Isolate Trigger: Detecting and Eliminating Adaptive Backdoor Attacks

TL;DR

IsTr introduces a trigger-isolation framework to defend against adaptive backdoors that entangle triggers with benign features. It combines Steps (gradient-based reverse trigger generation), Differential-Middle-Slice (DMS) for trigger localization, and Unlearning for lossless repair, achieving >95% detection accuracy and <3% post-repair ASR across six attacks on MNIST, GTSRB, and PubFig. The approach remains robust under data-, time-, and knowability-limited model outsourcing scenarios and shows a positive link between reverse precision and both detection and repair efficacy. By reframing backdoor defense around precise reverse engineering of triggers, IsTr advances practical, generalizable defenses against diverse and hybrid backdoor threats.

Abstract

Deep learning models are widely deployed in various applications but remain vulnerable to stealthy adversarial threats, particularly backdoor attacks. Backdoor models trained on poisoned datasets behave normally with clean inputs but cause mispredictions when a specific trigger is present. Most existing backdoor defenses assume that adversaries only inject one backdoor with small and conspicuous triggers. However, adaptive backdoor that entangle multiple trigger patterns with benign features can effectively bypass existing defenses. To defend against these attacks, we propose Isolate Trigger (IsTr), an accurate and efficient framework for backdoor detection and mitigation. IsTr aims to eliminate the influence of benign features and reverse hidden triggers. IsTr is motivated by the observation that a model's feature extractor focuses more on benign features while its classifier focuses more on trigger patterns. Based on this difference, IsTr designs Steps and Differential-Middle-Slice to resolve the detecting challenge of isolating triggers from benign features. Moreover, IsTr employs unlearning-based repair to remove both attacker-injected and natural backdoors while maintaining model benign accuracy. We extensively evaluate IsTr against six representative backdoor attacks and compare with seven state-of-the-art baseline methods across three real-world applications: digit recognition, face recognition, and traffic sign recognition. In most cases, IsTr reduces detection overhead by an order of magnitude while achieving over 95\% detection accuracy and maintaining the post-repair attack success rate below 3\%, outperforming baseline defenses. IsTr remains robust against various adaptive attacks, even when trigger patterns are heavily entangled with benign features.

Figures (13)

• Figure 1: Backdoor Attacks
• Figure 2: IsTr Framework. This framework first uses Steps to generate trigger patterns and screen for suspicious target labels. For each target label, IsTr leverages DMS to locate triggers in the image. IsTr reconstructs precise triggers by leveraging the orthogonality of Steps and DMS. IsTr rehabilitates the poisoning model through Unlearning with label-flipped data. Finally, IsTr employs Unlearning to make the model unlearns triggers, achieving model patching.
• Figure 3: Defense Intuition. Left: prior knowledge. Benign features require more training epochs to converge than triggers, resulting in higher feature extraction priority for benign features. Right: posterior knowledge. The poisoned model classifies poisoned samples as target labels, demonstrating that triggers possess higher classification priority than benign features.
• Figure 4: Comparison between the original trigger and the reverse-engineered result when Neural Cleanse performs reverse generation on facial datasets. Neural Cleanse tends to generate face rather than trigger.
• Figure 5: Backdoor Training Epoch Comparison.