Pith. sign in

REVIEW 4 major objections 5 minor 47 references

Backdoor knowledge can be trapped in a decoy branch during training and removed by dropping that branch.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Backdoors can be trapped by a decoy shortcut branch trained alongside the main network and removed simply by discarding that branch, no extra data needed.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection A genuinely useful training-time defense with strong empirical results, but the theoretical framing outruns the evidence and the shortcut's effectiveness is fragile to capacity mismatch. the 4 major comments →

arxiv 2608.00732 v1 pith:PBTF5VUF submitted 2026-08-01 cs.LG cs.CV

Mitigating Backdoors via Decoy Shortcuts and Knowledge Decoupling

Zixuan Zhu , Rui Wang , Lihua Jing , Jinwen Zhong This is my paper
classification cs.LG cs.CV
keywords backdoor attacksbackdoor defensedata poisoningshortcut learninghoneypotknowledge decouplingsimplicity biastraining-time defense
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Backdoor attacks plant a trigger-to-target-label association into poisoned training data, and the paper's central observation is that this association is learned faster and more strongly by a small parallel shortcut branch than by the deep main network. The authors turn that asymmetry into a training-time defense called Trapping and Removing (TR): before training, add a lightweight honeypot branch next to the backbone; during training, decouple the two branches' knowledge so poisoned samples flow into the honeypot and benign samples stay with the main network; afterwards, delete the honeypot. The result, if the paper's experiments are right, is that the backdoor disappears with no extra clean data, no fine-tuning, and little loss of accuracy on benign inputs. This matters because data-poisoning backdoors are hard to erase after the fact, so a defense that works during training and needs no clean reference set addresses a practical bottleneck.

Core claim

On the paper's own terms, the central claim is that backdoor knowledge exhibits a simplicity bias: when a shallow shortcut branch and the deep backbone are jointly trained on poisoned data, the shortcut branch quickly becomes the dominant learner of the trigger-to-target mapping, visible as high attack success rate and low benign accuracy in the shortcut during early epochs. The paper supports this with a gradient-flow analysis in which poisoned samples deliver consistent, constructively aligned gradients and the shortcut's attention unit amplifies them, yielding a winner-take-all gradient flow toward the shortcut for poisoned samples while clean-sample gradients stay balanced. TR exploits t

What carries the argument

The honeypot shortcut: a lightweight branch of Conv-Attention-BN-ReLU blocks (or transformer blocks for ViTs) that runs from the input straight to the classifier, structured so its spatial attention quickly highlights trigger regions. The mechanism is carried by the interaction of the attention map's gradient focusing, the simplicity bias of the shallow branch, and the knowledge-decoupling loss L = Lc + Lg + Lh + Ldpf + α Ldpp, with entropy-based weights wo and wh controlling how much each branch contributes to the final prediction.

Load-bearing premise

The defense assumes that any backdoor trigger is simpler and faster to learn than the benign content of an image, so the shallow honeypot branch will capture it first and the main network will not memorize it.

