BBCaL: Black-box Backdoor Detection under the Causality Lens
Authors: Mengxuan Hu
Zihan Guan
Junfeng Guo
Zhongliang Zhou
Jielu Zhang
Sheng Li
Venue: Accepted by TMLR ()

Abstract: Deep Neural Networks (DNNs) are known to be vulnerable to backdoor attacks, where attackers can inject hidden backdoors during the training stage. This poses a serious threat to the Model-as-a-Service setting, where downstream users directly utilize third-party models (e.g., HuggingFace Hub, ChatGPT). To this end, we study the inference-stage black-box backdoor detection problem in the paper, where defenders aim to build a firewall to filter out the backdoor inputs in the inference stage, with only input samples and prediction labels available. Existing investigations on this problem either rely on strong assumptions on types of triggers and attacks or suffer from poor efficiency. To build a more generalized and efficient method, we first provide a novel causality-based lens to analyze heterogeneous prediction behaviors for clean and backdoored samples in the inference stage, considering both sample-specific and sample-agnostic backdoor attacks. Motivated by the causal analysis and do-calculus in causal inference, we introduce Black-box Backdoor detection under the Causality Lens (BBCaL) which distinguishes backdoor and clean samples by analyzing prediction consistency after progressively constructing counterfactual samples. Theoretical analysis also sheds light on the effectiveness of the BBCaL. Extensive experiments on three benchmark datasets validate the effectiveness and efficiency of our method.

Published in Transactions on Machine Learning Research (12/2024)
BBCaL: Black-box Backdoor Detection under the Causality Lens
Mengxuan Hu* University of Virginia
qtg @tg edu
Zihan Guan" University of Varginia
bavuggs edu
Junfeng Guo University of Moryland
gdf2023Gumd.edh edu
Zhongliang Zhou
Merck
Jielu Zhang University of Georgia
edu
Sheng Li University of Verginia
vga8uf@vinginia. edu
Contributed equally
Reviewed on OpenReview: https: openreiiew. net/ forum? id= f2s
Abstract
Deep Neural Networks (DNNs) are known to be vulnerable to backdoor allacks, where attackers can inject hidden backdoors during the training stage. This poses serious threat to the Model-as-a-Servicc setting, where downstream (e.g., HuggingFace Hub, ChatGPT). To this end, study inference-slage black-bor backdoor detection problem in the paper, where defenders aim to build a firewall to filter out the backdoor imputs in the inference stage, with only input samples and prediction labels available. Existing investigations on this problem either rely on strong assumptions on types of triggers build a more generalized and efficient method,
directly utilize third-party models
and allacks or suffer from poor efficiency. we first provide a novel causality-based lens to analyze heterogeneous prediction behaviors for clean and backdoored samples in the inference stage, considering both sample-specific and sample-agnostic backdoor attacks. Motivated by the causal analysis and do-caleulus in causal inference, we introduce Black-box Backdoor detection under the Causality Lens (BBCaT.) which distinguishes backdoor and clean samples by analyzing prediction consistency after progressively constructing counterfactual samples. Thcoretical analysis also sheds light on the effectiveness of the BBCaL. Extensive experiments on three benchmark datasets validate the effectiveness and efficiency of our method.
1 Introduction
Deep neural networks (DNNs) have achieved tremendous success in various applications (Kortli et al., 2020; Zou et al., 2023; Vaswani al., 2017; Sun al., 2022a; Zhou al., 2024a;b). Despite these successes, training large DNNs requires considerable time and computational resources. Consequently, many users opt to utilize third-party pre-trained models through APT requests (e.g., ChatGPT), directly download them

---

Published in Transactions on Machine Learning Research (12/2024)
from online platforms (e.g., ModelZoo, HuggingFace Hub). This setting is what we call Modev-as-a-Service (MaaS) (Sun et al., 2022b; Li et al., 2017; Roman et al., 2009).
However, DNNs are easily attacked by injecting imperceptible backdoors during the training stage (Gu et al,, 2017; Chen et al., 2017; Nguyen & Tran, 2021). After backdoor injection, the DNN's prediction results can be maliciously manipulated by the adversaries whenever the input sample contains the pre-defined trigger pattern, while it behaves normally when the input sample is benign. This vulnerability poses serious threat to the MaaS setting, especially in some safety-critical applications such autonomous driving (Han et al., 2022; Chan et al., 2022), medical diagnosis (Feng et al., 2022) and financial fraud detection (Lunghi et al., 2023).
To mitigale the threat in the MaaS setting, inference-slage black-boz backdoor delection has drawn increasing research interest. In this scenario, defenders aim to establish a firewall-style detector on the user side to reject prodictions for backdoored samples while forwarding predictions for clean samples. Several approaches have been proposed to address this issue (Guo et al., 2023; Liu et al., 2023). However, some crucial challenges still remain. O Strong Assumptions and Low Generalization: Most defenses rely on strong assumptions about the trigger pattern (Gao et al., 2019; 2021; Guo et al., 2023) (e.g., sample-agnostic trigger) and are only feasible for specific types of attacks (Guo et al., 2023; Pal et al., 2024), which is impractical in MaaS scenarios where defenders lack information ion about attacks and triggers. algorithms (Liu et al., 2023) require extensive, computationally expensive image corruptions, leading to prolonged inference time that could degrade user experience. In light of these disadvantages our objective is to develop a generalized and efficient inference-stod stage detection algorithm. This algorithm allows defenders access only to the inference samples and their prediction labels generated by the DNNs, without any prior information about the target model and trigger patterns.
Low Efficiency: Some detection
To this end, we believe it is crucial to first address fundamental question: What is the inner mechanism that causes a backdoored DNN to behave normally with clean samples, but consistently predicts the target label when presented with backdoored samples? To explore this, we introduce causal inference as a novel perspective to unravel the mechanisms behind the heterogeneous prediction behaviors of clean and backdoored samples through causal graphs. Specifically, our causal analysis derives that predictions of backdoored samples are primarily misled by the spurious path introduced by the attacks, whereas those of clean samples follow the original causal path. Notably, our causal analysis includes both sample-agnoslic al allacks, where triggers are identical across all samples, and sample-specific attacks, where triggers are customized for each sample. Analyzing this wide range of triggers through causal graphs enables us to develop a more generalized detection method.
Following these insights, a naive detection method would be identifying the causal path that a sample follows during the inference stage. However, this approach is infeasible due to the limited information available. Therefore, motivated by causal interventions, which is used in causal inference to compare different potential outcomes under different variable interventions, we develop a Black-box Backdoor detection method under the Causality Lens (BBCaL). Specifically, we employ a simple yet effective counterfactual intervention method by progressively adding noise lo the input sample. This approach implicitly induces distinguishable prediction behaviors between clean and backdoored samples, with theoretical analysis further elucidating its offectiveness. Extensive experiments demonstrate that our method can defend against broader range of allacks with satisfactory elficiency.
In summary, the contributions of this paper include: (1) Novel Causality Lens. From the novel causality lens, we analyze the distinct prediction behaviors of clean images and various types of backdoored images in the MaaS setting. (2) Counterfactual Backdoor Detection Algorithm. Leveraging the causal analysis, we develop a causality-inspired detection method that distinguishes backdoor and clean samples by constructing counterfactual interventions and checking the consistency of the predictions.
(3) Theoretical Proof. We provide a theoretical analysis (Theorem 8) to validate our method. (4) Generaliztion and Efficieny. Various experiments across multiple popular datasets have empirically proven that our detection method achicyes an average of > 84% AUC under wide range of attacks with only an ignorable overhcad.
2

---

Published in Transactions on Machine Learning Research (12/2024)
2
Related Work
Backdoor Attacks. Backdoor attacks are usually launched by poisoning training dataset. Specifically, malicious attackers inject trigger patterns into victim samples and alter the ground-truth label to a predefined target label. Recent research can be divided into two categories on making the backdoor attacks more stealthy to enhance the attacks' fcasibility in practico. The first direction aims to make the trigger pattern visually less noticeable (Chen et al., 2017; Liu et al., 2020; Qi et al., 2022). For example, (Chen et al., 2017) blends the clean images with random pixels, and (Liu al., 2020) uses the natural reflection to construct the backdoor trigger. The other direction aims to make the attacking process less noticeable (Shafahi et al., 2018; Souri et al., 2021; Zeng et al., 2022; Guan et al., 2024b; 2023b; Guo et al., 2024). For example, CL (Shafahi et al., 2018) proposes clean-label attack, which constructs backdoor samples without changing labels.
Backdoor Defenses. To mitigate the threat of backdoor attacks, various defense methods have been proposed. As in (Li et al., 2022), we categorize the existing defense methods into five categories. First, detection-based defenses (Gao et al., 2019; Guo et al., 2021; Xiang et al., 2022; Guan et al., 2023a; Guo et al., 2023; Ma et al., 2022; Guan et al., 2024a) aim to explore whether the backdoors exist in the model. Second, preprocessing based defenses (Doan et al., 2020; Shi et al., 2023) further introduce a preprocessing module that triggers can be inactivated. Third, defenses based on model reconstruction (Liu et al., 2018; Zhao et al., 2020) directly climinate the effect of backdoors by tuning model weights or adjusting model structures. Fourth, defenses based on trigger synthesis (Wang et al., 2019; Chen et al., 2022) first reverse engineer trigger patterns and then suppress the trigger's effects. Lastly, training-sample- sample-fltering
defenses (Li et al., 2021a; Huang et al., 2022a) work by first filtering backdoor samples from the training dataset, then training the model exclusively in the remaining datasct.
Causal Inference in Backdoor Learning. Causal inference (Yao et al., 2021; Hu et al., 2024; Chu et al,, 2024) has been utilized tool to analyze attacks, defenses, and detection mechanisms in Al security (Huang et al., 2022b; Ren et al., 2022; Tople et al., 2020). For instance, (Ren et al., 2022) explores the causality between deep neural network outputs and subregions of input samples to uncover the working mechanism of adversarial examples. (Huang et al., 2022b) models the data generation process using structural causal models to distinguish between benigu and malicious out-of-distribution (OOD) data, Additionally, (Tople et al., 2020) proposes using causal learning to mitigate privacy attacks. However, their causality analysis focuses on other well-established problems, such as OOD detection, adversarial example detection, and privacy attacks, which are fundamentally different from our backdoor detection problem. Although previous works (Zhang et al., 2023; Liu et al., 2024) have also explored the use of causal graphs in backdoor attacks, our causality analysis is fundamentally different from them: Their analysis aims to provide an analysis for training a clean model from a backdoored dataset, while our analysis aims to investigate the distinct prediction behaviors in the inference stage for clean and backdoored images. A more detailed comparison of the two papers is presented in Appendix O. To the best of our knowledge, this paper is the first to provide a causality analysis of backdoor attacks in the inference stage.
3 Preliminaries
3.1 Main Pipeline of Backdoor Attacks
Let D = [.,,, yii denote the original dataset, where x; E R" denotes an image sample, and y denotes the corresponding ground-truth label. The deployed neural network model is denoted as fo, with as the trainable parameters. Then the malicious backdoor attacker selects subset of the original dataset (denoted as D.) and modifies it to backdoored version with D, = {(., v.) -; = x; + 8(xz), (æ,, y:) Dz), where y, denotes the target label, and d(-) is pre-defined trigger generation function. For example, in BadNet (Gu et al., 2017), the trigger generation function can be formulated as 5(z,) = (t 2x) @ m, where denotes the trigger, and m is a binary mask defining the position of the trigger; in Blend (Chen el al., 2017), the trigger generation function can be formulated as d(x,) = t, where t denotes the global trigger such as random noisc. Following the taxonomy in (Li et al., 2022), we categorize backdoor attacks into "samplo-agnostic" and "samplo-specific" based on the properties of trigger function 5(.) and provide the corresponding formal definitions as follows:
3

