n\n### **Weaknesses**\n\n1. **Suboptimal Performance Compared to Fine-Tuning**\n   While the method significantly improves over existing pruning-based defenses, its performance still lags behind the best fine-tuning-based approaches (e.g., Figure 4 and Table 3). Nonetheless, I agree with the authors that innovation in pruning remains an important and valuable research direction.\n\n2. **Limited Novelty in Certain Components**\n   Some elements of the method—such as the use of adversarial noise as a trigger surrogate (similar to SAU), the concepts of clean/backdoor neurons (seen in ANP and RNP), and learnable masks (explored in AWN and ANP)—have been discussed in prior work. These similarities somewhat reduce the novelty. However, the proposed selection process, particularly the insight that many neurons are shared between clean and backdoor behaviors, is both original and impactful.\n\n---\n\n### **Overall Evaluation**\n\nThis paper makes a solid and meaningful contribution to pruning-based backdoor defense. Although fine-tuning methods currently lead in performance, the proposed approach advances the field with a well-motivated design and rigorous experimentation. Continued innovation in pruning is essential and deserves recognition.", "was_revised": true, "final_justification": "Although the novelty of each component or the effectiveness compared to a fine-tuning-based method in all cases may be challenged from some perspectives, I think 1) combining existing ideas/intuitions to achieve a new SOTA is a worth-recognized contribution. 2) Beating all existing methods is not the necessary condition for a good paper, as long as it makes a contribution in this direction.\n\nSo, I would like to raise my score to support more research on pruning-based backdoor defense.", "rebuttal": "Thank you for your valuable feedback. In our responses below, we address each comment individually and indicate where clarifications or revisions will be made in the paper. Please let us know if you feel the changes are inadequate or if further clarification is needed. We are eager to work collaboratively with all reviewers during the discussion period to further improve the paper.\n\n**Comment 2.1: Performance Relative to Fine-Tuning**\n\nAs shown in Table 3, our approach, IMS, achieves significantly better RDR and ARR performance compared to state-of-the-art fine-tuning approaches, BTI-DBF, FT-SAM, and SAU, in low-data settings (2 and 10 SPC), which we identify as a key target scenario for pruning-based defenses. Moreover, Figure 4 also shows that IMS has reduced ARR variance compared to each fine-tuning baseline in all SPC settings. While FT-SAM outperforms IMS at 100 SPC, IMS still demonstrates superior RDR performance compared to BTI-DBF and SAU, with comparable ARR. These results support our central claim that our approach offers superior mitigation performance under limited data availability, where fine-tuning approaches are often less effective or impractical.\n\n**Comment 2.2: Novelty**\n\nWe agree that our proposed selection process is a a key innovation that distinguishes IMS from existing pruning-based defenses. We would also like to highlight other aspects that contribute to the broader novelty of our approach. \n\n1) While both IMS and SAU employ bi-level optimization, their goals differ fundamentally. SAU applies bi-level optimization to fine-tune the model, whereas IMS uses it to guide model component selection for pruning. As a result, the inner and outer subproblems in IMS are fundamentally distinct in design and purpose from those in SAU.\n\n2) In contrast to ANP and RNP, which only assess the subtractive effect of pruning (i.e., how model behavior changes when components are removed), IMS introduces an invertible masking mechanism that also evaluates model behavior when the roles of pruned and retained model components are reversed (i.e., under the inverse mask). This more comprehensive dual perspective enables more precise and reliable identification, and subsequent pruning, of backdoor-related components.\n\n3) Our adversarial objective is explicitly formulated for a pruning setting, rather than fine-tuning, and interacts with our invertible masking mechanism in a principled way to guide component selection.