Pith. sign in

REVIEW 68 references

Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasets

T0 review · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read T-Core, a bootstrapping defense that sifts clean data and filters trusted encoder channels, reduces backdoor attack success rates below 10% across encoder and dataset poisoning threats in transfer learning.

arxiv 2504.11990 v1 pith:CIJJ3O5R submitted 2025-04-16 cs.LG cs.CR

Yechao Zhang , Yuxuan Zhou , Tianyu Li , Minghui Li , Shengshan Hu , Wei Luo , Leo Yu Zhang This is my paper · ORCID
classification cs.LGcs.CR
keywords backdoorlearningencoderspre-trainedtrainingtransferacrossadaptation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Transfer learning lets developers take a pre-trained model and adapt it to a new task with only a small amount of data and computing. That convenience also creates a security risk: the pre-trained model or the training data may carry a hidden backdoor, a pattern that makes the final model misbehave when the pattern appears. Existing defenses mostly try to find and remove poisoned samples or neurons after the fact, and they were designed for training a full model from scratch, which is too expensive for many users.

T-Core flips the strategy. Instead of hunting for poison, it first picks out a small set of high-confidence clean examples. It does this by checking whether a sample stays in the same majority group across several layers of the network, which poisoned samples usually fail to do. It then expands this clean seed set, filters the encoder's neurons to keep only those that support clean recognition, and gradually trains a model on the growing clean pool, leaving suspicious samples out.

The paper evaluates T-Core against five encoder poisoning attacks, seven dataset poisoning attacks, and three combined threat scenarios on five image datasets. In most tested cases it keeps attack success rates under 10% while preserving accuracy. The main open points are that the authors do not release code or error bars, and an adaptive attacker with a large perturbation budget can still break the first sifting step.

Extended reading notes

Core claim

T-Core defends against all three backdoor threats in transfer learning (encoder poisoning, dataset poisoning, and adaptive poisoning), keeping attack success rates below 10% while maintaining accuracy, even when defenders only fine-tune the classification head and a small fraction of encoder parameters. The paper states: 'T-Core effectively defends against all considered backdoor threats, as shown in Tables 9 to 11. Specifically, the attack success rates for Threat-1, Threat-2, and Threat-3 are all below 10%.'

Load-bearing premise

The initial seed sifting (TIS) assumes poisoned samples are a minority in each class and are topologically inconsistent across network layers (Majority Rule and Consistency Rule, Sec 4.1.1). If an attacker crafts triggers that place poisoned samples in the majority clusters with consistent neighbors, the clean seed set is contaminated and the whole bootstrapping pipeline inherits the backdoor. The adaptive attack in Sec 5.6.1 demonstrates this: at l-infinity perturbation budget 16, TIS selects 38 poisoned samples as clean and ASR jumps to 92.5%.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Assumptions & free parameters 9 free parameters · 4 assumptions · 0 invented entities

T-Core is an empirical defense framework without a formal derivation. It relies on several hand-set hyperparameters and domain assumptions about the structure of poisoned versus clean data. The hyperparameters are documented and some are ablated, but no error bars or formal guarantees are provided. The main assumptions are about seed sifting reliability and clean subset expansion, which the adaptive attack section shows can be violated under large perturbations.

