Pith. sign in

REVIEW 3 major objections 4 minor 299 references

A cumulative-entropy coreset score can filter poisoned data, neutralize backdoors across eight attack types, and keep clean-data accuracy.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

ABCS selects a high-entropy coreset from poisoned training data and trains on it, mitigating eight backdoor attacks with minimal natural-accuracy loss.

T0 review reviewed 2026-08-01 challenge →

load-bearing objection Solid empirical training-time defense with broad evaluation, but the abstract overclaims robustness relative to the paper's own adaptive-attack results. the 3 major comments →

arxiv 2607.25502 v1 pith:OJSVRX4S submitted 2026-07-28 cs.LG cs.CR

Anti-Backdoor Coreset Selection via Cumulative Entropy

Qi Zhao , Christian Wressnegger This is my paper
classification cs.LG cs.CR
keywords backdoor attackdata poisoningtraining-time defensecoreset selectioncumulative entropymachine unlearninglabel smoothingprediction uncertainty
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that training-time defense against data-poisoning backdoors is best viewed as a coreset-selection problem: pick a small, informative subset of the poisoned training set and train only on that subset. It claims that poisonous samples become low-uncertainty quickly and are less frequent than benign ones, so a score that accumulates each sample's normalized prediction entropy over many epochs—Cumulative Entropy (CENT)—ranks them below informative benign samples. On top of this score, the paper adds a per-epoch unlearning step for high-entropy samples, using label smoothing and weight regularization to widen the uncertainty gap between benign and poisonous data. The headline result is that one method mitigates all eight backdoor attacks it tests, preserves natural accuracy close to a model trained on a clean dataset, and runs in about the same wall-clock time as naive training. This matters because prior defenses typically sacrifice accuracy or leave at least one attack partially successful.

Core claim

The paper's central proposal, ABCS, is that the cumulative entropy of a sample's prediction distribution across training epochs is a reliable anti-backdoor signal. Poisonous samples converge to the backdoor early, so their per-epoch entropy drops fast and stays low; benign samples, especially hard ones, keep higher entropy. Accumulating min-max normalized entropy over the selection phase stabilizes this separation and avoids the variance of one-shot uncertainty sampling. The method then unlearns the currently uncertain samples each epoch with smoothed labels and l2 weight anchoring, which enlarges the CENT gap before the final coreset is chosen. Training from scratch on the high-CENT coreset

What carries the argument

Cumulative Entropy (CENT): for each sample, the average over Tse selection epochs of its min-max normalized Shannon entropy over class predictions, H(x_i) = -Σ_c p_θ(c|x_i) log p_θ(c|x_i). This single object carries the argument by encoding both instantaneous uncertainty and temporal consistency of learning. Two supporting mechanisms do the heavy lifting: a warm-up phase sets the coreset size automatically from the mean entropy of correctly predicted samples, and a per-epoch unlearning step removes high-entropy samples under label smoothing with l2 weight regularization, enlarging the entropy gap between benign and poisonous samples before scores are accumulated. Final training is standard c

Load-bearing premise

Everything rests on the claim that poisoned samples have lower prediction uncertainty and are less frequent than benign samples; if an adversary can make poisoned samples as uncertain or as frequent as hard benign samples, the cumulative-entropy separation weakens and the defense's success rate declines.

What would settle it

Construct a poisoned dataset by poisoning only the 5% of clean samples with the highest Cumulative Entropy and randomizing half of their labels, then run ABCS. If the final model's attack success rate remains far from zero and the selected coreset still contains a nontrivial fraction of poisoned samples, the uncertainty-separation premise fails. The paper's own label-randomization experiments already show ASR rising to double digits for some attacks, so this is a directly checkable point.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If the central claim holds, a training-time defense can be built without clean reference data and without precise dataset splitting; a selection ratio around 55% is enough to keep natural accuracy.
  • Because the coreset is smaller than the full set, final training is faster, so total defense time is comparable to unprotected training rather than a multiple of it.
  • The defense transfers across architectures and task domains: the paper reports consistent results on image classification with several network families and on text classification with transformer models.
  • The method remains effective when the dataset is clean, avoiding the natural-accuracy drop that several prior defenses suffer on unpoisoned data.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the CENT-versus-backdoor separation suggests a general trade-off: any defense that exploits 'poisoned samples learn first and become certain' can be circumvented by attacks that slow poisoned-sample convergence, so the entropy gap itself is the quantity future adversaries will target.
  • The unlearning step's label-smoothing factor could be adapted online from the observed entropy gap, potentially making the defense more robust to the paper's own adaptive-attack results without changing the coreset formulation.
  • The paper notes its coresets are larger than an optimal clean-data coreset; this hints that a poisoned dataset carries an extra, discardable 'backdoor task' component, and an information-theoretic measure of that component might predict how much larger a safe coreset must be.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes ABCS (Anti-Backdoor Coreset Selection), a training-time defense that treats backdoor defense as a coreset selection problem. The method computes a Cumulative Entropy (CENT) score for each training sample by accumulating normalized entropy over a selection phase, preceded by a warm-up phase; during selection it unlearns uncertain samples with label smoothing and regularization to widen the uncertainty gap between benign and poisoned samples. The final model is trained from scratch on the selected high-CENT coreset. The paper evaluates ABCS on CIFAR10, GTSRB, Tiny-ImageNet, and text classification against eight backdoor attacks, comparing to six defenses, and reports natural accuracy close to clean training, near-zero ASR in standard settings, and comparable runtime, plus ablations and adaptive-attack analyses.

