Improving the Sensitivity of Backdoor Detectors via Class Subspace Orthogonalization
Not on the map. Why?
Abstract (arXiv)
Most post-training backdoor detection methods rely on attacked models exhibiting extreme outlier detection statistics for the target class of an attack, compared to non-target classes. However, these approaches may fail: (1) when some (non-target) classes are easily discriminable from all others, in which case they may naturally achieve extreme detection statistics (e.g., decision confidence); and (2) when the backdoor is subtle, i.e., with its features weak relative to intrinsic class-discriminative features. A key observation is that the backdoor target class has contributions to its detection statistic from both the backdoor trigger and from its intrinsic features, whereas non-target classes only have contributions from their intrinsic features. To achieve more sensitive detectors, we thus propose to suppress intrinsic features while optimizing the detection statistic for a given class. For non-target classes, such suppression will drastically reduce the achievable statistic, whereas for the target class the (significant) contribution from the backdoor trigger remains. In practice, we formulate a constrained optimization problem, leveraging a small set of clean examples from a given class, and optimizing the detection statistic while orthogonalizing with respect to the class's intrinsic features. We dub this plug-and-play approach Class Subspace Orthogonalization (CSO) and assess it against challenging mixed-label and adaptive attacks.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 22 of its 35 references that are in the map. First posted on arXiv 9 Dec 2025.
Builds on
22 of 35 references.
References · 22
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
- 2017MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applicationscited by 3,827
- 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
- 2018Spectral Signatures in Backdoor Attackscited by 457
- 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
- 2020Input-Aware Dynamic Backdoor Attackcited by 304
- 2019Label-Consistent Backdoor Attackscited by 285
- 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
- 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
10 more
- 2022Backdoor Defense via Decoupling the Training Processcited by 149
- 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
- 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
- 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 82
- 2019Bypassing Backdoor Detection Algorithms in Deep Learningcited by 69
- 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
- 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
- 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 37
- 2024CLIBE: Detecting Dynamic Backdoors in Transformer-based NLP Modelscited by 11
- 2024CEPA: Consensus Embedded Perturbation for Agnostic Detection and Inversion of Backdoorscited by 1
Built on by
Citing papers per year: 2026: 3.
3 papers.