Paper deep dive

Fine-Tuning Is All You Need to Mitigate Backdoor Attacks

Zeyang Sha, Xinlei He, Pascal Berrang, Mathias Humbert, Yang Zhang

Year: 2022Venue: arXiv preprintArea: Adversarial RobustnessType: EmpiricalEmbeddings: 79

Models: ResNet-18, ResNet-34

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%

Last extracted: 3/12/2026, 6:50:18 PM

Summary

The paper demonstrates that fine-tuning and a newly proposed 'super-fine-tuning' method are highly effective, low-cost defenses against backdoor attacks in machine learning models across encoder-based, transfer-based, and standalone scenarios. The authors introduce 'backdoor sequela' to measure changes in model vulnerability post-defense and show that these methods maintain model utility while reducing attack success rates better than existing complex defenses.

Entities (6)

BadEncoder · attack · 100%BadNets · attack · 100%Blended · attack · 100%Fine-tuning · defense-method · 100%Super-fine-tuning · defense-method · 100%Backdoor sequela · metric · 95%

Relation Signals (3)

Backdoor sequela → measures → Model vulnerability

confidence 95% · measure the changes in model vulnerabilities to other attacks before and after the backdoor has been removed

Fine-tuning → mitigates → Backdoor Attacks

confidence 95% · fine-tuning... can effectively remove backdoors from machine learning models

Super-fine-tuning → improves → model utility

confidence 90% · super-fine-tuning can more effectively remove all backdoors... and retain the models’ utility

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Backdoor attacks represent one of the major threats to machine learning models. Various efforts have been made to mitigate backdoors. However, existing defenses have become increasingly complex and often require high computational resources or may also jeopardize models' utility. In this work, we show that fine-tuning, one of the most common and easy-to-adopt machine learning training operations, can effectively remove backdoors from machine learning models while maintaining high model utility. Extensive experiments over three machine learning paradigms show that fine-tuning and our newly proposed super-fine-tuning achieve strong defense performance. Furthermore, we coin a new term, namely backdoor sequela, to measure the changes in model vulnerabilities to other attacks before and after the backdoor has been removed. Empirical evaluation shows that, compared to other defense methods, super-fine-tuning leaves limited backdoor sequela. We hope our results can help machine learning model owners better protect their models from backdoor threats. Also, it calls for the design of more advanced attacks in order to comprehensively assess machine learning models' backdoor vulnerabilities.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

78,690 characters extracted from source content.