Significance. The contribution is substantial if the empirical results hold: a simple, fast, training-time defense that covers many attack types without clean reference data and with public code. The paper is thorough in benchmarking, ablations, and adaptive evaluations, and it explicitly discusses limitations. The main caveat is that the central uncertainty premise is an empirical regularity rather than a guaranteed property; the paper's own adaptive label-randomization experiments show that the defense degrades substantially when poisoned samples are made uncertain. Nevertheless, the method still reduces ASR compared to no defense in most adaptive settings, and the standard-setting results are strong. The lack of theoretical foundation is acknowledged and is not by itself disqualifying.

major comments (3)
  1. [Abstract / Section 1 vs. Section E.5, Table 18] The claims that ABCS 'mitigates backdooring attacks consistently' (Abstract) and 'mitigate[s] all investigated backdoor' (Contributions) are contradicted by the paper's own adaptive experiments in Table 18. Under 50% label randomization, ABCS leaves ASR at 16.63% (BadNets), 30.03% (IAB), 23.99% (LF), 9.74% (Blend), and 15.69% (A-Blend). The Limitations section only mentions A-Blend as 'suboptimal' and does not qualify the general claim. Please soften the claims to reflect that ABCS substantially reduces ASR in standard settings and provides partial mitigation under adaptive uncertainty-raising attacks, or move the adaptive results into the main text and discuss their implications.
  2. [Section 4.1] The coreset size determination is ambiguous. The threshold τ is defined as an average over warm-up epochs of the mean entropy of correctly predicted samples, while the size s is defined using CENT(x_i), which is only accumulated during the subsequent selection phase. As written, CENT values do not exist at the point where τ is computed. Please provide a precise algorithm (or pseudocode) specifying whether τ is applied to the final CENT scores, whether the warm-up entropies are also accumulated, and how the two phases interact.
  3. [Section 5 and Section D.2] The hyperparameters ε=0.9, γ=0.1/0.01, Twa=10, and Tse=40 are set based on ablations on CIFAR10 and then used for other datasets. Since the same benchmark is used for both tuning and final evaluation, there is a risk of overfitting to the evaluation suite. The paper should report performance with fixed hyperparameters across datasets or provide a sensitivity analysis showing that the conclusions are robust to reasonable variations. At minimum, the evaluation protocol should be discussed explicitly.
minor comments (4)
  1. [Section 4.2, Step-2] The phrase 'select samples larger than the average' should specify that the average is computed over correctly predicted samples, as in the formula; otherwise the description is ambiguous.
  2. [Various] Typos: 'similiar' (p.2), 'mis-prediced' (p.15), 'in additon' (p.15), 'native training' (Table 3 caption), and the Figure 1 caption 'using with a ResNet18' should be corrected.
  3. [Section 4, CENT equation] The CENT equation does not explicitly define the model θ_t after each selection epoch; clarify whether it is the model after the unlearning step.
  4. [Table 1 caption] The caption states that defense failure (ASR >50%) is shown as orange boldface, but no orange entries appear in the ABCS columns; ensure the formatting is consistent in the final version.

Circularity Check

0 steps flagged

No significant circularity: ABCS's derivation is self-contained and its central claim is evaluated against external attacks.

full rationale

The paper's derivation chain is not circular. The CENT criterion is defined as an accumulated, min-max normalized Shannon entropy over training epochs (Section 4), independent of the ASR/DER metrics it is evaluated against. The premise that poisonous samples have lower prediction uncertainty is an empirical observation supported by Figure 1 and external citations (Li et al., 2021b), not a result derived from the defense's own outputs. The selection threshold τ is computed from the warm-up model's correct predictions, and the final coreset is trained from scratch, so the defense does not fit parameters to the target metric. The method is tested against eight external attacks and baselines, and the appendix's adaptive-attack experiments (including CENT-ranked poisoning and label randomization) directly challenge the central premise and show degraded but still meaningful ASR reduction, which is a sign of external evaluation rather than circularity. The authors' self-citations (Zhao & Wressnegger, 2024; 2025) support background observations about backdoor learning dynamics, but the central claim does not reduce to those citations. Hyperparameters such as Twa, Tse, ε, γ are ablated on the same attacks, which is benchmark tuning, not circularity in derivation. The Limitations section acknowledges the lack of a theoretical foundation and suboptimal performance on A-Blend, further confirming that the paper does not assert a forced result.