\n\nWe will revise the paper to more clearly highlight and elaborate on the core methodological contributions of IMS.\n\n**Comment 2.3: Missing Ablation Studies**\n\nTo address this comment, as well as related ones made by other reviewers, we have conducted several additional ablation experiments that will be included in the paper. First, to assess the contribution of each optimization phase, we evaluated the impact of the mask initialization step on overall performance. As discussed in our response to Reviewer gsLE (Comment 1.1), this step encourages pruning of the inverse mask, thereby forcing the inner subproblem to rely on backdoor-related components. The results, provided with Comment 1.1, show that this step significantly improves performance in more challenging attack scenarios (e.g., IAB and WaNet), supporting its inclusion.\n\nSecond, to assess the impact of $k$ in the proposed selection mechanism, we have evaluated the performance of IMS across a range of $k$ values. The results show that stronger binarisation of the selection parameters, via a larger $k$, leads to improved performance up to a certain point, beyond which gains plateau or diminis. This observation aligns with our original claim in Section 4.1. We present detailed results and further discussion in our response to Reviewer k34Q (Comment 3.3).\n\nRegarding $\\lambda$, we employ a simple single-step schedule, i.e., we initially set it to $0$ and increases it to $10$ halfway through the $R_2$ rounds. This allows the mask and channel selection parameters to be updated without $\\ell_1$-norm regularization in the early stages, promoting a greedy solution that is subsequently refined once regularization is introduced. To evaluate the sensitivity of our approach to the value of $\\lambda$, we have conducted experiments across a range of values using the ResNet architecture and the GTSRB dataset with a poisoning ratio of 10\\% and SPC of 10. The results, presented in the table below, show that performance remains stable for values of $\\lambda$ up to 2x the default in most cases, except for IAB and WaNet, which exhibit more sensitivity. For BadNet and BPP, performance remains robust even when $\\lambda$ is increased by a factor of 10. Finally, we emphasize that the same values of $\\lambda$, $k$, and $R_{1,2,3}$ are used consistently across all our experiments.\n\n| Attack | λ   | ASR  | RDR  | ARR  |\n|--------|-----|------|------|------|\n| BadNet |   5 |  0.0 |  3.7 |  3.8 |\n| BadNet |  10 |  0.0 |  4.4 |  4.2 |\n| BadNet |  15 |  0.0 |  4.2 |  4.1 |\n| BadNet |  20 |  0.0 |  6.0 |  6.0 |\n| BadNet |  25 |  0.1 |  4.5 |  4.6 |\n| BadNet |  50 |  1.3 |  4.7 |  3.7 |\n| BadNet |  75 |  3.5 |  6.5 |  3.8 |\n| BadNet | 100 | 13.5 | 14.1 |  2.8 |\n| BPP    |   5 |  0.0 |  7.6 |  1.8 |\n| BPP    |  10 |  0.0 |  7.6 |  1.4 |\n| BPP    |  15 |  0.0 |  7.1 |  1.5 |\n| BPP    |  20 |  0.0 |  7.4 |  1.7 |\n| BPP    |  25 |  0.0 |  7.7 |  1.6 |\n| BPP    |  50 |  0.0 |  7.6 |  1.4 |\n| BPP    |  75 |  0.0 |  6.9 |  1.0 |\n| BPP    | 100 |  0.0 |  6.4 |  0.5 |\n| IAB    |   5 |  0.2 |  5.1 |  4.2 |\n| IAB    |  10 |  1.1 |  7.1 |  4.7 |\n| IAB    |  15 | 52.1 | 54.3 |  5.6 |\n| IAB    |  20 | 87.9 | 88.5 |  6.5 |\n| IAB    |  25 | 54.5 | 55.5 |  4.1 |\n| IAB    |  50 | 51.6 | 53.2 |  3.9 |\n| IAB    |  75 | 86.3 | 86.7 |  2.5 |\n| IAB    | 100 | 73.2 | 73.2 |  2.8 |\n| SSBA   |   5 |  0.7 | 32.2 |  4.4 |\n| SSBA   |  10 |  1.0 | 26.0 |  4.0 |\n| SSBA   |  15 |  1.0 | 26.1 |  4.3 |\n| SSBA   |  20 |  2.1 | 30.4 |  4.3 |\n| SSBA   |  25 |  2.7 | 27.4 |  2.8 |\n| SSBA   |  50 | 60.7 | 73.0 |  3.1 |\n| SSBA   |  75 | 47.8 | 69.4 |  2.5 |\n| SSBA   | 100 | 85.2 | 89.8 |  2.7 |\n| WaNet  |   5 | 22.9 | 22.1 |  0.0 |\n| WaNet  |  10 | 17.2 | 16.9 |  0.0 |\n| WaNet  |  15 | 10.1 | 10.5 |  0.0 |\n| WaNet  |  20 | 41.8 | 41.6 |  0.0 |\n| WaNet  |  25 | 64.1 | 63.9 |  0.0 |\n| WaNet  |  50 | 61.1 | 61.0 |  0.0 |\n| WaNet  |  75 | 73.0 | 73.0 |  0.0 |\n| WaNet  | 100 | 75.8 | 75.9 |  0.0 |\n\n**Comment 2.4: Trigger Bound**\n\nIn our approach, we estimate the perturbation $\\delta$ using full gradients with the AdamW optimizer (rather than using only gradient signs), and project the updates onto an $\\ell\\_{\\infty}$-ball at each step. Specifically, we set $\\epsilon = 1$ as a hard upper bound, not a target magnitude, on $\\|\\delta\\|\\_{\\infty}$. Due to the use of AdamW optimizer, which incorporates decoupled weight decay, $\\|\\delta\\|\\_{2}$  is implicitly regularized and shrinks over time. As a result, the actual perturbation magnitudes remain well below the $\\epsilon$ bound in practice. This behavior stands in contrast to sign-based methods (e.g., FGSM or PGD variants used in SAU), where large $\\epsilon$ values often push the solution toward the boundary, directly determining the perturbation size. \n\nTo clarify this distinction, we will revise Section 4.2 to explicitly explain the role of $\\epsilon$ in our inner subproblem formulation.