Title: Backdoor Mitigation via Invertible Pruning Masks
Venue: NeurIPS 2025
Accepted: yes
Keywords: backdoor attack

backdoor mitigation

model pruning

adversarial machine learning

machine learning security
Abstract: Model pruning has gained traction as a promising defense strategy against backdoor attacks in deep learning. However, existing pruning-based approaches often fall short in accurately identifying and removing the specific parameters responsible for inducing backdoor behaviors. Despite the dominance of fine-tuning-based defenses in recent literature, largely due to their superior performance, pruning remains a compelling alternative, offering greater interpretability and improved robustness in low-data regimes. In this paper, we propose a novel pruning approach featuring a learned \emph{selection} mechanism to identify parameters critical to both main and backdoor tasks, along with an \emph{invertible} pruning mask designed to simultaneously achieve two complementary goals: eliminating the backdoor task while preserving it through the inverse mask. We formulate this as a bi-level optimization problem that jointly learns selection variables, a sparse invertible mask, and sample-specific backdoor perturbations derived from clean data. The inner problem synthesizes candidate triggers using the inverse mask, while the outer problem refines the mask to suppress backdoor behavior without impairing clean-task accuracy. Extensive experiments demonstrate that our approach outperforms existing pruning-based backdoor mitigation approaches, maintains strong performance under limited data conditions, and achieves competitive results compared to state-of-the-art fine-tuning approaches. Notably, the proposed approach is particularly effective in restoring correct predictions for compromised samples after successful backdoor mitigation.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a novel pruning-based backdoor defense method called Invertible Masking using Selection (IMS). It introduces an invertible pruning mask and a component selection mechanism, formulated within a bi-level optimization framework. Without needing trigger samples, IMS can effectively suppress backdoor behavior while preserving clean accuracy.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n1. The concept of invertible masks is both intuitive and effective. It provides a principled way to distinguish between clean and backdoor components, improving interpretability over existing methods that rely on one-sided heuristics.\n\n2. The method assumes no access to trigger samples and only limited clean data, which is realistic in outsourced training scenarios. It scales well to large datasets (e.g., Tiny-ImageNet, ImageNette) with reasonable computational complexity.\n\n3. IMS consistently achieves lower ASR and RDR than prior pruning defenses (FP, ANP, AWN, etc.), and remains competitive or superior to fine-tuning methods (FT-SAM, SAU).\n\n**Weaknesses**\n1. While the two-level training loop is central to the method, the paper lacks convergence analysis or training stability discussions.\n\n2. The paper highlights computational savings over fine-tuning in text but provides no runtime or resource comparison (e.g., time per epoch, GPU memory). This weakens the case for pruning as a practical alternative.\n\n3. While the proposed method is currently limited to CNNs, the paper should ideally provide at least a high-level discussion on how the key components, particularly the invertible mask and selection mechanism, might be extended to Vision Transformers (ViTs)\n\n4. Although the proposed method achieves low ASR and RDR on average, certain attacks still result in high recovery error. The paper does not analyze these failure cases or provide examples to understand the limits of the defense. Including qualitative or case-by-case analysis of misclassified samples would improve interpretability and guide future improvements.\n\n5. The paper introduces a selection mechanism to avoid over-pruning, but it does not clearly explain how pruning affects the model’s clean accuracy. For example, if stronger pruning removes more backdoor behavior, does it also harm clean predictions? It would be helpful to show how the method balances these two goals, perhaps by plotting how clean accuracy and backdoor removal change as pruning becomes more aggressive.\n\nQUESTIONS:\nSee weaknesses\n\nLIMITATIONS:\nSee weaknesses", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-24"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes *Invertible Masking using Selection* (IMS) for backdoor defense. Specifically, IMS employs an invertible mask and a selection mechanism to distinguish between model components for benign and backdoor tasks. The method formulates a bi-level optimization problem to jointly learn the pruning mask and selection parameter vector derived from clean data. The authors conducted extensive experiments on various datasets, models, and attacks to validate the effectiveness of the IMS.