Expand or collapse full text

Fine-Tuning Is All You Need to Mitigate Backdoor Attacks Zeyang Sha 1 Xinlei He 1 Pascal Berrang 2 Mathias Humbert 3 Yang Zhang 1 1 CISPA Helmholtz Center for Information Security 2 University of Birmingham 3 University of Lausanne Abstract Backdoor attacks represent one of the major threats to ma- chine learning models. Various efforts have been made to mitigate backdoors. However, existing defenses have be- come increasingly complex and often require high compu- tational resources or may also jeopardize models’ utility. In this work, we show that fine-tuning, one of the most common and easy-to-adopt machine learning training operations, can effectively remove backdoors from machine learning models while maintaining high model utility. Extensive experiments over three machine learning paradigms show that fine-tuning and our newly proposed super-fine-tuning achieve strong defense performance. Furthermore, we coin a new term, namelybackdoor sequela, to measure the changes in model vulnerabilities to other attacks before and after the backdoor has been removed. Empirical evaluation shows that, com- pared to other defense methods, super-fine-tuning leaves lim- ited backdoor sequela. We hope our results can help machine learning model owners better protect their models from back- door threats. Also, it calls for the design of more advanced attacks in order to comprehensively assess machine learning models’ backdoor vulnerabilities. 1 Introduction In recent years, researchers have shown that machine learn- ing (ML) models are vulnerable to various security attacks. One common attack in this domain is the backdoor at- tack [10, 15, 15, 23, 35, 43, 46, 56], whereby an adversary aims to insert a backdoor into a target ML model via mali- cious training. Taking image classification as an example, a backdoored model will classify images that embed spe- cific triggers into a pre-defined class while keeping normal behavior on clean images. So far, most efforts have gone into the design of effective backdoor attacks against various types of ML models [10, 15, 31, 40, 42]. To mitigate these at- tacks, intricate defenses have been proposed. Some of the de- fenses [7, 16, 22, 34, 55], focus on extracting the trigger from a target ML model via optimization; some aim to detect the inputs with triggers [6, 13, 53, 54]; others rely on training a large set of backdoored shadow models to learn how to dif- ferentiate backdoored models from clean ones [57]. As defenses become increasingly complex, the defender needs to be equipped with powerful computing infrastruc- tures, which is often a bottleneck. Moreover, to remove the backdoors, some of the defenses need to change the target models’ parameters, which jeopardizes the models’ perfor- mance on the original tasks, i.e., model utility. For instance, one defense named Activation Clustering (AC) [6] fails to successfully remove the backdoor (BadNets [15]) from the target model trained on CIFAR100 [1]. Moreover, AC causes the models’ accuracy on clean samples to drop from 0.672 to 0.582 (see Section 5.4). Fine-tuning is a widely adopted technique in the ML training pipeline, especially for transfer learning [62] and encoder-based learning [8, 9, 14, 18]. In this paper, we find that fine-tuning with a proper learning rate is the most ef- fective defense method for mitigating backdoor attacks in terms of both defense performance and utility. Moreover, it is remarkably easy to apply to a variety of machine learn- ing paradigms. Note that we focus on image classifiers as their backdoor vulnerabilities have been extensively stud- ied [10, 15, 15, 43]. Scenarios.We consider three types of ML deployment sce- narios in this work, namely, anencoder-basedscenario, a transfer-basedscenario, and astandalonescenario. These scenarios constitute most of the ML use cases, and re- searchers have shown that they are all vulnerable to back- door attacks. In the encoder-based scenario, one obtains a pre-trained encoder and then fine-tunes it for various down- stream tasks. These pre-trained encoders are normally estab- lished with self-supervised learning methods, such as con- trastive learning [8]. To deploy a backdoor attack in this case, the backdoor is implanted in the pre-trained encoder itself and will be activated after the encoder is fine-tuned for downstream tasks. In the transfer-based scenario, the user gets a pre-trained classifier, such as a ResNet-18 [19] trained on ImageNet [12]. Then, the model is fine-tuned (replac- ing the original classification layer with the new classifica- tion layer) with its own dataset. Similar to the encoder-based scenario, the backdoor here lies in the pre-trained classifier. The standalone scenario is the most common backdoor sce- nario. Here, the user directly interacts with a backdoored model without changing its parameters. Metrics.To measure the performance of backdoor de- fenses, we consider three metrics, including attack success rate (ASR), model utility (measured by clean accuracy, CA), and computational cost (measured by GPU hours). The for- 1 arXiv:2212.09067v1 [cs.CR] 18 Dec 2022 mer two are the standard metrics in this field: an effective defense aims to reduce the attack success rate while main- taining the target model’s utility. Meanwhile, low computa- tional cost implies the defense can be easily deployed, which is also one of the major advantages of our approach. Methodology.We empirically show that, in an encoder- based scenario, conventional fine-tuning is sufficient for countering