# Poison as a Cure: Detecting & Neutralizing Variable-Sized Backdoor Attacks in Deep Neural Networks

arXiv: https://arxiv.org/abs/1911.08040 · HTML: https://mlsanity.com/paper/1911.08040/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 Nov 2019.

## Built on by (most cited first, 22 of 22)

- [Backdoor Scanning for Deep Neural Networks through K-Arm Optimization](https://mlsanity.com/paper/2102.05123/) (2021)
- [Black-box Detection of Backdoor Attacks with Limited Information and Data](https://mlsanity.com/paper/2103.13127/) (2021)
- [Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks](https://mlsanity.com/paper/2111.12965/) (2021)
- [ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigms](https://mlsanity.com/paper/2302.11408/) (2023)
- [BEAGLE: Forensics of Deep Learning Backdoor Attack for Better Defense](https://mlsanity.com/paper/2301.06241/) (2023)
- [LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioning](https://mlsanity.com/paper/2403.17188/) (2024)
- [A Survey on AI Sustainability: Emerging Trends on Learning Algorithms and Research Challenges](https://mlsanity.com/paper/2205.03824/) (2022)
- [EX-RAY: Distinguishing Injected Backdoor from Natural Features in Neural Networks by Examining Differential Feature Symmetry](https://mlsanity.com/paper/2103.08820/) (2021)
- [Backdoors Stuck At The Frontdoor: Multi-Agent Backdoor Attacks That Backfire](https://mlsanity.com/paper/2201.12211/) (2022)
- [DECK: Model Hardening for Defending Pervasive Backdoors](https://mlsanity.com/paper/2206.09272/) (2022)
- [Backdoor Learning for NLP: Recent Advances, Challenges, and Future Research Directions](https://mlsanity.com/paper/2302.06801/) (2023)
- [Widen The Backdoor To Let More Attackers In](https://mlsanity.com/paper/2110.04571/) (2021)
- [Adversary Aware Continual Learning](https://mlsanity.com/paper/2304.14483/) (2023)
- [Hiding Behind Backdoors: Self-Obfuscation Against Generative Models](https://mlsanity.com/paper/2201.09774/) (2022)
- [Defense Against Multi-target Trojan Attacks](https://mlsanity.com/paper/2207.03895/) (2022)
- [Does Differential Privacy Prevent Backdoor Attacks in Practice?](https://mlsanity.com/paper/2311.06227/) (2023)
- [Game of Trojans: Adaptive Adversaries Against Output-based Trojaned-Model Detectors](https://mlsanity.com/paper/2402.08695/) (2024)
- [Contributor-Aware Defenses Against Adversarial Backdoor Attacks](https://mlsanity.com/paper/2206.03583/) (2022)
- [Game of Trojans: A Submodular Byzantine Approach](https://mlsanity.com/paper/2207.05937/) (2022)
- [Attack and Defense of Deep Learning Models in the Field of Web Attack Detection](https://mlsanity.com/paper/2406.12605/) (2024)
- [A Survey of Trojan Attacks and Defenses to Deep Neural Networks](https://mlsanity.com/paper/2408.08920/) (2024)
- [Lightweight and Fast Backdoor Model Detection](https://mlsanity.com/paper/2605.18907/) (2026)

## Abstract (arXiv)

Deep learning models have recently shown to be vulnerable to backdoor poisoning, an insidious attack where the victim model predicts clean images correctly but classifies the same images as the target class when a trigger poison pattern is added. This poison pattern can be embedded in the training dataset by the adversary. Existing defenses are effective under certain conditions such as a small size of the poison pattern, knowledge about the ratio of poisoned training samples or when a validated clean dataset is available. Since a defender may not have such prior knowledge or resources, we propose a defense against backdoor poisoning that is effective even when those prerequisites are not met. It is made up of several parts: one to extract a backdoor poison signal, detect poison target and base classes, and filter out poisoned from clean samples with proven guarantees. The final part of our defense involves retraining the poisoned model on a dataset augmented with the extracted poison signal and corrective relabeling of poisoned samples to neutralize the backdoor. Our approach has shown to be effective in defending against backdoor attacks that use both small and large-sized poison patterns on nine different target-base class pairs from the CIFAR10 dataset.