Axiom & Free-Parameter Ledger

4 free parameters · 3 axioms · 0 invented entities

The central claim is almost entirely empirical. It rests on domain assumptions about poisoned-sample uncertainty and backdoor-invariant data distributions, plus several hyperparameters tuned on the evaluation suite. No new physical or formal entities are introduced.

free parameters (4)
  • Label smoothing factor epsilon = 0.9
    Tuned via ablation (Fig. 8); too small a value weakens unlearning and increases ASR, especially for WaNet.
  • Unlearning regularization gamma = 0.1 (small-scale), 0.01 (large-scale)
    Selected via ablation (Fig. 13); large gamma lowers ASR, small gamma fails to separate poisoned samples.
  • Warm-up epochs Twa = 10
    Ablation (Fig. 12) shows shorter warm-up can fail to capture backdoor behavior, leading to higher ASR.
  • Selection epochs Tse = 40
    Longer accumulation improves exclusion of poisonous samples; chosen via ablation (Fig. 12).
axioms (3)
  • domain assumption Poisoned samples have lower prediction uncertainty and converge faster than benign samples during training.
    Stated in Section 1 and Figure 1; this is the basis for selecting high-CENT samples as the benign coreset. Supported by prior work but not guaranteed for unseen attacks.
  • domain assumption Backdoor attacks preserve the natural data distribution, so a coreset of the primary task maintains natural accuracy.
    Assumed in Section 4.2 Step-1; if an attack strongly shifts the benign distribution, the coreset may lose utility.
  • ad hoc to paper Unlearning with label smoothing enlarges the uncertainty gap between benign and poisoned samples without model collapse.
    Introduced in Section 4.2 Step-2; empirically demonstrated but not theoretically justified.

reviewed 2026-08-01 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Anti-Backdoor Coreset Selection via Cumulative Entropy." pith.science (2026). https://pith.science/paper/OJSVRX4S

@misc{pith2026260725502,
  author       = {Pith},
  title        = {Pith review of: Anti-Backdoor Coreset Selection via Cumulative Entropy},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OJSVRX4S}},
  note         = {Machine review of arXiv:2607.25502}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Recent training-time defenses against neural backdoors isolate a benign subset from poisoned training data, to learn a backdoor-free model from it. In this paper, we formulate this defense strategy as a coreset selection problem, giving rise to so-called "Anti-Backdoor Coreset Selection." Since poisonous samples have (a) lower prediction uncertainty and are (b) less frequent than benign samples, coreset selection naturally focuses more on samples associated with benign functionality than the backdoor functionality. We use the Cumulative Entropy as selection criterion to further facilitate this effect. The metric tracks the learning dynamics of training samples and allowing us to select benign samples with high informativeness for the coreset. Additionally, we unlearn the chosen samples in each epoch to facilitate the separability between benign and poisonous samples. Together, this yields an exceptionally effective training-time defense that constructs a benign coreset to train a backdoor-free model. Unlike prior defenses that compromise natural accuracy and fail against certain attacks, our method mitigates backdooring attacks consistently with a negligible impact on natural performance.

Figures

Figures reproduced from arXiv: 2607.25502 by Christian Wressnegger, Qi Zhao.