---

Published in Transactions on Machine Learning Research (12/2024)
Sample-agnostic Backdoor Attack
sample-specific Backdoor Áttack
Clean Image
"Fish"
A
"Dog"
"Dog"
Factual Image
Y
Y
B
B
(a)
(b)
(c)
T
T
"Fish"
S
A
"Dog"
"Fish"
Counterfactual
image
B
Y
N
N
(d)
(e)
(f)
Figure Causal graphs of the DNN's predictions for (a) clean images, (b) backdoor images with sample- agnostic trigger, (c) backdoor images with the samplo-specific trigger, (d) counterfactual of clean images, (c)
counterfactual of backdoor images with sample-agnostic trigger, and (f) counterfactual of backdoor images with the sample-specifie trigger.
Definition (Sample-agnostic Trigger). The trigger function 5(x,) of sample-agmostic backdoor attacks contain the same t, for all x;,
Definition (Sample-specifie Trigger). The trigger function 8(x,) of sample-specifie backdoor attacks contain different t for different 24.
Then the neural network model fe is trained on the mixture of backdoored subset D, and the remaining clean subset Dio with the following optimization objective:
Dyel
((o())))))) + Σ ((o(ax))
min
where E(-) denotes the loss function. In the inference stage, fo exhibits normal behavior when the input images are benign, but consistently predicts the target label y/ when the trigger is present.
3.2 Problem Formulation
In this paper, we consider inference-stage backdoor detection under the black-box setting for the MaaS following (Guo al., 2023; Liu al., 2023). Specifically, the defender is assumed to only have access input images and their prediction labels generated by the DNN, without any prior information about the backdoor attacks or the model. Our problem is hereby formally stated follows:
Problem (Inference-stage Black-box Backdoor Detection). Given DNN fo()), the defender aims to build detector A such that A.fooaaacctoor ), Pbackdoor
and only if the inpul is backdoored.
The challenge of the problem stems from two factors: (1) Generalization for various attacks: A aims detect a wide range of backdoor attacks without prior knowledge of the target model and trigger patterns; (2) Efficiency guarantee: Our detection algorithm is expected not to significantly impact the inference efficiency.
4

---

Published in Transactions on Machine Learning Research (12/2024)
3.3 Backdoor Attacks under Causality Lens.
To unravel the complex problem 3, it is necessary to first answer pivotal question: What causes backdoored DNNs to consistently predict the target label for backdoored samples, yet behave normally for clean samples? Motivated by causal inference (Xiao et al., 2023; Zhang et al., 2023), we propose using a novel causal lens to explore this question. Specifically, we construct causal graphs, which are directed acyclic graphs that illustrate the causal relationships between variables, for both clean and backdoored samples (see Figure 1). We provide detailed analysis in the subsequent scctions.
Causal Graph for Clean Samples. As shown in Figure (a)) for a well-trained DNN, the prediction Y of a clean image is dependent on the image content L, which consists of both semantic features S and background features B. Thus, the causal relationship between S, B, and I is represented as (S + + B). For instance, consider a fish image I, where pixels related to the fish per se are the semantic features S, and pixels related to the water and aquatic plants are background features B. A well-trained DNN makes prediction by leveraging both fish pixels and background pixels contained in I, denoted as + Y. This is referred to as the direct causal path.
For backdoor samples, the analysis becomes more complicated. As illustrated in Figure 1(b) and (c), backdoor attacks A modify images by injecting triggers and altering image labels to the target label, represented as I A + Y. This introduces a spurions path from I to Y, which lies outside the direct causal path (I + Y). The attacks thereby serve as a confounder, which builds and strengthens the erroneous correlations between the modified images and the target label. Consoquently, predictions of backdoored images are prodominantly led by this spurious path (I + A + Y) (Du et al., 2021; Zhang et al., 2023), while the direct causal path (I + Y) plays a minor role, symbolized by a gray dotted line in Figure 1 (a) and (c). This phenomenon has been empirically highlighted in previous papers (Cai et al., 2022; Yu et al., 2021; Sandoval-Segura et al., 2022). To develop a defense method with advanced generative capabilities across wide range of backdoor attacks, we explore not only attacks based on sample-ggnstic triggers but also thoes with sample-specifie triggers (described in $ 3.1). Specifically, we construct causal graphs for these two types of backdoor attacks as follows.
Causal Graph for Sample-agnostic Backdoor Attacks. Sample-agnostic backdoor attacks imply that all backdoor samples are constructed with a constant trigger pattern (see Definition 1). Therefore, valid sample-agnostic attacks A in Figure 1(b) are solely dependent on the trigger patterns T while independent of the image content, denoted as T A.
Causal Graph for Sample-Specific Backdoor Attacks. Sample-specific backdoor attacks imply that each backdoor sample is paired with a unique trigger, which is invalid for any other sample. Therefore, sample-specific attacks in Figure I(c) depend on both the trigger patterns T and the images 1.
4 Methodology
In this section, according to the causal analysis above, we first introduce counterfactual intervention to distinguish clean and backdoored samples by analyzing prediction consistency after progressively constructing counterfactual samples. Causal analysis and theoretical proof are also provided to explain the mechanism of our defense mothod. Then, we introduce the detailed method to detect backdoor attacks in the second step.
4.1 Step 1: Designing and Conducting Counterfactual Intervention
The above analysis sheds light on the intuition that clean samples and backdoor samples can be distinguished by evaluating whether the model's predictions are primarily influenced by the direct causal path the spurious path. However, the evaluations are challenging due to the black-box nature of DNNs and the limited information available in our selting. In causal inference, do-calculus is usually used to compare different. potential outcomes under different counterfactual interventions on a specific variable, Specifically, do-calculus performs counterfactual interventions by changing the original values of one variable to a counterfactual value (Guo et al., 2020; Yao et al., 2021). This method inspires us with the insight that, due to the intrinsically different causal rationales behind clean and backdoored samples, as demonstrated in the previous
5

---

Published in Transactions on Machine Learning Research (12/2024)
causal graphs, when the same counterfactual intervention is applied to them, they may exhibit distinguishable prediction behaviors.
Then the main question is narrowed down to the following: How to design an ideal counterfactual intervention strategy that increases the difference between clean and backdoored samples? Traditional counterfactual intervention in causal inference (Guo et al., 2020; Yao et al., 2021) is not suitable for image set settings because simply setting all images to fixed value is meaningless and fails to induce different prediction behaviors between clean and backdoored samples. In addition, the detection method is expected to be highly efficient. Therefore, generating time-consuming counterfactual perturbations is impractical in the MaaS scenario. To design simple and effective counterfactual interventions, we propose to use random noise, which has been one of the most popular methods for conducting counterfactual interventions (Chang et al., 2018; Jeanneret et al,, 2023). In addition, we also investigate other common counterfactual generation methods, such as random mask (Xiao et al., 2023) and mixup (Yu et al., 2023), in $ 5.3. Empirically random noise has proven to be the most stable and effective method for constructing counterfactual samples. Hence, we have adopted it in our method. We now formalize the idea and validate the idea with causal analysis and theoretical proof.
We first define magnitude set S, e.g., S {0.6,0.2,0 0.4, ..., ...,,..,,,,, 144. Then, for each element a in S, construct modified sample & = 2 + a² E, where x denotes the input image, n; = a² c denotes the additive noise, a E S denotes the noise magnitude, and E ~ (0, Taim(ae)) denotes a random Gaussian noise. The following analysis illustrates why and how conducting interventions on clean samples and backdoored samples results in distinct prediction results after being fed into DNN.
Prediction for Counterfactual Clean Im- ages. In Figure (d)), upon introducing noise, the predictions of the counterfactual images are determined by the new images i, which comprise the corresponding noise N, the orig- inal semantic features S, and the background features B. Specifically, the influence of the original semantic and the background features remains dominant when a² is small, leading to unchanged predictions (Jo(a() v.). However, predictions change after introducing a sufficient amount of noise (a) is a medium value) ). We validate this intuition with theoretical analysis in the later part.
BodNet
Clsa- Bad
Bleral
Blend
Accurary
30
WaNe
Caete-WNNtt
ISSBA
Clen-1SSSBA
1.2
30
EDC
Nolse Magnitude
Figure 2: Accuracy of the backdoored DNNs on benign test-
set and backdoored testset under different noise magnitudes.
Prediction for Counterfactual Backdoored Images. For a backdoored image â., we treat the modified image ai as combination of a new image a. and the original backdoor trigger 4;:
a: + ny a; 5(x.) + ny (æ; + n2)) + 5(xx) x²! + 8(x:).
(2)
After adding noise to a backdoored image with samplc-agnostic triggers (Figure (()),, the original valid trigger t; remains effective for the new image z" due to sample-agnostic trigger can poison any clean image. As a result, the prediction of the new backdoored image continues to be influenced primarily by the spurious path A A Y. Consequently, the prediction remains unchanged until the image is significantly distorted by noise (c.g., for large a²). For images with sample-specific triggers, as depicted in Figure (ff), where triggers are tailored to individual images, the original backdoor triggers become ineffective for new images. As a result, the backdoor path (A- f) for new images is severed, with predictions mainly influenced by new images 7. Consequently, the predictions of images promptly deviate from the original target label y/ upon adding noise. The theoretical proof is provided in Appendix P.
Remark 4. In summary, images with sumple-specisic briggers wilness immedialee prediction flipping upon introducing noise, whereas clean images experience gradual outcome changes in response to noise intensity. Images with sample-agnostic triggers, however, maintain stability even with considerable added noise.
4.1.1 Preliminary Experiments
To further validate above analysis, we conducted preliminary study to substantiate the phenomenon.
6

---

Published in Transactions on Machine Learning Research (12/2024)
Setting. We consider four popular backdoor attacks, specifically BadNet (Gu et al., 2017), Blend (Chen et al., 2017); Wa (Nguyen & Tran, 2021), and TSSBA (Li et al., 2021b), where BadNet and Blend correspond to sample-agnostic backdoor attacks, while WaNet and ISSBA correspond to sample-specific backdoor attacks. All experiments are conducted on CIFAR-10 using ResNet18 as the neural network architecture. To successfully inject backdoors into the largel model, we train the neural network for 200 epochs to achieve a clean accuracy of at least 90% and an attack success rate of at least 98%. For cach backdoored and benign lestset, we record the classification accuracy at different magnitudes of noise and plot the resultant curves in Figure 2. Specifically, to calculate the prediction accuracy of counterfactual samples, we consistently use the original labels from both the benign and backdoored test sets as the ground truth.
Observation. Note that the x-axis denotes the noise magnitude and the y-axis denotes the accuracy performance. Experiments conducted on clean and poisoned datasets under various backdoor attacks are plotted using different markers. For example, the accuracy performance on the backdoored and benign testset under the model backdoored with BadNet are drawn in blue and red color, respectively. As shown in Figure 2, the magnitude of the noise increases, the accuracy curves for the benign test set steadily decrease. In contrast, those for the backdoored testset fall into two categories: 1) for sample-agnostic backdoor attacks like BadNet and Blend, accuracy performance is largely unaffected by noise magnitude; 2) for sample-specific backdoor attacks like WaNet and ISSBA, accuracy performance shows a sharp decline with only small increase in noise. This observation aligns with the intuition discussed in the previous section.
4.1.2 Theoretical Analysis
Furthermore, we employ the neural tangent kernel (NTK) (Jacot et al., 2018; Guo et al., 2023; 2021; Lee et al., 2019) as a theoretical framework to shed light on the above phenomenon. Under the assumptions of NTK, a deep neural network with infinite width can be approximated as a linearized network. Hence, We first introduce an important lemma of NTK that is key to our proof.
Lemma 5 (Infinite width networks as linearized networks (Lee et al., 2019)). Let f(x) denote a
neural network with L hidden layers, each with width ny for t= 1,.=,,..,44 L. Let fe(x)= = (x) E R² denote the output of the neural network at time t. For a neural network fe(z) with infinite width, let θ denote the corresponding deterministic kernel, and f()(()) denote the linearization of f((x). If the learning rate satisfies < Maritical == 2 (Amin(9) + ()) -1 where Amin/maz(() are the minimum and marimum eigenvalues of θ respectivnely, then for every x E Re0 with ||e|12 S 1, as n + 00 and 1- xc, Se(x) converges in distribution to the same Gaussian distribution as the linearized model (Xr, 20)0-
Following (Guo et al., 2021; 2023), we leverage the RBF kernel and treat the DNN as a k-way kernel least square classifier. Under Lemma 5, the regression solution for the NTK is as follows:
ΣN O(,, x.: 2/
12(() Σ O(, x., + Σド=n O(,
(3)
+0 Σ O(, 2.)) 1/ + Σラ O(, . yt
(4)
Ex O(, m.) + Σ د 0 xz))
where ()(() and o((+) E R represent the predicted probabilities of class q and class based on ((::)) for clean samples and backdoored samples, respectively. N, and Np denote the number of clean and backdoored samples, respectively. a; and Big represent benign samples and benigu samples specifically from class g, respectively. æy represents the poisoned samples. By and ye are the corresponding one-hot labels for class q and target class i, respectively. The kernel function O(x, x:) 2-21lee- (7 > 0) is used. Given the assumption that training samples are evenly distributed, there are A benign samples belonging to each class. Without loss of generality, we assume B4 = 1 for class q while others are set to 0. The regression solution is then expressed as:
Σ E 0g EN O 2.) + Σn= O(, m.))
Nufk ((,,Zzg)
(5)
7

