ICML 2025

Circumventing Backdoor Space via Weight Symmetry
Jie Peng 1 Hongwei Yang 1 Jing Zhao 1 Hengji Dong 1 Hui He 1 Weizhe Zhang 1 2 Haoyu He 3
Abstract
Deep neural networks are vulnerable to backdoor
attacks, where malicious behaviors are implanted
during training. While existing defenses can effec-
tively purify compromised models, they typically
require labeled data or speciﬁc training proce-
dures, making them difﬁcult to apply beyond su-
pervised learning settings. Notably, recent studies
have shown successful backdoor attacks across
various learning paradigms, highlighting a crit-
ical security concern. To address this gap, we
propose Two-stage Symmetry Connectivity (TSC),
a novel backdoor puriﬁcation defense that oper-
ates independently of data format and requires
only a small fraction of clean samples. Through
theoretical analysis, we prove that by leverag-
ing permutation invariance in neural networks
and quadratic mode connectivity, TSC ampliﬁes
the loss on poisoned samples while maintaining
bounded clean accuracy. Experiments demon-
strate that TSC achieves robust performance com-
parable to state-of-the-art methods in supervised
learning scenarios. Furthermore, TSC generalizes
to self-supervised learning frameworks, such as
SimCLR and CLIP, maintaining its strong defense
capabilities. Our code is available at https:
//github.com/JiePeng104/TSC.
1. Introduction
Modern classiﬁers require substantial data and computa-
tional resources to achieve high accuracy, providing adver-
saries with opportunities to implant backdoors into deep
neural networks (Gu et al., 2017; Chen et al., 2017). This
vulnerability arises from either injecting poisoned data (Gu
et al., 2017; Turner et al., 2019) (i.e., data-poisoning attack),
or manipulating the training process (Pang et al., 2019;
1School of Cyberspace Science, Harbin Institute of Technol-
ogy, Harbin, China.
2Pengcheng Laboratory, Shenzhen, China.
3Department of Data Science and AI, Faculty of IT, Monash
University, Melb...