backdoors. In the other two scenarios where conventional fine-tuning is not effective, we further devise super-fine-tuning. Our super-fine-tuning method is inspired by super-convergence [48]. We find that a large learning rate significantly helps remove the backdoor, while a small learning rate can maintain the model utility. Therefore, we combine them together and construct a dynamic learning rate method to mitigate backdoor attacks. Evaluation.In the encoder-based scenario, our evaluation shows that the backdoor cannot survive if the user conducts the whole model (conventional) fine-tuning. For instance, when fine-tuning the backdoored encoder trained by BadEn- coder [23], after one epoch (which takes about 0.004 GPU hours on an NVIDIA DGX-A100 server), the attack suc- cess rate on STL10 [2] (pre-trained on CIFAR10) drops from 0.998 to 0.127. In this scenario, whole model fine-tuning is sufficient. More importantly, it is azero-costbackdoor re- moval solution, as conventional fine-tuning is a necessary step for users to adapt the pre-trained encoders to down- stream tasks [8, 17, 26, 28]. In the transfer-based scenario, our experiments show that through conventional fine-tuning, most of the backdoor at- tacks can be successfully mitigated. On the other hand, our proposed super-fine-tuning can more effectively remove all backdoors with fewer epochs and retain the models’ util- ity. For instance, while conventional fine-tuning can only decrease the ASR from 0.945 to 0.221 on BadNets [15] at- tacks of a CIFAR10 [1] model in 100 epochs (about 0.617 GPU hours), super-fine-tuning can make the ASR drop to 0.096 within three epochs (about 0.089 GPU hours) while keeping high utility (0.936). Note that fine-tuning is also necessary for transfer learning to perform downstream tasks; thus, our defense is still costless, similar to the encoder-based scenario. Normally, the standalone scenario does not need fine- tuning. Here, fine-tuning is an extra step intended to re- move the backdoor. However, this does not hurt model util- ity. In this scenario, conventional fine-tuning does not always work. Instead, by relying on our super-fine-tuning method, we can achieve excellent performance regarding mitigating backdoor attacks. For instance, in 0.089 GPU hours, super- fine-tuning can decrease the ASR of the Blended attack [10] on a CIFAR10 model from 0.997 to 0.082 while keeping a high utility (0.937). To summarize, our experimental results show that in the encoder-based scenario, conventional fine-tuning (on the whole model) is sufficient to remove almost all encoder- based backdoors. For the transfer-based and standalone sce- narios, super-fine-tuning can achieve remarkably strong per- formance. We compare the performance between super-fine-tuning and other existing state-of-the-art defense methods [6, 29, 30, 33, 53, 55]. Our results show that super-fine-tuning achieves the best performance in all perspectives (attack success rate, clean accuracy, and computational cost). For instance, the defense method called ABL [29] fails in mitigating most of the attacks in the standalone scenario. The ASR of BadNets on CIFAR10 will remain high (0.896) after ABL has been applied. Meanwhile, super-fine-tuning manages to drop the ASR from 0.954 to 0.069. Sequela of the Backdoor Defense.Though fine-tuning can effectively eliminate backdoors from ML models, it changes the models’ parameters. We are interested in whether such changes will have any effect on the models’ security and privacy.We refer to this asbackdoor defense sequela and consider two attacks, i.e., membership inference at- tacks [21, 45, 47] and backdoor re-injection attacks on back- doored models defended by different methods. We hypothesize that the fine-tuned model in the standalone scenario may have higher membership privacy risks due to the fact that during the fine-tuning process, we drive the model to further memorize the fine-tuning dataset and forget the backdoor trigger. Note that in the standalone setting, the fine-tuning dataset is a clean version of the model’s original training dataset. We conduct our experiments by leveraging existing membership inference attacks on both backdoored models and fine-tuned models. Surprisingly, our experimen- tal results show that, after super-fine-tuning, the membership leakage risks are even reduced. For instance, after a Bad- Nets model on CIFAR10 has been defended by super-fine- tuning, the membership inference attack can achieve 0.569 accuracy, which is lower than the performance on the orig- inal backdoored model (0.618). Therefore, from a privacy leakage perspective, fine-tuning has almost no negative im- pact on the target model. We also consider another backdoor sequela called back- door re-injection attacks. As fine-tuning only takes a few steps to mitigate the backdoor attacks, it is worth further ex- ploring whether the backdoor can be easily injected back. Our experimental results show that for any defense (both ours and methods from previous works), once it has been ap- plied to a model, the adversary can easily re-inject the same backdoor to the target model. For instance, once a BadNets model on CIFAR10 in the standalone scenario has been fine- tuned (ASR drops from 0.954 to 0.073), the adversary can re- inject BadNets to the model to achieve a similar ASR (0.935) within two epochs when the poison ratio is 0.1. To achieve a similar backdoor attack performance on the original clean model, BadNets requires seven epochs. Implications.In general, our results show that back- door defenses can be performed more easily than previ- ously thought. All one needs is fine-tuning or super-fine- tuning. Currently, the empirical evaluation suggests that backdoor attacks achieve almost perfect accuracy (∼100% accuracy [10, 15, 23, 35, 43]), especially for standalone clas- sifiers. By applying our easy-to-deploy fine-tuning defense, our work will certainly help the model users/owners mitigate existing backdoor attacks deployed in the real world. It fur- ther calls for the design of more advanced backdoor attacks 2 to better assess the vulnerability of ML models to such at- tacks. 