free parameters (9)
  • alpha (seed data proportion) = 1%
    Appendix A sets alpha to 1% as the 'very high standard' for seed sifting; this determines how many samples enter the trusted core and affects downstream defense quality.
  • m (number of nearest neighbors) = 50
    Appendix A sets m=50 for the Consistency Rule in TIS; this controls how strict the local topological invariance check is.
  • rexpand (seed expansion ratio) = 5%
    Appendix A sets rexpand to 5% for each expansion iteration in Seed Expansion; this controls the growth rate of the clean subset and its contamination risk.
  • Dsub size before encoder filtering = 10% of D
    Appendix A stops Seed Expansion when Dsub reaches 10% of D; this is a manually chosen balance between clean subset size and confidence.
  • ACCmin (unlearning stopping accuracy) = 20%
    Appendix A stops the selective unlearning process once training accuracy drops below 20%; this threshold affects how much clean performance is sacrificed before recovery.
  • channel filtering threshold (keep ratio) = 90%
    Appendix A states that 90% of channels are identified as trusted and 10% are untrusted; this ratio is set based on empirical observations and is not derived.
  • gamma1, gamma2, gamma3 (bootstrapping selection rates) = 2%, 2%, 5%
    Appendix A sets these selection rates for clean pool expansion; Table 13 shows that ASR is sensitive to gamma1 and gamma2, indicating these are load-bearing hand-set parameters.
  • rho (bootstrapping halt ratio) = 90%
    Appendix A sets rho to 90% as the stopping condition for clean pool expansion; Table 14 shows that ASR rises sharply when rho exceeds 90%, so this is a critical tuned parameter.
  • L (number of layers considered in TIS) = 3
    Appendix A records activations from the encoder output and the first two classifier layers; the number of layers is chosen by hand and not ablated.
assumptions (4)
  • domain assumption Majority Rule: poisoned samples are a minority within each class and form smaller clusters across all considered layers.
    Sec 4.1.1 invokes this rule to select the largest cluster in each layer; if poison ratio exceeds 50% or poisons are engineered into the majority cluster, TIS fails.
  • domain assumption Consistency Rule: clean samples have consistent nearest neighbors from the same class across different DNN layers, whereas poisoned samples do not.
    Sec 4.1.1 uses this to refine seed candidates; the adaptive attack in Sec 5.6.1 shows this assumption can be violated with sufficient perturbation budget.
  • domain assumption After confusion training with a small clean seed, the largest-loss region of the training set is populated almost exclusively by clean samples.
    Sec 4.1.2 and Fig. 6 rely on this empirical observation to expand the clean subset; it is demonstrated for 7 attacks and 4 poison ratios, but not guaranteed for future attacks.
  • domain assumption Clean hard examples are harder to learn than easily inserted backdoor-poisoned examples, and any mistakenly selected poisoned samples require significantly more data and training to become effective.
    Sec 4.3 uses this rationale for the meta-guidance expansion step; the paper provides no formal proof, only empirical intuition.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasets." pith.science (2026). https://pith.science/paper/CIJJ3O5R

@misc{pith2026250411990,
  author       = {Pith},
  title        = {Pith review of: Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasets},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CIJJ3O5R}},
  note         = {Machine review of arXiv:2504.11990}
}
read the original abstract

Transfer learning from pre-trained encoders has become essential in modern machine learning, enabling efficient model adaptation across diverse tasks. However, this combination of pre-training and downstream adaptation creates an expanded attack surface, exposing models to sophisticated backdoor embeddings at both the encoder and dataset levels--an area often overlooked in prior research. Additionally, the limited computational resources typically available to users of pre-trained encoders constrain the effectiveness of generic backdoor defenses compared to end-to-end training from scratch. In this work, we investigate how to mitigate potential backdoor risks in resource-constrained transfer learning scenarios. Specifically, we conduct an exhaustive analysis of existing defense strategies, revealing that many follow a reactive workflow based on assumptions that do not scale to unknown threats, novel attack types, or different training paradigms. In response, we introduce a proactive mindset focused on identifying clean elements and propose the Trusted Core (T-Core) Bootstrapping framework, which emphasizes the importance of pinpointing trustworthy data and neurons to enhance model security. Our empirical evaluations demonstrate the effectiveness and superiority of T-Core, specifically assessing 5 encoder poisoning attacks, 7 dataset poisoning attacks, and 14 baseline defenses across five benchmark datasets, addressing four scenarios of 3 potential backdoor threats.

Figures

Figures reproduced from arXiv: 2504.11990 by the authors.

Figure 2
Figure 2. Distribution of poisoned and clean samples in [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Comparison of average training losses for poi [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. CLP performance on different types of threat from an [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: The scatter plot of the upper bound of acti [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Number of poison samples in the largest loss region of the target class after seed expansion. Experiments are [PITH_FULL_IMAGE:figures/full_fig_p020_6.png]
Figure 7
Figure 7. Figure 7: Implementation of the MaskedLinear class, which applies a trainable mask to the weights of a linear layer. We use this code to transform a linear layer of ViT into a masked layer. The mask is clamped between 0 and 1 to ensure valid weight adjustments [PITH_FULL_IMAGE:…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

68 extracted references · 60 canonical work pages

  1. [1]

    Badnets: Evaluating backdooring attacks on deep neural networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “Badnets: Evaluating backdooring attacks on deep neural networks,” IEEE Access, vol. 7, pp. 47230–47244, 2019

    work page 2019

  2. [2]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,”arXiv preprint arXiv:1712.05526, 2017

    arXiv 2017

  3. [3]

    Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning,

    S. Liang, M. Zhu, A. Liu, B. Wu, X. Cao, and E.-C. Chang, “Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024

    work page 2024

  4. [4]

    BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning,

    J. Jia, Y . Liu, and N. Z. Gong, “BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning,” in 2022 IEEE Symposium on Security and Privacy (SP 22), pp. 2043–2059, 2022

    work page 2022

  5. [5]

    Backdoor Attacks Against Transfer Learning With Pre-Trained Deep Learning Models,

    S. Wang, S. Nepal, C. Rudolph, M. Grobler, S. Chen, and T. Chen, “Backdoor Attacks Against Transfer Learning With Pre-Trained Deep Learning Models,” IEEE Transactions on Services Computing, vol. 15, pp. 1526–1539, May 2022

    work page 2022

  6. [6]

    An em- barrassingly simple backdoor attack on self-supervised learning,

    C. Li, R. Pang, Z. Xi, T. Du, S. Ji, Y . Yao, and T. Wang, “An em- barrassingly simple backdoor attack on self-supervised learning,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pp. 4367–4378, October 2023

    work page 2023

  7. [7]

    Dis- tribution Preserving Backdoor Attack in Self-supervised Learning,

    G. Tao, Z. Wang, S. Feng, G. Shen, S. Ma, and X. Zhang, “Dis- tribution Preserving Backdoor Attack in Self-supervised Learning,” in 2024 IEEE Symposium on Security and Privacy (SP 24), IEEE Computer Society, 2024. ISSN: 2375-1207

    work page 2024

  8. [8]

    Back- door attacks on self-supervised learning,

    A. Saha, A. Tejankar, S. A. Koohpayegani, and H. Pirsiavash, “Back- door attacks on self-supervised learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 22), pp. 13337–13346, 2022

    work page 2022

Show all 68 references
  1. [9]

    CorruptEncoder: Data poi- soning based backdoor attacks to contrastive learning,

    J. Zhang, H. Liu, J. Jia, and N. Z. Gong, “CorruptEncoder: Data poi- soning based backdoor attacks to contrastive learning,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 24), 2024

    2024

  2. [10]

    A new backdoor attack in cnns by training set corruption without label poisoning,

    M. Barni, K. Kallas, and B. Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” in 2019 IEEE International Conference on Image Processing (ICIP 19), pp. 101– 105, IEEE, 2019

    2019

  3. [11]

    Demon in the variant: Statistical analysis of DNNs for robust backdoor contamination de- tection,

    D. Tang, X. Wang, H. Tang, and K. Zhang, “Demon in the variant: Statistical analysis of DNNs for robust backdoor contamination de- tection,” in 30th USENIX Security Symposium (USENIX Security 21), pp. 1541–1558, 2021

    2021

  4. [12]

    Revisiting the assumption of latent separability for backdoor defenses,

    X. Qi, T. Xie, Y . Li, S. Mahloujifar, and P. Mittal, “Revisiting the assumption of latent separability for backdoor defenses,” in The eleventh International Conference on Learning Representations (ICLR 23), 2023

    2023

  5. [13]

    WaNet - imperceptible warping- based backdoor attack,

    T. A. Nguyen and A. T. Tran, “WaNet - imperceptible warping- based backdoor attack,” in International Conference on Learning Representations (ICLR 21), 2021

    2021

  6. [14]

    Backdoor defense via deconfounded representation learning,

    Z. Zhang, Q. Liu, Z. Wang, Z. Lu, and Q. Hu, “Backdoor defense via deconfounded representation learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 23), pp. 12228–12238, 2023

    2023

  7. [15]

    Anti-Backdoor Learning: Training Clean Models on Poisoned Data,

    Y . Li, X. Lyu, N. Koren, L. Lyu, B. Li, and X. Ma, “Anti-Backdoor Learning: Training Clean Models on Poisoned Data,” in Advances in Neural Information Processing Systems (NeurIPS 21), vol. 34, pp. 14900–14912, Curran Associates, Inc., 2021

    2021

  8. [16]

    SPECTRE: defending against backdoor attacks using robust statistics,

    J. Hayase, W. Kong, R. Somani, and S. Oh, “SPECTRE: defending against backdoor attacks using robust statistics,” in Proceedings of the 38th International Conference on Machine Learning (ICML 21), 2021

    2021

  9. [17]

    Data-free backdoor re- moval based on channel lipschitzness,

    R. Zheng, R. Tang, J. Li, and L. Liu, “Data-free backdoor re- moval based on channel lipschitzness,” in European Conference on Computer Vision (ECCV 22), pp. 175–191, Springer, 2022