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths\n\n- Overall, the paper is well-written and easy to follow, with clear experimental settings and method formulations.\n- IMS is evaluated across a range of backdoor attacks, datasets, and model architectures. The authors also consider various advanced defense methods, which increase the soundness of the paper.\n- The IMS achieves a promising defense performance when clean data is limited.\n\n## Weaknesses\n\n- The motivation behind *invertible-masks*, i.e., the mask and its inverse, is unclear. For example, in ANP, they use bi-level optimization to ensure both benign performance (a larger mask will result in benign performance degradation) and backdoor mitigation (a smaller inverse mask will lead to ineffective mitigation), which implicitly uses *invertible-masks* in their defense. Thus, why does IMS's design result in improved defense performance compared to ANP/RNP? What if you use the ANP to prune all model parameters, not just the channel? This will validate whether the improvement stems from increasing the mask sizes or the design of the explicit *invertible-masks*.\n- The defense performance appears to be inferior to several existing methods for ASR and ARR (when SPC is greater than 10), such as FT-SAM and SAU (see Fig. 4 in the submission). That being said, can you elaborate on the advantages of IMS over these methods, in which clean data is not as limited? While I acknowledge that practical defenders may access limited clean data, evaluating against the scenario where SPC is 2 or even fewer is not necessary, since most defenses, even the IMS, are not effective in this case (a significant sacrifice in clean accuracy).\n\nQUESTIONS:\n- What is the value of $k$ in the experiments? Does it affect the defense performance?\n- How does the IMS perform against the adaptive attacks? [1] This is to validate whether the IMS is still effective when the benign and backdoor components are less separated.\n- What if there are multiple backdoor targets, such as all-to-all attacks?\n- Other questions are listed in the weaknesses section.\n\n\n[1] Revisiting the assumption of latent separability for backdoor defenses\n\nLIMITATIONS:\nWhile the author has claimed that extending the IMS to ViT-based models requires significant efforts, it is a critical limitation given the fact that the backdoor defense against small (ConvNets) models becomes saturated. In contrast, the fine-tuning approaches are more general.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-24"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a novel model pruning-based strategy for defending against backdoor attacks in deep learning. While model pruning is recognized for its interpretability and robustness—especially valuable in low-data scenarios—existing methods struggle to precisely identify and remove parameters responsible for malicious backdoor behaviors. In contrast, fine-tuning-based defenses have gained popularity due to their effectiveness, but they often lack the same level of interpretability. The authors propose an innovative approach that incorporates two key components: (1) a learned selection mechanism to pinpoint parameters critical to both the main task and the backdoor behavior, and (2) an invertible pruning mask, which serves dual purposes—removing the backdoor while preserving it through its inverse for analysis. Through extensive experiments, the method demonstrates superior performance compared to existing pruning-based defenses and achieves results competitive with state-of-the-art fine-tuning approaches.\n\nSTRENGTHS AND WEAKNESSES:\n### **Strengths**\n\n1. **Effective Backdoor Mitigation**\n   The proposed method outperforms existing pruning-based defenses and achieves performance comparable to state-of-the-art fine-tuning approaches. This makes it a competitive and practical solution for mitigating backdoor behaviors.\n\n2. **Innovative Use of Invertible Pruning Mask**\n   The introduction of an *invertible pruning mask* is a novel contribution. It enables dual functionality—removing backdoor effects while preserving them in an inverse form. This not only enhances defense but also provides interpretability and facilitates analysis of backdoor mechanisms.\n\n3. **Comprehensive and Rigorous Experiments**\n   The paper presents a thorough experimental evaluation across diverse models, datasets, attack types, and poisoning ratios. Notably, the authors run repeated trials and report statistical results using box plots—an important but often overlooked practice in this domain.