B ad W indtunnel: Defending Backdoor in High-noise Simulated Training with Confidence Variance (2025)

Abstract: Current backdoor attack defenders in Natural Language Processing (NLP) typically involve data reduction or model pruning, risking losing crucial information. To address this challenge, we introduce a novel backdoor defender, i.e., BadWindtunnel, in which we build a high-noise simulated training environment, similar to the wind tunnel, which allows precise control over training conditions to model the backdoor learning behavior without affecting the final model. We also use the confidence variance as a learning behavior quantification metric in the simulated training, which is based on the characteristics of backdoor-poisoned data (shorted in poisoned data): higher learnability and robustness. In addition, we propose a two-step strategy to further model poisoned data, including target label identification and poisoned data revealing. Extensive experiments demonstrate BadWindtunnel’s superiority, with a 21% higher average reduction in attack success rate than the second-best defender.

## introduction backdoor attacks are a significant security risk in nlp. these attacks manipulate a victim model that has good performance on clean data but always predicts the target label on poisoned data, which is applied with a specific trigger pattern. triggers in nlp are categorized into four types: word, sentence, style, and syntax. word and sentence triggers often involve inserting rare words or short sentences into the original text @xcite @xcite . style and syntactic triggers modify the text to match predefined styles or syntax @xcite . these triggers have more implicit characteristics, allowing for a natural backdoor injection while preserving semantics. this semantic invariance makes such attacks particularly challenging to defend against. as shown in figure 1 , current research mitigates backdoor attacks by reducing backdoor-related information from the data or model perspectives. as shown in figure 1a , data reduction methods identify the statistical traits of poisoned data, such as spurious correlations with the target label, to eliminate poisoned data or remove embedded triggers @xcite @xcite . however, these methods do not fully exploit the eliminated data and struggle with removing semantic-invariant attacks. in addition, residual poisoned data can still lead to a high attack success rate @xcite , making this approach insufficient for an effective defense. as shown in figure 1b , model pruning methods learn the differences in neuron activation between clean and poisoned data, enabling model pruning @xcite @xcite . however, neurons often carry mixed information from both clean and poisoned data. pruning may inadvertently eliminate some clean information, leading to a potential decline in overall model performance. to overcome the above limitations, we propose an effective backdoor defense method, i.e., backdoor defender in wind tunnel (dubbed badwindtunnel), that avoids data and model reductions, as shown in figure 1c . in our method, we create a simulated training scheme, similar to a wind tunnel, to reveal poisoned data for real training. the simulated training does not affect the final model and allows precise control over training conditions to better model the learning behavior of poisoned data. the learning behavior during simulated training can be used to reveal poisoned data, guiding the gradient descent direction and rate in real training. thus, badwindtunnel manages backdoor attacks without reduction to data or pruning of the model, preserving all detailed information. specifically, in badwindtunnel, we propose to use confidence variance instead of normal-used loss to quantify learning behavior in simulated training. the confidence variance indicates shifts in confidence throughout a training epoch, representing the model's learning speed, with poisoned data exhibiting higher values due to its greater learnability @xcite @xcite . in addition, we control the noise rate in the simulated training to amplify the difference in confidence variance between the clean and poisoned data. given the high robustness of poisoned data @xcite @xcite , its learnability remains stable at the same noise level, making the confidence variance more distinguishable. to further reveal poisoned data, we propose a two-step strategy, including target label identification and poisoned data revealing. the strategy ensures that the confidence variance distribution is unaffected by semantic category, focusing solely on whether the data is poisoned. the main contributions are as follows: extensive experiments show that: (1) our method effectively defends against the backdoor, achieving an average 21% lower attack success rate than the second-best defender and maintaining stable clean accuracy. (2) a comprehensive ablation study validates and visualizes the effectiveness of the simulated training, confidence variance, twostep strategy, and other key designs. high robustness. backdoor's high robustness is a key trick in its defenses. due to the strong correlation between trigger and target label, backdoors are less affected by noise. studies show that noisy poisoned data can still lead to stable outputs @xcite @xcite , and noisy backdoored models also maintain consistent outputs for poisoned data @xcite . even after random label scrambling and retraining, backdoor models retain the trigger-target label association @xcite . in our work, we leverage this robustness by creating a high-noise simulated training environment to amplify the learnability differences, enhancing defense effectiveness. ## conclusion this paper introduces badwindtunnel, a novel defense scheme for backdoor attacks in nlp. it builds a high-noise simulated training environment to reveal poisoned data without data reduction or model pruning. precisely, we quantify the high learnability of poisoned data using confidence variance and model it with the gmm in a two-step strategy. the poison-revealing data guides the gradient descent direction and rate during the defensive real training. experimental results show that badwindtunnel reduces the attack success rate by an additional 21% compared to the second-best defender on average and demonstrates robustness. ablation and visualization experiments further validate the effectiveness of our key designs.