mlsanityData to 7 Oct 2026

Data-free Backdoor Removal based on Channel Lipschitzness

arXiv 2208.03111 ↗First posted 5 Aug 2022cs.LG cs.CRcited by 77

Not on the map. Why?

Abstract (arXiv)

Recent studies have shown that Deep Neural Networks (DNNs) are vulnerable to the backdoor attacks, which leads to malicious behaviors of DNNs when specific triggers are attached to the input images. It was further demonstrated that the infected DNNs possess a collection of channels, which are more sensitive to the backdoor triggers compared with normal channels. Pruning these channels was then shown to be effective in mitigating the backdoor behaviors. To locate those channels, it is natural to consider their Lipschitzness, which measures their sensitivity against worst-case perturbations on the inputs. In this work, we introduce a novel concept called Channel Lipschitz Constant (CLC), which is defined as the Lipschitz constant of the mapping from the input images to the output of each channel. Then we provide empirical evidences to show the strong correlation between an Upper bound of the CLC (UCLC) and the trigger-activated change on the channel activation. Since UCLC can be directly calculated from the weight matrices, we can detect the potential backdoor channels in a data-free manner, and do simple pruning on the infected DNN to repair the model. The proposed Channel Lipschitzness based Pruning (CLP) method is super fast, simple, data-free and robust to the choice of the pruning threshold. Extensive experiments are conducted to evaluate the efficiency and effectiveness of CLP, which achieves state-of-the-art results among the mainstream defense methods even without any data. Source codes are available at https://github.com/rkteddy/channel-Lipschitzness-based-pruning.

Key facts. Cited by 77 papers in the map (data through 7 Oct 2026). Builds on 34 of its 46 references that are in the map. First posted on arXiv 5 Aug 2022.

Builds on

34 of 46 references.

References · 34

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2015Distilling the Knowledge in a Neural Networkcited by 10,076
  5. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2017Squeeze-and-Excitation Networkscited by 4,763
  8. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
  9. 2016An overview of gradient descent optimization algorithmscited by 1,021
  10. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  11. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  12. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
22 more
  1. 2018Spectral Signatures in Backdoor Attackscited by 457
  2. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  3. 2020Backdoor Learning: A Surveycited by 412
  4. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  5. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  6. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  7. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  8. 2019Label-Consistent Backdoor Attackscited by 285
  9. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  10. 2017Spectral Norm Regularization for Improving the Generalizability of Deep Learningcited by 178
  11. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  12. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
  13. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  14. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
  15. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 103
  16. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  17. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  18. 2020USCL: Pretraining Deep Ultrasound Image Diagnosis Model through Video Contrastive Representation Learningcited by 34
  19. 2020MaxUp: A Simple Way to Improve Generalization of Neural Network Trainingcited by 27
  20. 2019Februus: Input Purification Defense Against Trojan Attacks on Deep Neural Network Systemscited by 26
  21. 2020Defending against Backdoor Attack on Deep Neural Networkscited by 22
  22. 2020Re-synchronization using the Hand Preceding Model for Multi-modal Fusion in Automatic Continuous Cued Speech Recognitioncited by 16

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 26; 2024: 29; 2025: 12; 2026: 9.

77 papers.

Sort:

By area:

  1. 2023A Comprehensive Survey on Segment Anything Model for Vision and Beyondcited by 64
  2. 2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 63
  3. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
  4. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
  5. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  6. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
  7. 2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
  8. 2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 30
  9. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 29
  10. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  11. 2022Imperceptible and Robust Backdoor Attack in 3D Point Cloudcited by 25
  12. 2024Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attackscited by 19
38 more
  1. 2023UMD: Unsupervised Model Detection for X2X Backdoor Attackscited by 17
  2. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  3. 2023Revisiting Personalized Federated Learning: Robustness Against Backdoor Attackscited by 16
  4. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  5. 2023CBD: A Certified Backdoor Detector Based on Local Dominant Probabilitycited by 13
  6. 2024Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoorcited by 10
  7. 2023Versatile Backdoor Attack with Visible, Semantic, Sample-Specific, and Compatible Triggerscited by 8
  8. 2023On the Difficulty of Defending Contrastive Learning against Backdoor Attackscited by 8
  9. 2024Imperio: Language-Guided Backdoor Attacks for Arbitrary Model Controlcited by 8
  10. 2025Efficient Input-level Backdoor Defense on Text-to-Image Synthesis via Neuron Activation Variationcited by 8
  11. 2025Towards Reliable Forgetting: A Survey on Machine Unlearning Verificationcited by 8
  12. 2023Look, Listen, and Attack: Backdoor Attacks Against Video Action Recognitioncited by 7
  13. 2024BAN: Detecting Backdoors Activated by Adversarial Neuron Noisecited by 7
  14. 2024Towards Physical World Backdoor Attacks against Skeleton Action Recognitioncited by 7
  15. 2025BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Modelcited by 7
  16. 2025MARS: A Malignity-Aware Backdoor Defense in Federated Learningcited by 7
  17. 2025Towards Backdoor Stealthiness in Model Parameter Spacecited by 6
  18. 2023Influencer Backdoor Attack on Semantic Segmentationcited by 5
  19. 2023Boosting Backdoor Attack with A Learnable Poisoning Sample Selection Strategycited by 5
  20. 2024Data Free Backdoor Attackscited by 5
  21. 2026Test-Time Attention Purification for Backdoored Large Vision Language Modelscited by 5
  22. 2023Towards Sample-specific Backdoor Attack with Clean Labels via Attribute Triggercited by 4
  23. 2024Unified Neural Backdoor Removal with Only Few Clean Samples through Unlearning and Relearningcited by 4
  24. 2024Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activenesscited by 4
  25. 2024Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attackscited by 4
  26. 2023Adversarial Feature Map Pruning for Backdoorcited by 3
  27. 2023Temporal-Distributed Backdoor Attack Against Video Based Action Recognitioncited by 3
  28. 2024Augmented Neural Fine-Tuning for Efficient Backdoor Purificationcited by 3
  29. 2024MakeupAttack: Feature Space Black-box Backdoor Attack on Face Recognition via Makeup Transfercited by 3
  30. 2024Defending Deep Regression Models against Backdoor Attackscited by 3
  31. 2024BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluationcited by 3
  32. 2025Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasetscited by 3
  33. 2026From Internal Diagnosis to External Auditing: A VLM-Driven Paradigm for Data-Free Online Backdoor Defensecited by 3
  34. 2024UNIT: Backdoor Mitigation via Automated Neural Distribution Tighteningcited by 2
  35. 2024Fisher Information guided Purification against Backdoor Attackscited by 2
  36. 2024Combining Machine Learning Defenses without Conflictscited by 2
  37. 2024Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimizationcited by 2
  38. 2023Efficient Backdoor Removal Through Natural Gradient Fine-tuningcited by 1

50 most cited of 77 All 77 (JSON)