---

Published in Transactions on Machine Learning Research (12/2024)
User
Firewall
Third-Party Model
Preflight Batch Generation
Victim Model. Prediction
User Input
Victin Model fe
R2
Rg
R4
Noise Magnitude Set
Backdoored image Detection
Flip Position Score(FPS) Calculation
Clean Output
E []
Fish
Fish
Fish
Fish
Fish
Cat
return approve output; return reject output;
Reject
fo(k)) 16000
FPS min (f/ fo) =
Figure 3: Pipeline of BBCaL. Upon receiving target image 2y from the user, BBCaL first generates counterfactual prefflght batch' by incrementally introducing noise to z/.- These counterfactual images then fed to the DNN So(.) to oblaín predictions. Subsequently, the FPS score is computed based on these predictions. Finally, BBCaL employs the FPS score to discern and decline queries from identified backdoored images while approving and outputting predictions for clean images.
Nyth 0(, E O(,2,) E DN,/ 20()) = ΣN 0(, xi)) + E O(, xz))
(6)
Theorem (Prediction consistency for clean samples). Let No denote the total rumber of benign samples, & represent the number of benign samples in a specific class. Given a well-trained backdoored model
and let No So and clean inpul from class q, define a [E[[ iolaa--a x,,13]] and 3 E[]læ 2 /11],,, where 2y and æ ja denote benign somples from class q and benign samples from other class, respectively. Assuming that // follows Gaussian distribution, if we perturb the clean input with scaled Gaussian noise ~ ((0,aa1) the prediction remains unchanged until e
a² lmm
a)
Proof. The proof is provided under Lemma 5 and detailed in Appendix P.
The above theorem states that if the introduced noise e is small, the prediction for clean samples remains unchanged until e >> 2 the theoretical analysis for backdoored samples is provided in Appendix P. Hence, we can distinguish clean samples and backdoored samples by the different thresholds of prediction flipping in terms of counterfactual samples.
a+ lam -8² This result is consistent with our causal analysis. Due to space constsaints,
4.2 Step 2: Detecting Backdoor Samples
With the proposed counterfactual analysis, straightforward method for detecting backdoored samples is as follows: We can progressively add random noise to the input image and use the minimum noise magnitude that flips the prediction results to determine whether the input is clean or not.
Formally, given DNN fo(-) and a test sample D;, we obtain batch of counterfactual samples by progressively adding noise to the test sample, denoted the "preflight batch", consisting of modified images: P:

---

Published in Transactions on Machine Learning Research (12/2024)
2; After querying the deployed DNN with the preflight batch, we record the corresponding prodiction results for the sample zÚ R₂ = [f(
)]
fo(
As discussed in $ 4.1, the position of prediction flipping differs in clean and backdoored images. To exploit this difference, introduce a novel metric, the Flip Position Score (FPS), to measure the prediction changing time (detailed algorithm in Appendix C). For each sample, æi; the FPS is defined as
FPS(x;)) = min( + fo(#))}
(7)
In essence, FPS computes the index that the prediction result fo())) differs from the initial result fo(#))) Backdoored images typically have extremely low or high FPS scores, whereas clean images often have scores centered around the median. Hence, if PS(s)) lies within the threshold range [a, the sample is classified
as clean; otherwise, it is considered a backdoored sample. An overview of this approach is provided in Algorithm 2 and visualized in Figure 3. Details about the magnitude set and threshold range are claborated in the experimental section.
5
Experiments
5.1 Experimental Settings
Datasets and Models. Following (Guo et al., 2023; Gao et al,, 2019; Li et al., 2021a), we choose three popular datasets for evaluating the effectiveness of our proposed method: CIFAR-10 (Krizhevsky, 2009), GTSRB (Stallkamp et al., 2012), and ImageNet-subset (git). The details of the three datasets are listed in Table 3. For CIFAR-10 and GTSRB, we Irain with the popular ResNet (He et al., 2015). However, for the ImageNet-subsset, we opted for the EfficientNet architecture (Tan & Lo, 2020) as it reports a higher accuracy.
Attack Baselines. We choose 9 backdoor attacks from the well-cstablished recent works as our baselines: 1) BadNet (Gu al., 2017), 2) Blend Attack (Chen et al., 2017). 3) Label- Clean (Shafahi al., 2018), 4) SIG (Barni et al., 2019), 5) WaNet (Nguyen & Tran, 2021), 6) ISSBA (Li et al., 2021b), 7) Adaptive Blend (Qi et al., 2022), 8) Filter (Liu et al., 2019), and 9) DFST (Cheng et al., 2021). All attack baselines are implemented with the open-sourced backdoor learning toolbox (Li et al., 2023). More details of each attack method can be found in Appendix F.
Defense Baselines. Based on our setting, assumed that defenders can only access the prediction results and the input images. Therefore, we compare our method with ScaleUP (Guo et al., 2023), which perfectly fits the setting. In addition, we compare our method with Frequency (Zeng al., 2021) and LAVA (Just et al., 2023), which require additional validation set, and STRIP (Gao et al., 2019), which requires additional prediction probability information from the DNN model. More details about the defense baselines are in Appendix G.
Implementation Details. Following the previous works in backdoor defense (Li et al., 2021a), the poisoning ratio for backdoor attacks set as 10% as default. The length of the magnitude set S has been set to based on the experiments described in Section 5.3. According to our previous analysis, alpha should be small to detect sample-specifi backdoor tacks, while 3 should be large identify sample-agnostic backdoor attacks. Hence, the values of and B are set 1 and 6, respectively, which represent the first position and the sccond-to-last position in the magnitude set. All the hyperparameters are evaluated with ablation studies in the later part. Full details of the implementation are provided in Appendix J.
Evaluation Metrics. Following the existing works in backdoor detection (Gao et al., 2021; Guo et al., 2021; 2023), we choose the prccision (P), recall (R), and the area under receiver operating curve (AUROC) as the evaluation metrics.
5.2 Main Results
Table presents the main result, where we compare our method with other defense baselines against various backdoor attacks three datasets. For each metric, we mark the highest value with the bold font and the
9

---

Published in Transactions on Machine Learning Research (12/2024)
Table 1: Comparison of the proposed method with other baseline defense methods terms of precision (P), RR), and AUROC(AUC).
Defense Method
Dataset
Attack Method 4
STRIP
Frequency" 2
LAVA 2
Scale- UP
Ours
P
It.
AUC
P
It
AUC
II
AUC
P
It
AUC
P
It.
AUC
BedNet
0.85
0.99
0.98
0.76
0.64
0.82
0.70
0.57
0.78
0.88
1.00
0.93
0.85
1.00
0.91
Blead
0.81
0.82
0.89
0.82
0.82
0.90
0.51
0.15
0.67
0.55
0.31
0.56
0.83
0.97
0.90
WaNet
0.40
0.10
0.46
0.16
0.04
0.27
0.71
0.74
0.50
0.78
0.81
0.95
ISSBA
0.55
0.49
0.49
0.35
0.25
0.56
0.53
0.77
0.79
0.90
0.92
0.90
1.00
0.95
CIFAR-10
Lahel-Cloan
0.89
0.45
0.91
0.67
0.61
0.74
0.50
0.95
0.85
0.76
0.96
0.91
0.82
0.97
0.96
SIG
0.52
0.90
0.84
0.56
0.60
0.85
0.43
0.50
0.58
0.32
0.45
0.48
0.80
1.00
0.90
Adaptive Blend
0.50
1.00
0.94
0.45
0.64
0.50
0.58
0.74
0.62
0.81
0.73
0.96
Filter
0.48
0.35
0.54
0.50
0.99
0.50
0.44
0.68
0.70
0.49
0.65
0.51
0.64
0.99
0.80
DFST
0.51
0.09
0.70
0.50
1.00
0.45
0.67
0.54
0.72
0.46
0.55
0.57
0.78
0.99
0.90
Average
0.61
0.68
0.75
0.55
0.61
0.64
0.52
0.52
0.70
0.62
0.72
0.70
0.80
0.95
0.91
BadNet
0.50
0.98
0.83
0.53
0.98
0.95
0.00
0.16
0.64
0.66
0.99
0.87
0.74
0.99
0.85
Blead
0.56
0.99
0.33
0.97
0.76
0.56
0.74
0.76
0.87
WaNet
0.53
0.94
0.75
0.52
0.92
0.65
0.63
0.45
0.67
0.74
0.87
0.86
0.98
0.93
0.91
ISSBA
0.50
0.97
0.72
0.53
0.99
0.91
0.54
0.40
0.58
0.63
0.89
0.78
0.75
0.95
0.93
GTSRB
Label-Clean
0.61
0.48
0.68
0.48
0..84
0.60
0.52
0.90
0.68
0.49
0.58
0.51
0.51
0.68
0.76
SIG
0.49
0.68
0.50
0.50
0.94
0.60
0.75
0.80
0.49
0.69
0.50
0.83
0.92
0.90
Adaptive Blend
0.50
1.00
0.75
0.32
0.9:
0.58
0.52
0.57
0.61
0.40
0.51
0.65
0.67
0.80
0.73
Filter
0.50
1.00
0.25
0.50
0.48
0.34
0.61
0.58
0.55
0.46
0.63
0.56
0.73
0.78
0.80
DFST
0.50
0.90
0.88
0.50
1.00
0.32
0.05
0.63
0.70
0.57
0.98
0.75
0.72
1.00
0.82
Average
0.89
0.51
0.66
0.67
0.56
0.76
0.74
0.84
BadNet
0.90
0.67
0.92
0.77
0.92
0.84
0.65
0.47
0.74
0.50
0.29
0.60
0.87
0.98
0.93
Bleud
0.51
1.00
0.69
0.78
0.91
0.87
0.64
01.55
0.68
0.64
0.443
0.70
0.67
0.77
0.83
WaNet
0.51
0.96
0.55
0.63
0.52
0.65
0.59
0.49
0.72
0.74
0.81
0.52
0.88
0.97
0.93
ISSBA
0.57
0.92
0.76
0.62
0.55
0.87
0.89
0.94
subgeNet-subbet
Lahel-Clean
0.63
0.48
0.64
0.52
0.79
0.54
0.46
0.85
0.66
0.51
0.51
0.52
0.62
0.73
0.80
SIG
0.73
0.91
0.88
0.66
0.68
0.72
0.68
0.56
0.66
0.16
0.65
0.55
0.67
0.55
0.75
Adaptive Blend
0.49
1.00
0.73
0.50
1.00
0.57
0.54
0.56
0.63
0.48
0.53
0.62
0.75
0.87
0.80
Filter
0.54
0.97
0.61
0.59
0.60
0.67
0.49
0.70
0.69
0.77
DEST
0.52
0.93
0.51
0.63
0.57
0.62
0.48
0.67
0.68
0.55
0.73
0.64
0.73
0.78
0.82
Average
0.60
0.87
0.66
0.65
0.71
0.67
0.56
0.60
0.56
0.56
0.56
0.64
0.75
0.81
0.84
1 STRIP requires additional prediction probability information. 2 Frequency and LAVA both require an additional validation set.
second highest value with an underline. As the table suggests, our method achieves promising performance on all three datasets against various attack methods. Especially for samplo-specific backdoor attacks (c.g., WaNet and ISSBA), our method has been shown to be significantly better than the baseline defenses. Note that in our defense baselines, STRIP requires additional prediction probability information from the DNN model to detect backdoored samples, while our method only depends on the prediction labels. Moreover, Frequency and LAVA leverage an additional validation sct, which is also not required by our method. Our method has performed on par or even surpassed these three baselines with less information about the DNN model and the dataset. SCALE-UP is developed for the same setting as our method. However, it shows a much worse performance when defending against the Blend attack. This can be attributed to the Blend attack utilizing a global trigger (e.g., Hello-kitty-lik image), while the scaling operation in the SCALE-UP can easily destroy the feature information contained in the global trigger pattern. It is also noted that our method is seemingly less effective on Filter and DFST, compared to our promising performance on Badnet and Blend. We provide further discussion on this observation in the Appendix I.
5.3 Ablation Studies
The impact of the poisoning ratio and trigger size. To evaluate the effectiveness of BBCaL against different levels of poisoning ratio, we present the experimental results on CIFAR-10 in Figure 4. The results indicate that our mothod generally achieves stable performance across various levels of poisoning. Furthermore, Figure 7 shows that the performance of BBCaL remains stable across various trigger sizes, where the x-axis denotes the ratio of trigger size to image size in terms of length unit.
10