    2022

  10. [18]

    Detecting backdoor attacks on deep neural networks by activation clustering,

    B. Chen, W. Carvalho, N. Baracaldo, H. Ludwig, B. Edwards, T. Lee, I. Molloy, and B. Srivastava, “Detecting backdoor attacks on deep neural networks by activation clustering,” arXiv preprint arXiv:1811.03728, 2018

    2018 arXiv

  11. [19]

    Spectral signatures in backdoor attacks,

    B. Tran, J. Li, and A. Madry, “Spectral signatures in backdoor attacks,” in Advances in Neural Information Processing Systems (NeurIPS 18), pp. 8000–8010, 2018

    2018

  12. [20]

    ASSET: Robust back- door data detection across a multiplicity of deep learning paradigms,

    M. Pan, Y . Zeng, L. Lyu, X. Lin, and R. Jia, “ASSET: Robust back- door data detection across a multiplicity of deep learning paradigms,” in 32nd USENIX Security Symposium (USENIX Security 23), pp. 2725–2742, 2023

    2023

  13. [21]

    Towards a proactive ML approach for detecting backdoor poison samples,

    X. Qi, T. Xie, J. T. Wang, T. Wu, S. Mahloujifar, and P. Mittal, “Towards a proactive ML approach for detecting backdoor poison samples,” in 32nd USENIX Security Symposium (USENIX Security 23), pp. 1685–1702, 2023

    2023

  14. [22]

    STRIP: A defence against trojan attacks on deep neural networks,

    Y . Gao, C. Xu, D. Wang, S. Chen, D. C. Ranasinghe, and S. Nepal, “STRIP: A defence against trojan attacks on deep neural networks,” in Proceedings of the 35th Annual Computer Security Applications Conference (ACSAC 19), pp. 113–125, 2019

    2019

  15. [23]

    IBD-PSC: Input-level backdoor detection via parameter-oriented scaling consis- tency,

    L. Hou, R. Feng, Z. Hua, W. Luo, L. Y . Zhang, and Y . Li, “IBD-PSC: Input-level backdoor detection via parameter-oriented scaling consis- tency,” in Forty-first International Conference on Machine Learning (ICML 24), 2024

    2024

  16. [24]

    SCALE- UP: An efficient black-box input-level backdoor detection via ana- lyzing scaled prediction consistency,

    J. Guo, Y . Li, X. Chen, H. Guo, L. Sun, and C. Liu, “SCALE- UP: An efficient black-box input-level backdoor detection via ana- lyzing scaled prediction consistency,” in The Eleventh International Conference on Learning Representations (ICLR 23), 2023

    2023

  17. [25]

    Adversarial unlearning of backdoors via implicit hypergradient,

    Y . Zeng, S. Chen, W. Park, Z. Mao, M. Jin, and R. Jia, “Adversarial unlearning of backdoors via implicit hypergradient,” in International Conference on Learning Representations (ICLR 22), 2022

    2022

  18. [26]

    Enhancing fine-tuning based backdoor defense with sharpness-aware minimization,

    M. Zhu, S. Wei, L. Shen, Y . Fan, and B. Wu, “Enhancing fine-tuning based backdoor defense with sharpness-aware minimization,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV 23), 2023

    2023

  19. [27]

    On the effectiveness of distil- lation in mitigating backdoors in pre-trained encoder,

    T. Han, S. Huang, Z. Ding, W. Sun, Y . Feng, C. Fang, J. Li, H. Qian, C. Wu, Q. Zhang, et al., “On the effectiveness of distil- lation in mitigating backdoors in pre-trained encoder,” arXiv preprint arXiv:2403.03846, 2024

    2024

  20. [28]

    Februus: Input purification defense against trojan attacks on deep neural network systems,

    B. G. Doan, E. Abbasnejad, and D. C. Ranasinghe, “Februus: Input purification defense against trojan attacks on deep neural network systems,” in Proceedings of the 36th Annual Computer Security Applications Conference (ACSAC 20), pp. 897–912, 2020

    2020

  21. [29]

    Backdoor attack in the physical world,

    Y . Li, T. Zhai, Y . Jiang, Z. Li, and S.-T. Xia, “Backdoor attack in the physical world,” arXiv preprint arXiv:2104.02361, 2021

    2021 arXiv

  22. [30]

    Deepsweep: An evaluation framework for mitigating dnn back- door attacks using data augmentation,