Figure 1
Figure 1. Figure 1: Intermediate and cumulative entropy across training epochs for CIFAR10 poisoned by Blend with using a ResNet18 model. Note, that entropy values of all training samples are rescaled to [0, 1] at each epoch. tasks (the primary functionality and the backdoor) formed by mixing two datasets of benign and poisonous samples, respectively. By retrieving the coreset of the primary task, we effectively mitigate the … view at source ↗
Figure 2
Figure 2. Figure 2: Evaluation of coreset methods under the Blend attack using ResNet18 on CIFAR10 with ρ = 5 %. Error bars show the value range across five random runs per coreset size. 3. Coreset Selection as Backdoor Defense Prior training-time defenses (Zhang et al., 2023; Zhu et al., 2023b) use the training loss for identifying benign and poi￾sonous samples. There, the loss essentially serves as a proxy metric for the pr… view at source ↗
Figure 3
Figure 3. Figure 3: EL2N and its variant of sampling per epoch. mean squared error over training epochs [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Epoch-wise sampling vs. accumulation for uncertainty-based coreset selection. Selection ratio is 0.4. Each run trains a ResNet18 on CIFAR10 dataset that is poisoned by Blend attack with ρ = 5 %. Accumulating uncertainty measurements across epochs, in turn, yields a robust and stable coreset selection, and si￾multaneously enables the elimination of poisonous samples. Unlike the accumulation of Entropy and M… view at source ↗
Figure 5
Figure 5. Figure 5: Training baseline model ResNet18 from scratch on coresets of CIFAR10 selected from a poisoned dataset with Blend attack by using different uncertainty criteria in the accumulation. 4. Anti-Backdoor Coreset Selection via Cumulative Entropy Based on the observations made in the previous section, we propose a training-time defense, ABCS, using coreset selection via the Cumulative Entropy (CENT) criterion. CEN… view at source ↗
Figure 7
Figure 7. Figure 7: Comparing the impact of using warm-up and unlearning in ABCS. Baseline model ResNet18 is trained from scratch on selected coresets of CIFAR10 under WaNet attack. Label smoothing factor ε. The value ε is proportional to the strength of label smoothing. Thus, increasing ε will amplify the unlearning effect, and vice versa. Fig￾ure 8 below investigates the impact of different ε values on ABCS’s defense. Varyi… view at source ↗
Figure 8
Figure 8. Figure 8: Ablation study on label smoothing factor ε. particularly under the WaNet attack. As the result, residual poisoned samples in the coreset lead to a higher ASR. Overall, the effective￾ness of ABCS depends on choosing ε within a reasonable range, rather than relying on a specific fixed value. Min-max normalization in CENT. The min-max normal￾ization balances the entropy scale across epochs from early to late … view at source ↗
Figure 9
Figure 9. Figure 9: Coreset selected by three additional criteria on CIFAR10 poisoned by Blend with ρ = 5 % using ResNet18. Error bars indicate the range across five random trials per coreset size. A. Analysis of Other Coreset Selection Criteria In [PITH_FULL_IMAGE:figures/full_fig_p012_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Comparing loss-based criteria to uncertainty-based criteria with accumulation. All experiments are conducted by using ResNet18 model on CIFAR10 that is under the poisoning of WaNet attack with ρ = 5 %. Error bars show the value range across five random runs per coreset selection ratio. loss-based criteria in [PITH_FULL_IMAGE:figures/full_fig_p013_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Class-wise accuracy distribution on GTSRB across different attacks, averaged over five runs. “Clean D” refers to using the original clean dataset for the model training. C.2. Considered Defenses ABL (Li et al., 2021b): The ABL procedure consists of three stages: (1) training for 20 epochs on the entire poi￾soned dataset and isolating 1 % of the samples with the lowest loss, (2) fine-tuning the model on th… view at source ↗
Figure 12
Figure 12. Figure 12: Investigating the impact of warm-up epochs Twa (left), selection epochs Tse (right) on ABCS’s defense for CIFAR10. Twa and Tse. Based on the ablation study in [PITH_FULL_IMAGE:figures/full_fig_p015_12.png] view at source ↗
Figure 15
Figure 15. Figure 15: Impact of varying ρ. For ρ ≥ 5 %, ABCS con￾sistently selects a core￾set that yields a model with high natural accu￾racy and minimal ASR, indicating effective exclu￾sion of poisonous sam￾ples. At a lower poi￾soning rate (ρ = 1 %), the increased difficulty of learning backdoor slightly raises the risk of including sev￾eral poisoned samples in the coreset. Despite this, ABCS continues to perform robustly wit… view at source ↗
Figure 14
Figure 14. Figure 14: Evaluation across target classes (left) and different poisoning rates (right) on CIFAR10. Poisoning rates [PITH_FULL_IMAGE:figures/full_fig_p016_14.png] view at source ↗
Figure 16
Figure 16. Figure 16: Poisoning Single Source Class. E.3. Constructing Low-Redundancy Training Datasets Given adaptive adversaries aware of the coreset selection mechanism via CENT criterion, they may first extract a core￾set with a selection ratio of 50 % and subsequently poison it before releasing it as the final training dataset. Due to the high informativeness of this coreset, applying anti-backdoor coreset selection becom… view at source ↗
Figure 18
Figure 18. Figure 18: Impact of randomized label on Blend attack. We first use the Blend attack to visualize how random la￾beling affects model learning. Since coreset selection re￾lies on the uncertainty gap between benign and poisoned data, we measure the intermediate entropy difference as ∆H = Hbng − Hpoi, where Hbng and Hpoi denote the mean 0–1 normalized entropy at each epoch of benign and poisoned samples. A value ∆H > 0… view at source ↗
Figure 19
Figure 19. Figure 19: T-SNE visualization of data distribution of full clean training set D and its coreset (Figure 19a), and other coresets selected from individual poisoned training sets D˜ (Figure 19b). from various poisoned datasets shown in Figure 19b exhibit strong similarity in their global geometric structure. Aside from the easy classes 1 and 8 (cf [PITH_FULL_IMAGE:figures/full_fig_p021_19.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

