Pith. sign in

REVIEW 3 major objections 5 minor 46 references

Revisiting the Auxiliary Data in Backdoor Purification

T0 review · 3 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that the type of auxiliary data used to purify backdoored models is decisive, and that a victim-model-guided learnable transformation called GIC can calibrate imperfect, out-of-distribution auxiliary data so that six…

desk verdict Useful empirical study of auxiliary data in backdoor purification with a simple calibration method that helps ACC but often raises ASR; the theory is weak but the empirical contribution warrants review. read the letter →

arxiv 2502.07231 v1 pith:YCCJUFSD submitted 2025-02-11 cs.CR

Shaokui Wei , Shanchao Yang , Jiayin Liu , Hongyuan Zha This is my paper · ORCID
classification cs.CR
keywords backdoorattackspurificationauxiliarydatasetGuidedInputCalibrationout-of-distributiondatalearnableperturbationfine-tuningdefensesmodelsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Backdoor purification methods assume a small clean auxiliary dataset, but real auxiliary data is often imperfect: out-of-distribution, synthetic, or shifted samples degrade defenses. The paper first shows that the type of auxiliary data matters: in-distribution data preserves accuracy, while OOD data helps forget backdoors but harms utility. To fix this, the paper proposes Guided Input Calibration (GIC), a learnable transformation that adjusts auxiliary images so that the victim model classifies them with high confidence, pulling their features toward the training distribution. Across six purification methods and several attacks, GIC consistently improves clean accuracy, with the largest gains on external datasets. The paper argues this makes backdoor purification practical when ideal auxiliary data is unavailable.

What carries the argument

The central mechanism is Guided Input Calibration (GIC), a learned input transformation $g(x)=x+\epsilon$ with sample-specific perturbation $\epsilon$, optimized to minimize the victim model's classification loss on the auxiliary dataset subject to an $\ell_\infty$ bound $\delta=0.1$. The victim model itself supplies the supervision: because it was trained to classify clean data correctly, pushing auxiliary inputs toward high-confidence correct predictions should move their feature representations toward those of training samples. Theorem 4.1 makes this precise for a binary linear-probe model: with bounded feature norm $M$, if a calibrated input and a training sample share prediction confidence $p$, their feature distance is at most $4M^2 - \frac{4}{\|W\|^2}\left(\log\frac{1-p}{p}\right)^2$, so higher confidence implies tighter alignment. The perturbation form is simple, but the paper notes $g$ can also be a visual prompt or a spatial transformation.

What would settle it

Apply GIC to a victim model with a known trigger, using an auxiliary set that contains both clean and triggered images, and sweep the perturbation bound from 0 to 0.2; if the calibrated triggered images move toward the attacker's target class as the bound grows, or if the purified model's attack success rate rises with the bound, GIC is reinforcing backdoor features rather than clean ones.

Watch

Extended reading notes

Core claim

On its own terms, the paper's discovery is that the degradation caused by imperfect auxiliary data in backdoor purification is not inevitable: a transformation guided by the victim model's own predictions can realign out-of-distribution auxiliary samples with the model's learned representations. Ordered by their effect, seen in-distribution data preserves utility but may not erase the backdoor, unseen OOD data helps erase the backdoor but can destroy utility, and GIC splits the difference by minimizing classification loss on the auxiliary set under a small perturbation bound. The paper reports consistent ACC gains for ANP, NPD, FT, FT-SAM, FST, and SAU, including gains of +8.64 points for FT and +7.33 for FT-SAM on the external dataset, with ASR changes that vary in sign. A theorem bounds the feature distance between a calibrated auxiliary sample and a training sample with the same prediction confidence, formalizing why high-confidence alignment should keep transformed data near the training distribution.

Load-bearing premise

The load-bearing premise is that the victim model's confident predictions are a trustworthy map onto clean training data even though the model is backdoored; the theory also assumes, without proof, that training samples are the model's most confident predictions.