    H. Qiu, Y . Zeng, S. Guo, T. Zhang, M. Qiu, and B. Thuraisingham, “Deepsweep: An evaluation framework for mitigating dnn back- door attacks using data augmentation,” in Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security (AsiaCCS 21), pp. 363–377, 2021

    2021

  23. [31]

    Detecting backdoors during the inference stage based on corruption robustness consistency,

    X. Liu, M. Li, H. Wang, S. Hu, D. Ye, H. Jin, L. Wu, and C. Xiao, “Detecting backdoors during the inference stage based on corruption robustness consistency,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 23), pp. 16363– 16372, 2023

    2023

  24. [32]

    Robust backdoor detection for deep learning via topo- logical evolution dynamics,

    X. Mo, Y . Zhang, L. Zhang, W. Luo, N. Sun, S. Hu, S. Gao, and Y . Xiang, “Robust backdoor detection for deep learning via topo- logical evolution dynamics,” in 2024 IEEE Symposium on Security and Privacy (SP 24), (Los Alamitos, CA, USA), pp. 174–174, IEEE Computer Society, may 2024

    2024

  25. [33]

    The ”Beat- rix

    W. Ma, D. Wang, R. Sun, M. Xue, S. Wen, and Y . Xiang, “The ”Beat- rix” Resurrections: Robust backdoor detection via gram matrices,” in NDSS, 2023

    2023

  26. [34]

    Backdoor defense via decoupling the training process,

    K. Huang, Y . Li, B. Wu, Z. Qin, and K. Ren, “Backdoor defense via decoupling the training process,” in Proceedings of the International Conference on Learning Representations (ICLR 22), 2022

    2022

  27. [35]

    Training with more confi- dence: Mitigating injected and natural backdoors during training,

    Z. Wang, H. Ding, J. Zhai, and S. Ma, “Training with more confi- dence: Mitigating injected and natural backdoors during training,” in Advances in Neural Information Processing Systems (NeurIPS 22) (A. H. Oh, A. Agarwal, D. Belgrave, and K. Cho, eds.), 2022

    2022

  28. [36]

    Progressive poisoned data isolation for training-time backdoor defense,

    Y . Chen, H. Wu, and J. Zhou, “Progressive poisoned data isolation for training-time backdoor defense,” in Proceedings of the AAAI Conference on Artificial Intelligence (AAAI 24), pp. 11425–11433, 2024

    2024

  29. [37]

    Fine-Pruning: Defending against backdooring attacks on deep neural networks,

    K. Liu, B. Dolan-Gavitt, and S. Garg, “Fine-Pruning: Defending against backdooring attacks on deep neural networks,” inInternational Symposium on Research in Attacks, Intrusions and Defenses (RAID 18), pp. 273–294, Springer, 2018

    2018

  30. [38]

    Towards inspecting and eliminating trojan backdoors in deep neural networks,

    W. Guo, L. Wang, Y . Xu, X. Xing, M. Du, and D. Song, “Towards inspecting and eliminating trojan backdoors in deep neural networks,” in 2020 IEEE International Conference on Data Mining (ICDM 20), IEEE, 2020

    2020

  31. [39]

    Backdoor scanning for deep neural networks through k- arm optimization,

    G. Shen, Y . Liu, G. Tao, S. An, Q. Xu, S. Cheng, S. Ma, and X. Zhang, “Backdoor scanning for deep neural networks through k- arm optimization,” in International Conference on Machine Learning (ICML 21), pp. 9525–9536, PMLR, 2021

    2021

  32. [40]

    Neural Cleanse: Identifying and mitigating backdoor attacks in neural networks,

    B. Wang, Y . Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y . Zhao, “Neural Cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE Symposium on Security and Privacy (SP 19), pp. 707–723, May 2019

    2019

  33. [41]

    Detecting backdoors in pre-trained encoders,

    S. Feng, G. Tao, S. Cheng, G. Shen, X. Xu, Y . Liu, K. Zhang, S. Ma, and X. Zhang, “Detecting backdoors in pre-trained encoders,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 23), pp. 16352–16362, 2023

    2023

  34. [42]

    Backdoor defense via adaptively splitting poisoned dataset,

    K. Gao, Y . Bai, J. Gu, Y . Yang, and S.-T. Xia, “Backdoor defense via adaptively splitting poisoned dataset,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 23), 2023

    2023

  35. [43]

    Model-agnostic meta-learning for fast adaptation of deep networks,

    C. Finn, P. Abbeel, and S. Levine, “Model-agnostic meta-learning for fast adaptation of deep networks,” in International Conference on Machine Learning (ICML 17), pp. 1126–1135, PMLR, 2017