299 extracted references · 2 canonical work pages

  1. [1]

    A new backdoor attack in cnns by training set corruption without label poisoning

    Barni, M., Kallas, K., and Tondi, B. A new backdoor attack in cnns by training set corruption without label poisoning. In Proc. of the IEEE International Conference on Image Processing ( ICIP ) , 2019

    2019

  2. [2]

    and Roli, F

    Biggio, B. and Roli, F. Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84: 0 317--331, 2018

    2018

  3. [3]

    Poisoning attacks against support vector machines

    Biggio, B., Nelson, B., and Laskov, P. Poisoning attacks against support vector machines. In Proc. of the International Conference on Machine Learning ( ICML ) , 2012

    2012

  4. [4]

    M., Gretton, A., Rasch, M

    Borgwardt, K. M., Gretton, A., Rasch, M. J., Kriegel, H.-P., Sch \"o lkopf, B., and Smola, A. J. Integrating structured biological data by kernel maximum mean discrepancy. Bioinformatics, 2006. doi:10.1093/bioinformatics/btl242

    work page doi:10.1093/bioinformatics/btl242 2006

  5. [5]

    Poisoning the unlabeled dataset of Semi-Supervised learning

    Carlini, N. Poisoning the unlabeled dataset of Semi-Supervised learning. In Proc. of the USENIX Security Symposium , 2021

    2021

  6. [6]

    A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., and Tramèr, F

    Carlini, N., Jagielski, M., Choquette-Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., and Tramèr, F. Poisoning web-scale training datasets is practical. In Proc. of the IEEE Symposium on Security and Privacy , 2024

    2024

  7. [7]

    Effective backdoor defense by exploiting sensitivity of poisoned samples

    Chen, W., Wu, B., and Wang, H. Effective backdoor defense by exploiting sensitivity of poisoned samples. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2022

    2022

  8. [8]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted backdoor attacks on deep learning systems using data poisoning. CoRR, abs/1712.05526, 2017

    Pith/arXiv arXiv 2017

  9. [9]

    Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review

    Cheng, P., Wu, Z., Du, W., Zhao, H., Lu, W., and Liu, G. Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review. IEEE Transactions on Neural Networks and Learning Systems, 2025. doi:10.1109/TNNLS.2025.3540303

    arXiv 2025

  10. [10]

    Clark, P. J. and Evans, F. C. Distance to nearest neighbor as a measure of spatial relationships in populations. Ecology, 35 0 (4): 0 445--453, 1954

    1954

  11. [11]

    Selection via proxy: Efficient data selection for deep learning

    Coleman, C., Yeh, C., Mussmann, S., Mirzasoleiman, B., Bailis, P., Liang, P., Leskovec, J., and Zaharia, M. Selection via proxy: Efficient data selection for deep learning. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2020

    2020

  12. [12]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proc. of the Annual Meeting of the Association for Computational Linguistics, 2019

    2019

  13. [13]

    Label smoothing improves machine unlearning

    Di, Z., Zhu, Z., Jia, J., Liu, J., Takhirov, Z., Jiang, B., Yao, Y., Liu, S., and Liu, Y. Label smoothing improves machine unlearning. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2026

    2026

  14. [14]

    and Precioso, F

    Ducoffe, M. and Precioso, F. Adversarial active learning for deep networks: a margin based approach. In Proc. of the AAAI Conference on Artificial Intelligence ( AAAI ) , 2018

    2018

  15. [15]

    SalUn : Empowering machine unlearning via gradient-based weight saliency in both image classification and generation

    Fan, C., Liu, J., Zhang, Y., Wong, E., Wei, D., and Liu, S. SalUn : Empowering machine unlearning via gradient-based weight saliency in both image classification and generation. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2024

    2024

  16. [16]

    Backdoor defense via adaptively splitting poisoned dataset

    Gao, K., Bai, Y., Gu, J., Yang, Y., and Xia, S.-T. Backdoor defense via adaptively splitting poisoned dataset. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2023

    2023

  17. [17]

    Explaining and harnessing adversarial examples

    Goodfellow, I., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2015

    2015

  18. [18]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    Gu, T., Dolan - Gavitt, B., and Garg, S. Badnets: Identifying vulnerabilities in the machine learning model supply chain. Proceeding of Machine Learning and Computer Security Workshop, 2017

    2017

  19. [19]

    DeepCore : A comprehensive library for coreset selection in deep learning

    Guo, C., Zhao, B., and Bai, Y. DeepCore : A comprehensive library for coreset selection in deep learning. In Proc. of the International Conference on Database and Expert Systems Applications ( DEXA ) , 2022

    2022

  20. [20]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2016

    2016

  21. [21]