What would settle it

Train TR with a trigger whose pattern varies across poisoned samples and is designed to have high prediction entropy for the shortcut, then measure the original branch's attack success rate at convergence. If the original branch's ASR stays high, the simplicity-bias premise fails.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • TR is reported to reduce attack success rate to near zero on ten attacks, including BadNets, Blend, WaNet, Dynamic, and clean-label attacks, while keeping benign accuracy within a few points of the no-attack baseline.
  • Because the defense runs during training and the honeypot is discarded afterwards, it neither needs a clean validation set nor post-hoc trigger detection.
  • The same architecture works for training-from-scratch image attacks and for fine-tuning-style attacks on ViTs, suggesting the shortcut-simplicity principle transfers across model families.
  • Class-wise analysis on the imbalanced GTSRB dataset shows the main branch can still learn rare classes even though the shortcut absorbs easy patterns.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the simplicity-bias assumption is general, TR suggests a practical recipe for defending any training pipeline: give the model an explicitly simpler 'leaky' pathway, and the model's own inductive bias will route undesirable correlations into it.
  • A likely attack direction not fully resolved by the paper is a trigger engineered to have high entropy and slow, variable learning so that the shortcut cannot dominate its gradient flow; such a trigger would test the boundary of the method.
  • TR could double as a diagnostic: samples that the honeypot classifies with very high confidence into the target class are exactly the candidates for poisoned data, so the decoy branch's predictions could be exported as a poisoning detector.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes TR, a training-time backdoor defense for image classifiers. A lightweight parallel 'honeypot' shortcut branch is added to the network; the full model is trained with a classification loss plus feature- and prediction-level decoupling losses and an entropy-based weighting scheme, and the shortcut is discarded after training. The central claim is that backdoor knowledge is preferentially absorbed by the shortcut branch, so removal of that branch yields a clean model without additional data. The paper reports extensive experiments on CIFAR-10, GTSRB, CIFAR-100, and ImageNet-1k with several CNN and ViT architectures, compares against ten defenses, and includes ablations, poisoning-rate robustness, and an appendix on adaptive attacks.

Significance. If the claimed mechanism holds broadly, TR is practically attractive: it is a training-time defense that requires no clean reference data, works from scratch, and the reported numbers are strong (ASR often below 1% with BA close to the no-defense baseline). The empirical breadth, the release of code, and the inclusion of clean-label and sample-specific attacks are assets. However, the general validity of the underlying 'simplicity bias' premise is not rigorously established, and the adaptive-attack evaluation does not test the worst case. The paper's value is therefore conditional on tightening the theoretical and threat-model claims.

major comments (4)
  1. [Appendix B, Eq. (19)] The central inequality ||∂f_h/∂θ_h|| >> ||∂f_o/∂θ_o|| for poisoned samples is asserted via attention gating and simplicity bias, not derived. Figure 6 shows empirical gradient-ratio surges for the tested attacks, but there is no bound or characterization of the trigger classes for which the inequality holds. Since this inequality is what makes the honeypot trap universal, the paper should either prove it under explicit assumptions or restrict the defense claim to trigger classes satisfying it. Moreover, Table 2 shows that the decoupling losses L_g, L_h, L_dpf, and L_dpp do substantial work, so the gradient-flow argument alone does not explain the final defense behavior.
  2. [Table 12] The capacity-sensitivity ablation undermines the universal-simplicity claim. For WaNet and Dynamic, only the exact Base shortcut achieves low ASR; Small, Large, and W/O Attention variants leave ASR at 65–88%. This shows the trap is not automatic but requires matching shortcut capacity to trigger complexity. The 'adaptive shortcut generation' in Section 4.2 is a heuristic tied to the number of downsampling stages; the paper should provide a principled criterion or a systematic sensitivity analysis. As written, a defender facing an unknown attack cannot know the appropriate capacity, and the claim that the shortcut 'preferentially captures' backdoor knowledge is not robust across the tested shortcut configurations.
  3. [Appendix C] The adaptive attacks are not worst-case. C.1 optimizes triggers against a surrogate model Fθ and then evaluates on a newly initialized model; C.2 and C.3 likewise rely on the limited transferability of instance-specific triggers. The reported success is therefore evidence of trigger non-transferability rather than robustness of TR. An attacker who, per the Appendix's setup, knows the architecture and the loss in Eq. (12) could optimize δ to minimize ||∇_{θ_h} L||/||∇_{θ_o} L|| or to maximize shortcut entropy directly. Such an attack should be added, or the robustness claim should be weakened to 'non-transferable surrogate-optimized triggers.' The conclusion's concession that optimized/semantic attacks are future work should also appear in the main text, since it materially narrows the claimed scope.
  4. [Eq. (12) and Appendix E.3] The method has four jointly optimized losses plus the weighting factor α, and α is tuned per dataset (α=1 for CIFAR-10, linear decay 2→1 for GTSRB). Table 2 shows that omitting any term causes failures for some attacks, and Figure 9 shows that α is a critical hyperparameter with non-monotonic effects. This is not fatal, but the paper should report sensitivity over α for all datasets and attacks and discuss how a defender chooses α without knowing whether the data is poisoned. Currently the defense appears to require attack-specific or dataset-specific tuning, which is not reflected in the 'no additional data' framing.
minor comments (5)
  1. [Eq. (6)] The entropy-based weights are undefined if both entropies are zero. Please add a numerical safeguard or state the convention used in the implementation.
  2. [Section 4.2] The term 'automatic shortcut generation' is misleading: the number of blocks is set by the number of downsampling stages in the backbone, but Table 12 shows this does not determine whether the shortcut will trap WaNet/Dynamic. Clarify that 'automatic' means architecture-adaptive, not attack-adaptive.
  3. [Section 3.2 vs. Appendix C] Section 3.2 says the attacker has no access to model architecture or loss functions, while Appendix C assumes the attacker knows the architecture and defense. State explicitly that Appendix C considers a strictly stronger attacker and explain why the main threat model remains relevant.
  4. [Table 5 caption] The caption says 'CDB' but the baseline is CBD (Section 2.1). Please correct the typo.
  5. [General] The paper should state in the abstract or introduction that optimized attacks (e.g., LOTUS, IBA) are out of scope, since the conclusion already concedes this. This would align the claimed contribution with the evaluated attack classes.

