TED++: Submanifold-Aware Backdoor Detection via Layerwise Tubular-Neighbourhood Screening

2025/10/16 by Le, Nam, Zhang, Leo Yu, Liao, Kewen +2
#53Z50 #62H30 #68T07 #Artificial Intelligence (cs.AI) #FOS: Computer and information sciences #I.2.6 #I.5.1 #K.6.5 #Machine Learning (cs.LG)

paper · doi:10.48550/arxiv.2510.14299

Abstract

As deep neural networks power increasingly critical applications, stealthy backdoor attacks, where poisoned training inputs trigger malicious model behaviour while appearing benign, pose a severe security risk. Many existing defences are vulnerable when attackers exploit subtle distance-based anomalies or when clean examples are scarce. To meet this challenge, we introduce TED++, a submanifold-aware framework that effectively detects subtle backdoors that evade existing defences. TED++ begins by constructing a tubular neighbourhood around each class's hidden-feature manifold, estimating its local ``thickness'' from a handful of clean activations. It then applies Locally Adaptive Ranking (LAR) to detect any activation that drifts outside the admissible tube. By aggregating these LAR-adjusted ranks across all layers, TED++ captures how faithfully an input remains on the evolving class submanifolds. Based on such characteristic ``tube-constrained'' behaviour, TED++ flags inputs whose LAR-based ranking sequences deviate significantly. Extensive experiments are conducted on benchmark datasets and tasks, demonstrating that TED++ achieves state-of-the-art detection performance under both adaptive-attack and limited-data scenarios. Remarkably, even with only five held-out examples per class, TED++ still delivers near-perfect detection, achieving gains of up to 14% in AUROC over the next-best method. The code is publicly available at https://github.com/namle-w/TEDpp.

Citations

• Secure Transfer Learning: Training Clean Models Against Backdoor in (Both) Pre-trained Encoders and Downstream Datasets
• FLARE: Toward Universal Dataset Purification against Backdoor Attacks
• Detector Collapse: Physical-World Backdooring Object Detection to Catastrophic Overload or Blindness in Autonomous Driving
• IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistency
• Robust Backdoor Detection for Deep Learning via Topological Evolution Dynamics
• Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand
• Detecting Backdoors During the Inference Stage Based on Corruption Robustness Consistency
• Defending Against Backdoor Attacks by Layer-wise Feature Analysis
• SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistency
• Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection
• Black-box Dataset Ownership Verification via Backdoor Watermarking
• BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learning
• MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statistic
• Narcissus: A Practical Clean-Label Backdoor Attack with Limited Information
• Training with More Confidence: Mitigating Injected and Natural Backdoors During Training
• Backdoor Defense via Decoupling the Training Process
• Defending against Model Stealing via Verifying Embedded External Features
• Towards Practical Deployment-Stage Backdoor Attack on Deep Neural Networks
• Anti-Backdoor Learning: Training Clean Models on Poisoned Data
• Adversarial Unlearning of Backdoors via Implicit Hypergradient
• Backdoor Attack in the Physical World
• Input-Aware Dynamic Backdoor Attack
• Backdoor Learning: A Survey
• Backdoor Attacks Against Deep Learning Systems in the Physical World
• An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networks
• Label-Consistent Backdoor Attacks
• Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networks
• Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detection
• Spectral Signatures in Backdoor Attacks
• Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Deep Residual Learning for Image Recognition

Related

• Robust Backdoor Detection for Deep Learning via Topological Evolution Dynamics
• TED-LaST: Towards Robust Backdoor Defense Against Adaptive Attacks
• BAN: Detecting Backdoors Activated by Adversarial Neuron Noise
• COLLIDER: A Robust Training Framework for Backdoor Data
• ProP: Efficient Backdoor Detection via Propagation Perturbation for Overparametrized Models