---

Published in Transactions on Machine Learning Research (12/2024)
BadNet
Blend
MaNet
1.0
1.87
1.0
1.0-
0.9-
6.3-
9.9-
0.9
Precision
0.8-
Recall
AUC
0.7-7
0.7-
0.74
0.7-
6.3
8.1
0.0
Poisoning Ratio
Poisaning Ratio
Poisoning Ratio
Poisoning Ratio
SIG
DFST
Filter
LC
0.9-
0.8-
0.8-
0.8-
6.3-
0.74
6.7-
0.7
0.7-
0.6
8.6
8.6-
0.6
0.2
0.0
0.1
0.2
0.3
0.4
0.0
0.1
0.2
0.3
0.4
8.2
0.3
0.4
0.5
Poisoning Ratio
Poisoning Ratio
Poisoning Ratio
Poisoning Ratio
Figure 4: Performance with different. poisoning ratios.
Table 2: Comparison between other common counterfactual generation methods
BalKe
Riss
WcN4
I99A
800
Mapiin Bikes
Fiker
DPST
1991
1.1M
1006
0182
180
0.10
11.11
1118
2.50
1081
1101
1.46
0.28
110
0.21
0.40
1.52
101
0359
1222
0.31
3:00
8.85
0.80
0.11
0.00
1.00
0.41
0.41
6.50
The impact of counterfactual generation method. Apart from random noise, other counterfactual generation methods, such as random masking (Xiao et al., 2023) and mixup (Yu et al., 2023), have also been widely used to generate counterfactual samples. To assess the impact of counterfactual generation design, we compare the performance of the default random noise strategy with the mixup and the random masking strategy CIFAR-10 dataset and report the results in Table 2. As the table suggests, random noise shows the most stable and satisfactory performance across all lypes of backdoor allacks. A possible explanation is that random noise enables the generation of counterfactual samples with finer granularity.
The impact of magnitude set. Figure 5 and Figure 11 presents a series of heatmaps, showing the performance of BBCaL under different combinations of length and slep against different backdoor attacks. In particular, length represents the length of the magnitude set S, and step represents the difference between two adjacent noise values in the magnitude set. As shown, the performance of method generally achieves satisfactory performance with length of 7 and step of 0.2.
5.4 Discussion and Visualization
Efficiency Testing. Efficiency is of critical concern in setting, since user experience is expected to not be signilicantly affected by the delection algorithm. Therefore, we compare the inference time consumption
BadNet
Blend
WaNet
8.95
0.95
0.90
8.85
8.90
0.90
0.80
0.85
8.88
6.80
0.70
8.85
8.1
6.15
0.2
8.25
6.38
8.85
8.1
6.15
0.2
8.25
6.3
8.45
8.1
0.15
0.2
0.25
0.3
Figure 5: Performance of BBCAL under different combinations of length and step.
11

---

Published in Transactions on Machine Learning Research (12/2024)
Time Efficiency (s)
Bedliet
Blend
0.015
0.010
0.9-
0.9-
0. 0.0
0.8-
Precision
0.3-
Recall
0.000
0.7-
AUC
Vanitla
STRIP
Frequency
LAVA
Scale UP
Ours
Trigger Size
Trigger Size
Figure 7: Performance against backdoor attacks with different trigger sizc.
Figure 6: Comparison of inference time.
before and after adopting the detection algorithms and report the corresponding results in Figure 6. The results demonstrate that our BBCaL ranks as the top-2 most efficient algorithm, exhibiting a trivial overhead compared the vanilla inference time consumption (without detection algorithm), which proves the efficiency of our method.
Score Distribution. To visually demonstrate the effectiveness of BBCaL, we plot the distribution of the FPS values for backdoored samples and clean samples in Appendix L. As the figure suggests, the FPS values for clean samples are centered in the middle, but those for backdoored samples lie on the two sides, aligning with the causal analysis derived in the last section.
Defences against Adaptive Attacks. We consider a practical scenario where an attacker has prior information about our deployed defense method. Then, instead of training backdoored models as in Equation 1, the attacker might add an additional term to the loss function to evade our backdoor detection. Specifically, the adaptive loss function would be,
Del min Σ ((f(xx)). + Σ ((fe(E)). v.) +
Pjd
Del
Σ E(fold; +m m.))).
(8)
where is random Gaussian noise added to each backdoor sample 2,, and m is the magnitude multi- plier of the added noise. Intuitively, this loss function makes the prediction behaviors on backdoored images more similar those on clean images when the noise is added. To evaluate the effectiveness of our detection method, provide results with varying against BadNet attack on CIFAR-10 dataset on Figure 8. As the figure suggests, the performance is consistently satisfactory with m varying from 0.1 to 0.7.
Adaptive Attacks
8.8-
Precision
8.6-
Recall
AUC
6.4-
0.0
0.2
0.4
0.6
0.8
Figure 8: Performance against adaptive attacks with varying m.
6 Conclusion and Future Works
In this paper, we propose an effective method for solving the input-level black-box backdoor detection problem. Our method is firstly motivated by novel perspective for analyzing the heterogeneous prediction behaviors for backdoored samples and clean samples, and further supported by strict theoretical analysis. Then by leveraging the causal insight, our detection algorithm introduces counterfactual samples as intervention in the prediction behaviors to distinguish backdoored samples and clean samples. Extensive experiments across popular datascts demonstrate the effectiveness and efficiency of our method. Despite these satisfactory results, there are still several directions that can be explored in the future. Firstly, how to construct an automatic algorithm for determining the magnitude set S? Meta information such as the mean and variance of the training dataset might be helpful the algorithm design. Secondly, we focus solely on classification task in the experiment. It would be promising if the methodology can be also adapted other tasks such generation.
12

---

Published in Transactions on Machine Learning Research (12/2024)
Acknowledgement
The work is in part supported by the U.S. Office of Naval Research Award under Grant Number N00014-24- 1-2668 and the National Science Foundation under Grants IIS-2316306 and CNS-2330215.
References
GitHub - fastai imaggeette: smaller subset of 10 easily classified classes from Imagenet, and little more [Accessed 14-08-2024).
French github.com. https://githut http:///thuub.cmoossasssaaaaaa//
Mauro Barni, Kassem Kallas, and Benedetta Tondi. new backdoor attack in cuns by training set corruption without label poisoning. In 2019 IEEE International Conference on Image Processing (ICIP), pp. 101-105. TERE, 2019. 9, 19
Ruisi Cai, Zhenyu Zhang, Tianlong Chen, Xiaohan Chen, and Zhangyang Wang. Randomized channel shuflligg: Minimal-overhead backdoor attack detection without clean datasets. Advances in Newral Information Processing Systems, 35:33876 33889, 2022. 5
Shih-Han Chan, Yimpeng Dong, Jun Zhu, Xiaolu Zhang, and Jun Zhou. Baddet: Backdoor attacks on object detection. In European Conference on Computer Vision, pp. 396-412. Springer, 2022. 2
Chun-Hao Chang, Elliot Creager, Anna Goldenberg, and David Duvenaud. Explaining image classifiers by counterfactual generation. arXiv preprint orXix:1807.0000
2018. 6
Weixin Chen, Baoyuan Wu, and Haoqian Wang. Effective backdoor defense by exploiting sensitivity of poisoned samples. In Alice H. Oh, Alekh Agarwal, Danielle Belgrave, and Kyunghyun Cho (eds.), Advances in Neural Information Processing Systems, 2022. URL https: /ttp:///ee//ereeieeeeeee wtt.:reewwweeetoommddieeeeee Tx2UOUg. 3
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arxiv: 151.00526, 2017. 2, 3, 7, 9, 19
Siyuan Chong, Yingqi Liu, Shiqing Ma, and Xiangyu Zhang. Deep feature space trojan attack of noural networks by rolled detoxification. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 1148 1156, 2021. 9, 19
Zhixuan Chu, Mengxuan Hu, Qing Cui, Longlei Li, and Sheng Li. Task-driven causal feature distillation: Towards trustworthy risk prediction. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 11642-11650, 2024. 3
Bao Gia Doan, Ehsan Abbasnejad, and Damith C. Ranasinghe. Februus: Input purification defense against trojan attacks on deep neural network systems. In Annual Computer Security Applications Conference, ACSAC '20, pp. 897 912, New York, NY, USA, 2020. Association for Computing Machinery. ISBN 9781 450388888. doi: 10. 10.1145/342722833277666 URL https://doi. org/10. argg/0..145/// 1145/34222222. 0444///32222282222244.4444 3427264. 3
Mengnan Du, Varun Manjunatha, Rajiv Jain, Ruchi Deshpande, Franck Dernoncourt, Jiuxiang Gu, Tong Sun, and Xia Hu. Towards interpreting and mitigating shortcut learning behavior of nlu models, arXiv preprint ar Xrx:22200..00 06922, 2021.
Yu Feng, Benteng Ma, Jing Zhang, Shanshan Zhao, Yong Xia, and Dacheng Tao. Fiba: Frequency-ijjectio based backdoor attack in medical image analysis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20876 20885, 2022.
Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the 35th Annual Computer Security Applications Conference, pp. 113-125, 2019. 2, 3, 9, 19
Yansong Gao, Yconjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith C Ranasinghe, and Hyoungshick Kim. Design and evaluation of a multi-domain trojan detection method on deep neural networks. IEFE Transactions on Dependable and Secure Computing, 19(4)22349 2364, 2021. 2, 9
13