2 Backdoor Attacks 2.1 The Principle of Backdoor Attacks In this work, we focus on targeted backdoor attacks on im- age classification tasks, which is the most common setting of backdoor-related research. The classification tasks can be formulated as follows:f(x) =c, wherex∈X,c∈C.Xis the image domain andCis the label domain. To inject a backdoor into a target model, an adversary manipulates the model to learn the trigger pattern. Images with this trigger pattern will be classified into the target label. The process can be formulated as the following:f(t(x)) =c t , wheret(·) is the pre-defined trigger pattern andc t is the target label. Currently, different types of backdoor attacks mainly focus on how to design better trigger patterns [10,37,40,44] or how to improve the backdoor training process [5, 35, 37, 58, 61]. For better trigger patterns, the adversary aims to bypass the existing defenses to poison the training dataset. With re- gards to improving the backdoor training process, the adver- sary aims to inject the backdoor in an easier and faster way. We will introduce the representative attacks in detail in Sec- tion 4.1. Our further experiments show that all these back- door attacks can be easily mitigated by either conventional fine-tuning or our proposed super-fine-tuning method. 2.2 Attack Scenarios As stated before, we consider three different scenarios in our works, including encoder-based, transfer-based, and stan- dalone scenarios. Based on these scenarios, we recommend users use different fine-tuning strategies (see Section 3 for more details). Encoder-Based Scenario.With the quick development of self-supervised learning, the encoder-based paradigm is becoming popular. The encoder-based paradigm consists of two key steps: pre-training an encoder and construct- ing downstream classifiers from the encoder for various tasks. Current efforts of the attack mainly focus on inject- ing backdoors into the encoder and expect downstream clas- sifiers built on the pre-trained encoder to have good back- door performance as well as high utility. One representative encoder-based backdoor attack is BadEncoder [23], where an optimization-based solution is used to train a backdoored image encoder. Concretely, to obtain the backdoored en- coder, BadEncoder forces the embeddings of the triggered images to be close to a pre-defined target image’s embedding (increasing attack success rate) while keeping clean images’ embeddings similar to the corresponding embeddings on the clean model (maintaining model utility). Normally,backdoor attacks on this encoder-based paradigm assume the users freeze the encoder’s parameters and only fine-tune the downstream classifier. In this case, most attacks survive and achieve a high attack success rate as well as high utility. However, in common encoder use cases, the encoder is fine-tuned as well [52], which means that the encoder’s parameters are changed too. This may call for extra difficulty in maintaining the attack performance. Transfer-Based Scenario.Another popular scenario is the transfer learning setting, whereby the user gets a pre-trained model on a large-scale dataset (pre-trained model) and then fine-tunes the model to adapt to their own downstream tasks (fine-tuned model). To achieve such adaptation, one com- mon way is to replace the pre-trained model’s original clas- sification layer with a new classification layer that fits the downstream task and fine-tune the new model. For back- door attacks in this scenario, the adversary injects the back- door in the pre-trained model by associating a trigger with a certain class on a subset of the pre-training dataset. After fine-tuning (with the downstream task dataset), the adversary expects that images with the pre-defined trigger will be mis- classified in the fine-tuned model, and the misclassifications all lead to the same (but random) class. We consider this set- ting as multiple attacks can be easily adapted here like the ones considered in our experiments [10, 15, 40, 41, 60]. Note that there exists another work on backdoor attacks against transfer learning [58]. We do not use it as its performance is not strong based on our evaluation as well as the results in [23]. Standalone Scenario.The most common and difficult sce- nario is the standalone scenario. In this scenario, the user can directly deploy the model obtained from the Internet with- out any modification. Note that the training dataset of the model is usually publicly available to the user. An alterna- tive case is that the user outsources their data to a company that offers ML model training service and then obtains the model from the company (the company being the adversary here). In both cases, the backdoor injected by the adversary makes the model misclassify any inputs with the trigger into the pre-defined class. Our evaluation shows that, even if the user fine-tunes the model with the same dataset that was used to train the backdoored model, the backdoor can still remain, which calls for more effective defenses (see Section 5.3 for more details). 