Circularity Check

0 steps flagged

No significant circularity: TR is evaluated against external backdoor attacks and its training losses do not encode the test-time ASR metric.

full rationale

The paper's central claim is that a parallel shortcut branch absorbs backdoor knowledge during training and can be discarded afterward. This is an empirical finding supported by Figure 2 and Appendix B, not an identity. The defense is evaluated with standard, pre-existing attacks (BadNets, Blend, WaNet, Dynamic, SIG, CL, etc.) using released implementations, and the reported ASR is measured on poisoned test data after discarding the shortcut. The training losses L_c, L_g, L_h, L_dpf, and L_dpp do not use the test set or the ASR metric; they use prediction entropy and feature/prototype distances computed on the training data. Thus the low ASR is not fitted or encoded as the evaluation quantity. The gradient-flow analysis in Appendix B is a heuristic post-hoc explanation based on external simplicity-bias literature and the paper's own gradient measurements, not a circular derivation. The paper cites its own prior work (Zhu et al. 2023) for background and as a baseline, but the central mechanism is independently demonstrated in Figures 2, 4, 6, and 7, so the self-citations are not load-bearing. Fragility of the shortcut size (Table 12) and transferability limitations of the adaptive attacks (Appendix C) are legitimate robustness/correctness concerns, but they do not make the derivation circular.

Axiom & Free-Parameter Ledger

3 free parameters · 3 axioms · 1 invented entities

The method relies on a small set of tuned hyperparameters (alpha, shortcut size, warmup epoch) and on the domain assumption that backdoor triggers are essentially simple patterns that a shallow branch can learn faster. The honeypot branch itself is an invented architectural component with no independent evidence outside the paper.