Editorial extensions

If this is right

  • For defenders with only out-of-distribution or synthetic auxiliary data, GIC recovers most of the clean accuracy that would be lost, with external-dataset gains up to +8.64 points for fine-tuning and +7.33 for FT-SAM.
  • Because GIC improves every tested defense method (ANP, NPD, FT, FT-SAM, FST, SAU), it can be stacked onto an existing purification pipeline without changing the downstream defense.
  • The benefit transfers across attack types, including BadNets, Blended, Input-Aware, SIG, LF, and WaNet, and across datasets such as GTSRB and Tiny ImageNet, not just CIFAR-10.
  • The remaining ASR changes are mixed in sign; defenders who care about worst-case attack success need to re-tune the perturbation bound rather than assume GIC always lowers ASR.
  • Feature-space analysis with t-SNE shows that after GIC, external auxiliary data closely overlaps the seen data representations, which is the concrete mechanism behind the accuracy recovery.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct extension would be to use GIC inside data-free or one-shot purification: if the calibration can make 5% auxiliary data behave like curated in-distribution data, it may also reduce the minimum data needed, a question the paper leaves open.
  • The same calibration objective could be applied to other model-editing tasks that suffer from distribution shift, such as machine unlearning or continual learning, though the paper only evaluates backdoor purification.
  • A cheap control experiment would replace the victim-model-guided perturbation with random noise of the same $\ell_\infty$ norm; if random noise matches GIC's ACC gains, then the alignment signal is not the active ingredient.
  • Because GIC trusts the victim model's confident predictions, its safety may depend on the attack type: testing it against attacks with very subtle triggers that preserve high confidence on poisoned inputs would reveal whether calibration can silently reinforce the backdoor.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This manuscript studies how the choice and quality of the auxiliary dataset affect post-training backdoor purification, and proposes Guided Input Calibration (GIC), a learnable transformation g(x)=x+ε that perturbs auxiliary inputs under an L∞ budget of 0.1 to minimize the victim model's classification loss on those inputs. The authors categorize auxiliary data into seen, unseen in-distribution, and out-of-distribution types; evaluate ANP, NPD, FT, FT-SAM, FST, and SAU on CIFAR-10, GTSRB, and Tiny ImageNet under several backdoor attacks; and report that GIC improves clean accuracy (ACC) for all six defenses on BadNets, with the largest gains on external datasets. They also present Theorem 4.1, a feature-distance bound for a binary linear-head model, intended to justify that GIC keeps transformed features close to training-sample features. The paper concludes that GIC substantially enhances purification performance across diverse auxiliary datasets.

Significance. GIC is simple and practically appealing: it is a wrapper around existing defenses, requires no clean reference data, and the empirical comparison spans multiple attacks, defenses, and auxiliary-data types on a standardized platform, BackdoorBench. The auxiliary-data taxonomy and the honest reporting of raw ACC/ASR numbers are useful contributions to the backdoor-defense community. However, the central claim is only partially supported: ACC gains are consistent, but ASR increases in many configurations, and the theoretical justification (Theorem 4.1) is not valid in the high-confidence regime that GIC actively targets. If the ASR tradeoff can be properly characterized and the theory repaired or removed, GIC would be a useful incremental contribution; in its current form, the paper overstates the security benefit.

