ArcGen: Generalizing Neural Backdoor Detection Across Diverse Architectures

TL;DR

ArcGen addresses the challenge of detecting neural backdoors when target models come from unseen architectures. It introduces architecture-invariant features by adding alignment layers to the feature extractor and training with distribution- and sample-level alignment losses, guided by adversarial training against an architecture discriminator. The method achieves substantial generalization gains, with up to 42.5% AUC improvements on unseen architectures and robust performance across diverse datasets, attacks, and even under distribution shifts and adaptive evasion attempts. This approach reduces architecture-induced bias in detection features and offers practical black-box applicability, albeit with higher upfront training cost. Overall, ArcGen advances reliable backdoor detection in real-world, architecture-heterogeneous deployment scenarios.

Abstract

Backdoor attacks pose a significant threat to the security and reliability of deep learning models. To mitigate such attacks, one promising approach is to learn to extract features from the target model and use these features for backdoor detection. However, we discover that existing learning-based neural backdoor detection methods do not generalize well to new architectures not seen during the learning phase. In this paper, we analyze the root cause of this issue and propose a novel black-box neural backdoor detection method called ArcGen. Our method aims to obtain architecture-invariant model features, i.e., aligned features, for effective backdoor detection. Specifically, in contrast to existing methods directly using model outputs as model features, we introduce an additional alignment layer in the feature extraction function to further process these features. This reduces the direct influence of architecture information on the features. Then, we design two alignment losses to train the feature extraction function. These losses explicitly require that features from models with similar backdoor behaviors but different architectures are aligned at both the distribution and sample levels. With these techniques, our method demonstrates up to 42.5% improvements in detection performance (e.g., AUC) on unseen model architectures. This is based on a large-scale evaluation involving 16,896 models trained on diverse datasets, subjected to various backdoor attacks, and utilizing different model architectures. Our code is available at https://github.com/SeRAlab/ArcGen.

Figures (8)

• Figure 1: The t-SNE visualizations of features extracted by (a) MNTD and (b) ULPs for both seen and unseen model architectures on the GTSRB dataset.
• Figure 2: The workflow of the learning-based detection.
• Figure 3: An overview of the proposed ArcGen. The system comprises two main components: the feature extractor and the detector. The feature extractor is designed to extract aligned features from various model architectures, while the detector identifies backdoors based on these extracted features. To train the feature extractor effectively, we incorporate two additional losses—distribution-level alignment and sample-level alignment losses. These losses ensure that feature distributions remain indistinguishable across different architectures. The distribution-level alignment loss is achieved through adversarial learning with an architecture discriminator. Concurrently, the sample-level alignment is applied to a group of backdoored models that share the same attack settings but differ in architecture. This promotes the concentration of features from these models within the feature space, enhancing the extractor's ability to generalize across diverse architectures.
• Figure 4: The t-SNE visualization of the extracted features by different methods for different model architectures on GTSRB dataset. The color orange represents features for benign models and the blue represents features for backdoored models with BadNets attack. The scatter plot shows the distribution of model features in high-dimensional space.
• Figure 5: The importance of alignment layers. When we remove these layers, the discriminator loss struggles to converge, and the target loss cannot be effectively optimized.