Backdoor Removal Method for Deep Neural Networks Based on Pruning and Backdoor Unlearning
[1]LI Xuexiang,GAO Yafei,XIA Huili,et al.Backdoor Removal Method for Deep Neural Networks Based on Pruning and Backdoor Unlearning[J].Journal of Zhengzhou University (Engineering Science),2026,47(XX):1-8.[doi:10.13705/j.issn.1671-6833.2025.05.018]
Copy
Journal of Zhengzhou University (Engineering Science)[ISSN
1671-6833/CN
41-1339/T] Volume:
47
Number of periods:
2026 XX
Page number:
1-8
Column:
Public date:
2026-09-10
- Title:
- Backdoor Removal Method for Deep Neural Networks Based on Pruning and Backdoor Unlearning
- Keywords:
- deep neural networks; backdoor attack; backdoor defense; pre-activation distribution; adversarial backdoor unlearning
- CLC:
- TP309 TP181
- Abstract:
- Backdoor attacks pose a serious threat to the security of deep neural networks. Most existing backdoor defense methods rely on partial original training data to remove backdoor from models. However, in real-world scenarios where these data access is limited, these methods perform poorly in eliminating backdoor and often significantly impact the model’s original accuracy. To address these issues, this paper proposes a data-free backdoor removal method based on pruning and backdoor unlearning (DBR-PU). Specifically, the proposed method first analyzes the pre-activation distribution differences of model neurons on a synthetic dataset to identify suspicious neurons. Then, it reduces the impact of backdoor by pruning these suspicious neurons. Finally, an adversarial backdoor unlearning strategy is employed to further eliminate the model’s internal response to any residual backdoor information. Extensive experiments on the CIFAR10 and GTSRB datasets against six mainstream backdoor attack methods demonstrate that, under data access constraints, the proposed method achieves a minimal accuracy gap compared to the best baseline defense methods and performs the best in reducing attack success rates, outperforming the best baseline defense method by 2.37% and 1.3%, respectively.
- References:
-
[1] 罗荣辉, 袁航, 钟发海, 等. 基于卷积神经网络的道路拥堵识别研究[J]. 郑州大学学报(工学版), 2019, 40(2): 21-25.
LUO R H, YUAN H, ZHONG F H, et al. Traffic jam detection based on convolutional neural network[J]. Journal of Zhengzhou University (Engineering Science), 2019, 40(2): 21-25.
[2] LI Y M, JIANG Y, LI Z F, et al. Backdoor learning: a survey[J]. IEEE Transactions on Neural Networks and Learning Systems, 2024, 35(1): 5-22.
[3] GU T Y, LIU K, DOLAN-GAVITT B, et al. BadNets: evaluating backdooring attacks on deep neural networks[J]. IEEE Access, 2019, 7: 47230-47244.
[4] NGUYEN A, TRAN A. WaNet: imperceptible warping-based backdoor attack[EB/OL]. (2021-02-20)[2024-11-16]. https://doi.org/10.48550/arXiv.2102.10369.
[5] BARNI M, KALLAS K, TONDI B. A new backdoor attack in CNNs by training set corruption without label poisoning[C]//2019 IEEE International Conference on Image Processing (ICIP). Piscataway: IEEE, 2019: 101-105.
[6] TRAN B, LI J, MADRY A. Spectral signatures in backdoor attacks[EB/OL]. (2018-11-01)[2024-11-16]. https://doi.org/10.48550/arXiv.1811.00636.
[7] WU D X, WANG Y S. Adversarial neuron pruning purifies backdoored deep models[EB/OL]. (2021-10-27)[2024-11-16]. https://doi.org/10.48550/arXiv.2110.14430.
[8] ZENG Y, CHEN S, PARK W, et al. Adversarial unlearning of backdoors via implicit hypergradient[EB/OL]. (2021-10-07)[2024-11-16]. https://doi.org/10.48550/arXiv.2110.03735.
[9] ZHENG R K, TANG R J, LI J Z, et al. Pre-activation distributions expose backdoor neurons[J]. Advances in Neural Information Processing Systems, 2022, 35: 18667-18680.
[10] ZHANG X Y, ZHOU X Y, LIN M X, et al. ShuffleNet: an extremely efficient convolutional neural network for mobile devices[C]//2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway: IEEE, 2018: 6848-6856.
[11] CAI R, ZHANG Z Y, CHEN T L, et al. Randomized channel shuffling: Minimal-overhead backdoor attack detection without clean datasets[J]. Advances in Neural Information Processing Systems, 2022, 35: 33876-33889.
[12] CHEN H T, WANG Y H, XU C, et al. Data-free learning of student networks[C]//2019 IEEE/CVF International Conference on Computer Vision (ICCV). Piscataway: IEEE, 2019: 3514-3522.
[13] FANG G F, SONG J, SHEN C C, et al. Data-free adversarial distillation[EB/OL]. (2019-12-23)[2024-11-16]. https://arxiv.org/abs/1912.11006.
[14] SHI L C, JIAO Y Y, LU B L. Differential entropy feature for EEG-based vigilance estimation[C]//2013 35th Annual International Conference of the IEEE Engineering in Medicine and Biology Society (EMBC). Piscataway: IEEE, 2013: 6627-6630.
[15] CHEN X Y, LIU C, LI B, et al. Targeted backdoor attacks on deep learning systems using data poisoning[EB/OL]. (2017-12-15)[2024-11-16]. https://arxiv.org/abs/1712.05526.
[16] NGUYEN T A, TRAN A. Input-aware dynamic backdoor attack[J]. Advances in Neural Information Processing Systems, 2020, 33: 3454-3464.
[17] WANG Z T, ZHAI J, MA S Q. BppAttack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning[C]//Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. Piscataway: IEEE, 2022: 15074-15084.
[18] LIU K, DOLAN-GAVITT B, GARG S. Fine-pruning: defending against backdooring attacks on deep neural networks[C]//Research in Attacks, Intrusions, and Defenses. Cham: Springer International Publishing, 2018: 273-294.
[19] WU B Y, CHEN H R, ZHANG M D, et al. Backdoorbench: A comprehensive benchmark of backdoor learning[J]. Advances in Neural Information Processing Systems, 2022, 35: 10546-10559.
[20] HEUSEL M, RAMSAUER H, UNTERTHINER T, et al. GANs trained by a two time-scale update rule converge to a local Nash equilibrium[EB/OL]. (2017-06-26)[2024-11-16]. https://arxiv.org/abs/1706.08500.
[21] VAN DER MAATEN L, HINTON G. Visualizing data using t-SNE[J]. Journal of Machine Learning Research, 2008, 9(11): 2579-2605.
- Similar References:
Memo
-
Last Update:
2026-01-14