\n\n**Comment 2.5: Hyperparameters**\n\nAs mentioned in our response to Comment 2.3, we have conducted additional ablation studies to evaluate the sensitivity of IMS to $\\lambda$. We have also explored the impact of $k$ on component selection (Reviewer k34Q, Comment 3.3), and the importance of each optimization phase, particularly mask initialization (Reviewer gsLE, Comment 1.1). We hope these new experiments address your concerns regarding the setting of the values of the hyperparameters. Please note that all hyperparameters were held fixed across all 864 experimental settings involving different combinations of attacks, model architectures, datasets, poisoning ratios, and SPC values. \n\nWe acknowledge that the number of rounds used for each phase was not discussed in the paper. Specifically, $R_1$ and $R_2$ (both set to 200) serve as upper bounds on the number of iterations for mask initialization and the outer subproblem in Algorithm 1, respectively. As shown in Figure 8 of the supplementary material, the median and median absolute deviation of the actual iteration counts indicate that, for mask initialization, only half the plotted cases reach the maximum threshold, while for the outer subproblem, none do. We will add a clarifying note on this in Section D of the supplementary material."}, {"review_id": "ZPf3ZpFYdk", "reviewer": "Reviewer_k34Q", "summary": "This paper proposes *Invertible Masking using Selection* (IMS) for backdoor defense. Specifically, IMS employs an invertible mask and a selection mechanism to distinguish between model components for benign and backdoor tasks. The method formulates a bi-level optimization problem to jointly learn the pruning mask and selection parameter vector derived from clean data. The authors conducted extensive experiments on various datasets, models, and attacks to validate the effectiveness of the IMS.", "questions": "- What is the value of $k$ in the experiments? Does it affect the defense performance?\n- How does the IMS perform against the adaptive attacks? [1] This is to validate whether the IMS is still effective when the benign and backdoor components are less separated.\n- What if there are multiple backdoor targets, such as all-to-all attacks?\n- Other questions are listed in the weaknesses section.\n\n\n[1] Revisiting the assumption of latent separability for backdoor defenses", "limitations": "While the author has claimed that extending the IMS to ViT-based models requires significant efforts, it is a critical limitation given the fact that the backdoor defense against small (ConvNets) models becomes saturated. In contrast, the fine-tuning approaches are more general.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "## Strengths\n\n- Overall, the paper is well-written and easy to follow, with clear experimental settings and method formulations.\n- IMS is evaluated across a range of backdoor attacks, datasets, and model architectures. The authors also consider various advanced defense methods, which increase the soundness of the paper.\n- The IMS achieves a promising defense performance when clean data is limited.\n\n## Weaknesses\n\n- The motivation behind *invertible-masks*, i.e., the mask and its inverse, is unclear. For example, in ANP, they use bi-level optimization to ensure both benign performance (a larger mask will result in benign performance degradation) and backdoor mitigation (a smaller inverse mask will lead to ineffective mitigation), which implicitly uses *invertible-masks* in their defense. Thus, why does IMS's design result in improved defense performance compared to ANP/RNP? What if you use the ANP to prune all model parameters, not just the channel? This will validate whether the improvement stems from increasing the mask sizes or the design of the explicit *invertible-masks*.