Pith. sign in

REVIEW 17 cited by

Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2101.05930 v2 pith:OMPWTM4G submitted 2021-01-15 cs.LG cs.AI

Yige Li , Xixiang Lyu , Nodens Koren , Lingjuan Lyu , Bo Li , Xingjun Ma This is my paper · ORCID
classification cs.LGcs.AI
keywords backdoorcleannetworkneuralattacksattentiondatamodel
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Deep neural networks (DNNs) are known vulnerable to backdoor attacks, a training time attack that injects a trigger pattern into a small proportion of training data so as to control the model's prediction at the test time. Backdoor attacks are notably dangerous since they do not affect the model's performance on clean examples, yet can fool the model to make incorrect prediction whenever the trigger pattern appears during testing. In this paper, we propose a novel defense framework Neural Attention Distillation (NAD) to erase backdoor triggers from backdoored DNNs. NAD utilizes a teacher network to guide the finetuning of the backdoored student network on a small clean subset of data such that the intermediate-layer attention of the student network aligns with that of the teacher network. The teacher network can be obtained by an independent finetuning process on the same clean subset. We empirically show, against 6 state-of-the-art backdoor attacks, NAD can effectively erase the backdoor triggers using only 5\% clean training data without causing obvious performance degradation on clean examples. Code is available in https://github.com/bboylyg/NAD.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 17 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. TrojanDec: Data-free Detection of Trojan Inputs in Self-supervised Learning

    cs.CR 2025-01 conditional novelty 7.0 of 10

    A black-box, data-free method detects and removes patch-based trojan triggers from test images for self-supervised learning encoders.

  2. BDefects4NN: A Backdoor Defect Database for Controlled Localization Studies in Neural Networks

    cs.SE 2024-12 conditional novelty 7.0 of 10

    A new benchmark database of 1,654 backdoor-infected DNNs with neuron-level labels shows current fault localization methods identify fewer than 20% of responsible neurons on average.

  3. Lethe: Purifying Backdoored Large Language Models with Knowledge Dilution

    cs.CL 2025-08 conditional novelty 6.0 of 10

    LETHE uses parameter-level model merging plus prompt-level word definitions to dilute backdoor behavior in LLMs, cutting attack success to below 7% in most tested settings.

  4. BURN: Backdoor Unlearning via Adversarial Boundary Analysis

    cs.CR 2025-07 conditional novelty 6.0 of 10

    BURN removes backdoors from trained models by detecting poison samples through adversarial boundary distance and re-labeling them with labels recovered by adversarial perturbations.

  5. Circumventing Backdoor Space via Weight Symmetry

    cs.LG 2025-06 conditional novelty 6.0 of 10

    A weight-permutation-based two-stage mode connectivity method purifies backdoored neural networks across supervised and self-supervised learning with few clean samples.

  6. BadSR: Stealthy Label Backdoor Attacks on Image Super-Resolution

    cs.CV 2025-05 conditional novelty 6.0 of 10

    BadSR creates stealthy poisoned high-resolution labels for super-resolution backdoors, achieving above 80% attack success across five SR models while keeping labels visually close to clean images.

  7. Backdooring Outlier Detection Methods: A Novel Attack Approach

    cs.LG 2024-12 conditional novelty 6.0 of 10

    BATOD uses two trigger types to invert a classifier's inlier/outlier decisions, lowering poisoned-sample detection AUC to below 16 across tested datasets, compared with 40 to 60 for earlier backdoor attacks.

  8. BackdoorMBTI: A Backdoor Learning Multimodal Benchmark Tool Kit for Backdoor Defense Evaluation

    cs.CR 2024-11 conditional novelty 6.0 of 10

    BackdoorMBTI is the first backdoor security benchmark and toolkit that covers image, text, and audio modalities with a unified evaluation pipeline.

  9. Defense Against LLM Backdoors using Critical Neuron Isolation Pruning

    cs.CR 2026-07 conditional novelty 5.0 of 10

    A trigger-inversion plus activation-difference pruning pipeline removes LLM backdoors with ~0.1% neuron intervention and >95% relative ASR reduction.

  10. From Detection to Correction: Backdoor-Resilient Face Recognition via Vision-Language Trigger Detection and Noise-Based Neutralization

    cs.CV 2025-08 unverdicted novelty 5.0 of 10

    A majority vote of large vision-language models is claimed to detect backdoor triggers in face images, with calibrated noise correcting poisoned samples at 100% accuracy.

  11. NT-ML: Backdoor Defense via Non-target Label Training and Mutual Learning

    cs.LG 2025-08 unverdicted novelty 5.0 of 10

    NT-ML combines non-target label training and mutual learning to purify a backdoored model using a small set of clean samples.

  12. Bridging Distribution Shift and AI Safety: Conceptual and Methodological Synergies

    cs.LG 2025-05 conditional novelty 5.0 of 10

    The paper proposes a one-to-one mapping between six causes of distribution shift and several AI safety issues, arguing for mutual method transfer through aligned definitions.

  13. An Effective and Resilient Backdoor Attack Framework against Deep Neural Networks and Vision Transformers

    cs.CV 2024-12 conditional novelty 5.0 of 10

    Attention-guided trigger placement with co-optimized training and alternating clean retraining achieves high backdoor attack success at low poison ratios on CNNs and vision transformers, while evading several publishe...

  14. A Robust Attack: Displacement Backdoor Attack

    cs.CR 2025-02 conditional novelty 4.0 of 10

    Displacement Backdoor Attack blends shifted self-copies of an image into the original as a backdoor trigger and reportedly maintains high attack success under data augmentation.

  15. Neutralizing Backdoors through Information Conflicts for Large Language Models

    cs.CL 2024-11 conditional novelty 4.0 of 10

    A trigger-agnostic defense that merges a backdoored LLM with a clean-data LoRA model and adds contradictory prompt evidence, reducing attack success while keeping most clean-task accuracy.

  16. BadScan: An Architectural Backdoor Attack on Visual State Space Models

    cs.CV 2024-11 reject novelty 4.0 of 10

    BadScan is a trigger-activated architectural backdoor for VMamba that replaces the standard 2D selective scan with malformed scans at inference time.

  17. A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluations

    cs.CR 2025-02 conditional novelty 2.0 of 10

    A literature review that taxonomizes LLM backdoor attacks and defenses by model construction phase, with no new experimental results.

Pith tools