Data to 14 Oct 2026

Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimization

arXiv 2304.11823 ↗First posted 24 Apr 2023cs.AIcited by 64

Not on the map. Why?

Abstract (arXiv)

Backdoor defense, which aims to detect or mitigate the effect of malicious triggers introduced by attackers, is becoming increasingly critical for machine learning security and integrity. Fine-tuning based on benign data is a natural defense to erase the backdoor effect in a backdoored model. However, recent studies show that, given limited benign data, vanilla fine-tuning has poor defense performance. In this work, we provide a deep study of fine-tuning the backdoored model from the neuron perspective and find that backdoorrelated neurons fail to escape the local minimum in the fine-tuning process. Inspired by observing that the backdoorrelated neurons often have larger norms, we propose FTSAM, a novel backdoor defense paradigm that aims to shrink the norms of backdoor-related neurons by incorporating sharpness-aware minimization with fine-tuning. We demonstrate the effectiveness of our method on several benchmark datasets and network architectures, where it achieves state-of-the-art defense performance. Overall, our work provides a promising avenue for improving the robustness of machine learning models against backdoor attacks.

Key facts. Cited by 64 papers in the map (data through 14 Oct 2026). Builds on 40 of its 63 references that are in the map. First posted on arXiv 24 Apr 2023.

Builds on

40 of 63 references.

References · 40

2015Deep Residual Learning for Image Recognitioncited by 52,096
2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
2016Identity Mappings in Deep Residual Networkscited by 1,965
2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,417
2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 456
2016Entropy-SGD: Biasing Gradient Descent Into Wide Valleyscited by 359
2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353

28 more

2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
2020Input-Aware Dynamic Backdoor Attackcited by 313
2021ASAM: Adaptive Sharpness-Aware Minimization for Scale-Invariant Learning of Deep Neural Networkscited by 293
2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 242
2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 235
2022Surrogate Gap Minimization Improves Sharpness-Aware Trainingcited by 172
2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 166
2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 161
2022Backdoor Defense via Decoupling the Training Processcited by 153
2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
2020Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Reviewcited by 123
2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 79
2022Make Sharpness-Aware Minimization Stronger: A Sparsified Perturbation Approachcited by 70
2020Efficient Adversarial Attacks for Visual Object Trackingcited by 66
2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
2023FedSpeed: Larger Local Interval, Less Communication Round, and Higher Generalization Accuracycited by 49
2020Computing Systems for Autonomous Driving: State-of-the-Art and Challengescited by 47
2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
2022Improving Sharpness-Aware Minimization with Fisher Mask for Better Generalization on Language Modelscited by 42
2022Robust Weight Perturbation for Adversarial Trainingcited by 25
2022Imperceptible and Robust Backdoor Attack in 3D Point Cloudcited by 25
2018IoT Security Techniques Based on Machine Learningcited by 22
2022Hardly Perceptible Trojan Attack against Neural Networks with Bit Flipscited by 22
2023AdaSAM: Boosting Sharpness-Aware Minimization with Adaptive Learning Rate and Momentum for Training Deep Neural Networkscited by 21
2022Efficient Generalization Improvement Guided by Random Weight Perturbationcited by 8
2020Regularized Training and Tight Certification for Randomized Smoothed Classifier with Provable Robustnesscited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 7; 2024: 26; 2025: 19; 2026: 12.

64 papers.

Sort:

By area:

2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 115
2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 67
2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 43
2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 37
2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 32
2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 28
2025To Think or Not to Think: Exploring the Unthinking Vulnerability in Large Reasoning Modelscited by 22
2025A Survey on Privacy Risks and Protection in Large Language Modelscited by 21
2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 19
2025BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Modelscited by 17
2023Defenses in Adversarial Machine Learning: A Surveycited by 14
2024Mitigating the Backdoor Effect for Multi-Task Model Merging via Safety-Aware Subspacecited by 14

38 more

2024Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoorcited by 11
2024Generalization Bound and New Algorithm for Clean-Label Backdoor Attackcited by 11
2024BAN: Detecting Backdoors Activated by Adversarial Neuron Noisecited by 8
2024Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defensecited by 7
2025Towards Backdoor Stealthiness in Model Parameter Spacecited by 7
2025Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimizationcited by 7
2024Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activenesscited by 6
2025Exploring Backdoor Attack and Defense for LLM-empowered Recommendationscited by 6
2023Boosting Backdoor Attack with A Learnable Poisoning Sample Selection Strategycited by 5
2024Wicked Oddities: Selectively Poisoning for Effective Clean-Label Backdoor Attackscited by 4
2024Perturb and Recover: Fine-tuning for Effective Backdoor Removal from CLIPcited by 4
2024Augmented Neural Fine-Tuning for Efficient Backdoor Purificationcited by 3
2024Flatness-aware Sequential Learning Generates Resilient Backdoorscited by 3
2024Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimizationcited by 3
2025Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasetscited by 3
2024UNIT: Backdoor Mitigation via Automated Neural Distribution Tighteningcited by 2
2024PBP: Post-training Backdoor Purification for Malware Classifierscited by 2
2025Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergiescited by 2
2025Circumventing Backdoor Space via Weight Symmetrycited by 2
2024Unlearning Backdoor Attacks through Gradient-Based Model Pruningcited by 1
2024Magnitude-based Neuron Pruning for Backdoor Defenscited by 1
2024BadVim: Unveiling Backdoor Threats in Visual State Space Modelcited by 1
2024PAD-FT: A Lightweight Defense for Backdoor Attacks via Data Purification and Fine-Tuningcited by 1
2024Trojan Cleansing with Neural Collapsecited by 1
2024Cut the Deadwood Out: Backdoor Purification via Guided Module Substitutioncited by 1
2025Class-Conditional Neural Polarizer: A Lightweight and Effective Backdoor Defense by Purifying Poisoned Featurescited by 1
2025Backdoor Mitigation via Invertible Pruning Maskscited by 1
2025Where Do Backdoors Live? A Component-Level Analysis of Backdoor Propagation in Speech Language Modelscited by 1
2026BadDet+: Robust Backdoor Attacks for Object Detectioncited by 1
2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 0
2024Partial train and isolate, mitigate backdoor attackcited by 0
2024FLAIN: Mitigating Backdoor Attacks in Federated Learning via Flipping Weight Updates of Low-Activation Input Neuronscited by 0
2024Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigationcited by 0
2024Stealthy and Robust Backdoor Attack against 3D Point Clouds through Additional Point Featurescited by 0
2025A Robust Attack: Displacement Backdoor Attackcited by 0
2025Prototype Guided Backdoor Defensecited by 0
2025MergeGuard: Efficient Thwarting of Trojan Attacks in Machine Learning Modelscited by 0
2025AutoDebias: Automated Framework for Debiasing Text-to-Image Modelscited by 0

50 most cited of 64 All 64 (JSON)

Similar, not cited

Close in wording, no citation either way