\n- The defense performance appears to be inferior to several existing methods for ASR and ARR (when SPC is greater than 10), such as FT-SAM and SAU (see Fig. 4 in the submission). That being said, can you elaborate on the advantages of IMS over these methods, in which clean data is not as limited? While I acknowledge that practical defenders may access limited clean data, evaluating against the scenario where SPC is 2 or even fewer is not necessary, since most defenses, even the IMS, are not effective in this case (a significant sacrifice in clean accuracy).", "was_revised": true, "final_justification": "As most of my concerns are addressed, I decided to raise my score to 4. \n\nOverall, this paper demonstrates strong defense performance and well-designed experiments. My primary concern was the novelty of the methodology. While some concerns remain, the author's rebuttal has adequately addressed my main issues, such as the generalizability of IMS and the motivation behind the approach. Therefore, I have decided to raise my score to 4.", "rebuttal": "Thank you for your thoughtful and constructive feedback. We are encouraged by the positive reception of our work and appreciate the time and effort taken to evaluate our paper. In the responses below, we address each comment individually and indicate where clarifications or revisions will be made in the paper. Please let us know if you believe the changes are inadequate or if further clarification is needed. We are eager to work collaboratively with all reviewers during the discussion period to further improve the paper.\n\n**Comment 3.1: Novelty Compared to ANP and RNP**\n\nWhile ANP employs a bi-level optimization strategy, it only considers the subtractive effect of pruning, i.e., how model behavior changes when components are removed. Specifically, in ANP, the maximization step uses $\\mathbf{m} + \\mathbf{\\delta}$ (Equation 8 in their paper), where $\\mathbf{m}$ is a learnable binary mask and $\\mathbf{\\delta}$ is the perturbation. However, the outer minimization step operates solely on $\\mathbf{m}$, and there is no mechanism to explicitly evaluate how pruned components behave when retained. Thus, although $\\mathbf{\\delta}$ can transiently activate masked channels, it does not constitute a true inverse mask. Components retained by $\\mathbf{m}$ are never pruned, and components pruned by $\\mathbf{m}$ are not systematically evaluated in isolation.\n\nRNP also adopts a subtractive approach. During the \\emph{recovering} stage, a mask is learned to restore benign accuracy after unlearning, and this same mask is applied to the original model parameters. At no point does RNP evaluate the behavior of components under an inverse pruning scheme. \n\nIn contrast, IMS explicitly introduces an invertible masking mechanism that enables us to analyze how pruned components behave when retained and how retained components behave when excluded. This dual perspective (enabled by structured, complementary masks) allows for a more comprehensive assessment of component behavior and leads to more targeted and reliable pruning.\n\nRegarding your question about where pruning is applied: all three methods (ANP, RNP, and IMS) target the same set of model components (e.g., convolutional channels), hence the overall pruning scope is consistent. Therefore, our observed performance improvements cannot be attributed to differences in pruning granularity or scope. Rather, they stem from IMS’s unique selection strategy and the dual evaluation framework enabled by invertible masks.\n\nOur core motivation, as discussed in Section 4.1, is to address a fundamental limitation in prior pruning-based defenses: the assumption that the backdoor can be removed  purely through subtraction (i.e., pruning suspected backdoor components). By evaluating both pruning and retention effects through complementary masks, IMS establishes a more robust criterion for component selection, particularly in contrast to ANP and RNP. We will revise Section 4.1 to clarify these distinctions and highlight the novelty and impact of our approach.