3 Backdoor Defenses In this section, we first introduce the defender’s goals and ca- pabilities. Then, we will discuss how fine-tuning and super- fine-tuning work to mitigate backdoor attacks. 3.1 Defender’s Goals and Capabilities Defender’s Goals.A defender’s goal can be summarized from three perspectives. •Backdoor Performance.The main goal of the defender is to reduce the backdoor performance. To achieve this goal, the defender can either detect/mitigate the triggered inputs or purify the model to mitigate the backdoor effect. •Utility.In addition to reducing the backdoor performance, the defender should also keep the utility of the backdoored model. That means that, after the defense, the model should still perform well on clean inputs. 3 First PhaseSecond Phase LR MAX1 LR BASE LR MAX2 ....... ....... Figure 1: The learning rate scheduler of super-fine-tuning. •Computational Cost.As ML models become increas- ingly complex, training and testing models both require one to have powerful computing infrastructures. Ideally, the defender should use minimal computing resources to mitigate backdoors. Defender’s Capabilities.The defender is supposed to have a clean dataset to conduct the backdoor defense. For the encoder-based and transfer-based scenarios, this assumption is straightforward. The user (who is also the defender) is the one who fine-tunes the model for their downstream tasks, and they should have the clean dataset already. For the standalone scenario, as mentioned before, the model’s training dataset is provided or can be obtained by the user. Moreover, in all the scenarios, we assume the defender has white-box access to the model, which means that they can access and modify the model’s parameters. Also, as we have stated before, the defender only has limited computational resources. 3.2 Fine-Tuning to Mitigate Backdoor Attacks In this section, we describe how conventional fine-tuning works and then propose our super-fine-tuning method. Conventional Fine-Tuning.Fine-tuning is a strategy origi- nally proposed in the context of transfer learning. The moti- vation behind existing fine-tuning is to enable the pre-trained model to fit new data samples using information learned from the pre-training phase. In our case, fine-tuning is supposed to mitigate backdoor attacks as well as leverage the pre-trained model information. Instead of only fine-tuning a few layers like previous works [23], we adopt whole model fine-tuning in all our scenarios. During the fine-tuning process, we rely on the same learning rate as the one used in the pre-training process. In the encoder-based scenario, conventional fine-tuning means that the user conducts the whole model fine-tuning, which is recommended by various existing works [8, 24, 52]. Our experimental results show that conventional fine-tuning can effectively mitigate backdoor attacks in the encoder- based scenario, but it does not always work in the transfer- based and standalone scenarios. Super-Fine-Tuning.We further propose a super-fine-tuning strategy, a novel fine-tuning approach focusing on remov- ing backdoor attacks. Super-fine-tuning is inspired by super- convergence [48], which shows that the regular changes in learning rate can contribute to fast learning. The main in- novation of super-fine-tuning is the scheduler of the learning rate. Normally, the gradient descent process can be formu- lated asx=x−ε5 x f(x)wherexrepresents the weights of the model,εrepresents the learning rate, andf(·)represents the loss function. To make the model forget backdoor trig- gers while keeping the utility, we makeεchange according to the schedule shown in Figure 1. The intuition behind our designed function is that large learning rates tend to make the model forget backdoor triggers while small learning rates maintain the model utility (see Section 5.5 for detailed infor- mation). Therefore, we combine the two different learning rates with the scheduler. Concretely, we first pre-define a base learning rate (LR BASE) and two maximum learning rates (LR MAX1 and LR MAX2) for the scheduler of super-fine-tuning. Note that LR MAX1 is required to be larger than LR MAX2. We separate the training process into two phases. In the first phase, we make the learning rate linearly increase from LR BASE to LR MAX1 in several iterations and then drop back to LR BASE. This way, a learning rate that is close to LR MAX1 is sup- posed to force the model to forget backdoor triggers quickly, while the learning rate that is close to LR BASE will keep the model utility on clean samples. The same process should be repeated until we lower the maximum learning rate after a pre-defined number of epochs (in our experiments, we find that ten epochs work well). In the second phase, we continue oscillating between the base learning rate and LR MAX2 for the remaining epochs, mitigating the overfitting level of the model. Our experimental results show that the above process can effectively mitigate backdoor attacks while retaining the model’s utility. 