free parameters (3)
  • decoupling weight alpha = 1 for CIFAR-10; linearly decreased 2 to 1 for GTSRB
    Tuned per dataset; ablation in Appendix E.3 shows performance varies with alpha, and a GTSRB-specific schedule is introduced.
  • shortcut size (number of blocks) = 2 blocks for WRN-16-1, 3 for ResNet-18, 6 for ViTs
    Chosen in proportion to backbone; ablations show robustness but the design choice affects defense, especially for WaNet and Dynamic.
  • warmup epoch count = 1 epoch
    The first epoch uses only the classification loss Lc; this is a hyperparameter that sets when decoupling starts.
axioms (3)
  • domain assumption Simple or low-complexity features (e.g., backdoor triggers) are learned by shallow networks faster than complex benign features.
    Invoked in Section 4.1 and Appendix B, based on literature (Shah et al. 2020) and the paper's gradient analysis.
  • domain assumption A single shared classifier can be used for both branches while still decoupling benign and backdoor knowledge.
    The method uses a single classifier Sc for both branches; decoupling losses are added to keep them apart.
  • domain assumption The defender has no additional clean data, so the defense must rely solely on the poisoned training set.
    Stated in Section 3.2 threat model.
invented entities (1)
  • Honeypot shortcut branch no independent evidence
    purpose: A lightweight parallel branch that absorbs backdoor knowledge during training and is discarded after training.
    This is the paper's central architectural contribution; there is no external evidence for its necessity beyond the experiments in this paper.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Mitigating Backdoors via Decoy Shortcuts and Knowledge Decoupling." pith.science (2026). https://pith.science/paper/PBTF5VUF

@misc{pith2026260800732,
  author       = {Pith},
  title        = {Pith review of: Mitigating Backdoors via Decoy Shortcuts and Knowledge Decoupling},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PBTF5VUF}},
  note         = {Machine review of arXiv:2608.00732}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Backdoor attacks pose a serious threat to deep neural networks, especially when training relies on third-party data, allowing adversaries to inject malicious behaviors through data poisoning. In this work, we reveal that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network. Motivated by this insight, we propose Trapping and Removing (TR), a simple yet effective training-time defense that introduces a lightweight shortcut branch as a "honeypot" to trap backdoor knowledge. After training, backdoors can be removed by discarding the shortcut, without requiring any additional data. To further enhance backdoor isolation while maintaining benign performance, we design a knowledge decoupling strategy with entropy-based weight assignment, encouraging poisoned samples to flow through the honeypot while guiding the main network to focus on benign learning. In addition, we introduce an automatic shortcut generation strategy to improve generalization across model architectures. Extensive experiments on four benchmark datasets and five model architectures demonstrate that our approach effectively mitigates a wide range of backdoor attacks while preserving performance on benign data. Code: https://github.com/Zixuan-Zhu/TR}{github.com/Zixuan-Zhu/TR.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

47 extracted references · 5 canonical work pages

  1. [1]

    Learning multiple layers of features from tiny images

    [Alex, 2009] Krizhevsky Alex. Learning multiple layers of features from tiny images

    2009

  2. [3]

    Results.The adaptive attack successfully injects a back- door into the model, achieving a BA of 88.23% and an ASR of 99.99%

    The initial learning rate is set to 0.01 and is reduced by a factor of 10 halfway through the training. Results.The adaptive attack successfully injects a back- door into the model, achieving a BA of 88.23% and an ASR of 99.99%. However, our defense reduces its ASR to 0% and improves the BA to 94.49%. This suggests that the opti- mized trigger patterns be...

    work page 2024

  3. [6]

    ImageNet: A Large- Scale Hierarchical Image Database

    [Denget al., 2009 ] Jia Deng, Wei Dong, Richard Socher, Li- Jia Li, Kai Li, and Li Fei-Fei. ImageNet: A Large- Scale Hierarchical Image Database. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 248–255. Ieee,

    2009

  4. [7]

    An image is worth 16x16 words: Transformers for image recognition at scale.arXiv preprint arXiv:2010.11929,

    [Dosovitskiyet al., 2020 ] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Min- derer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale.arXiv preprint arXiv:2010.11929,

    Pith/arXiv arXiv 2020

  5. [9]

    Although ESTI achieves a slightly lower average ASR with PreActResNet- 18, our approach yields a substantially higher average BA

    Our method achieves the best or second-best performance in most cases, particularly on the GTSRB dataset. Although ESTI achieves a slightly lower average ASR with PreActResNet- 18, our approach yields a substantially higher average BA. Consistent performance across three network architectures and two datasets demonstrates the strong generalization ca- pab...

    work page 2024

  6. [10]

    Badnets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain.arXiv preprint arXiv:1708.06733,

