mlsanityData to 7 Oct 2026

Anti-Backdoor Learning: Training Clean Models on Poisoned Data

arXiv 2110.11571 ↗First posted 22 Oct 2021cs.LG cs.AIcited by 258

Not on the map. Why?

Cited by 86 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Backdoor attack has emerged as a major security threat to deep neural networks (DNNs). While existing defense methods have demonstrated promising results on detecting or erasing backdoors, it is still not clear whether robust training methods can be devised to prevent the backdoor triggers being injected into the trained model in the first place. In this paper, we introduce the concept of anti-backdoor learning, aiming to train clean models given backdoor-poisoned data. We frame the overall learning process as a dual-task of learning the clean and the backdoor portions of data. From this view, we identify two inherent characteristics of backdoor attacks as their weaknesses: 1) the models learn backdoored data much faster than learning with clean data, and the stronger the attack the faster the model converges on backdoored data; 2) the backdoor task is tied to a specific class (the backdoor target class). Based on these two weaknesses, we propose a general learning scheme, Anti-Backdoor Learning (ABL), to automatically prevent backdoor attacks during training. ABL introduces a two-stage gradient ascent mechanism for standard training to 1) help isolate backdoor examples at an early training stage, and 2) break the correlation between backdoor examples and the target class at a later training stage. Through extensive experiments on multiple benchmark datasets against 10 state-of-the-art attacks, we empirically show that ABL-trained models on backdoor-poisoned data achieve the same performance as they were trained on purely clean data. Code is available at urlhttps://github.com/bboylyg/ABL.

Key facts. Cited by 258 papers in the map (data through 7 Oct 2026). Builds on 28 of its 43 references that are in the map. First posted on arXiv 22 Oct 2021.

Builds on

28 of 43 references.

References · 28

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2016Wide Residual Networkscited by 3,057
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  5. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  6. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  7. 2018Spectral Signatures in Backdoor Attackscited by 457
  8. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  9. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  10. 2019Hidden Trigger Backdoor Attackscited by 359
  11. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  12. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
16 more
  1. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  2. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  3. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  4. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  5. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  6. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  7. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  8. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
  9. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  10. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  11. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 121
  12. 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
  13. 2020Deep Feature Space Trojan Attack of Neural Networks by Controlled Detoxificationcited by 93
  14. 2020Rethinking the Trigger of Backdoor Attackcited by 76
  15. 2020Do We Need Zero Training Loss After Achieving Zero Training Error?cited by 61
  16. 2021What Do Deep Nets Learn? Class-wise Patterns Revealed in the Input Spacecited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 2; 2022: 39; 2023: 60; 2024: 80; 2025: 42; 2026: 35.

258 papers.

Sort:

By area:

  1. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  2. 2024Rethinking Machine Unlearning for Large Language Modelscited by 247
  3. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  4. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  5. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
  6. 2022Federated Learning with Label Distribution Skew via Logits Calibrationcited by 108
  7. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  8. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 93
  9. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
  10. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
  11. 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 57
  12. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
38 more
  1. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 50
  2. 2024Instruction Backdoor Attacks Against Customized LLMscited by 50
  3. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
  4. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
  5. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Modelscited by 44
  6. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  7. 2021Few-shot Backdoor Defense Using Shapley Estimationcited by 40
  8. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  9. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
  10. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  11. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
  12. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  13. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
  14. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  15. 2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 35
  16. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  17. 2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 34
  18. 2022Identifying a Training-Set Attack's Target Using Renormalized Influence Estimationcited by 32
  19. 2024BadMerging: Backdoor Attacks Against Model Mergingcited by 32
  20. 2024Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearningcited by 31
  21. 2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 30
  22. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 29
  23. 2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29
  24. 2022Understanding Rare Spurious Correlations in Neural Networkscited by 27
  25. 2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 26
  26. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  27. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 25
  28. 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 21
  29. 2022CalFAT: Calibrated Federated Adversarial Training with Label Skewnesscited by 20
  30. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 20
  31. 2023Backdoor Attacks Against Dataset Distillationcited by 20
  32. 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
  33. 2023Backdoor Attack with Sparse and Invisible Triggercited by 20
  34. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
  35. 2023Delving into the Adversarial Robustness of Federated Learningcited by 19
  36. 2023Defending Against Patch-based Backdoor Attacks on Self-Supervised Learningcited by 19
  37. 2024Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attackscited by 19
  38. 2024Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Modelscited by 19

50 most cited of 258 All 258 (JSON)