4 Experimental Setup 4.1 Current Attacks and Defenses Attacks.For our evaluation, we consider the following six attacks. We show triggered examples of different attacks in Table 1. For each attack, we set the poison ratio to 0.1. •BadNets [15].BadNets is the most representative and clas- sic backdoor attack against ML models. The key intuition behind BadNets is to add a visible trigger to some part of the training images and label them with a target class. When the model is trained on this poisoned dataset, the backdoor will be injected, and any inputs with the same trigger will be misclassified into the target class. •Blended [10].The Blended backdoor attack is another well-established backdoor attack. Different from BadNets, Blended aims at creating a trigger that is difficult to detect even by human eyes. Also, the position of the trigger does not affect the recognition of the backdoor. •LF [60].The Low Frequency (LF) backdoor aims to de- sign backdoor attacks from a frequency perspective. Previ- ous works’ trigger images are significantly different from clean images in the frequency domain. LF aims to make the triggered sample and clean sample consistent in terms 4 of frequency. In this way, backdoor triggers have better concealment in the frequency domain. •Inputaware [40].Inputaware argues that uniform trigger patterns will be easy to detect by simple pattern recognition methods. Therefore, this attack aims to design a generator driven by diversity loss to generate personalized triggers. Through this generator, the triggers for different images are different. •WaNet [41].WaNet also focuses on designing unde- tectable backdoor attacks. WaNet uses small and smooth deformation technology to generate undetectable trigger samples. •BadEncoder [23].Different from previous attacks, BadEncoder conducts backdoor attacks on the encoders (e.g., encoders established by self-supervised learning). It injects backdoors into encoders and then expects the cor- responding downstream classifiers to have good backdoor performance as well as high utility. Note that BadEncoder is designed specifically for the encoder-based scenario, while the other five attacks can be applied to both transfer-based and standalone scenarios. Defenses.Besides fine-tuning and super-fine-tuning, we also evaluate the following six state-of-the-art defense methods. •ABL [29].Anti-Backdoor Learning (ABL) aims to train the clean model on the poisoned dataset. The intuition of ABL is that a model tends to remember backdoor sam- ples fast, and backdoor samples are tied to specific classes. ABL designs a two-stage gradient ascent method to isolate backdoor samples and makes the relationship between the backdoor sample and the corresponding label invalid. In this way, ABL can successfully counter backdoor attacks. •AC [6].The intuition behind Activation Clustering (AC) is that clean samples and backdoor samples will activate dif- ferent parameters in neural networks. AC finds the back- door samples by traversing the parameters of each activa- tion and comparing their distributions. •FP [33].Fine-pruning (FP) is a defense method similar to fine-tuning. However, fine-pruning argues that only con- ducting fine-tuning cannot effectively mitigate the back- door attack. Therefore, besides fine-tuning, the method will prune the neural network to eliminate the low influen- tial neurons in order to remove the backdoor in the model. Later we show that proper fine-tuning is sufficient to miti- gate backdoor attacks (see Section 5.1). •NAD [30].Neural Attention Distillation (NAD) also ar- gues that simply fine-tuning is not enough to mitigate the backdoor attack. They use knowledge distillation with the clean teacher model to guide the fine-tuning process of the backdoored student model. In this way, the backdoor can be removed but the computational cost is high. •NC [55].Neural Cleanse (NC) is a classic backdoor detec- tion and removal method. NC optimizes potential triggers in each class and then compares each class’ minimum per- turbation to find the out-of-distribution classes. If this class exists, the model is backdoored, and this class is the target class. To mitigate backdoor attacks, NC conducts unlearn- ing by fine-tuning the model using images with triggers and correct samples. •Spectral [53].Spectral signatures detection aims to re- move triggered samples by detecting the spectrum of the covariance of a feature representation learned by the neu- ral network. Then, the spectral approach will retrain the model with the remaining clean data. We use BackdoorBench 1 to implement these attacks and defenses. Also, all the experiments are conducted on an NVIDIA DGX-A100 server. 4.2 Datasets We leverage five image datasets for our evaluation. •CIFAR10 [1].CIFAR10 is an image dataset containing 10 classes. It has 50,000 training images and 10,000 testing images. The size of each image is 32×32×3. •CIFAR100 [1].CIFAR100 contains 50,000 training im- ages and 10,000 testing images in 100 classes. Each image in this dataset has a size of 32×32×3. •STL10 [2].STL10 is a 10-class dataset that contains 50,000 labeled images in the training set and 80,000 in the testing set. It also has 100,000 unlabeled images. The size of each image is 96×96×3. •GTSRB [3].This is a traffic sign dataset containing 39,209 training images and 12,630 testing images among 43 classes. Each image has a size of 48×48×3. •SVHN [4].SVHN is a digit classification dataset con- taining 33,402 training images and 13,068 testing images. Each image has a size of 32×32×3. 4.3 Evaluation Metrics To evaluate whether backdoor attacks have been successfully mitigated, we adopt three evaluation metrics following the three goals of the defender described in Section 3. •Attack Success Rate.Attack success rate (ASR) is used to measure whether backdoor samples are successfully clas- sified into the target label or not. •Clean Accuracy.Clean Accuracy (CA) is used to evaluate whether a model can perform well with clean data. •Computational Cost.As we have stated before, when the users take advantage of a third party’s pre-trained mod- els, normally, they do not have sufficient computational re- sources. Therefore, the backdoor defense methods should use as little computational resources as possible. Here, we leverage computational cost (measured by GPU hours) as another new important metric to evaluate defense methods. 