\n\n**Comment 3.2: Fine-tuning Comparison**\n\nTo clarify the performance differences, Table 3 shows that in low-data settings (2 and 10 SPC), IMS achieves significantly higher RDR and ARR compared to BTI-DBF, FT-SAM, and SAU. Moreover, as shown in Figure 4, IMS exhibits lower variance in ARR across all SPC levels, suggesting improved consistency. While FT-SAM outperforms IMS in terms of median ASR and ARR at 100 SPC, IMS still achieves better RDR than BTI-DBF and SAU, with comparable ARR. This highlights its competitiveness even in higher-data regimes, although its primary advantage over state-of-the-art approaches emerges when data availability is limited, a scenario where fine-tuning methods are often less effective or even infeasible. Nonetheless, we agree that SPC values below 2 are rarely practical. Our evaluation at 2 SPC is intended to benchmark the lower limit of applicability across all approaches, and we acknowledge that performance degradation is expected in such extreme cases.\n\nThat said, IMS offers additional advantages beyond performance, particularly in higher-SPC settings. As noted in the Introduction, Conclusion, and by Reviewers uZpS and dLLr, pruning-based approaches (such as IMS) offer improved interpretability compared to fine-tuning. Specifically, IMS yields a learned mask that explicitly identifies components associated with the backdoor task, offering greater transparency into the mitigation process. In contrast, fine-tuning approaches operate through implicit gradient-based updates, making it more difficult to attribute behavioral changes to specific model components. We will revise Section 5.2 to more clearly emphasize this interpretability benefit.\n\n**Comment 3.3: Importance of K**\n\nIn all experiments, we set $k = 20$. In response to this comment and related ones from other reviewers, we have conducted an ablation study to evaluate the sensitivity of our approach to the value of $k$. The table below presents results using a representative subset of our experiments using the ResNet model and the GTSRB dataset with a poisoning ratio of 10\\% and SPC of 10.\n\nThe results show that performance remains largely stable in the range $10 < k < 30$. When $k < 10$, the binarisation of the selection parameters is less sharp, which reduces pruning specificity and degrades performance. Conversely, when $k > 30$, the steepening of the inflection point amplifies the gradient of the $\\ell_1$ regularization term, discouraging selection and limiting pruning effectiveness.\n\nWe will include these results, along with additional ablation studies on the effect of $\\lambda$ and the importance of mask initialization, in the final paper.\n\n|Attack|k|ASR|RDR|ARR|\n|------|--|----|----|----|\n|BadNet|1|0.0|3.4|3.6|\n|BadNet|10|0.0|4.4|4.2|\n|BadNet|15|0.0|4.8|4.8|\n|BadNet|20|0.1|4.0|4.0|\n|BadNet|25|0.1|4.0|4.0|\n|BadNet|30|6.2|9.2|4.5|\n|BadNet|40|93.9|93.9|0.8|\n|BadNet|50|93.3|93.3|0.0|\n|BPP|1|1.0|7.7|1.3|\n|BPP|10|0.0|7.4|1.6|\n|BPP|15|0.0|7.3|1.5|\n|BPP|20|0.0|7.6|1.4|\n|BPP|25|0.0|7.8|2.0|\n|BPP|30|0.0|7.9|1.8|\n|BPP|40|100.0|100.0|5.6|\n|BPP|50|100.0|100.0|0.0|\n|IAB|1|74.1|74.9|5.1|\n|IAB|10|13.6|17.0|3.9|\n|IAB|15|35.4|37.1|4.3|\n|IAB|20|1.1|7.1|4.7|\n|IAB|25|15.9|18.7|4.2|\n|IAB|30|35.3|37.3|3.7|\n|IAB|40|87.0|87.1|0.0|\n|IAB|50|87.1|87.2|0.0|\n|SSBA|1|32.2|55.2|6.4|\n|SSBA|10|1.7|28.3|3.6|\n|SSBA|15|0.9|32.0|4.3|\n|SSBA|20|1.0|26.0|4.0|\n|SSBA|25|1.0|26.2|4.3|\n|SSBA|30|2.1|26.8|4.0|\n|SSBA|40|19.5|40.8|2.8|\n|SSBA|50|100.0|100.0|0.0|\n|WaNet|1|50.9|52.5|0.4|\n|WaNet|10|60.4|59.9|0.0|\n|WaNet|15|6.8|7.2|0.0|\n|WaNet|20|17.2|16.9|0.0|\n|WaNet|25|5.1|5.5|0.0|\n|WaNet|30|36.6|35.9|0.0|\n|WaNet|40|96.6|96.8|0.0|\n|WaNet|50|96.6|96.8|0.0|\n\n**Comment 3.4: Considered Attacks**\n\nOur current study includes several adaptive backdoor attacks such as BPP, IAB, SSBA, and WaNet that dynamically modify their trigger based on the input. As shown in Figure 5(b), IMS demonstrates comparable performance across both adaptive and static attacks (e.g., BadNet, Blended, LF, and Signal), suggesting robustness even when backdoor patterns are input-dependent.