major comments (3)
  1. [Section 4.2, Table 2; Abstract] The claim that GIC 'substantially enhance[s] purification performance' is not supported by Table 2 alone, because GIC increases ASR in 11 of 18 defense-dataset rows, with large relative jumps in several cases (e.g., FST Brightness 0.53→1.52, FT-SAM External 0.80→1.31, FST External 0.29→1.02). The text acknowledges only 'variations' in ASR and explains them as a tradeoff, but a defense method that improves ACC while re-enabling a nontrivial fraction of attacks has not unequivocally improved purification. The authors should either report a combined utility-security criterion, impose a safety constraint on ASR, or empirically bound the residual backdoor effectiveness before making the broad claim in the abstract.
  2. [Section 4.1, Theorem 4.1] Theorem 4.1 does not currently support the paper's conclusion. As p→1, log((1-p)/p)→-∞, so the right-hand side of the stated inequality becomes negative; the bound is vacuous exactly in the high-confidence regime that GIC's objective drives toward. Additionally, the premise that 'training samples are the most confident predictions of f after training' is asserted without proof and is questionable for backdoored models, whose trigger-carrying inputs are often engineered to produce maximal confidence. The theorem therefore does not establish that GIC aligns auxiliary data with the clean training distribution rather than with backdoor-related features.
  3. [Section 4.1, Eq. (1); Section 4.2] The key empirical counter-check to the concern that GIC may pull auxiliary data toward backdoor features is deferred to an appendix that is not present in the submitted manuscript: the text states, 'We empirically demonstrate in the Appendix that the transformed images do not exhibit characteristics of poisoned data, even for attacks with minor image modifications.' Because the victim model itself is compromised and Table 2 shows ASR increases, this is a load-bearing claim. The authors should include the appendix or, preferably, an in-main-text experiment that compares the feature-space proximity of GIC-transformed auxiliary samples to clean versus poisoned target-class prototypes, and that reports the ASR of the victim on GIC-transformed inputs.
minor comments (5)
  1. [Section 4.2, Experiment settings] The text says the perturbations are optimized using 'the objective defined in Equation 2', but Equation 2 is the BCE training loss for the victim model; the GIC objective is Equation (1). This makes the experimental setup ambiguous and should be corrected.
  2. [Section 3.2, Finding 2] There is a duplicated phrase: 'such as those introduced by unseen data, can aid in backdoor purification can aid backdoor purification.' Please rephrase.
  3. [References [34] and [35]] References [34] and [35] are the same paper ('Backdoor mitigation by distance-driven detoxification'). They should be merged into a single citation.
  4. [Tables 2, 3, and 4] The paper states that each experiment is run five times and that error bars are reported in Figure 1, but Tables 2, 3, and 4 report single ACC/ASR values without error bars. At minimum, the authors should indicate which ACC improvements are outside the error bars or provide a statistical significance test.
  5. [Figure 3] The t-SNE visualization is suggestive but not quantitative. A quantitative feature-distance or distribution-overlap measure between transformed auxiliary data and seen data would strengthen the claim that GIC achieves alignment.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: GIC is an empirical preprocessing method evaluated on held-out attacks and defenses; its theoretical bound is weak but not an input-to-output reduction.

full rationale

The central claim is that a learnable perturbation g, optimized by Eq. (1) against the victim model f, improves downstream backdoor purification. This is not circular: the transformation is fit to auxiliary data, and the claimed benefit is measured by ACC/ASR on held-out test sets after running external defenses (ANP, NPD, FT, FT-SAM, FST, SAU) with and without GIC. No reported quantity is a fitted parameter renamed as a prediction; the evaluation is against external benchmarks and attack/defense methods. Self-citations (BackdoorBench, SAU, FT-SAM, NPD, distance-driven detoxification) provide context and baselines but do not carry the derivation. Theorem 4.1 is a correctness risk rather than a circular step: the stated bound can become negative for high-confidence p, and the premise that training samples are the most confident predictions is asserted without proof and may fail for poisoned target-class samples, so the 'clean distribution alignment' claim is not established. The paper also defers to an appendix the needed check that transformed images are not poisoned-like, and Table 2 shows ASR increases in many rows. These are rigor/validity concerns, not instances of the paper's conclusions being equivalent to its inputs by construction.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper's central result relies on several unproved simplifications: the bounded feature norm assumption, the binary linear model for theory, the oracle 'seen' dataset, and the assumption that the victim's confidence guides alignment. The method's hyperparameters (delta, learning rate, steps) are hand-chosen. No new entities are postulated.

free parameters (3)
  • delta (L_inf bound for perturbation) = 0.1
    Chosen by hand to keep calibrated inputs close to originals; directly controls GIC's transformation strength (Section 4.2).
  • perturbation learning rate = 0.1
    Adam learning rate used to optimize the per-sample perturbation epsilon (Section 4.2).
  • perturbation optimization steps = 100
    Number of gradient steps used to learn each sample's perturbation (Section 4.2).
assumptions (5)
  • standard math Feature norms are bounded by M = max_x ||phi(x)||
    Used in Theorem 4.1 to bound feature distances; reasonable for neural networks with normalization layers (Section 4.1).
  • domain assumption The victim model is a binary classifier with a linear head trained with BCE (Equation 2)
    The theoretical analysis is restricted to a simplified binary linear-head model and does not cover the actual multi-class CNNs used in experiments (Section 4.1).
  • ad hoc to paper Training samples achieve the highest prediction confidence, so matching confidence identifies a close training sample
    Motivates why minimizing CE on auxiliary data pulls features toward training data; stated informally without proof (Section 4.1).
  • ad hoc to paper The 'seen' auxiliary dataset assumes perfect knowledge of poisoning labels (oracle)
    Used to construct Dseen and claim an upper bound on purification performance; not realistic in practice (Section 3.2).
  • domain assumption Defender has no knowledge of the trigger or target label
    Standard threat model for backdoor purification (Section 3.1).