---

Published in Transactions on Machine Learning Research (12/2024)
Tianyu Gu, Brendan Dolan- Gavit,, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine 2017. 2, 3, 7, 9, 18
learning model supply chain. arXiv preprinl
Zihan Guan, Mengnan Du, and Ninghao Liu. Xgbd: Explanation-guided graph backdoor detection. 26th European Conference on Artificial Intelligence (ECAT), 2023a. 3
Zihan Guan, Lichao Sun, Mengnan Du, and Ninghao Liu. Attacking neural nelworks with neural networks: Towards deep synchronization for backdoor attacks. In Proceedings of the 32nd ACM International Conference on Information and Knowledge Management, CIKM '23, pp. 608 618, New York, NY, USA, 2023b. Association for Computing Machinery. ISBN 9798400701245.. doi: https://doi.onn 10. 1145//588780..33 361008446147744 3
URL
Zihan Guan, Mengxuan Hu, Sheng Li, and Anil Vullikanti. Ufid: A unified framework for input-level backdoor detection diffusion models. arXiv preprint Xix:2444.00111,, 2024a. 3
Zihan Guan, Mengxuan Hu, Zhongliang Zhou, Jielu Zhang, Sheng Li, and Ninghao Liu. Badsam: Exploring sccurity vulnerabílities of sam via backdoor attacks (student abstract). In Proceedings of the AAAI
Conference on Artificial Intelligence, volume 38, pp. 23506 23507, 2024b. 3
Dongliang Guo, Mengxuan Hu, Zihan Guan, Junfeng Guo, Thomas Hartvigsen, and Shong Li. Backdoor in seconds: Unlocking vulnerabilities in large pre-trained models via model editing. arXio preprinl arXiv:24100 10.1100..1100 18267, 2024. 3
Junfeng Guo, Ang Li, and Cong Liu. Aeva: Black-box backdoor detection using ad advessarial ext reme value analysis. In International Conference on Learning Representations, 2021. 3, 7, 9, 23, 24, 25
Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. SCALF-UP: An efficient black- box input-level backdoor detection via analyzing scaled prediction consistency. In The Eleventh International Conference on Learning Representations, 2023. URL https: http://www.....eeeooooooo///ooo.
2, 3, 4, 7, 9, 20, 23, 24, 25
Ruocheng Guo, Lu Cheng, Jundong Li, P Richard Hahn, and Huan Liu. A survey of learning causality with data: Problems and methods. ACM Computing Surveys (CSUR), 33(4):1-37, 2020. 5, 6
Xingshuo Han, Guowen Xu, Yuan Zhou, Xuehuan Yang, Jiwei Li, and Tianwei Zhang. Physical backdoor attacks to lane detection systems in autonomous driving. In Proceedings of the 30th ACM International Conference on Multimedia, pp. 2937-2968, 2022. 2
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition, 2015.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840 1-661,-6851,, 2020. 25
Mengxuan Hu, Zhixuan Chu, and Sheng Li. DTRNet: Precisely correcting selection bias in individual-level continuous treatment effect estimation by reweighted disentangled representation. Transactions on Machine Learning Research, 2024. ISSN 2835-8856. URL https: //op/////////e/////// wwtpeeewwwwweeeeeeeeeeeeeeeeeeee htt.:/oormmmddd12222443.
Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. arXiv preprint arXin:220 20..:2200003223 2022a. 3
Zhuo Huang, Xiaobo Xia, Li Shen, Bo Han, Mingming Gong, Chen Gong, and Tongliang Liu. Harnessing out-of-distribution examples via augmenting content and style. arXiv preprint 2rX1h:2207.08162, 2022b. 3
Arthur Jacot, Franck Gabriel, and Clément Hongler. Neural tangent kernel: Convergence and generalization in neural networks. Advances in neural information processing systems, 31, 2018. 7, 23
Guillaume Jeanneret, Loic Simon, and Frédéric Jurie. Adversarial counterfactual visual explanations. In
Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16425-164355 2023.
14

---

Published in Transactions on Machine Learning Research (12/2024)
Hoang Anh Just, Feiyang Kang, Tianhao Wang, Yi Zeng, Myeongscob Ko, Ming Jin, and Ruoxi Jia. LAVA: Data valuation without pre-specified learning algorithms. In The Fleventh International Conference on Learning Representations, 2023. URL
9, 19
Yassin Kortli, Maher Jridi, Ayman Al Falon, and Mohamed Atri. Face recognition systems: A survey. Sensors, 20(2):342, 2020.
Alex Krizhevsky. Learning multiple layers of features from tiny images. pp. 32 33, 2009. URL https: //www. toronto......o.... edt/-krrizleerringg wew.aaninnneaaureee------ features- TRO00-T..-00 pd. 9
Jachoon Lee, Lechao Xiao, Samuel Schoenholz, Yasaman Bahri, Roman Novak, Jascha Sohl-Dickstein, and Jeffrey Pennington. Wide neural networks of any depth evolve as lincar models under gradient descent.
Advances in neural informalion processing systems, 32, 2019. 7, 23
Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti- backdoor learning: Training clean models on poisoned data. In NewrIPS, 2021a. 3, 9, 20
Yige Li, Xingjun Ma, Jiabo Hc, Hanxun Huang, and Gang Jiang. Multi-trigger backdoor attacks: More triggers, more threats. arviv preprint (fi:2401.11299 2024. 21
Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: survey, 2022. 3
Yiming Li, Mengxi Ya, Yang Bai, Yong Jiang, and Shu-Taa Xia. Backdoorbox: A python toolbox for backdoor learning. arXiv preprint arXiv:2302.00 762, 2023. 18
Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specifie triggers, 2021b. 7, 9, 19
Zhenlong Li, Chaowei Yang. Qunying Huang, Kai Liu, Min Sun, and Jizhe Xia. Building model as a service to support geosciences. Computers, Environment and Urban Systems, 61:141-152, 2017.
Kang Liu, Brendan Davint and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks, 2018. URL https://arxi:: org/abs// 12185. 3
Xiaogeng Liu, Minghui Li, Haoyu Wang, Shengshan Hu, Dengpan Ye, Hai Jin, Libing Wu, and Chaowei Xiao. Detecting backdoors during the inference stage based on corruption robustness consistency. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16363 16372, 2023. 2, 4
Yingqi Liu, Wen-Chin Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. Abs: Scanning neural networks for back-doors by artificial brain stimulation. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 1265-1282, 2019. 9, 19
Yiran Liu, Xiaoang Xu, Zhiyi Hou, and Yang Yu. Causality based front-door defense against backdoor attack on language models. In Forty-first International Conference on Machine Learning, 2024. URL https://openrevaie wttppppaw.....eeeoor/oaaaaaeaae. rett/foruuridddddddeevHHHtttdd
22, 23
Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks, 2020. URL https://arxiv http://aaaw.ooaaaaaaaa/aaaaaaa/a wtg//bs////////////// /a0ab///00.0033...... 3
Danicle Lunghi, Alkis Simitsis, Olivier Caclen, and Gianluca Bontempi. Adversarial learning in real-world fraud detection: Challenges and perspectives. In Proceedings of the Second ACM Data Economy Workshop, pp. 27-33, 2023. 2
Wanlun Ma, Derui Wang, Ruoxi Sun, Minhui Xue, Sheng Wen, and Yang Xiang. The" beatrix restriitressurrcction::: Robust backdoor detection via gram matriccs. arXiv preprint 1XXx:2209911115 2022. 3
Anh Nguyen and Anh Tran. Wanet-imperooptible varping-based based backdoor attack.
ar preprint
210:2202210300 2021. 2, 7, 9, 19
15

---

Published in Transactions on Machine Learning Research (12/2024)
Soumyadeep Pal, Yuguang Yao, Ren Wang, Bingquan Shen, and Sijia Liu. Backdoor secrets unveiled:
Identifying backdoor data with optimized scaled prediction consistency. In The Twelfth International Conference on Learning Representations, 2024. URL https:// http:p//pppprrrreeeeeeeeeeeeeeea net/foormmmdd-1114022ee
2
Xiangyu Qi, Tinghao Xie, Yiming Li, Saced Mahloujifar, and Prateck Mittal. Revisiting the assumption of la-
Lent separability for backdoor defenses. In The eleventh international conference on learning representations, 2022. 3, 9, 19
Min Ren, Yun-Long Wang, and Fhao-Feng Hc. Towards interpretable defense against adversarial attacks via causal inference. Machine Intellignnce Reseurch, 19(3):209 226, 2022. 3
Dumitru Roman, Sven Schade, AJ Berre, N Rune Bodsberg, and J Langlois. Model as a service (maas). In AGILE Workshop: Grid Technologies for Geospatial Applications, Hannover, Germany, 2009. 2
Pedro Sandoval-Segura, Vasu Singla, Liam Fowl, Jonas Geiping, Micah Goldblum, David Jacobs, and Tom Goldstein. Poisons that are learned faster are more effective. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pottern Recognition, pp. 198 205, 2022. 5
Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. Advances in neural informalion processing systems, 31, 2018. 3, 9, 19
Yucheng Shi, Mengnan Du, Xuansheng Wu, Zihan Guan, Jin Sun, and Ninghao Liu. Black-box backdoor defense via zero-shot image purification. Advances in Neural Information Processing Systems, 36:57336 57366, 2023. 3
Hossein Souri, Liam Fowl, Rama Chellappa, Micah Goldblum, and Tom Goldstein. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch, 2021. URL 0896.08970. 3
www.avo..rr/baoo /
J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel. Man vs. computer: Benchmarking machine learning
algorithms for traffic sign recognition. Neural Networks, (0)=- 2012. ISSN 0893-6080. doi: 10.1016/j..eemet. 2012.02.016. URL http://wwer sciencedirect. com/ wtt wttp://ccinnceeeeeeeeee http:///ccccccccccc////////00000
9
Tian-Xiang Sun, Xiang-Yang Liu, Xi-Peng Qiu, and Xuan-Jing Huang. Paradigm shift in natural language processing. Machine Intelligence Research, 19(3):169-18) 2022a. 1
Tianxiang Sun, Yunfan Shao, Hong Qian, Xuanjing Huang, and Xipeng Qiu. Black-box tuning for language- aeseeice---- In International Conference Machine Learning, pp. 20841 20855. PMLR, 2022b. 2
Mingxing Tan and Quoe V. Le. Efficientnet: Rethinking model scaling for convolutional neural networks, 2020. 9
Shruti Tople, Amit Sharma, and Aditya Nori. Alleviating privacy attacks via causal learning. In International Conference on Machine Learning, pp. 9537 9547. PMLR, 2020. 3
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you nood. Advances in neural information processing systems, 30, 2017.1
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks neural networks. In 2019 IEEF Symposium on Security and Privacy (SP), pp. 707 723, 2019. doi: 10.1109/SPP2211.00003 3
Zhen Xiang, David J Miller, and George Kesidis. Post-training detection of backdoor attacks for two-class and multi-attack scenarios. Xrxiv preprint ar arXi::2201088/77 084.07444 2022. 3
16