    [Guet al., 2017 ] Tianyu Gu, Brendan Dolan-Gavitt, and Sid- dharth Garg. Badnets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain.arXiv preprint arXiv:1708.06733,

    Pith/arXiv arXiv 2017

  7. [12]

    Backdoor Defense via De- coupling the Training Process

    [Huanget al., 2022 ] Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor Defense via De- coupling the Training Process. InThe Tenth International Conference on Learning Representations,

    2022

  8. [13]

    winner-take-all

    Normal DBD CDB ASD V&B PDB ESTI TR(Ours) 1052 13691 2159 8858 7750 3360 5309 1332 Table 5: Time (seconds) of four defenses versus normal training, evaluated on CIFAR-10 with WRN-16-1. B Gradient-Based Analysis and Verification of Learning Behaviors B.1 Theoretical Analysis To understand why poisoned samples are preferentially cap- tured by the honeypot sh...

    2023

  9. [16]

    A data-free backdoor injection approach in neural networks

    [Lvet al., 2023 ] Peizhuo Lv, Chang Yue, Ruigang Liang, Yunfei Yang, Shengzhi Zhang, Hualong Ma, and Kai Chen. A data-free backdoor injection approach in neural networks. In32nd USENIX Security Symposium (USENIX Security 23), pages 2671–2688,

    2023

  10. [17]

    Towards deep learning models resistant to adversarial attacks.stat, 1050(9),

    [Mkadryet al., 2017 ] Aleksander Mkadry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks.stat, 1050(9),

    2017

  11. [18]

    Progres- sive backdoor erasing via connecting backdoor and adver- sarial attacks

    [Muet al., 2023 ] Bingxu Mu, Zhenxing Niu, Le Wang, Xue Wang, Qiguang Miao, Rong Jin, and Gang Hua. Progres- sive backdoor erasing via connecting backdoor and adver- sarial attacks. InProceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, pages 20495–20503,

    2023

  12. [19]

    Input-Aware Dynamic Backdoor Attack.Advances in Neu- ral Information Processing Systems, 33:3454–3464,

    [Nguyen and Tran, 2020] Tuan Anh Nguyen and Anh Tran. Input-Aware Dynamic Backdoor Attack.Advances in Neu- ral Information Processing Systems, 33:3454–3464,

    2020

  13. [20]

    WaNet–Imperceptible Warping-based Backdoor Attack

    [Nguyen and Tran, 2021] Anh Nguyen and Anh Tran. WaNet–Imperceptible Warping-based Backdoor Attack. arXiv preprint arXiv:2102.10369,

    Pith/arXiv arXiv 2021

  14. [21]

    The pitfalls of simplicity bias in neural networks.Advances in Neural Information Processing Systems, 33:9573–9585,

    [Shahet al., 2020 ] Harshay Shah, Kaustav Tamuly, Aditi Raghunathan, Prateek Jain, and Praneeth Netrapalli. The pitfalls of simplicity bias in neural networks.Advances in Neural Information Processing Systems, 33:9573–9585,

    2020

  15. [22]

    Very deep convolutional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556,

    [Simonyan and Zisserman, 2014] Karen Simonyan and An- drew Zisserman. Very deep convolutional networks for large-scale image recognition.arXiv preprint arXiv:1409.1556,

    Pith/arXiv arXiv 2014

  16. [25]

    Setting the trap: Capturing and defeating backdoors in pretrained language models through honeypots.Advances in Neural Informa- tion Processing Systems, 36:73191–73210,

    [Tanget al., 2023 ] Ruixiang Ryan Tang, Jiayi Yuan, Yiming Li, Zirui Liu, Rui Chen, and Xia Hu. Setting the trap: Capturing and defeating backdoors in pretrained language models through honeypots.Advances in Neural Informa- tion Processing Systems, 36:73191–73210,

    2023

  17. [26]