\n\nWhile we acknowledge the value of evaluating IMS against a broader set of attacks, including the one you mentioned, as well as multi-trigger, multi-target, and all-to-all backdoor settings, such experiments are currently beyond our computational budget. Our full set of experiments, including additional results omitted from the main paper due to space constraints, already exceeds 25 TB in data storage. Nonetheless, we view this as an important direction for future work.\n\nImportantly, our evaluation protocol is aligned with current best practices in the literature, including those used in SAU, FT-SAM, and the BackdoorBench benchmarking paper. Although the mentioned attack appears to reduce latent space separability, the visualizations provided in that work focus on feature distributions from the final dense layer. In contrast, IMS selects and prunes components in all convolutional layers, making the comparison less direct.\n\n**Comment 3.5: ViTs**\n\nTo address the important point of evaluating IMS on ViT-based architectures, which was also raised by Reviewer k34Q (Comment 4.3), we will include a brief discussion in the main text (space permitting, otherwise in the appendix) regarding the applicability and potential extensions of IMS to ViT-based architectures.\n\nMotivated by this feedback, we have conducted a preliminary set of experiments applying a modified version of IMS to ViT models backdoored by BadNet, BPP, and IAB. The results are highly promising: IMS effectively mitigates both BadNet and BPP attacks across all three considered SPC settings.  While our ViT adaptation is still at an exploratory stage and does not yet include all architectural adjustments required for full generalization, these initial findings suggest that the core ideas of IMS can extend beyond ConvNets. For a more detailed description of the modified approach and corresponding results, please refer to our response to Comment 4.3."}, {"review_id": "VaH20sXBMY", "reviewer": "Reviewer_uZpS", "summary": "This paper proposes a novel pruning-based backdoor defense method called Invertible Masking using Selection (IMS). It introduces an invertible pruning mask and a component selection mechanism, formulated within a bi-level optimization framework. Without needing trigger samples, IMS can effectively suppress backdoor behavior while preserving clean accuracy.", "questions": "See weaknesses", "limitations": "See weaknesses", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n1. The concept of invertible masks is both intuitive and effective. It provides a principled way to distinguish between clean and backdoor components, improving interpretability over existing methods that rely on one-sided heuristics.\n\n2. The method assumes no access to trigger samples and only limited clean data, which is realistic in outsourced training scenarios. It scales well to large datasets (e.g., Tiny-ImageNet, ImageNette) with reasonable computational complexity.\n\n3. IMS consistently achieves lower ASR and RDR than prior pruning defenses (FP, ANP, AWN, etc.), and remains competitive or superior to fine-tuning methods (FT-SAM, SAU).\n\n**Weaknesses**\n1. While the two-level training loop is central to the method, the paper lacks convergence analysis or training stability discussions.\n\n2. The paper highlights computational savings over fine-tuning in text but provides no runtime or resource comparison (e.g., time per epoch, GPU memory). This weakens the case for pruning as a practical alternative.\n\n3. While the proposed method is currently limited to CNNs, the paper should ideally provide at least a high-level discussion on how the key components, particularly the invertible mask and selection mechanism, might be extended to Vision Transformers (ViTs)\n\n4. Although the proposed method achieves low ASR and RDR on average, certain attacks still result in high recovery error. The paper does not analyze these failure cases or provide examples to understand the limits of the defense. Including qualitative or case-by-case analysis of misclassified samples would improve interpretability and guide future improvements.