---

Published in Transactions on Machine Learning Research (12/2024)
Yao Xiao, Ziyi Tang, Pengxu Wei, Cong Liu, and Liang Lin. Masked images are counterfactual samples for robust fine-tuning- In Proceedings of the IEEE/CVE Conference on Computer Vision and Paltern Recognition, pp. 20301 20310, 2023. 5, 6, 11, 20
Liuyi Yao, Zhixua Chu, Sheng Li, Yaliang Li, Jing Gao, and Aidong Zhang. A survey on causal inference.
ACM Transactions Knowledge Discovery from Data (TKDD), 15(5):1-46, 2021. 3, 5, 6
Da Yu, Huishuai Zhang, Wei Chen, Jian Yin, and Tie Yan Liu. Indiscriminate poisoning attacks are shortcuts. 2021.
Liu Yu, Yuzhou Mao, Jin Wu, and Fan Zhou. Mixup-based unified framework to overcome gender bias resurgence. In Proceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval, pp. 1753-175555 2023. 6, 11, 20
Yi Zeng, Won Park, 7. Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks' triggers: A frequency perspective. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 16473- -6488,, 2021. 9, 19
Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia. Narcissus: A practical clean-label backdoor atlack with limited information. ar preprinl arXiv:2204.008 05225,, 2022. 3
Zaixi Zhang, Qi Liu, Zhicai Wang, Zepu Lu, and Qingyong Hu. Backdoor defense via deconfounded representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12228-1222 12238, 2023. 3, 5, 22
Pu Zhao, Pin-Yu Chen, Payel Das, Karthikeyan Natesan Ramamurthy, and Xue Lin. Bridging mode connectivity in loss landscapes and adversarial robustness, 2020. URL https /taa:://axxvv org/ 2005 00060.
Zhongliang Zhou, Wayland Yeung, Saber Soleymani, Nathan Gravel, Mariah Salcedo, Sheng Li, and Natarajan Kannan. Using explainable machine learning to uncover the kinase- substrate interaction landscape. Bioinformatics, 4tt2)ab 2024a.
Zhongliang Zhou, Jielu Zhang, Zihan Guan, Mengxuan Hu, Ni Lao, Lan Mu, Sheng Li, and Gengchen Mai. Img2loc: Revisiting image geolocalization using multi-modality foundation models and image-based retrieval-augmmentdd gencration. In Proceedings of the 4 7th International ACM SIGIR Conference on Research and Development in Information Retrieval, pp. 2749 2754, 2024b.
Zhengxia Zou, Keyan Chen, Zhenwei Shi, Yuhong Guo, and Jieping Ye. Object detection in 20 years: A survey. Proceedings of the IEEE, 2023. 1
17

---

Published in Transactions on Machine Learning Research (12/2024)
A Appendix
B Preliminary Experiment on Counterfactual Examples
C FPS score
Algorithm FPS Score Calculation.
Input: Prediction results fo(P:) (Zb)), (o(
FPS |S| for 1o S do
if fa(2)) + fa( then
break
else
FPS j
end if end for
return FPS
D Algorithm
Algorithm The Backdoor Detection Method.
Input: Dataset Drest ((111(())::))))) ..., (In, vn)}; Target Model fe; detection threshold [a, 3]; magnitude set S.
for i= 1 to n do
Construct the preflight batch P. [ s?, a!!1 for each (ar;, yi) Drest given S. So (5t)
Obtain the prediction result for the query Ps, [oo(1)) (o fe(
Compute the score on following Algorithm in Appendix C.
end for
Filter backdoored samples by threshold [a. 3].
E
More Details about Dataset
The details of the dataset are given in Table 3.
Table 3: Statistical information about the Datasets
Dataset
Image Size
# of Training samples
# of Testing Samples
# of Classes
CIFAR-10
32
32
3
50,000
10,000
10
GTSRB
32
32
x 3
39,209
12,630
43
ImageNet-Subset
224
224
3
9,469
3,925
10
F More Details about Attack baselines
All the attack baselines are implemented with the open-sourced backdoor learning toolbox (Li et al., 2023). The details of the attack baselines are as below:
BadNet (Gu et al., 2017) employs grid-like pixels the triggers for each of the backdoored samples.
18

---

Published in Transactions on Machine Learning Research (12/2024)
Clean
Badliet
Blend
Wallet
15SBA
LC
DFST
S1G
Filter
Adaptive 81end
Figure 9: Visualization of backdoor samples on CIFAR-10 dataset.
Blend (Chen et al., 2017) employs a hello-kitty-like image and blends it with each of the backdoored samples.
WaNet (Nguyen & Tran, 2021) employs the interpolation method and generates sample-specific triggers for each of the backdoored samples.
ISSBA (Li et al., 2021b) generates sample-specifie trigger patterns through an encoder-decoder network.
LC (Shafahi al., 2018) employs perturbations to modify the original images and then conducts invisible backdoor attacks.
DFST (Cheng et al., 2021) conducts the invisible backdoor attacks in the feature space via style transfer. They first train a style-transfer GAN model on sunset weather datasets and then employ the trained GAN model to construct backdoor images so that the backdoor images have a style of sunsct.
SIG (Barni et al., 2019) conducts the invisible backdoor attacks with sinusoidal signal.
Filter (Tiu et al. 2019) constructs backdoor images by employing filters such as the Nashville filter the trigger pattern.
Adaptive Blend (Qi et al., 2022) constructs backdoor samples by first partitioning the standard trigger patterns into several patches the training stage. But in the inference stage, backdoors are activated with the standard trigger pattern.
We present a visualization of the backdoored image generated by different backdoor attacks Figure 9.
G More Details about Defense baselines
In this section, we introduce the basic parameter setting for each of the defense baselines.
STRIP (Gao et al., 2019): We follow the official implementation of STRIP". Specifically, 100 samples are iteratively superimposed on the given sample and we record the classification probabilities generated by the DNN model. Subsequently, an entropy value is calculated based on the 100 probability values to determine whether the given sample backdoor or not. higher entropy value denotes a higher probability of being backdoored.
Frequency (Zeng et al., 2021): We follow the official implementation of Frequency². Specifically, we employ 6-layer CNN model as the backbone architecture the binary detector and train it for 50 epochs on an additional validation set 1000 samples. The binary detector determines whether the given sample is clean or backdoored by analyzing the Fourier transform of the original image. Subsequently, we use the probability of being identified as "backdoored" as the score for each sample.
LAVA (Just et al., 2023): We follow the official implementation of LAVA Specifically, we determine the data valuation of each data sample in the test set by calculating the proposed calibrated gradient in the original paper. A higher gradient value denotes higher probability of being backdoored.
htttss///ggaabbboomm/a/isgg///gg
httee///chhuub.omm////aaaee/frrr 3 httpe///eihhbbcmmm//moo/gggggggn
19

---

Published in Transactions on Machine Learning Research (12/2024)
Table 4: Details about the deployed DNN models
Attadi
Dataact
Nod
ISSBA
SIG
CA (5)
ASR. (9;
CA (5)
ASR (9)
Ca (5)
ASR (83)
CA (34)
ASB (96)
CA (85)
ASB (5)
CA (55) ASR: (5)
CA (8).
ASR (5)
CA. (5)
ASR (93
CA (%)
ASR (9))
CIFAR-J0 CITSRB
92
100
92
100
92
200
91
191
92
102
180
99
150
50
100
10
97
180
100
16
100
06
100
96
100
100
100
98
100
18
100
IrsageNee
180
100
100
83
100
83
100
99
50
97
SCALE-UP (Guo et al., 2023): We follow the official implementation of SCALE-UP 4. Specifically, the scaling set is chosen as = (1,3, 5, 7, 9} for all the experiments. The proposed SPC value is calculated for each of the samples, where a higher SPC value denotes a higher probability of being a backdoor sample.
More Details about the Deployed DNN Models
We provide the details about the deployed DNN models in Table 4, where CA denotes the clean accuracy and ASR denotes the attack success rate. Note that for cach experiment, we run the experiment three times and record the average performance of CA and ASR.
Experimental Discussion
Our explanation is that, for semantic backdoor attacks such as Filter, and DFST, they all rely on semantic features as a trigger launch backdoor attacks. For example, Filter relies on specific filter, and DFST relies style transfer learned from couple of sunset images. Therefore, when rumning over these backdoor allacks, it is observed that the distributions of these backdoor samples' FPS scores tend to be slightly closer to the clean samples' FPS scores. Specifically, (1) when we start adding random noise, the prediction label of these backdoor samples will not immediately change; (2) when we gradually add larger magnitudes of random noise, the prediction label of these backdoor samples will ultimately change with a faster speed than the clean samples, potentially because the semantic features the trigger are not as complex as those in the clean image. Thereby, observation (1) makes the FPS not as low as the typical sample-specific backdoor attacks such as WaNet; and observation (2) makes the FPS not as stably high as the typical sample-agnoste backdoor attacks such as BadNets. Although it is slightly less effective, our method still outperforms the basclines. These experimental findings pose a noteworthy question that might be helpful for further refining our method. Inspired by this interesting question, we'd like to leave more explorations in the future works.
detection method
J More Details about Implementation
Following the prior works in backdoor defences (Li et al., 2021a), the poisoning ratio for backdoor attacks is set as 10% as default. The a and values are set as 1 and 6, respectively. is noted that the design of the magnitude set S is a non-trivial question. the set is too short, the granularity might not be fine-grained enough to distinguish between backdoor samples and clean samples, which is detrimental meeting the effectiveness requirement. However, if the set is too large, the efficiency requirement cannot be satisfied. To achieve balanced trade-off between the two sides, we have chosen 7 as moderate length for the magnilude set, where the noise magnitude increases linearly starting from 0 with a step length of 0.2. For a and 8, we choose and 6 for all datascts, respectively. As shown in Figure 10, they are stable to distinguish backdoor and clean samples across all datasets. All the experiments are evaluated on an NVIDIA RTX A5000 GPU with 24GB GPU memory.
K
Comparison of different counterfactual generation methods
The impact of counterfactual generation method Apart from random noise, other methods, such as random masking (Xiao et al., 2023) and mixup (Yu et al., 2023), have also been extensively used for
20

---

Published in Transactions on Machine Learning Research (12/2024)
polsoned Images
BadNet
WaNet
clean images
10000
Figure 10: Comparison of FPS score distribution between backdoored and clean images
generating counterfactual samples. To assess the impact of counterfactual sample design, we compare the performance of our method with mixup and random masking on CIFAR-10 dataset and report the results in Table 2. As the table suggests, random noise shows the most stable performance across all types of backdoor allacks. A possible explanation is that random noise enables counterfactual sample generation with finer granularity.
L Score distribution
To visually demonstrate the effectiveness of BBCaL, we plot the distribution of the FPS values for backdoor samples and clean samples in Figure 10. As the figure suggests, the FPS values for clean samples center in the middle but those for backdoor samples lie on the two sides, aligning with the causal analysis derived in the last section.
M More Details about Defending Multi-Triggen Backdoor Attacks (MTBAs)
We first formulate the MTBAs problem following (Li et al., 2024): For the MTBAs, we randomly selected subset of training samples, De, which was then unifornly divided into smaller subsets, denoted De {D=)m k= Each D received randomly chosen trigger from trigger function pool T = (6x 1m 1=11 forming D = (0 lat = x + (x(x)) a D²). Different target labels were randomly assigned to different triggers. The training model on this multi-trigger poisoned dataset {D) pm is formulated as follows:
min (L vi)
Σ
E
To evaluate the effectiveness of our detection method in the MTBAs setting, we consider a challenging experiment setup: the trigger pool contains both sample-agnostic and sample-specific triggers. This challenging setting helps us to explore the effectiveness of our model under the mixture of both sample-agnostic and sample-specific triggers. Specifically, we used BadNet and WaNet on CIFAR-10 dataset, which belong to the sample-agnostic and sample-spccific attacks, respectively. After backdoor learning over the datasct poisoned with BadNet and WaNet, we obtain model which achieves 92% in CA, 98% in WaNet ASR, and 100% in BadNet ASR. Then, samples, and 5000 WaNet-poisoned samples. The results are shown in Figure 5.
the detection methods test dataset which consists of 5000 BadNet-poisoned
It is observed that our method still oulperforms other baselines, preliminary demonstrating that our method works well in the MTBAs setting. For the causal analysis under the MTBAs setting, the causal structure employed for analyzing MTBAs depends on what trigger used by the attackers in the inference time. For example, if BadNet is utilized, it corresponds with the causal analysis of backdoored images with sample-agnostic triggers, resulting in very high FPS. Conversely, if WaNet. is used, it aligns with the causal
21

