mlsanityData to 7 Oct 2026

Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetwork

arXiv 2210.06428 ↗First posted 12 Oct 2022cs.CR cs.CV cs.LGcited by 12

Not on the map. Why?

Abstract (arXiv)

Deep neural networks (DNNs) are vulnerable to backdoor attacks. Previous works have shown it extremely challenging to unlearn the undesired backdoor behavior from the network, since the entire network can be affected by the backdoor samples. In this paper, we propose a brand-new backdoor defense strategy, which makes it much easier to remove the harmful influence of backdoor samples from the model. Our defense strategy, Trap and Replace, consists of two stages. In the first stage, we bait and trap the backdoors in a small and easy-to-replace subnetwork. Specifically, we add an auxiliary image reconstruction head on top of the stem network shared with a light-weighted classification head. The intuition is that the auxiliary image reconstruction task encourages the stem network to keep sufficient low-level visual features that are hard to learn but semantically correct, instead of overfitting to the easy-to-learn but semantically incorrect backdoor correlations. As a result, when trained on backdoored datasets, the backdoors are easily baited towards the unprotected classification head, since it is much more vulnerable than the shared stem, leaving the stem network hardly poisoned. In the second stage, we replace the poisoned light-weighted classification head with an untainted one, by re-training it from scratch only on a small holdout dataset with clean samples, while fixing the stem network. As a result, both the stem and the classification head in the final network are hardly affected by backdoor training samples. We evaluate our method against ten different backdoor attacks. Our method outperforms previous state-of-the-art methods by up to 20.57%, 9.80%, and 13.72% attack success rate and on-average 3.14%, 1.80%, and 1.21% clean classification accuracy on CIFAR10, GTSRB, and ImageNet-12, respectively. Code is available online.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Builds on 43 of its 75 references that are in the map. First posted on arXiv 12 Oct 2022.

Builds on

43 of 75 references.

References · 43

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
  4. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016Wide Residual Networkscited by 3,057
  7. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,678
  8. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  9. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  11. 2018Spectral Signatures in Backdoor Attackscited by 457
  12. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
31 more
  1. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  2. 2019Hidden Trigger Backdoor Attackscited by 359
  3. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  4. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  5. 2019Label-Consistent Backdoor Attackscited by 285
  6. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  7. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  8. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  9. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 192
  10. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  11. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  12. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  13. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  14. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  15. 2019TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systemscited by 120
  16. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  17. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  18. 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
  19. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  20. 2020Strong Data Augmentation Sanitizes Poisoning and Backdoor Attacks Without an Accuracy Tradeoffcited by 86
  21. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  22. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  23. 2020Can Adversarial Weight Perturbations Inject Neural Backdoors?cited by 51
  24. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  25. 2021Poisoning the Unlabeled Dataset of Semi-Supervised Learningcited by 44
  26. 2021Few-shot Backdoor Defense Using Shapley Estimationcited by 40
  27. 2021Trigger Hunting with a Topological Prior for Trojan Detectioncited by 39
  28. 2021Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networkscited by 33
  29. 2021Excess Capacity and Backdoor Poisoningcited by 24
  30. 2021How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Datacited by 22
  31. 2022Quarantine: Sparsity Can Uncover the Trojan Attack Trigger for Freecited by 15

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 6; 2024: 3; 2025: 1; 2026: 2.

12 papers.

  1. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
  2. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  3. 2023Setting the Trap: Capturing and Defeating Backdoors in Pretrained Language Models through Honeypotscited by 16
  4. 2023Revisiting Data-Free Knowledge Distillation with Poisoned Teacherscited by 9
  5. 2023On the Difficulty of Defending Contrastive Learning against Backdoor Attackscited by 8
  6. 2024Semantic Shield: Defending Vision-Language Models Against Backdooring and Poisoning via Fine-grained Knowledge Alignmentcited by 7
  7. 2025Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Modelscited by 5
  8. 2023Safe and Robust Watermark Injection with a Single OoD Imagecited by 3
  9. 2024Protecting against simultaneous data poisoning attackscited by 1
  10. 2024Using Interleaved Ensemble Unlearning to Keep Backdoors at Bay for Finetuning Vision Transformerscited by 1
  11. 2026Removing the Trigger, Not the Backdoor: Alternative Triggers and Latent Backdoorscited by 0
  12. 2026Mitigating Backdoors via Decoy Shortcuts and Knowledge Decouplingcited by 0