\n\n5. The paper introduces a selection mechanism to avoid over-pruning, but it does not clearly explain how pruning affects the model’s clean accuracy. For example, if stronger pruning removes more backdoor behavior, does it also harm clean predictions? It would be helpful to show how the method balances these two goals, perhaps by plotting how clean accuracy and backdoor removal change as pruning becomes more aggressive.", "was_revised": true, "final_justification": "The authors have addressed my all concerns", "rebuttal": "Thank you for your thoughtful and constructive feedback. We are encouraged by the positive reception of our work and appreciate the time and effort taken to evaluate our paper. In the responses below, we address each comment individually and indicate where clarifications or revisions will be made in the paper. Please let us know if you believe the changes are inadequate or if further clarification is needed. We are eager to work collaboratively with all reviewers during the discussion period to further improve the paper.\n\n**Comment 4.1: Convergence Analysis**\n\nUnfortunately, the highly non-convex nature of the models used in our evaluation precludes any form of rigorous convergence analysis. As a middle ground, we include plots in Appendix D (Figure 8) that show the number of rounds required by the two-level training loop. These results indicate that, for mask initialization, the median number of rounds matches the early stopping threshold in half of the cases. Moreover, none of the plotted runs reach the maximum number of rounds, suggesting that early stopping occurs when the aggregate training loss plateaus. Based on your feedback, along with Comment 2.5 from Reviewer dLLr, we will add this discussion to Appendix D.\n\n**Comment 4.2: Computational Efficiency**\n\nWe do not make any claim about computationally efficiency of IMS compared to existing fine-tuning methods. This is also reflected in our response to the \"Experiments compute resources\" section of the NeurIPS Paper Checklist. In Appendix D, we provide an evaluation of our method’s computational efficiency, reporting the number of rounds, cost per round, total run time, and the resources used to conduct these experiments.\n\n**Comment 4.3: ViTs**\n\nIn response to this comment, as well as similar feedback from Reviewer k34Q, we plan to add a brief section, either in the main text or supplementary material, addressing the applicability of IMS to ViT-based architectures. Additionally, motivated by this discussion, we conducted preliminary experiments to evaluate the applicability of our method to Vision Transformers (ViTs), with promising initial results. A draft of the planned inclusion is provided below.\n\nVision Transformers (ViTs) have gained popularity in image classification tasks in recent years. Similar to CNNs, several studies have shown that ViTs are highly overparameterized and can be pruned to improve efficiency. Notably, [1] demonstrated that ViTs can sustain high levels of pruning while maintaining performance. Building on this insight, pruning encoder blocks appears promising for extending pruning-based methods to non-CNN architectures. We hypothesize that the backdoor task may be encoded in specific embedding dimensions within each block. Therefore, applying a mask to prune these embedding dimensions is a natural first step.\n\nTo assess the effectiveness of this strategy, we apply IMS to ViT-B/16 trained with the BadNet, BPP, and IAB attacks on GTSRB. The results are presented in the table below. The only modification we make to the method is the removal of the sparsity term in Equation (6), motivated by the findings of [1]. Remarkably, IMS performs very well on the BadNet and BPP attacks across all SPC settings. Although the results for IAB are less promising, this preliminary investigation demonstrates the potential of IMS and other pruning approaches for ViTs.\n\nFuture work should explore which model components are most suitable for pruning, as the embedding dimension is only one option. For example, the Q, K, and V matrices offer valuable information, as demonstrated by feature selection methods such as [2] using them to improve model efficiency.\n\n[1] Xu, Kaixin, et al. \"Lpvit: Low-power semi-structured pruning for vision transformers.\" European Conference on Computer Vision. Cham: Springer Nature Switzerland, 2024.\n\n[2] Huang, Lan, et al. \"Efficient feature selection for pre-trained vision transformers.\" Computer Vision and Image Understanding 254 (2025): 104326.