    He, X., Xu, Q., Wang, J., Rubinstein, B. I. P., and Cohn, T. SEEP : Training dynamics grounds latent representation search for mitigating backdoor poisoning attacks. In Proc. of the Annual Meeting of the Association for Computational Linguistics, 2024

    2024

  22. [22]

    and Farahani, R

    Hekmatfar, M. and Farahani, R. Z. (eds.). Facility Location: Concepts, Models, Algorithms and Case Studies. Contributions to Management Science. Springer, 2009. doi:10.1007/978-3-7908-2151-2

    work page doi:10.1007/978-3-7908-2151-2 2009

  23. [24]

    Densely connected convolutional networks

    Huang, G., Liu, Z., and van der Maaten, L. Densely connected convolutional networks. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2017

    2017

  24. [25]

    Backdoor defense via decoupling the training process

    Huang, K., Li, Y., Wu, B., Qin, Z., and Ren, K. Backdoor defense via decoupling the training process. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2022 a

    2022

  25. [26]

    Active learning by querying informative and representative examples

    Huang, S.-j., Jin, R., and Zhou, Z.-H. Active learning by querying informative and representative examples. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2010

    2010

  26. [27]

    Uncertainty-aware learning against label noise on imbalanced datasets

    Huang, Y., Bai, B., Zhao, S., Bai, K., and Wang, F. Uncertainty-aware learning against label noise on imbalanced datasets. In Proc. of the AAAI Conference on Artificial Intelligence ( AAAI ) , 2022 b

    2022

  27. [28]

    D., Hayase, J., and Oh, S

    Jha, R. D., Hayase, J., and Oh, S. Label poisoning is all you need. In Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., and Levine, S. (eds.), Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2023

    2023

  28. [29]

    Killamsetty, K., Sivasubramanian, D., Ramakrishnan, G., of Texas at Dallas, R. I. U., of Technology Bombay Institution One, I. I., and Two, I. N. Glister: Generalization based data subset selection for efficient and robust learning. In Proc. of the AAAI Conference on Artificial Intelligence ( AAAI ) , 2020

    2020

  29. [30]

    Killamsetty, K., Sivasubramanian, D., Mirzasoleiman, B., Ramakrishnan, G., De, A., and Iyer, R. K. GRAD-MATCH: A gradient matching based data subset selection for efficient learning. In Proc. of the International Conference on Machine Learning ( ICML ) , 2021

    2021

  30. [31]

    CIFAR (canadian institute for advanced research), 2008

    Krizhevsky, A., Nair, V., and Hinton, G. CIFAR (canadian institute for advanced research), 2008. URL http://www.cs.toronto.edu/ kriz/cifar.html

    2008

  31. [32]

    Weight poisoning attacks on pretrained models

    Kurita, K., Michel, P., and Neubig, G. Weight poisoning attacks on pretrained models. In Proc. of the Annual Meeting of the Association for Computational Linguistics, 2020

    2020

  32. [33]

    M., Autenrieth, M., and Beluch, W

    Köhler, J. M., Autenrieth, M., and Beluch, W. H. Uncertainty based detection and relabeling of noisy image labels. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops, 2019

    2019

  33. [34]

    and Yang, X

    Le, Y. and Yang, X. Tiny imagenet visual recognition challenge. CS 231N, 2015

    2015

  34. [35]

    Deep learning

    LeCun, Y., Bengio, Y., and Hinton, G. Deep learning. Nature, 521 0 (7553): 0 436--444, 2015. doi:10.1038/nature14539

    doi:10.1038/nature14539 2015

  35. [36]

    Invisible backdoor attack with sample-specific triggers

    Li, Y., Li, Y., Wu, B., Li, L., He, R., and Lyu, S. Invisible backdoor attack with sample-specific triggers. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2021 a

    2021

  36. [37]

    Anti-backdoor learning: Training clean models on poisoned data

    Li, Y., Lyu, X., Koren, N., Lyu, L., Li, B., and Ma, X. Anti-backdoor learning: Training clean models on poisoned data. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2021 b

    2021

  37. [38]

    Backdoor learning: A survey

    Li, Y., Jiang, Y., Li, Z., and Xia, S.-T. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems, 2022

    2022

  38. [39]

    Trojaning attack on neural networks

    Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., and Zhang, X. Trojaning attack on neural networks. In Proc. of the Network and Distributed System Security Symposium ( NDSS ) , 2018

    2018

  39. [40]

    Coresets for data-efficient training of machine learning models

    Mirzasoleiman, B., Bilmes, J., and Leskovec, J. Coresets for data-efficient training of machine learning models. In Proc. of the International Conference on Machine Learning ( ICML ) , 2020

    2020

  40. [41]

    When does label smoothing help? In Proc

    Müller, R., Kornblith, S., and Hinton, G. When does label smoothing help? In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2019