---

Published in Transactions on Machine Learning Research (12/2024)
Precision
Recall
AUROC
STRIP
0.69
0.57
0.62
Frequency
0.40
0.23
0.54
LAVA
0.52
0.21
0.63
ScaleUP
0.68
0.61
0.70
Ours
0.80
0.92
0.91
Table Performance comparison on defending multi-trigger backdoor attack.
analysis of sample-specific backdoor samples, resulting in very low FPS. Regardless of the trigger employed, backdoored samples can be effectivcly distinguished from clean samples.
N More Details about Other Potential Adaptive Attack
In this section, we explore another polential adaptive attack, specifically composite backdoor attack, on CIFAR10 dataset. Notably, this attack is successfully injected with an attack success rate of 95% and a clean accuracy 92%. Below are the comparison results for the detection effectiveness:
Precision
Recall
AUROC
STRIP
0.10
0.03
0.14
Frequency
0.34
0.44
0.55
LAVA
0.46
0.38
0.49
ScaleUP
0.55
0.61
0.62
Ours
0.70
0.62
0.76
Table 6: Performance comparison on defending composite backdoor attack.
shown, our method outperforms the other baselines in detecting composite backdoor attacks. However, we also observe that the precision/rent values are lower than those of BadNet or Blend. The explanation is that composite backdoor attacks belong the category of semantic backdoor attacks, which challenges the effectiveness of our detection method.
Comparison with (Zhang al., 2023) and (Liu et al., 2024)
Causal inference also used (Zhang et al., 2023), where they view the backdoor attack as confounder in the data poisoning process. However, Our causality analysis is fundamentally different from that in (Zhang et al., 2023) with the three aspects:
Analysis Objective Their analysis aims to provide theoretical analysis for training a clean model from backdoored dataset, while our analysis aims to investigate the distinct prediction behaviors of clean and backdoored images from a causal perspective.
Analysis Content Their analysis causal graphs model the generation process of backdoor data in the training stage, while our analysis focuses on DNNs prediction behaviors in the inference stage when input with different lypes of data. Although similar structures are used (e.g., I A + Y), the actual meaning of each edge are fundamentally different. For example, [1], A + Y means backdoor attackers will "change the labels the targeted label' when constructing backdoor samples (evidencod by $3.2 of (Zhang al., 2023)), but in our setting, A + Y means that backdoor attacks will make the backdoored DNNs predict the input image label Y.
22

---

Na Published in Transactions on Machine Learning Research (12/2024)
Analysis Usage Their analysis aims to adjust confounder, by disentangling backdoor path and causal path in the model training process. However, our causal analysis works guideline for distinguishing backdoor samples and clean samples in the inference stage.
(Liu et al., 2024) also explored causality in the fields of language models, where front-door adjustment in causal inference was used to fine-tune pre-trained language model as the defense model to correct predictions. In addition to the significant differences between fields (backdoor attacks in computer vision and backdoor attacks in NLP), causal analysis was used for different purposes. Hence, this approach is infeasible for our task due to limited information and efficiency requirements.
P Proof
We first introduce an important lemma that is key to our proof.
Lemma (Infinite width net works as linearized networks (Lee et al., 2019)) Let f(x) denole a fully-connecled neural network with L hidden layers, each with width ny for tor-=1a 1....... L. Let f((x)= h (x) E R denote the oulput of the neural network at time t. For a neural network fe(x) with infinite width, let θ denote the corresponding deterministic kernel, and ft f(in(z) denote the linearization of f((z). If the learning rate n satisfies where Amin/mer( (9) are the minimum and marimum eigenvalues of
=
1] < Terisiial := 2 (>min()) + ()) θ respectivcly, then for every z E We with | S 1, as n + 00 and - oc, fz(z) converges in distribution to the same Gaussian distribution as the linearized model ((Kr
Our proof is grounded in the intuition that, although directly analyzing a black-box DNN is notoriously challenging, recent studies on the Neural Tangent Kernel (NTK) (Jacot et al., 2018) have shown that a DNN with infinite width can be treated as a linearized network. Following (Guo et al., 2021; 2023), we leverage the RBF kernel and treat the DNN as a k-way kernel least square classifier. Under Lemma 7, the regression solution for the NTK is as follows:
( x.)) 3g
1= O,,, 2i) + Σj= 0(, (2
(9)
+0 ΣM ((, mi) 1/ + Σn= O(, m.) y/t
(10)
E O(, m.) + و O O(,
where (.(() and of(-) E E represent the predicted probabilities of class q and class t based on f(:0) for clean samples and backdoored samples, respectively. N₂ and N, denote the number of clean and backdoored samples, respectively. a, and Big represent benign samples and benign samples specifically from class a respectively. z, represents the poisoned samples. 3y and Ye are the corresponding one-hot labels for class and target class f, respectively. The kernel function O(x, xx) = 211lle=== (7 > 0) is used. Given the assumption that training samples are evenly distributed, there are Ne benign samples belonging to each class. Without loss of generality, we assume y4 = 1 for class q while others are set to O. The regression solution is then expressed as:
Σ
No/k ((,zzgg)
(11)
2i=1 O vD) + E/e 0(, O()
+f(-) Σ No/k O(,, xxx)) + Σ O 2.) カ-
(12)
ΣN O(, Σ 0(,
P.1 Proof of perturbation on clean images
Theorem (Prediction consistency for clean samples). Let N₂ denote the total namber of benign samples, and let $. represent the number of benign samples in specific class. Given a well-trained backdoored model
23

---

Published in Transactions on Machine Learning Research (12/2024)
to and clean imput from class q, define E|| 111l²]] and 3 = B|| 1/1ll9,, where zq and x la denote benign somples from class q and benign samples from other class, respectively. Assuming that i follows Gaussian distribution, if we perturb the clean input with scaled Gaussian noise e ~ N(0, the prediction remains unchanged until a² 22+mm_-
2(3-a)
Proof. The proof provided under Lemma After substituting the clean test sample æ, whose ground truth is class 9, into Equation 11, we have:
E
Nu/k (x, Dig)
(x)
(13a)
i=1 (x. + Σラ (g)
No/R (xx Figy)
(13b)
11 @ xi)
No/k e- 2- 2-
2i=1
(13c)
No No/k e-2 | | ENa e 2-2:llm-m.,1
Ei=1
No where the trivial term Σn == ((x, 2z)) in Equation 13a is omitted following (Guo et al., 2021; 2023), due to the following two reasons: (1) æ is clean sample with low similarity to backdoored samples; (2) Furthermore, for commonly used backdoor attacks, the number of backdoored samples is only a small fraction of that of the clean samples, i.e, N, << No.
model, the probability of predicting class q for an image from class q should be greater than that for any other class. Therefore, the following equation must hold:
For
No/k
No-Na/l Σ
Σ
2 2:110-2:0111
27 21 > O.
(14)
For notational convenience, lot a Bii
xy1l represent the expected L2-norm of the difference between the input image and the clean images in class q, and let B E[[lar ar / [| denote the expected L2-norm of the difference between the imput image and the clean images from other classes. Substituting a and into Equation 14 results in the following equation:
No 27a (No
273 > 0. No N )e k
(15)
It is noted that the term (N, No can be simplified to m No For instance, in a 10-class dataset like CIFAR-10, m 9, and for ImageNet, m 99. Consequently, Equation 15 can be rewritten as:
23a me -278 > O.
(16)
Taking the logarithm of both sides and dividing by -2 gives:
Inm 3< 0.
(17)
27
Now, consider a scenario in which a scaled Ganssian perturbation, c, is added to a clean image. Consequently, Equation 14 becomes:
No/k Σ
No- No/k
2-l #/o
(18)
Following a similar procedure as before, we substitute a' = E|| + - ag [2]] and 3' = Eiil= + 6- We assume that Z/4 follows Gaussian distribution. Consequently, we derive the following equation:
/// 117)
a' > oz B < 3.
(19)
24

---

Published in Transactions on Machine Learning Research (12/2024)
Adding с to the original image increases the difference between the new image and its original ground truth, zq.- Hence, if é is larger enough, a' > Moreover, applying sufficient Gaussian noise can result in an image that essentially becomes pure Gaussian noise Ho et al. (2020). Consequently, the differences between the current image and those from other classes decrcases. Following this trend, after adding sufficient noise, imm - < 0. Therefore, the prediction m - 3 O, whereas the prediction for the original image is a + 27 would change. Next, we will identify this threshold. Using a and B, Equation 18 can be rewritten as:
a' + 24
27(a+e e +22 +2(m-a,)) c) - me (1(-))+2(==))))))))
(20)
Taking the logarithm of both sides and dividing by -2 yields the following.
lum
(ax + e² + 2(xx =x.g"²)) +
(8 + 6² + 2(x (c)
27
(21)
Imm
=0 +
B+ + 2(21/9 xrg)" Te.
24
Since in Equation 17, we have a² + Inm 3 <<0, 0, when e is small enough (e - 0), Equation 21 remains less 27
than O and Equation 18 is still greater than O, indicating that the prediction remains unchanged. However, a² 27 - if 6 2($-a) Equation 21 becomes greater than and Equation 18 becomes less than 0, leading to change in prediction. This proof sheds light on our causal analysis, demonstrating that clean images experience gradual outcome changes in response to noise intensity.
P.2 Proof of perturbation Backdoored images
Now analyze the behavior of backdoor samples after perturbation. For given backdoored sample, can simplify Equation 12 as:
Σn θ(x, xz) (x) ~ No
(22)
Σ ((x Σ/= Np O(x, m.))
Following (Guo et al., 2021; 2023), we omit the term Σ No/k (x. This is because æ usually does not No.k belong to the target class ye. Hence DNi, O(x, aa) << クド= az),;;) Otherwise, the attacker would not have the motivation to craft backdoored samples.
P.2.1 Model Agnostic Attack
According to the definition model agnostic attack in $2, we can express the backdoored sample as x = +t, where & is a constant value denoting the trigger pattern. Then, similar the proof process for the clean images, we assume that the backdoored model well-trained. Hence, for backdoored image with target label y/, the output probability for the class y/ should be greater than other classes. Therefore, we have:
N
No
O x3) - Σ
0(x,z;) >
(23)
N₂ 2 -t-
No
2y 3x (( > 0.
Following a similar proof process as used for clean samples, we define the expectation of the L2-norm of the difference between the input image and the original clean images of poisoned images as a = E[]]a' - 1/1 and the expectation of the 1.2-norm of the difference between the input image and the benign images
25

---

Published in Transactions on Machine Learning Research (12/2024)
ISSBA
SIG
Filter
0.9
0.95
8.90
8.7
7-
0.6
8-
Sabel-Consistent
DFST
Adaptive Blend
0.9
6.95
5-
0.95
6-
6.98
6-
0.8
9.99
7-
8.85
7-
9.85
8.88
0.6
9.80
6.15
6.2
6.25
6.3
0.05
9.3
0.1
0.15
0.2
0.25
0.3
Figure 11: Performance of BBCaL under different combinations of length and step.
B = E' xb 131] This results a+
lum 3 0. As in the previous proof, after adding the perturbation, 24
the expression becomes a² + In 24
8 + 2(r xz² t) Typically,
E E x = Eaab 2/11 E(t).
(24)
where ay and sr, represent any benign image and the original benign image of backdoored image, respectively. Since the backdoored image is randomly selected from the benign images, and trigger is subsequently added, and o are from the same distribution. We assume E[zs xzI = O, and since the trigger always adds a positive value, Ø x t is always negative. Therefore, a² + In 8² + 2(xx x - -t²²e is always less than which implics that after adding perturbation, the prediction remains unchanged.
27
P.2.2 Model Specific Attack
According to the definition in $2. For a given backdoored sample with model specific trigger æ = x' + a(x'), we can simplify eq. (12) as:
No
27lla'+o ta)
2y toll)'t((m)-a))) > 0.
(25)
Due to the specific nature of the sample-specific attack, where the trigger is tailored to individual images, the trigger for becomes ineffective for other new images (e.g., x' + n)). Hence
N
2lllaa < <0,
(26)
where is small change for the imput. Hence when n, have that the prediction of the perturbed image would change inmediately.
Q More Experiments about Magnitude Set
Figure presents additional heatmaps, showing the performance of BBCaL under different combinations of length and step against different backdoor attacks. In particular, length represents the length of the magnitude set S, and step represents the difference between two adjacent noise values in the magnitude set..
26