1 https://github.com/SCLBD/BackdoorBench. 5 Table 1: Examples of triggered inputs from different backdoor attacks. BadNetsBlendedLFInputawareWaNet 4.4 Training Details For the encoder-based scenario, we leverage the official code 2 of BadEncoder to obtain the backdoored encoder. The encoder is ResNet-18 [19] trained by SimCLR [8]. We set the batch size to 256 and train the encoder for 1,000 epochs with a learning rate of 3e −4 and the ADAM [25] op- timizer. Then, we train the downstream classifier (MLP) by classifier-only fine-tuning and whole model fine-tuning for 200 epochs with a learning rate of 3e −4 . In the transfer-based and standalone-based scenarios, we take advantage of Back- doorBench to train different backdoored attack models. As recommended by BackdoorBench, we insert the backdoor in PreAct-ResNet18 [20]. During the training process, we leverage the SGD optimizer with 0.001 as learning rate, 256 as batch size, and 200 as number of training epochs. For super-fine-tuning, we set LR BASE as 3e −4 , LR MAX1 as 0.1, and LR MAX2 as 0.001. We also set 500 as number of iterations. 5 Evaluation Results 5.1 Encoder-Based Scenario In the encoder-based scenario, we make use of BadEncoder as backdoor attack since it is the most representative back- door attack in this setting. The workflow of BadEncoder is to train a backdoored encoder, freeze the encoder, and use the clean data to train a classifier for the downstream task. How- ever, according to previous works [8, 24, 51], fine-tuning the whole model can achieve better performance than only fine- tuning the downstream classifier. Therefore, our fine-tuning method updates the parameters of the whole model. The experimental results are shown in Figure 2. We train the encoders on CIFAR10 and STL10. Then, we choose CIFAR10, STL10, and SVHN as downstream tasks. From Figure 2, we first observe that BadEncoder is not stable in all datasets. For instance, when the encoder is pre-trained on STL10 and then fine-tuned with CIFAR10, even only fine-tuning the downstream classifier makes the ASR drop to 0.002. Second and more importantly, with whole model conventional fine-tuning, the injected backdoor can always be removed immediately, e.g., within one epoch. For in- stance, for the encoder pre-trained on CIFAR10 with STL10 as downstream task (shown in Figure 2), when conducting whole model fine-tuning, the ASR drops from 0.998 (fine- tuning downstream classifiers) to 0.127 within one epoch. 2 https://github.com/jinyuan-jia/BadEncoder. Note that, in this scenario, whole model conventional fine- tuning is a natural step to achieve better performance on downstream tasks. Therefore, it haszero-costfor mitigating backdoor attacks. 5.2 Transfer-Based Scenario The transfer-based scenario is also one of the most common machine learning deployment settings. In this scenario, users obtain the model trained on the large dataset and then fine- tune the model on their own dataset to perform the down- stream task. We conduct experiments where the backdoored models are pre-trained on CIFAR100 and fine-tuned with CIFAR10 and GTSRB. Here, we adopt five different attack methods described in Section 4.1. As we have stated in Sec- tion 2.2, to verify whether a backdoor has been removed, we leverage the original triggers and test whether images with such triggers can be misclassified to a certain class. The results are shown in Figure 3. As we can see, in this transfer-based scenario, conventional fine-tuning can effec- tively mitigate backdoor attacks in most cases. For instance, when the defender conducts fine-tuning to the model back- doored by BadNets on CIFAR10, the attack can only achieve 0.378 ASR in one epoch and the ASR will remain around 0.2 after 20 epochs. Our proposed super-fine-tuning method can achieve even better performance than conventional fine- tuning in this scenario. As shown in Figure 3, in most cases, super-fine-tuning can achieve lower ASR with less epochs. On BadNets-GTSRB, even after the first epoch, ASR will drop to 0.088. Also, it can be seen that super-fine-tuning yields better CA than conventional fine-tuning. For instance, super-fine-tuning on CIFAR10 against Inputaware attacks can achieve 0.798 CA in the first epoch and 0.937 CA after 100 epochs, both higher than conventional fine-tuning (0.678 in the first epoch and 0.898 after 100 epochs). This find- ing demonstrates that our proposed super-fine-tuning outper- forms conventional fine-tuning in this scenario. 5.3 Standalone Scenario The standalone scenario is the most difficult scenario to mit- igate backdoor attacks. Here, a user directly interacts with the model without any modification. Similar to the transfer- based scenario, we adopt the five attacks in Section 4.1. Fine- tuning is no longer a necessary step. Also, due to the fact that the model is trained on the desired dataset, it increases the difficulty of mitigating backdoor attacks. Most previous works [10, 15, 33] that claim backdoor attacks cannot be eas- 6 121416181100 Epoch 0 20 40 60 80 100 Accuracy CIFAR10-STL10 121416181100 Epoch 0 20 40 60 80 100 CIFAR10-SVHN 121416181100 Epoch 0 20 40 60 80 100 STL10-CIFAR10 121416181100 Epoch 0 20 40 60 80 100 STL10-SVHN CA (whole model fine-tuning) ASR (whole model fine-tuning) CA (fine-tuning downstream classifier) ASR (fine-tuning downstream classifier) Figure 2: The performance of whole model fine-tuning and downstream classifier fine-tuning on BadEncoder. The X-axis represents training epochs. The Y-axis represents accuracy. 