This work reveals that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network, and proposes Trapping and Removing (TR), a simple yet effective training-time defense that introduces a lightweight shortcut branch as a "honeypot" to trap backdoor knowledge.
Abstract
Backdoor attacks pose a serious threat to deep neural networks, especially when training relies on third-party data, allowing adversaries to inject malicious behaviors through data poisoning. In this work, we reveal that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network. Motivated by this insight, we propose Trapping and Removing (TR), a simple yet effective training-time defense that introduces a lightweight shortcut branch as a"honeypot"to trap backdoor knowledge. After training, backdoors can be removed by discarding the shortcut, without requiring any additional data. To further enhance backdoor isolation while maintaining benign performance, we design a knowledge decoupling strategy with entropy-based weight assignment, encouraging poisoned samples to flow through the honeypot while guiding the main network to focus on benign learning. In addition, we introduce an automatic shortcut generation strategy to improve generalization across model architectures. Extensive experiments on four benchmark datasets and five model architectures demonstrate that our approach effectively mitigates a wide range of backdoor attacks while preserving performance on benign data. Code: https://github.com/Zixuan-Zhu/TR}{github.com/Zixuan-Zhu/TR.
Backdoor attacks are critical threats to deep neural networks (DNNs). However, most of the studied attacks employ a single type of trigger, as proposed backdoor defenders often rely on the assumption that triggers would appear in a unified manner. In this paper, we show that this naive assumption can create a loophole that allows more sophisticated backdoor attacks to bypass. We design a novel backdoor attack mechanism that incorporates multiple types of backdoor trigger, focusing on stealthiness and effectiveness. Our investigation starts with the intriguing observation that the performance of a backdoor attack in deep learning models, as well as its detectability and removability, are all proportional to the magnitude of the trigger. Based on this correlation, we propose reducing the magnitude of each trigger type and combining them to achieve a strong backdoor relying on the combined trigger while still staying safely under the radar of defenders. Extensive experiments on three standard datasets demonstrate that our method can achieve high attack success rates (ASRs) and can bypass state-of-the-art defenses in a utility-preserving sense: a defense either fails to remove the backdoor or removes it only by severely damaging the clean accuracy (ACC) of the protected model. Thus, reducing ASR by making the model unusable is not considered a successful defense.
Duc Anh Vu, Vuong Quoc Anh Pham, Le Hoang Nguyen et al.· IEEE Access· 0 citations
Deep neural network (DNN) backdoor attacks implant hidden malicious behaviors during model training so that inputs containing a trigger are misclassified to an attacker-specified target. While prior studies have explored pruning as a defense, the impact of conventional compression-oriented pruning, which is primarily used for model size reduction and efficiency, on the effectiveness of existing general backdoor attacks has not been fully examined. We show that many existing attacks are fragile under such pruning. To this end, we propose Mask2Keep (M2K), an attack-enhancement training framework that improves backdoor robustness under compression-oriented pruning by encouraging the model to encode both task- and backdoor-related information into parameters that are less likely to be removed. M2K suppresses pruning-prone parameters and redistributes critical information into more stable ones. M2K consists of three stages: (1) training a base backdoor model and learning a soft mask to estimate parameters likely to be pruned; (2) applying targeted regularization to encourage the redistribution of critical information into preserved parameters; and (3) fine-tuning by freezing likely-to-be-pruned parameters while distilling knowledge into the retained ones. Experiments across multiple attack types, datasets, and pruning strategies show that M2K maintains high attack success rates and competitive clean accuracy after aggressive compression, demonstrating its robustness to compression-oriented pruning.
Jing Shang, Jian Wang, Kailun Wang et al.· Neural Networks· 0 citations
Recent training-time defenses against neural backdoors isolate a benign subset from poisoned training data, to learn a backdoor-free model from it. In this paper, we formulate this defense strategy as a coreset selection problem, giving rise to so-called"Anti-Backdoor Coreset Selection."Since poisonous samples have (a) lower prediction uncertainty and are (b) less frequent than benign samples, coreset selection naturally focuses more on samples associated with benign functionality than the backdoor functionality. We use the Cumulative Entropy as selection criterion to further facilitate this effect. The metric tracks the learning dynamics of training samples and allowing us to select benign samples with high informativeness for the coreset. Additionally, we unlearn the chosen samples in each epoch to facilitate the separability between benign and poisonous samples. Together, this yields an exceptionally effective training-time defense that constructs a benign coreset to train a backdoor-free model. Unlike prior defenses that compromise natural accuracy and fail against certain attacks, our method mitigates backdooring attacks consistently with a negligible impact on natural performance.
