mlsanityData to 7 Oct 2026

RPP: A Certified Poisoned-Sample Detection Framework for Backdoor Attacks under Dataset Imbalance

arXiv 2602.00183 ↗First posted 30 Jan 2026cs.CR cs.CV cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

Deep neural networks are highly susceptible to backdoor attacks, yet most defense methods to date rely on balanced data, overlooking the pervasive class imbalance in real-world scenarios that can amplify backdoor threats. This paper presents the first in-depth investigation of how the dataset imbalance amplifies backdoor vulnerability, showing that (i) the imbalance induces a majority-class bias that increases susceptibility and (ii) conventional defenses degrade significantly as the imbalance grows. To address this, we propose Randomized Probability Perturbation (RPP), a certified poisoned-sample detection framework that operates in a black-box setting using only model output probabilities. For any inspected sample, RPP determines whether the input has been backdoor-manipulated, while offering provable within-domain detectability guarantees and a probabilistic upper bound on the false positive rate. Extensive experiments on five benchmarks (MNIST, SVHN, CIFAR-10, TinyImageNet and ImageNet10) covering 10 backdoor attacks and 12 baseline defenses show that RPP achieves significantly higher detection accuracy than state-of-the-art defenses, particularly under dataset imbalance. RPP establishes a theoretical and practical foundation for defending against backdoor attacks in real-world environments with imbalanced data.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 46 of its 68 references that are in the map. First posted on arXiv 30 Jan 2026.

Builds on

46 of 68 references.

References · 46

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  4. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  5. 2019Class-Balanced Loss Based on Effective Number of Samplescited by 1,239
  6. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  7. 2020Long-tail learning via logit adjustmentcited by 605
  8. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  9. 2017A systematic study of the class imbalance problem in convolutional neural networkscited by 510
  10. 2018Spectral Signatures in Backdoor Attackscited by 457
  11. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  12. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
34 more
  1. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  2. 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
  3. 2020Input-Aware Dynamic Backdoor Attackcited by 304
  4. 2019Label-Consistent Backdoor Attackscited by 285
  5. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  6. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  7. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  8. 2017Neural Trojanscited by 151
  9. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  10. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  11. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 103
  12. 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
  13. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  14. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 93
  15. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  16. 2020On Certifying Robustness against Backdoor Attacks via Randomized Smoothingcited by 74
  17. 2019PhysGAN: Generating Physical-World-Resilient Adversarial Examples for Autonomous Drivingcited by 72
  18. 2020Certified Robustness of Nearest Neighbors against Data Poisoning and Backdoor Attackscited by 58
  19. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
  20. 2022Practical Evaluation of Adversarial Robustness via Adaptive Auto Attackcited by 44
  21. 2022Towards A Proactive ML Approach for Detecting Backdoor Poison Samplescited by 40
  22. 2022A survey on learning from imbalanced data streams: taxonomy, challenges, empirical study, and reproducible experimental frameworkcited by 39
  23. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  24. 2021De-Pois: An Attack-Agnostic Defense against Data Poisoning Attackscited by 29
  25. 2023ASSET: Robust Backdoor Data Detection Across a Multiplicity of Deep Learning Paradigmscited by 29
  26. 2023Robust Backdoor Detection for Deep Learning via Topological Evolution Dynamicscited by 24
  27. 2022Machine Learning Security against Data Poisoning: Are We There Yet?cited by 23
  28. 2021LARNet: Lie Algebra Residual Network for Face Recognitioncited by 14
  29. 2023CBD: A Certified Backdoor Detector Based on Local Dominant Probabilitycited by 13
  30. 2024Backdoor Secrets Unveiled: Identifying Backdoor Data with Optimized Scaled Prediction Consistencycited by 13
  31. 2020Reverse Engineering Imperceptible Backdoor Attacks on Deep Neural Networks for Detection and Training Set Cleansingcited by 11
  32. 2025SacFL: Self-Adaptive Federated Continual Learning for Resource-Constrained End Devicescited by 8
  33. 2023Improved Activation Clipping for Universal Backdoor Mitigation and Test-Time Detectioncited by 3
  34. 2024Long-Tailed Backdoor Attack Using Dynamic Data Augmentation Operationscited by 2

Built on by

Not cited yet.