TED++: Submanifold-Aware Backdoor Detection via Layerwise Tubular-Neighbourhood Screening

TL;DR

TED++ tackles backdoor detection under data scarcity by modeling per-layer activations as class submanifolds with learnable tubular neighbourhoods, and by tracking off-tube deviations through Locally Adaptive Ranking across layers. A two-stage pipeline—tube-aware ranking followed by trajectory PCA—yields robust detection using a small clean validation set. Empirical results across CIFAR-10, GTSRB, and TinyImageNet show state-of-the-art AUROC and F1 scores, including resilience against source-specific and dynamic attacks, and near-perfect detection with as few as five validation samples per class. The approach reduces reliance on large validation sets and maintains competitive inference time, positioning TED++ as a leading input-level defence with strong practical impact.

Abstract

As deep neural networks power increasingly critical applications, stealthy backdoor attacks, where poisoned training inputs trigger malicious model behaviour while appearing benign, pose a severe security risk. Many existing defences are vulnerable when attackers exploit subtle distance-based anomalies or when clean examples are scarce. To meet this challenge, we introduce TED++, a submanifold-aware framework that effectively detects subtle backdoors that evade existing defences. TED++ begins by constructing a tubular neighbourhood around each class's hidden-feature manifold, estimating its local ``thickness'' from a handful of clean activations. It then applies Locally Adaptive Ranking (LAR) to detect any activation that drifts outside the admissible tube. By aggregating these LAR-adjusted ranks across all layers, TED++ captures how faithfully an input remains on the evolving class submanifolds. Based on such characteristic ``tube-constrained'' behaviour, TED++ flags inputs whose LAR-based ranking sequences deviate significantly. Extensive experiments are conducted on benchmark datasets and tasks, demonstrating that TED++ achieves state-of-the-art detection performance under both adaptive-attack and limited-data scenarios. Remarkably, even with only five held-out examples per class, TED++ still delivers near-perfect detection, achieving gains of up to 14\% in AUROC over the next-best method. The code is publicly available at https://github.com/namle-w/TEDpp.

Figures (5)

• Figure 1: (a) Conceptual model of three class submanifolds and their tubular neighbourhoods, with poisoned samples (red) lying just outside the tube yet still having nearest clean neighbours in ambient space. (b) UMAP projections of CIFAR-10 activations in four ResNet-18 layers under a Trojan backdoor attack. The shaded contours indicate the estimated tubular neighbourhood around the clean‐class submanifold. Phase 1: All points—clean and poisoned—lie well inside the tube; ranks are indistinguishable. Phase 2: Poisoned points begin to drift off the clean manifold (outside the tube), but TED’s rank-based test fluctuates and fails to separate them from clean samples. Phase 3: Most poisoned samples cross the tube boundary yet still attain the lowest rank 0, showing TED cannot penalise off‐tube departures. Phase 4: Finally, clean and poisoned trajectories reconverge in the ambient space, rendering TED powerless.
• Figure 2: TED++ pipeline. Stage 1 (Ranking Computation): For each layer $\ell$, we extract activations $h^{(\ell)}(x)$, estimate the tubular‐neighbourhood radius $\tau_\ell$ around each class submanifold using clean validation activations, and apply Locally Adaptive Ranking (LAR) by assigning worst‐case ranks only to off‐tube activations while retaining natural nearest‐neighbour ranks for on‐tube activations. Stage 2 (Input Detection): Each sample is represented by its $L$-dimensional rank trajectory $R(x)=[R_1(x),\dots,R_L(x)]$. A PCA model trained on clean‐validation trajectories learns the characteristic "tube‐constrained" behaviour; at test time, samples whose reconstruction error exceeds the threshold $\theta$ are flagged as poisoned.
• Figure 3: Performance of TED++ against the Blend attack using various combinations of validation sample counts $m$ and the neighbour percentile factor $\beta$ on CIFAR-10.
• Figure 4: Comparison of AUROC scores between TED and TED++ as the number of validation samples decreases on CIFAR-10 and GTSRB.
• Figure 5: Inference times of state-of-the-art input-level defences on the CIFAR-10 dataset. We provide TED and TED++ with 5 validation samples per class, and apply default settings for the other defences.