how reviews work

0 comments
Cite this review

Pith. "Pith review of Revisiting the Auxiliary Data in Backdoor Purification." pith.science (2026). https://pith.science/paper/YCCJUFSD

@misc{pith2026250207231,
  author       = {Pith},
  title        = {Pith review of: Revisiting the Auxiliary Data in Backdoor Purification},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YCCJUFSD}},
  note         = {Machine review of arXiv:2502.07231}
}
read the original abstract

Backdoor attacks occur when an attacker subtly manipulates machine learning models during the training phase, leading to unintended behaviors when specific triggers are present. To mitigate such emerging threats, a prevalent strategy is to cleanse the victim models by various backdoor purification techniques. Despite notable achievements, current state-of-the-art (SOTA) backdoor purification techniques usually rely on the availability of a small clean dataset, often referred to as auxiliary dataset. However, acquiring an ideal auxiliary dataset poses significant challenges in real-world applications. This study begins by assessing the SOTA backdoor purification techniques across different types of real-world auxiliary datasets. Our findings indicate that the purification effectiveness fluctuates significantly depending on the type of auxiliary dataset used. Specifically, a high-quality in-distribution auxiliary dataset is essential for effective purification, whereas datasets from varied or out-of-distribution sources significantly degrade the defensive performance. Based on this, we propose Guided Input Calibration (GIC), which aims to improve purification efficacy by employing a learnable transformation. Guided by the victim model itself, GIC aligns the characteristics of the auxiliary dataset with those of the original training set. Comprehensive experiments demonstrate that GIC can substantially enhance purification performance across diverse types of auxiliary datasets. The code and data will be available via https://github.com/shawkui/BackdoorBenchER.

Figures

Figures reproduced from arXiv: 2502.07231 by the authors.

Figure 1
Figure 1. Performance of backdoor purification techniques equipped with different types of auxiliary [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. t-SNE visualization of features from different auxiliary datasets. In each plot, points [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. T-SNE visualization of feature representations for the external dataset, showing the [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 36 canonical work pages

  1. [1]

    Past, present, and future of face recognition: A review

    Insaf Adjabi, Abdeldjalil Ouahabi, Amir Benzaoui, and Abdelmalik Taleb-Ahmed. Past, present, and future of face recognition: A review. Electronics, page 1188, 2020

    work page 2020

  2. [2]

    Exploring visual prompts for adapting large-scale models

    Hyojin Bahng, Ali Jahanian, Swami Sankaranarayanan, and Phillip Isola. Exploring visual prompts for adapting large-scale models. arXiv preprint arXiv:2203.17274, 2022

    arXiv 2022

  3. [3]

    A new backdoor attack in cnns by training set corruption without label poisoning

    Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In International Conference on Image Processing, 2019

    work page 2019

  4. [4]

    Large scale gan training for high fidelity natural image synthesis

    Andrew Brock. Large scale gan training for high fidelity natural image synthesis. arXiv preprint arXiv:1809.11096, 2018

    arXiv 2018

  5. [5]

    One-shot neural backdoor erasing via adversarial weight masking

    Shuwen Chai and Jinghui Chen. One-shot neural backdoor erasing via adversarial weight masking. In Conference on Neural Information Processing Systems, 2022

    work page 2022

  6. [6]

    Detecting backdoor attacks on deep neural networks by activation clustering

    Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. In Workshop on Artificial Intelligence Safety, 2019

    work page 2019

  7. [7]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv e-prints, pages arXiv–1712, 2017

    work page 2017

  8. [8]

    Cinic-10 is not imagenet or cifar-10

    Luke N Darlow, Elliot J Crowley, Antreas Antoniou, and Amos J Storkey. Cinic-10 is not imagenet or cifar-10. arXiv preprint arXiv:1810.03505, 2018

    arXiv 2018

Show all 46 references
  1. [9]

    Countering backdoor attacks in image recognition: A survey and evaluation of mitigation strategies

    Kealan Dunnett, Reza Arablouei, Dimity Miller, V olkan Dedeoglu, and Raja Jurdak. Countering backdoor attacks in image recognition: A survey and evaluation of mitigation strategies. arXiv preprint arXiv:2411.11200, 2024