\n\n|Attack|SPC|ASR|RDR|ARR|\n|-|-|-|-|-|\n|BadNet|2|2.2|6.3|4.0|\n|BadNet|10|6.9|9.8|3.5|\n|BadNet|100|4.9|6.9|2.0|\n|BPP|2|0.0|7.3|0.8|\n|BPP|10|0.1|9.1|2.2|\n|BPP|100|0.1|8.3|1.6|\n|IAB|2|67.4|67.8|3.1|\n|IAB|10|73.4|73.5|2.7|\n|IAB|100|67.3|67.4|1.9|\n\n**Comment 4.4: Evaluation of Fail Cases**\n\nIn Figure 6, we examine how ASR varies with the proportion of perturbations that cause misclassification towards the target class. This analysis shows that when this proportion is high, IMS is significantly more robust and effective. To strengthen this analysis, we will add additional plots in the appendix that show the per-attack relationship within each dataset category. However, due to NeurIPS policies regarding figure sharing, we are unable to include these plots in the rebuttal.\n\nIn general, results characterized by a longer and flatter distribution along the x-axis (Prop Target Class) tend to exhibit a shorter ASR tail. This observation suggests that the variation in attack performance shown in Figure 5(b) may be explained by the difficulty of estimating the trigger distribution.\n\n**Comment 4.5: Impact of Pruning**\n\nWe balance backdoor removal and clean accuracy by ensuring that the main loss terms in Equations (4) and (6), the agree and disagree components, share a common construction and therefore have comparable magnitudes. Additionally, the $\\ell_{1}$ penalty in Equation (6) encourages sparsity in the selection variables, thereby discouraging unnecessary pruning.\n\nTo empirically examine this trade-off, we measured the relationship between effective sparsity and ARR. We define effective sparsity as the proportion of entries in $\\mathcal{S}$ and the inverse mask $\\bar{\\mathcal{A}}'$ that fall below 0.5. Using Spearman’s $\\rho$, we assessed how these sparsity metrics relate to ARR across each dataset–model pair, and also report the observed sparsity ranges. As hypothesised, GTSRB and Tiny ImageNet show a monotonic increasing association between the proportion of selected/pruned values and ARR ($\\rho > 0.5$ in most cases), which aligns with the corresponding sparsity minima and maxima. In contrast, CIFAR-10 typically exhibits a weaker, monotonic decreasing relationship. Notably, the narrow spread between the minimum and maximum values of $\\bar{\\mathcal{A}}'$ across all settings suggests that, in absolute terms, the extent of pruning remains modest relative to the total model size.\n\nFinally, while increasing $\\lambda$ could theoretically drive higher sparsity, our analysis in response to Reviewer dLLr (Comment 2.3) shows that large $\\lambda$ values substantially harm ASR and RDR, while yielding only marginal gains in ARR. We will include the full results table as well as a variant of this discussion in the supplementary material so that others can benefit from these findings.\n\n*Table caption: Significance (sig), Spearman $\\rho$, and observed minimum/maximum pruning proportions (as percentages) across runs.*\n\n|Dataset|Model|Selection||| |Mask||| |\n|-------|-----|--------|--|----|----|----|--|----|----|\n|       |     |Sig     |ρ |Min |Max |Sig |ρ |Min |Max |\n|CIFAR-10|VGG|False|0.053|1.07|12.52|True|-0.321|0.15|5.63|\n|CIFAR-10|ResNet|True|-0.164|1.71|13.03|True|-0.456|0.56|6.13|\n|CIFAR-10|EfficientNet|True|-0.496|0.38|2.98|True|-0.540|0.24|2.26|\n|CIFAR-10|MobileNet|True|-0.310|0.24|2.81|False|-0.074|0.15|1.57|\n|GTSRB|VGG|True|0.705|2.31|10.65|True|0.232|0.44|4.07|\n|GTSRB|ResNet|True|0.384|2.59|9.85|False|-0.002|0.88|3.74|\n|GTSRB|EfficientNet|True|-0.222|0.54|5.32|True|-0.346|0.45|3.46|\n|GTSRB|MobileNet|True|0.466|0.45|5.70|True|0.209|0.19|2.25|\n|Tiny|VGG|True|0.680|2.65|12.95|True|0.447|1.14|5.92|\n|Tiny|ResNet|True|0.577|2.62|11.14|True|0.457|1.86|6.87|\n|Tiny|EfficientNet|True|0.681|0.24|5.40|True|0.503|0.15|3.28|\n|Tiny|MobileNet|True|0.926|0.16|4.27|True|0.845|0.06|3.43|"}]

Author rebuttal:

Meta-review: This paper proposes a new method to detect backdoor-affected neurons using a dual-optimization framework that simultaneously selects neurons and sample-dependent triggers. Experiments show the method to be effective.

Reviewers unanimously agreed on the method's novelty and efficacy. Initial concerns regarding performance against baselines, ablation studies, and other backbones (like ViT) were well-addressed during the rebuttal. Following the rebuttal, all reviewers were in favor of the paper's acceptance.
Decision: Accept (poster)