    Label-Consistent Backdoor Attacks

    [Turneret al., 2019 ] Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-Consistent Backdoor Attacks. arXiv preprint arXiv:1912.02771,

    Pith/arXiv arXiv 2019

  18. [27]

    Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks

    [Wanget al., 2019 ] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y Zhao. Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. In2019 IEEE Sym- posium on Security and Privacy, pages 707–723. IEEE,

    2019

  19. [28]

    Pillar-Based Object Detection for Au- tonomous Driving

    [Wanget al., 2020 ] Yue Wang, Alireza Fathi, Abhijit Kundu, David A Ross, Caroline Pantofaru, Tom Funkhouser, and Justin Solomon. Pillar-Based Object Detection for Au- tonomous Driving. InEuropean Conference on Computer Vision, pages 18–34. Springer,

    2020

  20. [29]

    Decoupling representation learning and classification for gnn-based anomaly detection

    [Wanget al., 2021 ] Yanling Wang, Jing Zhang, Shasha Guo, Hongzhi Yin, Cuiping Li, and Hong Chen. Decoupling representation learning and classification for gnn-based anomaly detection. InProceedings of the 44th interna- tional ACM SIGIR conference on research and develop- ment in information retrieval, pages 1239–1248,

    2021

  21. [30]

    Trap and re- place: Defending backdoor attacks by trapping them into an easy-to-replace subnetwork.Advances in neural infor- mation processing systems, 35:36026–36039,

    [Wanget al., 2022 ] Haotao Wang, Junyuan Hong, Aston Zhang, Jiayu Zhou, and Zhangyang Wang. Trap and re- place: Defending backdoor attacks by trapping them into an easy-to-replace subnetwork.Advances in neural infor- mation processing systems, 35:36026–36039,

    2022

  22. [31]

    Mitigating backdoor attack by injecting proactive defensive backdoor.Advances in Neural Information Processing Systems, 37:80674–80705,

    [Weiet al., 2024 ] Shaokui Wei, Hongyuan Zha, and Baoyuan Wu. Mitigating backdoor attack by injecting proactive defensive backdoor.Advances in Neural Information Processing Systems, 37:80674–80705,

    2024

  23. [32]

    Cbam: Convolutional block attention module

    [Wooet al., 2018 ] Sanghyun Woo, Jongchan Park, Joon- Young Lee, and In So Kweon. Cbam: Convolutional block attention module. InProceedings of the European confer- ence on computer vision (ECCV), pages 3–19,

    2018

  24. [33]

    A set of generalized com- ponents to achieve effective poison-only clean-label back- door attacks with collaborative sample selection and trig- gers

    [Wuet al., 2025 ] Zhixiao Wu, Yao Lu, Jie Wen, Hao Sun, Qi Zhou, and Guangming Lu. A set of generalized com- ponents to achieve effective poison-only clean-label back- door attacks with collaborative sample selection and trig- gers. InAdvances in Neural Information Processing Sys- tems,

    2025

  25. [35]

    Backdoor defense via suppressing model shortcuts

    [Yanget al., 2023 ] Sheng Yang, Yiming Li, Yong Jiang, and Shu-Tao Xia. Backdoor defense via suppressing model shortcuts. InICASSP 2023-2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1–5. IEEE,

    2023

  26. [36]

    Backdoor defense via enhanced splitting and trap isolation

    [Yuet al., 2025 ] Hongrui Yu, Lu Qi, Wanyu Lin, Jian Chen, Hailong Sun, and Chengbin Sun. Backdoor defense via enhanced splitting and trap isolation. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 1708–1717,

    2025

  27. [37]

    Wide residual net- works.arXiv preprint arXiv:1605.07146,

    [Zagoruyko, 2016] Sergey Zagoruyko. Wide residual net- works.arXiv preprint arXiv:1605.07146,

    Pith/arXiv arXiv 2016

  28. [38]