    2024 arXiv

  2. [10]

    Badnets: Evaluating backdooring attacks on deep neural networks

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, pages 47230–47244, 2019

    2019

  3. [11]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Conference on Computer Vision and Pattern Recognition, 2016

    2016

  4. [12]

    Identity mappings in deep residual networks

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In European Conference on Computer Vision, 2016

    2016

  5. [13]

    Denoising diffusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33:6840–6851, 2020

    2020

  6. [14]

    Revisiting data- free knowledge distillation with poisoned teachers

    Junyuan Hong, Yi Zeng, Shuyang Yu, Lingjuan Lyu, Ruoxi Jia, and Jiayu Zhou. Revisiting data- free knowledge distillation with poisoned teachers. In International Conference on Machine Learning, pages 13199–13212. PMLR, 2023

    2023

  7. [15]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009

    2009

  8. [16]

    Tiny imagenet visual recognition challenge

    Ya Le and Xuan Yang. Tiny imagenet visual recognition challenge. CS 231N, 2015

    2015

  9. [17]

    Neural attention distillation: Erasing backdoor triggers from deep neural networks

    Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. In International Conference on Learning Representations, 2021

    2021

  10. [18]

    Reconstructive neuron pruning for backdoor defense

    Yige Li, Xixiang Lyu, Xingjun Ma, Nodens Koren, Lingjuan Lyu, Bo Li, and Yu-Gang Jiang. Reconstructive neuron pruning for backdoor defense. In International Conference on Machine Learning, 2023

    2023

  11. [19]

    Invisible backdoor attack with sample-specific triggers

    Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu. Invisible backdoor attack with sample-specific triggers. In International Conference on Computer Vision, 2021

    2021

  12. [20]

    Fusing pruned and backdoored models: Optimal transport-based data-free backdoor mitigation

    Weilin Lin, Li Liu, Jianze Li, and Hui Xiong. Fusing pruned and backdoored models: Optimal transport-based data-free backdoor mitigation. arXiv preprint arXiv:2408.15861, 2024. 11

    2024 arXiv

  13. [21]

    Fine-pruning: Defending against backdooring attacks on deep neural networks

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine-pruning: Defending against backdooring attacks on deep neural networks. In Research in Attacks, Intrusions, and Defenses, 2018

    2018

  14. [22]

    Computing systems for autonomous driving: State of the art and challenges

    Liangkai Liu, Sidi Lu, Ren Zhong, Baofu Wu, Yongtao Yao, Qingyang Zhang, and Weisong Shi. Computing systems for autonomous driving: State of the art and challenges. IEEE Internet of Things Journal, pages 6469–6486, 2020

    2020

  15. [23]

    Towards stable backdoor purification through feature shift tuning

    Rui Min, Zeyu Qin, Li Shen, and Minhao Cheng. Towards stable backdoor purification through feature shift tuning. arXiv preprint arXiv:2310.01875, 2023

    2023 arXiv

  16. [24]

    Input-aware dynamic backdoor attack

    Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. In Conference on Neural Information Processing Systems, 2020

    2020

  17. [25]

    Wanet - imperceptible warping-based backdoor attack

    Tuan Anh Nguyen and Anh Tuan Tran. Wanet - imperceptible warping-based backdoor attack. In International Conference on Learning Representations, 2021

    2021

  18. [26]

    Imagenet large scale visual recognition challenge

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115:211–252, 2015

    2015

  19. [27]

    Poison frogs! targeted clean-label poisoning attacks on neural networks

    Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Du- mitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. In Conference on Neural Information Processing Systems, 2018

    2018

  20. [28]

    Very deep convolutional networks for large-scale image recognition

    Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations, 2015

    2015

  21. [29]

    Deep perturbation learning: enhanc- ing the network performance via image perturbations

    Zifan Song, Xiao Gong, Guosheng Hu, and Cairong Zhao. Deep perturbation learning: enhanc- ing the network performance via image perturbations. In International Conference on Machine Learning, pages 32273–32287. PMLR, 2023

    2023

  22. [30]

    The german traffic sign recognition benchmark: a multi-class classification competition

    Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. The german traffic sign recognition benchmark: a multi-class classification competition. In International Joint Conference on Neural Networks, 2011

    2011

  23. [31]

    Mrtrix3: A fast, flexible and open software framework for medical image processing and visualisation

    J-Donald Tournier, Robert Smith, David Raffelt, Rami Tabbara, Thijs Dhollander, Maximilian Pietsch, Daan Christiaens, Ben Jeurissen, Chun-Hung Yeh, and Alan Connelly. Mrtrix3: A fast, flexible and open software framework for medical image processing and visualisation. Neuroima...