    2019

  41. [42]

    S., Ravikumar, P

    Natarajan, N., Dhillon, I. S., Ravikumar, P. K., and Tewari, A. Learning with noisy labels. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2013

    2013

  42. [43]

    Descent-to-delete: Gradient-based methods for machine unlearning

    Neel, S., Roth, A., and Sharifi-Malvajerdi, S. Descent-to-delete: Gradient-based methods for machine unlearning. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2020

    2020

  43. [44]

    Nguyen, T. A. and Tran, A. Input-aware dynamic backdoor attack. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2020

    2020

  44. [45]

    Nguyen, T. A. and Tran, A. T. Wanet - imperceptible warping-based backdoor attack. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2021

    2021

  45. [46]

    Paul, M., Ganguli, S., and Dziugaite, G. K. Deep learning on a data diet: finding important examples early in training. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2021

    2021

  46. [47]

    Scikit-learn: Machine learning in python

    Pedregosa, F., Varoquaux, G., Gramfort, A., Michel, V., Thirion, B., Grisel, O., Blondel, M., Prettenhofer, P., Weiss, R., Dubourg, V., Vanderplas, J., Passos, A., Cournapeau, D., Brucher, M., Perrot, M., and Duchesnay, E. Scikit-learn: Machine learning in python. Journal of Machine Learning Research, 12: 0 2825--2830, 2011

    2011

  47. [48]

    Hidden killer: Invisible textual backdoor attacks with syntactic trigger

    Qi, F., Li, M., Chen, Y., Zhang, Z., Liu, Z., Wang, Y., and Sun, M. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, 2021

    2021

  48. [49]

    Revisiting the assumption of latent separability for backdoor defenses

    Qi, X., Xie, T., Li, Y., Mahloujifar, S., and Mittal, P. Revisiting the assumption of latent separability for backdoor defenses. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2023

    2023

  49. [50]

    InfoBatch : Lossless training speed up by unbiased dynamic data pruning

    Qin, Z., Wang, K., Zheng, Z., Gu, J., Peng, X., Xu, Z., Zhou, D., Shang, L., Sun, B., Xie, X., and You, Y. InfoBatch : Lossless training speed up by unbiased dynamic data pruning. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2024

    2024

  50. [51]

    Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmentation

    Qiu, H., Zeng, Y., Guo, S., Zhang, T., Qiu, M., and Thuraisingham, B. Deepsweep: An evaluation framework for mitigating dnn backdoor attacks using data augmentation. In Proc. of the ACM Asia Conference on Computer and Communications Security ( ASIA CCS ) , 2021

    2021

  51. [52]

    Mobilenetv2: Inverted residuals and linear bottlenecks

    Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., and Chen, L.-C. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2018

    2018

  52. [53]

    and Savarese, S

    Sener, O. and Savarese, S. Active learning for convolutional neural networks: A core-set approach. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2018

    2018

  53. [54]

    R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., and Goldstein, T

    Shafahi, A., Huang, W. R., Najibi, M., Suciu, O., Studer, C., Dumitras, T., and Goldstein, T. Poison frogs! targeted clean-label poisoning attacks on neural networks. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2018

    2018

  54. [55]

    and Zisserman, A

    Simonyan, K. and Zisserman, A. Very deep convolutional networks for large-scale image recognition. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2015

    2015

  55. [56]

    Stallkamp, J., Schlipsing, M., Salmen, J., and Igel, C. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Networks, 2012. ISSN 0893-6080

    2012

  56. [57]

    Revisiting Unreasonable Effectiveness of Data in Deep Learning Era

    Sun, C., Shrivastava, A., Singh, S., and Gupta, A. Revisiting Unreasonable Effectiveness of Data in Deep Learning Era . In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2017

    2017

  57. [58]

    T., Trischler, A., Bengio, Y., and Gordon, G

    Toneva, M., Sordoni, A., des Combes, R. T., Trischler, A., Bengio, Y., and Gordon, G. J. An empirical study of example forgetting during deep neural network learning. In Proc. of the International Conference on Learning Representations ( ICLR ) , 2019

    2019

  58. [59]

    Label-consistent backdoor attacks

    Turner, A., Tsipras, D., and Madry, A. Label-consistent backdoor attacks. ArXiv, abs/1912.02771, 2019

    Pith/arXiv arXiv 1912

  59. [60]

    and Hinton, G

    van der Maaten, L. and Hinton, G. Visualizing data using t-sne. Journal of Machine Learning Research, 2008

    2008

  60. [61]

    Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples

    Wei, S., Zhang, M., Zha, H., and Wu, B. Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2023

    2023

  61. [62]

    Herding dynamical weights to learn

    Welling, M. Herding dynamical weights to learn. In Proc. of the International Conference on Machine Learning ( ICML ) , 2009