Vertical Federated Learning (VFL) allows multiple organizations with disjoint feature spaces and overlapping sample identities to collaboratively train machine learning models while keeping local data. Despite its privacy-preserving design, recent studies have shown that VFL is vulnerable to backdoor attacks. In particular, a malicious passive party can inject a carefully crafted trigger into its local inputs or intermediate embeddings, causing the global model to produce targeted mispredictions at inference time. Existing backdoor attacks in VFL (e.g., BadVFL) rely on the assumption that the malicious client can obtain additional knowledge about task labels, which contradicts the core privacy assumptions of VFL. In this paper, we propose GOFA, a new backdoor attack method for VFL scenarios. GOFA uses the gradient feedback from the server to construct a poisoned dataset and employs an adversarial example attack (e.g., FGSM) for masking the original features of the data to enhance trigger learning. We use the CIFAR-10 and UCI-HAR datasets. Our experiments demonstrate the effectiveness of our method in various settings.
Y. Cheng, Naotoshi Adachi· 2026 6th International Confe...· 0 citations
Attackers can embed malicious behaviors into Deep Learning (DL) models and make these contaminated models publicly available. The malfunction of backdoored models does not raise suspicion unless the attacker activates the malicious behavior by triggering it with an embedded trigger in the input data during inference. Unaware users may integrate these contaminated models into their applications, thereby exposing their systems to adversarial attacks with potentially severe outcomes. In many real-world deep learning applications that rely on publicly available or third-party models, existing backdoor detection methods are often impractical because they typically require access to the original training data, the target model’s internal weights, or the confidence scores of its predictions. This paper introduces a novel real-time backdoor defense framework, the Chessboard Masked AutoEncoder (CBMAE), which can reconstruct images and neutralize hidden triggers at runtime, regardless of access to the model’s architecture, parameters, or soft output. We evaluated our framework on benchmark datasets such as CIFAR-10, GTSRB, and ImageNet-16, showing strong resistance to backdoor attacks. While existing defense methods can significantly reduce attack success rates (ASR), they often do so at the cost of substantial accuracy drops on clean or purified data. In contrast, although our method may not reduce ASR as aggressively as some specialized defenses, it strikes a strong balance by effectively lowering ASR while preserving high accuracy on clean and recovered poisoned data. Our source code is available at https://github.com/hvorya/Backdoor
Seied veria Hoseini, Jaakko Suutala, Juha Partala et al.· IEEE Access· 0 citations
Recent studies have identified vulnerabilities in contrastive vision-language pre-training (CLIP) models to backdoor attacks. Attackers manipulate models to exhibit targeted behaviors upon encountering specific triggers while maintaining normal performance on clean inputs. Existing backdoor attacks on CLIP primarily focus on the pre-training stage or require extensive data for fine-tuning, which limits their practicality in few-shot transfer learning scenarios. In this work, we introduce BadCLIP, a novel backdoor attack that leverages prompt learning to effectively inject malicious behaviors into CLIP models even in data-scarce scenarios. Our BadCLIP operates under two different scenarios. (1) BadCLIP-W assumes white-box access to models and consists of a learnable trigger and a trigger-aware context generator. To optimize performance, we introduce a trigger warm-up strategy during training. (2) BadCLIP-B functions under black-box constraints to models. To enhance attack performance, we first generate a trigger pattern by a black-box optimization process due to the absence of gradient information. Then, we adopt the trigger pattern to poison the training datasets to inject backdoors via prompt learning. Comprehensive experiments demonstrate that BadCLIP-W and BadCLIP-B achieve high attack success rates while maintaining comparable accuracy on clean images.
Kuofeng Gao, Jiawang Bai, Shaobo Min et al.· IEEE Transactions on Pattern...· 0 citations