mlsanityData to 7 Oct 2026

Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examples

arXiv 2307.10562 ↗First posted 20 Jul 2023cs.LG cs.CRcited by 40

Not on the map. Why?

Cited by 22 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Backdoor attacks are serious security threats to machine learning models where an adversary can inject poisoned samples into the training set, causing a backdoored model which predicts poisoned samples with particular triggers to particular target classes, while behaving normally on benign samples. In this paper, we explore the task of purifying a backdoored model using a small clean dataset. By establishing the connection between backdoor risk and adversarial risk, we derive a novel upper bound for backdoor risk, which mainly captures the risk on the shared adversarial examples (SAEs) between the backdoored model and the purified model. This upper bound further suggests a novel bi-level optimization problem for mitigating backdoor using adversarial training techniques. To solve it, we propose Shared Adversarial Unlearning (SAU). Specifically, SAU first generates SAEs, and then, unlearns the generated SAEs such that they are either correctly classified by the purified model and/or differently classified by the two models, such that the backdoor effect in the backdoored model will be mitigated in the purified model. Experiments on various benchmark datasets and network architectures show that our proposed method achieves state-of-the-art performance for backdoor defense.

Key facts. Cited by 40 papers in the map (data through 7 Oct 2026). Builds on 49 of its 72 references that are in the map. First posted on arXiv 20 Jul 2023.

Builds on

49 of 72 references.

References · 49

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  7. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  9. 2018Robustness May Be at Odds with Accuracycited by 873
  10. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  11. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  12. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
37 more
  1. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  2. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  3. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  4. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  5. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  6. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  7. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  8. 2018Spatially Transformed Adversarial Examplescited by 195
  9. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
  10. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  11. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  12. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  13. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  14. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  15. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  16. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  17. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
  18. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 93
  19. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
  20. 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
  21. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
  22. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 58
  23. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
  24. 2019Efficient Adversarial Training with Transferable Adversarial Examplescited by 54
  25. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  26. 2020Computing Systems for Autonomous Driving: State-of-the-Art and Challengescited by 47
  27. 2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
  28. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  29. 2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
  30. 2022Prior-Guided Adversarial Initialization for Fast Adversarial Trainingcited by 34
  31. 2022One-shot Neural Backdoor Erasing via Adversarial Weight Maskingcited by 25
  32. 2022Imperceptible and Robust Backdoor Attack in 3D Point Cloudcited by 25
  33. 2022Removing Batch Normalization Boosts Adversarial Trainingcited by 24
  34. 2018IoT Security Techniques Based on Machine Learningcited by 22
  35. 2022BagFlip: A Certified Defense against Data Poisoningcited by 18
  36. 2022On the Effectiveness of Adversarial Training against Backdoor Attackscited by 15
  37. 2022Progressive Backdoor Erasing via connecting Backdoor and Adversarial Attackscited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 20; 2025: 9; 2026: 9.

40 papers.

Sort:

By area:

  1. 2024Threats, Attacks, and Defenses in Machine Unlearning: A Surveycited by 34
  2. 2024Machine Unlearning: A Comprehensive Surveycited by 33
  3. 2024Corrective Machine Unlearningcited by 26
  4. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  5. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoorscited by 25
  6. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  7. 2023MultiDelete for Multimodal Machine Unlearningcited by 20
  8. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  9. 2025Tool Unlearning for Tool-Augmented LLMscited by 17
  10. 2024MU-Bench: A Multitask Multimodal Benchmark for Machine Unlearningcited by 16
  11. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  12. 2024Mitigating the Backdoor Effect for Multi-Task Model Merging via Safety-Aware Subspacecited by 14
28 more
  1. 2024Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoorcited by 10
  2. 2024Adversarial Backdoor Defense in CLIPcited by 10
  3. 2025Breaking the Stealth-Potency Trade-off in Clean-Image Backdoors with Generative Trigger Optimizationcited by 7
  4. 2024DeTrigger: A Gradient-Centric Approach to Backdoor Attack Mitigation in Federated Learningcited by 5
  5. 2024TrojFM: Resource-efficient Backdoor Attacks against Very Large Foundation Modelscited by 4
  6. 2024Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activenesscited by 4
  7. 2025Exploring Nonlinear Pathway in Parameter Space for Machine Unlearningcited by 4
  8. 2025ReVeil: Unconstrained Concealed Backdoor Attack on Deep Neural Networks using Machine Unlearningcited by 3
  9. 2024Backdoor Defense through Self-Supervised and Generative Learningcited by 2
  10. 2024Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimizationcited by 2
  11. 2025Parasite: A Steganography-based Backdoor Attack Framework for Diffusion Modelscited by 2
  12. 2024Prompting the Unseen: Detecting Hidden Backdoors in Black-Box Modelscited by 1
  13. 2024Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Imagescited by 1
  14. 2025Class-Conditional Neural Polarizer: A Lightweight and Effective Backdoor Defense by Purifying Poisoned Featurescited by 1
  15. 2025Circumventing Backdoor Space via Weight Symmetrycited by 1
  16. 2025Backdoor Mitigation via Invertible Pruning Maskscited by 1
  17. 2026Safety-Efficacy Trade Off: Robustness against Data-Poisoningcited by 1
  18. 2026Backdoor Directions in Vision Transformerscited by 1
  19. 2026From Parameters to Feature Space: Task Arithmetic for Backdoor Mitigation in Model Mergingcited by 1
  20. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 0
  21. 2024Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigationcited by 0
  22. 2025Understanding Machine Unlearning Through the Lens of Mode Connectivitycited by 0
  23. 2026Shapley-Guided Neural Repair Approach via Derivative-Free Optimizationcited by 0
  24. 2026Backdoor Mitigation in Object Detection via Adversarial Fine-Tuningcited by 0
  25. 2026Rethinking Backdoor Adversarial Unlearning through the Lens of Catastrophic Forgetting in Continual Learningcited by 0
  26. 2026InstantForget: Update-Free Backdoor Unlearning with Inference-Time Feature Resetcited by 0
  27. 2026Understanding Machine Unlearning Through the Lens of Mode Connectivitycited by 0
  28. 2026Anti-Backdoor Coreset Selection via Cumulative Entropycited by 0