---

Published in Transactions on Machine Learning Research (12/2024)
R
Impact Statement
Deep neural networks have been widely adopted in a variety of domains, making it crucial to assess their security in practical applications. In this paper, we propose a simple yet effective method for solving the inference-stage black-box backdoor detection under a strict but practical scenario of Model-as-a-Service (MaaS), As outlined in the threat model, our method is proposed from the perspective of a defender. Therefore, this paper has no ethical issues and will not introduce any additional security risks the DNNs.
27


Reviews:
[{"review_id": "XIY3JqLweF", "reviewer": "Reviewer_Wr5G", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The paper is well-written, providing a clear formulation of the problem setting, research goal, and review of existing works. Additionally, the formulation of backdoor attacks using causal inference is both insightful and innovative.\n- The method is well-motivated, with a logical approach to addressing the research question.\n- The authors consider both basic attacks (e.g., BadNets) and more advanced attacks (e.g., WaNet), which demonstrates a comprehensive evaluation.\n\nWeakness:\n- Approaching backdoor detection from the perspective of spurious paths is not novel, as similar ideas have been explored in prior works [1, 2, 3]. For example, [3] identifies backdoors by shuffling neural network weights (injecting noise into the weight space). Additionally, [2, 3] discuss the concept of backdoor features as \"shortcut features.\" While the proposed method focuses on a black-box setting, where existing methods may not directly apply, it would be beneficial to acknowledge and discuss these related approaches.\n\n[1] Randomized Channel Shuffling: Minimal-Overhead Backdoor Attack Detection without Clean Datasets.\n[2] Indiscriminate poisoning attacks are shortcuts.\n[3] Poisons that are learned faster are more effective.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This work aims to detect backdoor attacks by leveraging causality and spurious correlations. The authors clearly define the problem and propose a noise injection method on images to effectively tackle black-box backdoor detection. The method's effectiveness is validated across multiple datasets and attack types.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "See weakness.", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "fnhwkNyYGE", "reviewer": "Reviewer_7cR2", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- This paper is well-written and easy-to-follow. The motivation is clear, and the proposed method is intuitive and straightforward.\n- The proposed method is efficient to implement, and the effectiveness is great, as shown by the quantitative results compared to other baseline methods.\n\nWeaknesses:\n- Although this paper considers both sample-agnostic and sample-specific types for backdoor triggers, diverse or adaptive trigger patterns are not explored, which could largely affect the efficacy of the proposed method. It is suggested to discover how the causal struct is for the adaptive triggers and discuss how can the proposed method solve such problems.\n\n\n- The feasibility of the proposed causal graph is doubtful: Even though the proposed method works well under the given graph assumption, whether it is feasible for real-world scenarios is still unclear. It would be nice to provide more intuitive examples and explanations.\n\n- While the paper claims to be the first to provide a causality analysis for backdoor attacks in the inference stage, many works that conduct causal analysis for attack, defense, and detection are already proposed, it would be nice to incorporate them in the related work.\n\n\t- Huang et al., Harnessing out-of-distribution examples via augmenting content and style, in ICLR 2023.\n\t- Tople et al., Alleviating Privacy Attacks via Causal Learning, In ICML 2020.\n\t- Ren et al., Towards Interpretable Defense Against Adversarial Attacks via Causal Inference, In MIR 2022.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Summary:\nThis paper studies the black-box backdoor detection problem by conducting do-calculus. Specifically, the authors focus on inference-stage black-box backdoor detection as a firewall to filter out the backdoor inputs in the inference stage. By leveraging the do-calculus in the causal structural model, the clean examples and backdoored examples act differently when facing various magnitudes of perturbation. Under theoretical and empirical analyses, it is shown that noise-augmented sample generated from clean data shows more consistent predictions compared to the backdoored data, therefore, successfully detecting the backdoor examples. Extensive experiments show the effectiveness of the proposed method.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please see weaknesses part.", "broader_impact_concerns": "No ethical concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "ySsp3NEQWe", "reviewer": "Reviewer_PhMm", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strenghts:\n1. Novel Perspective: Introduces an innovative approach to backdoor detection using causality, accompanied by clear and intuitive explanations.\n2. Effective Technique: Presents an effective and efficient backdoor detection method that outperforms existing baselines.\n3. Comprehensive Experiments: Conducts extensive experiments on a variety of datasets, models, and backdoor attack types, ensuring the method's robustness and generalizability.\n4. Theoretical Support: Provides insightful theoretical proofs that support the proposed detection technique.\n\nWeaknesses:\n1. Insufficiently Supported Claims: Some claims lack robust support and may not fully align with empirical results.\n2. Limited Analysis of Less Effective Cases: The paper does not delve deeply into cases where the proposed method is less effective.\n3. Overlooked Potential Adaptive Attacks: Potential adaptive attacks against the detection method are not thoroughly explored.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper introduces a novel and intriguing black-box backdoor detection technique from a causality perspective. Specifically, the authors analyze backdoor behavior using causal graphs and observe the different behaviors of backdoor and clean samples under counterfactual interventions. They find that sample-agnostic backdoor attacks tend to maintain robust predictions, whereas sample-specific backdoors become fragile when subjected to varying levels of Gaussian noise as an intervention. Based on these observations, the paper presents a backdoor detection method that compares the prediction robustness of backdoor and clean samples across a series of noise interventions. Clean samples are expected to show a gradual decrease in prediction accuracy, while backdoor samples are anticipated to exhibit either a slight (for sample-agnostic) or significant (for sample-specific) decrease.\nThe authors conduct extensive experiments across various datasets, models, and backdoor attacks to demonstrate the effectiveness of the proposed method compared to existing baselines. Additionally, the paper provides insightful theoretical proofs supporting the proposed approach.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "The paper is well-written, and the proposed method is both novel and interesting. I appreciate the analysis from a causality perspective to model backdoor behavior. However, there are a few concerns regarding some of the claims and experiments:\n\n(1) Insufficiently Supported Claims:\n\n**Trigger Injection Function:** In Section 3.1, the authors model the trigger injection function as $\\hat{x}_i = x_i + t_i$. The \"+\" operation may not be precise for many backdoor attacks. For instance, in attacks like BadNet and Blend, the trigger often replaces part of the original image rather than merely adding to it. Additionally, triggers in attacks such as WaNet and DFST involve complex transformations.\n\n**Impact on Noise Intervention Assumption:** This imprecision affects the observation in Equation (2), where the authors assume that noise intervention on backdoor samples is equivalent to applying noise to clean samples followed by trigger injection. This assumption may not be rigorous and may not hold in practice.\n\n**Counter-Example with Blend Trigger:** A typical counter-example is the Blend trigger. The authors classify Blend as a sample-agnostic backdoor that is robust against noise intervention. However, if a small, fixed Gaussian noise is used as the trigger pattern (as discussed in the original Blend paper beyond the HelloKitty trigger) and noise intervention is applied afterward, it is likely that the success rates of backdoor samples would decrease. This is because the noise intervention distorts the fixed noise trigger patterns.\n\n**Recommendation**: I suggest the authors elaborate on this point, possibly refining the trigger injection model to better align with various backdoor attack strategies and reassessing the noise intervention assumptions accordingly.\n\n(2) Limited Analysis of Less Effective Cases:\n\n**Filter Attacks:** According to Table 1, Filter attacks are challenging to detect using the proposed method, achieving an AUC of nearly 0.8, although this still outperforms the baselines. The paper does not provide an in-depth analysis of why the proposed method is less effective for Filter attacks\nA possible reason is that Filter triggers are typically semantic (e.g., a style transfer) and behave more similarly to natural images compared to other typical backdoor triggers. This similarity makes it difficult to differentiate them from clean samples.\n\n**Recommendation:** I suggest the authors provide insights into why the proposed method struggles with Filter attacks. Understanding the underlying reasons can help in refining the detection technique or guiding future research to address these challenges.\n\n(3) Overlooked Potential Adaptive Attacks:\n\n**Discussion on Adaptive Attacks:** While the authors discuss potential adaptive attacks against the proposed detection method in the last paragraph of Section 5.4, this discussion could be expanded to include more straightforward alternatives.\n\n**Example with Natural Object Triggers:** For instance, a backdoor could leverage natural objects as triggers [1]. In this scenario, the backdoor behavior would involve natural objects rather than out-of-context triggers. Natural object triggers, while serving as triggers, behave more like clean samples and may exhibit similar patterns under noise intervention, potentially evading detection.\n\n**Recommendation:** I suggest the authors provide a discussion on such scenarios where natural object triggers are used. Exploring how the proposed method fares against these adaptive attacks can offer a more comprehensive evaluation of its robustness.\n\nReference:\n\n[1] Lin, Junyu, et al. \"Composite backdoor attack for deep neural network by mixing existing benign features.\" Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. 2020.", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper studies black-box backdoor detection at inference time. This is the problem where one must detect (and filter out) "backdoor inputs" having access only to input samples and predicted labels. They propose a causal approach to this problem based on the insight that predictions to backdoor samples follow a "spurious path" whereas those for clean samples follow the "causal path". Their black box detection method derived from that insight, aims to distinguish between clean samples and backdoor samples by inspecting the prediction consistency when progressively adding noise. They find empirically that this method can distinguish between clean and backdoor samples for a broad range of attacks. They also provide theoretical analysis.

The reviewers found the paper "well-written" (Reviewer Wr5G, Reviewer 7cR2), "accompanied by clear and intuitive explanations" (Reviewer PhMm); the problem formulation "insightful and innovative" (Reviewer Wr5G); the proposed method "well-motivated" (Reviewer Wr5G), "intuitive and straighforward" (Reviewer 7cR2) and "innovative, effective and efficient " (Reviewer PhMm). The reviewers also found the empirical evaluation "comprehensive", covering basic and more advanced attacks (Reviewer Wr5G), the "effectiveness is great, as shown by the quantitative results compared to other baselines" (Reviewer 7cR2). Reviewer PhMm also recognized the "extensive experiments on a variety of datasets, models, and backdoor attack types, ensuring the method's robustness and generalizability."

Reviewers' concerns regarding missing related work (Reviewer Wr5G, Reviewer 7cR2) have been addressed during the rebuttal; though see the note below in "requested changes".
Other concerns raised relate to other types of trigger patterns that the authors didn't explore (Reviewer 7cR2, Reviewer PhMm), feasibility of causal graph assumptions (Reviewer 7cR2), discussion of limitations and hypotheses for why the proposed approach works less well for some types of attacks, though still outperforming baselines (Reviewer PhMm). The authors have addressed such concerns to the reviewers' satisfaction, by including clarifications of assumptions, running additional experiments, and discussing limitations.

Based on the above, I recommend to accept the paper with a minor requested change, outlined below. I also recommend a featured certification as all reviewers pointed out the innovative perspective of the paper, strong empirical results as well as theoretical analysis. During the rebuttal, the authors addressed various other concerns about more advanced attacks and ran additional experiments.

Requested change:

In Section 2, the authors state: "however, there is limited prior work using causal inference to analyze backdoor attacks during the inference stage. To the best of our knowledge, this paper is the first to provide a causality analysis of backdoor attacks in the inference stage". I think the first of those sentences was added during the rebuttal (after incorporating references suggested by the reviewers) and the second was there from before. Can you please clarify, is this paper indeed the first to do causal analysis of backdoor attacks at the inference stage or is there limited prior work to that? It's okay if this is not the first paper to do so, but in that case please revise claims accordingly for complete accuracy.
Decision: Accept (poster)