    2017

  36. [44]

    Learning multiple layers of features from tiny im- ages,

    A. Krizhevsky, “Learning multiple layers of features from tiny im- ages,” Tech Report, 2009

    2009

  37. [45]

    Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,

    J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition,” Neural networks, vol. 32, pp. 323–332, 2012

    2012

  38. [46]

    Reading digits in natural images with unsupervised feature learning,

    Y . Netzer, T. Wang, A. Coates, A. Bissacco, B. Wu, and A. Y . Ng, “Reading digits in natural images with unsupervised feature learning,” in NIPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011

    2011

  39. [47]

    An analysis of single-layer networks in unsupervised feature learning,

    A. Coates, A. Ng, and H. Lee, “An analysis of single-layer networks in unsupervised feature learning,” in AISTATS, 2011

    2011

  40. [48]

    ImageNet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “ImageNet: A large-scale hierarchical image database,” in 2009 IEEE Conference on Computer Vision and Pattern Recognition (CVPR 09), pp. 248–255, IEEE, 2009

    2009

  41. [49]

    META- SIFT : How to sift out a clean subset in the presence of data poi- soning?,

    Y . Zeng, M. Pan, H. Jahagirdar, M. Jin, L. Lyu, and R. Jia, “META- SIFT : How to sift out a clean subset in the presence of data poi- soning?,” in 32nd USENIX Security Symposium (USENIX Security 23), pp. 1667–1684, 2023

    2023

  42. [50]

    Mutual information guided backdoor mitigation for pre- trained encoders,

    T. Han, W. Sun, Z. Ding, C. Fang, H. Qian, J. Li, Z. Chen, and X. Zhang, “Mutual information guided backdoor mitigation for pre- trained encoders,” arXiv preprint arXiv:2406.03508, 2024

    2024

  43. [51]

    Mitigat- ing Backdoor Attacks in Pre-Trained Encoders via Self-Supervised Knowledge Distillation ,

    R. Bie, J. Jiang, H. Xie, Y . Guo, Y . Miao, and X. Jia, “ Mitigat- ing Backdoor Attacks in Pre-Trained Encoders via Self-Supervised Knowledge Distillation ,” IEEE Transactions on Services Computing, vol. 17, pp. 2613–2625, Sept. 2024

    2024

  44. [52]

    A density-based algorithm for discovering clusters in large spatial databases with noise,

    M. Ester, H.-P. Kriegel, J. Sander, X. Xu, et al., “A density-based algorithm for discovering clusters in large spatial databases with noise,” in KDD, pp. 226–231, 1996. Appendix A. Implementation Details of T-Core In Sec. 4, we present the overall algorithmic details of our T...

    1996

  45. [53]

    https://github.com/leftthomas/SimCLR

  46. [54]

    https://github.com/UMBCvision/SSL-Backdoor

  47. [55]

    https://github.com/jinyuan-jia/BadEncoder

  48. [56]

    https://github.com/Gwinhen/DRUPE

  49. [57]

    https://github.com/jzhang538/CorruptEncoder

  50. [58]

    Car” for STL-10, “Bird

    https://github.com/vtu81/backdoor-toolbox experimental setups for certain attack methods on some datasets. For instance, TaCT attack on ImageNet is originally not supported. We conducted experiments by adapting the settings from other datasets. Trigger and Target Class: In the...

  51. [59]

    https://github.com/Unispac/Fight-Poison-With-Poison

  52. [60]

    https://github.com/THUYimingLi/BackdoorBox

  53. [61]

    https://github.com/reds-lab/ASSET

  54. [62]

    https://github.com/bboylyg/ABL

  55. [63]

    https://github.com/zaixizhang/CBD

  56. [64]

    https://github.com/rkteddy/channel-Lipschitzness-based-pruning

  57. [65]

    https://github.com/wssun/SSLBackdoorMitigation

  58. [66]

    https://github.com/ruoxi-jia-group/Meta-Sift

  59. [67]

    https://github.com/SCLBD/BackdoorBench

  60. [68]

    https://github.com/YiZeng623/I-BAU TABLE 19: Performance of the state-of-the-art inference-time defenses SCALE-UP and IBD-PSC under different threat scenarios, using the CIFAR-10 dataset. SCALE-UP IBD-PSCThreat Type Poisoning Method TPR(%) ↑ FPR(%) ↓ AUC↑ F1↑ TPR(%) ↑ FPR(%) ↓...

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.