\n\n---\n\n### **Weaknesses**\n\n1. **Suboptimal Performance Compared to Fine-Tuning**\n   While the method significantly improves over existing pruning-based defenses, its performance still lags behind the best fine-tuning-based approaches (e.g., Figure 4 and Table 3). Nonetheless, I agree with the authors that innovation in pruning remains an important and valuable research direction.\n\n2. **Limited Novelty in Certain Components**\n   Some elements of the method—such as the use of adversarial noise as a trigger surrogate (similar to SAU), the concepts of clean/backdoor neurons (seen in ANP and RNP), and learnable masks (explored in AWN and ANP)—have been discussed in prior work. These similarities somewhat reduce the novelty. However, the proposed selection process, particularly the insight that many neurons are shared between clean and backdoor behaviors, is both original and impactful.\n\n---\n\n### **Overall Evaluation**\n\nThis paper makes a solid and meaningful contribution to pruning-based backdoor defense. Although fine-tuning methods currently lead in performance, the proposed approach advances the field with a well-motivated design and rigorous experimentation. Continued innovation in pruning is essential and deserves recognition.\n\nQUESTIONS:\n1. **Missing Ablation Studies**\n   The proposed method comprises multiple components, including initialization, selection, masking, and perturbation generation. However, the individual contribution and effectiveness of each component are not adequately analyzed through ablation studies.\n\n2. **Unclear Choice of \\$\\lambda\\$**\n   The paper mentions that \\$\\lambda\\$ is initially set to 0 and later increased to 10. However, the rationale behind this choice, the schedule for its adjustment, and its impact on the final performance remain unclear and underexplained.\n\n3. **Scale of \\$\\epsilon\\$**\n   In adversarial perturbation-based methods, the magnitude of the perturbation \\$\\epsilon\\$ is a critical factor. If the trigger exceeds this perturbation scale, its effectiveness cannot be ensured. In this work, \\$\\epsilon\\$ is set to 1, which allows unrestricted modifications to the image. Based on prior experience, such a large value may lead to ill-posed perturbations and result in unrealistic or uninformative adversarial examples.\n\n4. **Unexplored Parameter Choices**\n   Important hyperparameters, such as the number of rounds \\$R\\_1\\$, \\$R\\_2\\$, and \\$R\\_3\\$, are introduced but not analyzed or justified. Their influence on performance should be investigated.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents an improved pruning-based backdoor defense by introducing a dual-optimization framework that simultaneously searches for reverse-engineered triggers and identifies backdoor-related neurons in the model. The method leverages the behavioral differences between trigger and clean inputs to more accurately locate neurons associated with the backdoor. The authors conduct experimental evaluations and demonstrate the effectiveness of their design.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n1. The paper introduces an innovative approach to pruning-based backdoor defense by implementing a three-way classification of neurons (backdoor-related, clean-related, and unselected) and incorporating an invertible mask mechanism.\n \n2. The experimental results demonstrate that the proposed method can effectively remove backdoors compared to  existing pruning-based defenses, while preserving the clean accuracy.\n\n3. The paper provides thorough experimental validation across a wide range of attack methods and compares against multiple defensive approaches.\n\n4. The paper is well-written.\n\nWeaknesses\n\n1. The method incorporates multiple loss terms (particularly in Equation 7), but lacks ablation studies to demonstrate the individual contribution and necessity of each term. The authors should consider adding more ablation studies.\n\n2. The data visualization in key figures (e.g., Figures 3 and 5) suffers from small graph sizes, making it challenging to accurately interpret the results.\n\nQUESTIONS:\n1. Could the authors provide detailed ablation experiments for each loss term in Equation 7? \n2. There appears to be an inconsistency in notation in Equation 7 and line 224, where \\tilde{p}_{\\mathcal{A}'} should likely be \\hat{p}_{\\mathcal{A}'} based on the context. Could the authors clarify and correct this notation?\n3. Could the authors provide clearer visualizations for Figures 3 and 5?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}