mlsanityData to 13 Oct 2026

Adversarial Unlearning of Backdoors via Implicit Hypergradient

arXiv 2110.03735 ↗First posted 7 Oct 2021cs.LG cs.CR cs.CVcited by 164

Not on the map. Why?

Cited by 54 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We propose a minimax formulation for removing backdoors from a given poisoned model based on a small set of clean data. This formulation encompasses much of prior work on backdoor removal. We propose the Implicit Bacdoor Adversarial Unlearning (I-BAU) algorithm to solve the minimax. Unlike previous work, which breaks down the minimax into separate inner and outer problems, our algorithm utilizes the implicit hypergradient to account for the interdependence between inner and outer optimization. We theoretically analyze its convergence and the generalizability of the robustness gained by solving minimax on clean data to unseen test data. In our evaluation, we compare I-BAU with six state-of-art backdoor defenses on seven backdoor attacks over two datasets and various attack settings, including the common setting where the attacker targets one class as well as important but underexplored settings where multiple classes are targeted. I-BAU's performance is comparable to and most often significantly better than the best baseline. Particularly, its performance is more robust to the variation on triggers, attack settings, poison ratio, and clean data size. Moreover, I-BAU requires less computation to take effect; particularly, it is more than 13× faster than the most efficient baseline in the single-target attack setting. Furthermore, it can remain effective in the extreme case where the defender can only access 100 clean samples -- a setting where all the baselines fail to produce acceptable results.

Key facts. Cited by 164 papers in the map (data through 13 Oct 2026). Builds on 38 of its 56 references that are in the map. First posted on arXiv 7 Oct 2021.

Builds on

38 of 56 references.

References · 38

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,223
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,321
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,379
  4. 2017Understanding Black-box Predictions via Influence Functionscited by 1,729
  5. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,099
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,047
  7. 2015Automatic differentiation in machine learning: a surveycited by 852
  8. 2016Universal adversarial perturbationscited by 782
  9. 2017Spectrally-normalized margin bounds for neural networkscited by 681
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 579
  11. 2019Meta-Learning with Implicit Gradientscited by 523
  12. 2018Spectral Signatures in Backdoor Attackscited by 481
26 more
  1. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 456
  2. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 451
  3. 2019Hidden Trigger Backdoor Attackscited by 370
  4. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 352
  5. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 348
  6. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 323
  7. 2020Input-Aware Dynamic Backdoor Attackcited by 312
  8. 2019Label-Consistent Backdoor Attackscited by 294
  9. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 198
  10. 2020Blind Backdoors in Deep Learning Modelscited by 181
  11. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 169
  12. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 161
  13. 2020On the Iteration Complexity of Hypergradient Computationcited by 154
  14. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 151
  15. 2018Rademacher Complexity for Adversarially Robust Generalizationcited by 132
  16. 2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 120
  17. 2020RAB: Provable Robustness Against Backdoor Attackscited by 117
  18. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 115
  19. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 95
  20. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 95
  21. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 94
  22. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 89
  23. 2021Backdoor Attack in the Physical Worldcited by 83
  24. 2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 77
  25. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 60
  26. 2020Can Adversarial Weight Perturbations Inject Neural Backdoors?cited by 56

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2022: 26; 2023: 37; 2024: 56; 2025: 26; 2026: 19.

164 papers.

Sort:

By area:

  1. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 508
  2. 2022Backdoor Defense via Decoupling the Training Processcited by 152
  3. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  4. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  5. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Modelscited by 79
  6. 2023LAVA: Data Valuation without Pre-Specified Learning Algorithmscited by 69
  7. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 64
  8. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
  9. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 59
  10. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Modelscited by 55
  11. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 54
  12. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 45
38 more
  1. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 45
  2. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  3. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 43
  4. 2024Threats, Attacks, and Defenses in Machine Unlearning: A Surveycited by 39
  5. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 39
  6. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  7. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
  8. 2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 37
  9. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  10. 2024BadMerging: Backdoor Attacks Against Model Mergingcited by 33
  11. 2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 32
  12. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 32
  13. 2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29
  14. 2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 28
  15. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 28
  16. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 26
  17. 2024Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Modelscited by 26
  18. 2022BAFFLE: Hiding Backdoors in Offline Reinforcement Learning Datasetscited by 25
  19. 2023Backdoor Learning on Sequence to Sequence Modelscited by 21
  20. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 21
  21. 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
  22. 2023Backdoor Attack with Sparse and Invisible Triggercited by 20
  23. 2022PolicyCleanse: Backdoor Detection and Mitigation in Reinforcement Learningcited by 19
  24. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 19
  25. 2023UMD: Unsupervised Model Detection for X2X Backdoor Attackscited by 18
  26. 2022How to Sift Out a Clean Data Subset in the Presence of Data Poisoning?cited by 17
  27. 2022Backdoor Cleansing with Unlabeled Datacited by 17
  28. 2022On the Effectiveness of Adversarial Training against Backdoor Attackscited by 16
  29. 2023Defending Against Backdoor Attacks by Layer-wise Feature Analysiscited by 16
  30. 2024The Mirrored Influence Hypothesis: Efficient Data Influence Estimation by Harnessing Forward Passescited by 16
  31. 2023On the Trustworthiness Landscape of State-of-the-art Generative Models: A Survey and Outlookcited by 15
  32. 2024Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attackscited by 15
  33. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 15
  34. 2022Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifierscited by 14
  35. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  36. 2023CBD: A Certified Backdoor Detector Based on Local Dominant Probabilitycited by 13
  37. 2024LOTUS: Evasive and Resilient Backdoor Attacks through Sub-Partitioningcited by 13
  38. 2024Persistent Backdoor Attacks in Continual Learningcited by 13

50 most cited of 164 All 164 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Backdoor Unlearning by Linear Task Decomposition
  2. 2025BURN: Backdoor Unlearning via Adversarial Boundary Analysis
  3. 2024Unlearning Backdoor Attacks through Gradient-Based Model Pruning
  4. 2023Exploiting Machine Unlearning for Backdoor Attacks in Deep Learning System
  5. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Data
  6. 2021Excess Capacity and Backdoor Poisoning
  7. 2023DHBE: Data-free Holistic Backdoor Erasing in Deep Neural Networks via Restricted Adversarial Distillation
  8. 2026Statistically Undetectable Backdoors in Deep Neural Networks