    2019

  24. [32]

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks

    Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Symposium on Security and Privacy, 2019

    2019

  25. [33]

    Shared adversarial unlearn- ing: Backdoor mitigation by unlearning shared adversarial examples

    Shaokui Wei, Mingda Zhang, Hongyuan Zha, and Baoyuan Wu. Shared adversarial unlearn- ing: Backdoor mitigation by unlearning shared adversarial examples. In Advances in Neural Information Processing Systems, 2023

    2023

  26. [35]

    Backdoor mitigation by distance-driven detoxifi- cation

    Shaokui Wei, Jiayin Liu, and Hongyuan Zha. Backdoor mitigation by distance-driven detoxifi- cation. arXiv preprint arXiv:2411.09585, 2024

    2024 arXiv

  27. [36]

    Backdoorbench: A comprehensive benchmark of backdoor learning

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. Backdoorbench: A comprehensive benchmark of backdoor learning. In Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2022

    2022

  28. [37]

    Defenses in adversarial machine learning: A survey

    Baoyuan Wu, Shaokui Wei, Mingli Zhu, Meixi Zheng, Zihao Zhu, Mingda Zhang, Hongrui Chen, Danni Yuan, Li Liu, and Qingshan Liu. Defenses in adversarial machine learning: A survey. arXiv e-prints, 2023. 12

    2023

  29. [38]

    Backdoorbench: A comprehensive benchmark and analysis of backdoor learning

    Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, Mingli Zhu, Ruotong Wang, Li Liu, and Chao Shen. Backdoorbench: A comprehensive benchmark and analysis of backdoor learning. arXiv e-prints, 2024

    2024

  30. [39]

    Adversarial neuron pruning purifies backdoored deep models

    Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models. In Conference on Neural Information Processing Systems, 2021

    2021

  31. [40]

    Spatially transformed adversarial examples

    Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially transformed adversarial examples. In International Conference on Learning Representations, 2018

    2018

  32. [41]

    Morley Mao, and Ruoxi Jia

    Yi Zeng, Won Park, Z. Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks’ triggers: A frequency perspective. In International Conference on Computer Vision, 2021

    2021

  33. [42]

    Adversarial unlearning of backdoors via implicit hypergradient

    Yi Zeng, Si Chen, Won Park, Zhuoqing Mao, Ming Jin, and Ruoxi Jia. Adversarial unlearning of backdoors via implicit hypergradient. In International Conference on Learning Representations, 2022

    2022

  34. [43]

    How to sift out a clean data subset in the presence of data poisoning? arXiv preprint arXiv:2210.06516, 2022

    Yi Zeng, Minzhou Pan, Himanshu Jahagirdar, Ming Jin, Lingjuan Lyu, and Ruoxi Jia. How to sift out a clean data subset in the presence of data poisoning? arXiv preprint arXiv:2210.06516, 2022

    2022 arXiv

  35. [44]

    Data-free backdoor removal based on channel lipschitzness

    Runkai Zheng, Rongjun Tang, Jianze Li, and Li Liu. Data-free backdoor removal based on channel lipschitzness. In European Conference on Computer Vision, 2022

    2022

  36. [45]

    Enhancing fine-tuning based backdoor defense with sharpness-aware minimization

    Mingli Zhu, Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In International Conference on Computer Vision, 2023

    2023

  37. [46]

    Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features

    Mingli Zhu, Shaokui Wei, Hongyuan Zha, and Baoyuan Wu. Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features. In Advances in Neural Information Processing Systems, 2023

    2023

  38. [47]

    Vdc: Versatile data cleanser for detecting dirty samples via visual-linguistic inconsistency

    Zihao Zhu, Mingda Zhang, Shaokui Wei, Bingzhe Wu, and Baoyuan Wu. Vdc: Versatile data cleanser for detecting dirty samples via visual-linguistic inconsistency. In International Conference on Learning Representations, 2024. 13

    2024

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.