Two Sides of the Same Coin Learning the Backdoor to Remove the Backdoor

Jul 16, 2026

Upload by Levi

Recent defenses for neural backdoors focus on separating poisoned from benign samples during training, often using a fixed training-loss threshold or an oracle learned iteratively for identifying benign data. Observations show backdoored behavior can be learned more easily from poisoned samples than from clean ones. HARVEY instead learns an oracle for poisonous rather than benign samples, enabling far more accurate identification. Evaluations demonstrate near-perfect backdoor removal with attack success rates reduced to a minimum while keeping negligible loss in natural accuracy.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages15

Reading Time38 min

Abstract

Introduction

Threat model and attack types

Related training-time defense approaches

Proposed method: HARVEY

Four-stage training procedure

Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor Qi Zhao, Christian Wressnegger KASTEL Security Research Labs Karlsruhe Institute of Technology (KIT) arXiv :2607 .05748v 1 [ cs .LG] 7 Jul 2026 Abstract The community has recently developed various training-time defenses to counter neural backdoors introduced through data poisoning. In light of the observation that a model learns poisonous samples responsible for the backdoor easier than benign samples, these approaches either use a fixed threshold of the training loss for splitting (Li et al. 2021a; Huang et al. 2022; Chen et al. 2022) or iteratively learn a reference model as an oracle for identifying benign samples (Gao et al. 2023; Zhang et al. 2023) . In particular, the latter has proven effective for anti-backdoor learning. Our method, HARVEY, leverages a similar yet crucially different technique: learning an oracle for poisonous rather than benign samples. Learning a backdoored reference model is significantly easier than learning a reference model on benign data. Consequently, we can identify poisonous samples much more accurately than related work identifies benign samples. This crucial difference enables near-perfect backdoor removal as we demonstrate in our evaluation. HARVEY substantially outperforms related approaches across attack types, datasets, and architectures, lowering the attack success rate to the very minimum at a negligible loss in natural accuracy. 1 Introduction Learning an expressive deep neural network (DNN) requires large amounts of training data, which is oftentimes retrieved from third-party resources in practice (Carlini et al. 2023) . Using such an external dataset without review may introduce security threats via data poisoning (Biggio and Roli 2018) . The adversary may sneak a small portion of poisonous samples into the training dataset to introduce a neural backdoor. Such a backdoor shortcuts the prediction toward a predefined target label based on a trigger pattern (Gu et al. 2017; Chen et al. 2017; Liu et al. 2018b; Nguyen and Tran 2020, 2021; Barni et al. 2019) and can be established via data poisoning in two ways: First, dirty-label attacks (Gu et al. 2017; Chen et al. 2017; Liu et al. 2018b; Nguyen and Tran 2020, 2021) construct the trigger pattern on poisonous samples and relabel them to the target. Second, clean-label attacks (Turner et al. 2019; Shafahi et al. 2018; Zhao et al. 2023) strategically modify samples from the target class but do not change their labels. Copyright © 2025, Association for the Advancement of Artificial Intelligence ([www.aaai.org](www.aaai.org)). All rights reserved. Table 1: Comparison of training-time backdoor defenses. | Method | Defense<br>Technique | Splitting<br>Ratio | Architecture<br>Independent | Natural<br>Accuracy | | --- | --- | --- | --- | --- | | ABL | Unlearn | Fixed | – | | | CBD | Suppress | Adaptive | – | | | DBD | Data Split | Fixed | – | | | D-ST | Data Split | Fixed | – | | | HARVEY | Data Split | Adaptive | | | A wide variety of strategies have been proposed to alleviate backdooring attacks. Type-1: Model-based defenses either reverse-engineer the trigger pattern (Wang et al. 2023, 2022, 2019a), merely detect the existence of the backdoor (Cai et al. 2022; Xu et al. 2021; Wang et al. 2020), or erase the backdoor from the model (Liu et al. 2018a; Zhao et al. 2020; Li et al. 2021b) . Type-2: Runtime defenses conduct differential testing (Doan et al. 2020), break the trigger functionality via data preprocessing (Qiu et al. 2021) or filter out abnormal inputs (Hayase et al. 2021; Gao et al. 2019) . Type-3: Training-time defenses, in turn, suppress the backdoor during the training, either using prior knowledge of a clean dataset as the reference (Zhou et al. 2023; Gao et al. 2023), or without such (Li et al. 2021a; Chen et al. 2022; Huang et al. 2022; Zhang et al. 2023) . All the strategies above have slightly different threat models, and o

FAQs

What problem does the document address?

It addresses how to remove neural backdoors introduced through data poisoning during the training process, especially when no clean reference dataset is available.

How does HARVEY differ from prior training-time defenses?

HARVEY learns an oracle for poisonous samples instead of an oracle for benign samples, leveraging that backdoored reference learning is easier on poisoned data.

What are the main stages of HARVEY?

HARVEY follows four stages: initialization with naive training and half-and-half split using RCE loss, iterative learning of poisonous/unlearning of benign via a backdoored reference model, meta-splitting to refine the poisonous subset, and subsequent steps to complete backdoor removal.

Jul 16, 2026

Upload by Levi