    Narcissus: A practical clean-label backdoor attack with limited infor- mation

    [Zenget al., 2023 ] Yi Zeng, Minzhou Pan, Hoang Anh Just, Lingjuan Lyu, Meikang Qiu, and Ruoxi Jia. Narcissus: A practical clean-label backdoor attack with limited infor- mation. InProceedings of the 2023 ACM SIGSAC Confer- ence on Computer and Communications Security, pages 771–785,

    2023

  29. [39]

    Unsu- pervised Multi-View Constrained Convolutional Network for Accurate Depth Estimation.IEEE Transactions on Im- age Processing, 29:7019–7031,

    [Zhanget al., 2020 ] Yuyang Zhang, Shibiao Xu, Baoyuan Wu, Jian Shi, Weiliang Meng, and Xiaopeng Zhang. Unsu- pervised Multi-View Constrained Convolutional Network for Accurate Depth Estimation.IEEE Transactions on Im- age Processing, 29:7019–7031,

    2020

  30. [40]

    Backdoor defense via decon- founded representation learning

    [Zhanget al., 2023 ] Zaixi Zhang, Qi Liu, Zhicai Wang, Zepu Lu, and Qingyong Hu. Backdoor defense via decon- founded representation learning. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12228–12238,

    2023

  31. [41]

    The victim and the beneficiary: Exploiting a poisoned model to train a clean model on poisoned data

    [Zhuet al., 2023 ] Zixuan Zhu, Rui Wang, Cong Zou, and Li- hua Jing. The victim and the beneficiary: Exploiting a poisoned model to train a clean model on poisoned data. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 155–164,

    2023

  32. [43]

    winner-take-all

    across 8 different backdoor attacks, including invisible (e.g., WaNet), sample- specific (e.g., Dynamic) and clean-label (e.g., SIG, PCBA) attacks. Balanced Initialization.First, we investigate whether the shortcut’s dominance stems from an initialized bias. As shown in Figure 7, at the random initialization stage, the gra- dient norm ratio between the sh...

    work page 2023

  33. [45]

    The results clearly demonstrate that our TR re- duces the attack success rate of all attacks to 0% while achiev- ing either the best or second-best benign accuracy. This supe- rior performance stems from our decoupling strategy, which channels all backdoor knowledge into the shortcut branch, en- abling the original network to focus on learning benign info...

    work page arXiv 2090

  34. [47]

    Similar to NLP backdoor attacks, these attacks are imple- mented by fine-tuning a pre-trained clean model with poi- soned data, a common approach when targeting transformers

    Since the default poi- soning rate of 0.01 fails to attack ViT-T/16 and ViT-S/16, we increase it to 0.1 for a stronger attack. Similar to NLP backdoor attacks, these attacks are imple- mented by fine-tuning a pre-trained clean model with poi- soned data, a common approach when targeting transformers. In this scenario, benign and backdoor knowledge are nat...

    work page 2023

  35. [2009]

    A New Backdoor Attack in CNNS by Training Set Corruption Without Label Poisoning

    [Barniet al., 2019 ] Mauro Barni, Kassem Kallas, and Benedetta Tondi. A New Backdoor Attack in CNNS by Training Set Corruption Without Label Poisoning. In 2019 IEEE International Conference on Image Process- ing, pages 101–105. IEEE,

    2019

  36. [2011]

    A closer look at robustness of vision transformers to backdoor attacks

    [Subramanyaet al., 2024 ] Akshayvarun Subramanya, Soroush Abbasi Koohpayegani, Aniruddha Saha, Ajinkya Tejankar, and Hamed Pirsiavash. A closer look at robustness of vision transformers to backdoor attacks. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pages 3874–3883,

    2024

  37. [2014]

    The german traffic sign recognition benchmark: a multi-class classification competition

    [Stallkampet al., 2011 ] Johannes Stallkamp, Marc Schlips- ing, Jan Salmen, and Christian Igel. The german traffic sign recognition benchmark: a multi-class classification competition. InThe 2011 international joint conference on neural networks, pages 1453–1460. IEEE,

    2011

  38. [2016]