    2009

  62. [63]

    Backdoorbench: A comprehensive benchmark of backdoor learning

    Wu, B., Chen, H., Zhang, M., Zhu, Z., Wei, S., Yuan, D., and Shen, C. Backdoorbench: A comprehensive benchmark of backdoor learning. In Thirty-sixth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2022

    2022

  63. [64]

    and Wang, Y

    Wu, D. and Wang, Y. Adversarial neuron pruning purifies backdoored deep models. In Proc. of the Annual Conference on Neural Information Processing Systems ( NeurIPS ) , 2021

    2021

  64. [65]

    M., and Jia, R

    Zeng, Y., Park, W., Mao, Z. M., and Jia, R. Rethinking the backdoor attacks' triggers: A frequency perspective. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2021

    2021

  65. [66]

    Exploring the orthogonality and linearity of backdoor attacks

    Zhang, K., Cheng, S., Shen, G., Tao, G., An, S., Makur, A., Ma, S., and Zhang, X. Exploring the orthogonality and linearity of backdoor attacks. In Proc. of the IEEE Symposium on Security and Privacy , 2024

    2024

  66. [67]

    Backdoor defense via deconfounded representation learning

    Zhang, Z., Liu, Q., Wang, Z., Lu, Z., and Hu, Q. Backdoor defense via deconfounded representation learning. In Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) , 2023

    2023

  67. [68]

    and Wressnegger, C

    Zhao, Q. and Wressnegger, C. Adversarially robust anti-backdoor learning. In Proc. of the ACM Workshop on Artificial Intelligence and Security ( AISEC ) , October 2024

    2024

  68. [69]

    and Wressnegger, C

    Zhao, Q. and Wressnegger, C. Two sides of the same coin: L earning the backdoor to remove the backdoor. In Proc. of the Annual AAAI Conference on Artificial Intelligence ( AAAI ) , February 2025

    2025

  69. [70]

    Clean-label backdoor attacks on video recognition models

    Zhao, S., Ma, X., Zheng, X., Bailey, J., Chen, J., and Jiang, Y. Clean-label backdoor attacks on video recognition models. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2023

    2023

  70. [71]

    Enhancing fine-tuning based backdoor defense with sharpness-aware minimization

    Zhu, M., Wei, S., Shen, L., Fan, Y., and Wu, B. Enhancing fine-tuning based backdoor defense with sharpness-aware minimization. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2023 a

    2023

  71. [72]

    The victim and the beneficiary: Exploiting a poisoned model to train a clean model on poisoned data

    Zhu, Z., Wang, R., Zou, C., and Jing, L. The victim and the beneficiary: Exploiting a poisoned model to train a clean model on poisoned data. In Proc. of the IEEE/CVF International Conference on Computer Vision ( ICCV ) , 2023 b

    2023

  72. [73]

    Adversarial attacks on machine learning cybersecurity defences in Industrial Control Systems , year =

    Anthi, Eirini and Williams, Lowri and Rhode, Matilda and Burnap, Pete and Wedgbury, Adam , journal =. Adversarial attacks on machine learning cybersecurity defences in Industrial Control Systems , year =

  73. [74]

    and Dambra, Savino and Freeman, David and Pierazzi, Fabio and Roundy, Kevin A

    Apruzzese, Giovanni and Anderson, Hyrum S. and Dambra, Savino and Freeman, David and Pierazzi, Fabio and Roundy, Kevin A. , booktitle = satml, title =

  74. [75]

    Bagdasaryan, Eugene and Shmatikov, Vitaly , booktitle = usenixss, title =

  75. [76]

    Detecting Poisoning Attacks on Machine Learning in IoT Environments , year =

    Baracaldo, Nathalie and Chen, Bryant and Ludwig, Heiko and Safavi, Amir and Zhang, Rui , booktitle =. Detecting Poisoning Attacks on Machine Learning in IoT Environments , year =

  76. [77]

    Barni, Mauro and Kallas, Kassem and Tondi, Benedetta , booktitle = icip, title =

  77. [78]

    CoRR , title =

    Bengio, Yoshua and L. CoRR , title =

  78. [79]

    Berthelot, David and Carlini, Nicholas and Goodfellow, Ian and Papernot, Nicolas and Oliver, Avital and Raffel, Colin , booktitle = neurips, title =

  79. [80]

    Biggio, Battista and Nelson, Blaine and Laskov, Pavel , booktitle = icml, title =

  80. [81]

    Wild patterns: Ten years after the rise of adversarial machine learning , year =

    Biggio, Battista and Roli, Fabio , journal =. Wild patterns: Ten years after the rise of adversarial machine learning , year =

Showing first 80 references.

This paper was first reviewed by deepseek-v4-flash on August 1, 2026.