Mask2Keep: Mask-guided information transfer for backdoors resilient to compression-oriented pruning.

Abstract

Deep neural network (DNN) backdoor attacks implant hidden malicious behaviors during model training so that inputs containing a trigger are misclassified to an attacker-specified target. While prior studies have explored pruning as a defense, the impact of conventional compression-oriented pruning, which is primarily used for model size reduction and efficiency, on the effectiveness of existing general backdoor attacks has not been fully examined. We show that many existing attacks are fragile under such pruning. To this end, we propose Mask2Keep (M2K), an attack-enhancement training framework that improves backdoor robustness under compression-oriented pruning by encouraging the model to encode both task- and backdoor-related information into parameters that are less likely to be removed. M2K suppresses pruning-prone parameters and redistributes critical information into more stable ones. M2K consists of three stages: (1) training a base backdoor model and learning a soft mask to estimate parameters likely to be pruned; (2) applying targeted regularization to encourage the redistribution of critical information into preserved parameters; and (3) fine-tuning by freezing likely-to-be-pruned parameters while distilling knowledge into the retained ones. Experiments across multiple attack types, datasets, and pruning strategies show that M2K maintains high attack success rates and competitive clean accuracy after aggressive compression, demonstrating its robustness to compression-oriented pruning.