    Identity mappings in deep residual networks

    [Heet al., 2016b ] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. InComputer Vision–ECCV 2016: 14th Euro- pean Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part IV 14, pages 630–645. Springer,

    2016

  39. [2017]

    Progressive poisoned data isolation for training- time backdoor defense

    [Chenet al., 2024 ] Yiming Chen, Haiwei Wu, and Jiantao Zhou. Progressive poisoned data isolation for training- time backdoor defense. In Michael J. Wooldridge, Jen- nifer G. Dy, and Sriraam Natarajan, editors,Thirty-Eighth AAAI Conference on Artificial Intelligence (AAAI 2024), Vancouver, Canada, pages 11425–11433. AAAI Press,

    2024

  40. [2018]

    From shortcuts to triggers: Back- door defense with denoised poe.arXiv preprint arXiv:2305.14910,

    [Liuet al., 2023 ] Qin Liu, Fei Wang, Chaowei Xiao, and Muhao Chen. From shortcuts to triggers: Back- door defense with denoised poe.arXiv preprint arXiv:2305.14910,

    Pith/arXiv arXiv 2023

  41. [2019]

    Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning.arXiv preprint arXiv:1712.05526,

    [Chenet al., 2017 ] Xinyun Chen, Chang Liu, Bo Li, Kim- berly Lu, and Dawn Song. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning.arXiv preprint arXiv:1712.05526,

    Pith/arXiv arXiv 2017

  42. [2020]

    Backdoor defense via adap- tively splitting poisoned dataset

    [Gaoet al., 2023 ] Kuofeng Gao, Yang Bai, Jindong Gu, Yong Yang, and Shu-Tao Xia. Backdoor defense via adap- tively splitting poisoned dataset. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4005–4014,

    2023

  43. [2021]

    Fine-Pruning: Defending Against Backdoor- ing Attacks on Deep Neural Networks

    [Liuet al., 2018 ] Kang Liu, Brendan Dolan-Gavitt, and Sid- dharth Garg. Fine-Pruning: Defending Against Backdoor- ing Attacks on Deep Neural Networks. InInternational Symposium on Research in Attacks, Intrusions, and De- fenses, pages 273–294. Springer,

    2018

  44. [2022]

    [Jinet al., 2023 ] Yan Jin, Fang Gao, Jun Yu, Jiabao Wang, and Feng Shuang. Multi-object tracking: Decoupling fea- tures to solve the contradictory dilemma of feature require- ments.IEEE Transactions on Circuits and Systems for Video Technology, 33(9):5117–5132,

    2023

  45. [2023]

    A dual stealthy backdoor: From both spatial and frequency perspectives

    [Gaoet al., 2024 ] Yudong Gao, Honglong Chen, Peng Sun, Junjian Li, Anqing Zhang, Zhibo Wang, and Weifeng Liu. A dual stealthy backdoor: From both spatial and frequency perspectives. InThirty-Eighth AAAI Conference on Arti- ficial Intelligence, AAAI 2024, Vancouver, Canada, pages 1851–1859. AAAI Press,

    2024

  46. [2024]

    Lo- tus: Evasive and resilient backdoor attacks through sub- partitioning

    [Chenget al., 2024 ] Siyuan Cheng, Guanhong Tao, Yingqi Liu, Guangyu Shen, Shengwei An, Shiwei Feng, Xiangzhe Xu, Kaiyuan Zhang, Shiqing Ma, and Xiangyu Zhang. Lo- tus: Evasive and resilient backdoor attacks through sub- partitioning. InProceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, pages 24798–24809,

    2024

  47. [2025]

    Decou- pling features in hierarchical propagation for video object segmentation.Advances in Neural Information Processing Systems, 35:36324–36336,

    [Yang and Yang, 2022] Zongxin Yang and Yi Yang. Decou- pling features in hierarchical propagation for video object segmentation.Advances in Neural Information Processing Systems, 35:36324–36336,

    2022

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.