mlsanityData to 7 Oct 2026

Reliable Poisoned Sample Detection against Backdoor Attacks Enhanced by Sharpness Aware Minimization

arXiv 2411.11525 ↗First posted 18 Nov 2024cs.CVcited by 2

Not on the map. Why?

Abstract (arXiv)

Backdoor attack has been considered as a serious security threat to deep neural networks (DNNs). Poisoned sample detection (PSD) that aims at filtering out poisoned samples from an untrustworthy training dataset has shown very promising performance for defending against data poisoning based backdoor attacks. However, we observe that the detection performance of many advanced methods is likely to be unstable when facing weak backdoor attacks, such as low poisoning ratio or weak trigger strength. To further verify this observation, we make a statistical investigation among various backdoor attacks and poisoned sample detections, showing a positive correlation between backdoor effect and detection performance. It inspires us to strengthen the backdoor effect to enhance detection performance. Since we cannot achieve that goal via directly manipulating poisoning ratio or trigger strength, we propose to train one model using the Sharpness-Aware Minimization (SAM) algorithm, rather than the vanilla training algorithm. We also provide both empirical and theoretical analysis about how SAM training strengthens the backdoor effect. Then, this SAM trained model can be seamlessly integrated with any off-the-shelf PSD method that extracts discriminative features from the trained model for detection, called SAM-enhanced PSD. Extensive experiments on several benchmark datasets show the reliable detection performance of the proposed method against both weak and strong backdoor attacks, with significant improvements against various attacks (+34.38% TPR on average), over the conventional PSD methods (i.e., without SAM enhancement). Overall, this work provides new insights about PSD and proposes a novel approach that can complement existing detection methods, which may inspire more in-depth explorations in this field.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 39 of its 49 references that are in the map. First posted on arXiv 18 Nov 2024.

Builds on

39 of 49 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  4. 2016Densely Connected Convolutional Networkscited by 6,691
  5. 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,404
  6. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  7. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  8. 2018Spectral Signatures in Backdoor Attackscited by 457
  9. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  10. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  11. 2016Entropy-SGD: Biasing Gradient Descent Into Wide Valleyscited by 357
  12. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
27 more
  1. 2021ASAM: Adaptive Sharpness-Aware Minimization for Scale-Invariant Learning of Deep Neural Networkscited by 293
  2. 2019Label-Consistent Backdoor Attackscited by 285
  3. 2021When Vision Transformers Outperform ResNets without Pre-training or Strong Data Augmentationscited by 259
  4. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  5. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  6. 2022Surrogate Gap Minimization Improves Sharpness-Aware Trainingcited by 171
  7. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  8. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  9. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  10. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  11. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 121
  12. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
  13. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  14. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 93
  15. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 77
  16. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  17. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
  18. 2023Reconstructive Neuron Pruning for Backdoor Defensecited by 56
  19. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 40
  20. 2023Neural Polarizer: A Lightweight and Effective Backdoor Defense via Purifying Poisoned Featurescited by 35
  21. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  22. 2024Evaluating LLM -- Generated Multimodal Diagnosis from Medical Images and Symptom Analysiscited by 23
  23. 2023Distilling Cognitive Backdoor Patterns within an Imagecited by 20
  24. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  25. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  26. 2023Activation Gradient based Poisoned Sample Detection Against Backdoor Attackscited by 9
  27. 2024When LLM Meets Hypergraph: A Sociological Analysis on Personality via Online Social Networkscited by 4

Built on by

Cited by year

Citing papers per year: 2025: 2.

2 papers.

  1. 2025Class-Conditional Neural Polarizer: A Lightweight and Effective Backdoor Defense by Purifying Poisoned Featurescited by 1
  2. 2025Variance-Based Defense Against Blended Backdoor Attackscited by 0