mlsanityData to 14 Oct 2026

Adversarial Neuron Pruning Purifies Backdoored Deep Models

arXiv 2110.14430 ↗First posted 27 Oct 2021cs.LG cs.CR cs.CVcited by 235

Not on the map. Why?

Cited by 73 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

As deep neural networks (DNNs) are growing larger, their requirements for computational resources become huge, which makes outsourcing training more popular. Training in a third-party platform, however, may introduce potential risks that a malicious trainer will return backdoored DNNs, which behave normally on clean samples but output targeted misclassifications whenever a trigger appears at the test time. Without any knowledge of the trigger, it is difficult to distinguish or recover benign DNNs from backdoored ones. In this paper, we first identify an unexpected sensitivity of backdoored DNNs, that is, they are much easier to collapse and tend to predict the target label on clean samples when their neurons are adversarially perturbed. Based on these observations, we propose a novel model repairing method, termed Adversarial Neuron Pruning (ANP), which prunes some sensitive neurons to purify the injected backdoor. Experiments show, even with only an extremely small amount of clean data (e.g., 1%), ANP effectively removes the injected backdoor without causing obvious performance degradation.

Key facts. Cited by 235 papers in the map (data through 14 Oct 2026). Builds on 36 of its 49 references that are in the map. First posted on arXiv 27 Oct 2021.

Builds on

36 of 49 references.

References · 36

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 7,005
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2017Understanding Black-box Predictions via Influence Functionscited by 1,741
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  8. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  9. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  10. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  11. 2018Spectral Signatures in Backdoor Attackscited by 484
  12. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
24 more
  1. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  2. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  3. 2020Input-Aware Dynamic Backdoor Attackcited by 313
  4. 2017Certified Defenses for Data Poisoning Attackscited by 303
  5. 2019Label-Consistent Backdoor Attackscited by 296
  6. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
  7. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 242
  8. 2017Neural Trojanscited by 153
  9. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 135
  10. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 134
  11. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 132
  12. 2018Sever: A Robust Meta-Algorithm for Stochastic Optimizationcited by 125
  13. 2020RAB: Provable Robustness Against Backdoor Attackscited by 118
  14. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 115
  15. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 108
  16. 2020Neuron Shapley: Discovering the Responsible Neuronscited by 98
  17. 2020Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Casescited by 95
  18. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 89
  19. 2019Defending Neural Backdoors via Generative Distribution Modelingcited by 84
  20. 2019Data Poisoning against Differentially-Private Learners: Attacks and Defensescited by 78
  21. 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 59
  22. 2019REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Datacited by 44
  23. 2017Residual Convolutional CTC Networks for Automatic Speech Recognitioncited by 21
  24. 2019Generative Adversarial Nets for Robust Scatter Estimation: A Proper Scoring Rule Perspectivecited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 2; 2022: 37; 2023: 51; 2024: 79; 2025: 30; 2026: 36.

235 papers.

Sort:

By area:

  1. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Trainingcited by 529
  2. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  3. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
  4. 2022How to Backdoor Diffusion Models?cited by 104
  5. 2022Wild Patterns Reloaded: A Survey of Machine Learning Security against Training Data Poisoningcited by 94
  6. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 86
  7. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 79
  8. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 64
  9. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 63
  10. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 59
  11. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 57
  12. 2023Detecting Backdoors in Pre-trained Encoderscited by 55
38 more
  1. 2022Constrained Optimization with Dynamic Bound-scaling for Effective NLPBackdoor Defensecited by 47
  2. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 46
  3. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 45
  4. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  5. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 43
  6. 2022The Combinatorial Brain Surgeon: Pruning Weights That Cancel One Another in Neural Networkscited by 41
  7. 2022Training with More Confidence: Mitigating Injected and Natural Backdoors During Trainingcited by 38
  8. 2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 37
  9. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  10. 2024BadMerging: Backdoor Attacks Against Model Mergingcited by 34
  11. 2022Marksman Backdoor: Backdoor Attacks with Arbitrary Target Classcited by 33
  12. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 33
  13. 2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 32
  14. 2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 28
  15. 2022Untargeted Backdoor Attack against Object Detectioncited by 28
  16. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 28
  17. 2022Understanding Rare Spurious Correlations in Neural Networkscited by 27
  18. 2022Imperceptible Backdoor Attack: From Input Space to Feature Representationcited by 27
  19. 2023Circuit Breaking: Removing Model Behaviors with Targeted Ablationcited by 27
  20. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 26
  21. 2023AI-Generated Content (AIGC) for Various Data Modalities: A Surveycited by 25
  22. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoorscited by 25
  23. 2024CleanGen: Mitigating Backdoor Attacks for Generation Tasks in Large Language Modelscited by 24
  24. 2023Analyzing And Editing Inner Mechanisms Of Backdoored Language Modelscited by 23
  25. 2022Revisiting a kNN-based Image Classification System with High-capacity Storagecited by 22
  26. 2024Pruning for Robust Concept Erasing in Diffusion Modelscited by 22
  27. 2022Just Rotate it: Deploying Backdoor Attacks via Rotation Transformationcited by 20
  28. 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
  29. 2023Backdoor Attack with Sparse and Invisible Triggercited by 20
  30. 2024Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attackscited by 19
  31. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 19
  32. 2023UMD: Unsupervised Model Detection for X2X Backdoor Attackscited by 18
  33. 2023Backdoor Federated Learning by Poisoning Backdoor-Critical Layerscited by 18
  34. 2022A Survey of Neural Trojan Attacks and Defenses in Deep Learningcited by 17
  35. 2022Backdoor Cleansing with Unlabeled Datacited by 17
  36. 2022On the Effectiveness of Adversarial Training against Backdoor Attackscited by 16
  37. 2023Revisiting Personalized Federated Learning: Robustness Against Backdoor Attackscited by 16
  38. 2022Quarantine: Sparsity Can Uncover the Trojan Attack Trigger for Freecited by 15

50 most cited of 235 All 235 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogramming
  2. 2025Provable Repair of Deep Neural Network Defects by Preimage Synthesis and Property Refinement
  3. 2023DHBE: Data-free Holistic Backdoor Erasing in Deep Neural Networks via Restricted Adversarial Distillation
  4. 2024"No Matter What You Do": Purifying GNN Models via Backdoor Unlearning
  5. 2022Pruning Adversarially Robust Neural Networks without Adversarial Examples
  6. 2026Statistically Undetectable Backdoors in Deep Neural Networks
  7. 2022Defense against Backdoor Attacks via Identifying and Purifying Bad Neurons
  8. 2023PatchBackdoor: Backdoor Attack against Deep Neural Networks without Model Modification