121416181100 Epoch 0 20 40 60 80 100 Accuracy BadNets-CIFAR10 121416181100 Epoch 0 20 40 60 80 100 Blended-CIFAR10 121416181100 Epoch 0 20 40 60 80 100 Inputaware-CIFAR10 121416181100 Epoch 0 20 40 60 80 100 LF-CIFAR10 121416181100 Epoch 0 20 40 60 80 100 WaNet-CIFAR10 121416181100 Epoch 0 20 40 60 80 100 Accuracy BadNets-GTSRB 121416181100 Epoch 0 20 40 60 80 100 Blended-GTSRB 121416181100 Epoch 0 20 40 60 80 100 Inputaware-GTSRB 121416181100 Epoch 0 20 40 60 80 100 LF-GTSRB 121416181100 Epoch 0 20 40 60 80 100 WaNet-GTSRB CA (super-fine-tuning) ASR (super-fine-tuning) CA (conventional fine-tuning) ASR (conventional fine-tuning) Figure 3: The performance of conventional fine-tuning and super-fine-tuning against different attacks in the transfer-based scenario. The X-axis represents training epochs. The Y-axis represents the accuracy. ily mitigated by fine-tuning are conducted in this scenario. As shown in Figure 4, conventional fine-tuning indeed per- forms poorly in mitigating backdoor attacks in this case. For instance, when conducting conventional fine-tuning on the model backdoored by Blended attacks on CIFAR10, the ASR still remains high (0.978) even after 100 epochs. However, among all five attacks we have studied, super-fine-tuning al- ways decreases the ASR significantly while keeping high clean accuracy. For instance, on CIFAR10, super-fine-tuning can decrease the ASR of Blended backdoor from 0.998 to 0.081, which is in line with the predicted probability of the clean sample. We can also conclude from Figure 4 that super- fine-tuning maintains the model’s utility to a large extent. In most cases, the utility does not even drop after the first epoch. In general, we empirically demonstrate that, with super- fine-tuning, we can effectively mitigate the backdoor attacks while keeping the model utility with a limited number of epochs. Later in Section 5.5, we will dive into the details of how the learning rate modification affects the ASR and CA. 5.4 Comparison to Other Defense Methods Previously, we have shown that super-fine-tuning can effec- tively mitigate backdoor attacks with limited computational resources. In this section, we compare super-fine-tuning with other existing state-of-the-art defense methods to show that super-fine-tuning is the most effective and efficient one. Note that here we only focus on the standalone scenario since fine- tuning is a necessary step in the other two scenarios, which means fine-tuning as a defense is zero-cost. Also, fine-tuning or super-fine-tuning can decrease the ASR to a large extent while maintaining the model’s utility. The results on CIFAR10 are shown in Figure 5. We also show the results on CIFAR100 and GTSRB in Figure 12 and Figure 13 in the appendix. Note that in Figure 5, the X-axis is CA and the Y-axis is ASR. Therefore, in each sub-figure, the closer to the lower right corner, the better the defense performance. Among all defense methods against differ- ent attacks, super-fine-tuning, in general, achieves the low- est ASR while maintaining the highest CA. For instance, to mitigate the BadNets attack on CIFAR10, super-fine-tuning can achieve 0.932 CA with only 0.009 ASR, which consti- tutes the best performance among all defense methods. We can also see that other defense methods cannot always guar- 7 020406080100 Epoch 0 20 40 60 80 100 Accuracy BadNets-CIFAR10 020406080100 Epoch 0 20 40 60 80 100 Blended-CIFAR10 020406080100 Epoch 0 20 40 60 80 100 Inputaware-CIFAR10 020406080100 Epoch 0 20 40 60 80 100 LF-CIFAR10 020406080100 Epoch 0 20 40 60 80 100 WaNet-CIFAR10 020406080100 Epoch 0 20 40 60 80 100 Accuracy BadNets-CIFAR100 020406080100 Epoch 0 20 40 60 80 100 Blended-CIFAR100 020406080100 Epoch 0 20 40 60 80 100 Inputaware-CIFAR100 020406080100 Epoch 0 20 40 60 80 100 LF-CIFAR100 020406080100 Epoch 0 20 40 60 80 100 WaNet-CIFAR100 020406080100 Epoch 0 20 40 60 80 100 Accuracy BadNets-GTSRB 020406080100 Epoch 0 20 40 60 80 100 Blended-GTSRB 020406080100 Epoch 0 20 40 60 80 100 Inputaware-GTSRB 020406080100 Epoch 0 20 40 60 80 100 LF-GTSRB 020406080100 Epoch 0 20 40 60 80 100 WaNet-GTSRB CA (super-fine-tuning) ASR (super-fine-tuning) CA (conventional fine-tuning) ASR (conventional fine-tuning) Figure 4: Accuracy of conventional fine-tuning and super-fine-tuning on backdoor samples and clean samples in the standalone sce- nario. The X-axis represents training epochs. The Y-axis represents the accuracy. Epoch 0 is the original backdoor ASR and CA before fine-tuning or super-fine-tuning. 0.8500.8750.9000.9250.950 CA 0.0 0.2 0.4 0.6 0.8 1.0 ASR BadNets 0.8500.8750.9000.9250.950 CA 0.0 0.2 0.4 0.6 0.8 1.0 ASR Blended 0.8500.8750.9000.9250.950 CA 0.0 0.2 0.4 0.6 0.8 1.0 ASR Inputaware 0.8500.8750.9000.9250.950 CA 0.0 0.2 0.4 0.6 0.8 1.0 ASR LF 0.8500.8750.9000.9250.950 CA 0.0 0.2 0.4 0.6 0.8 1.0 ASR WaNet ABL AC FP NC NAD Spectral Conventional Fine-tuning Super-fine-tuning Figure 5: Comparison between existing state-of-the-art backdoor defenses and super-fine-tuning on CIFAR10. The X-axis represents accuracy on clean samples. The Y-axis represents the attack success rate. Points closer to the lower right corner indicate better defense performance. ABL AC FP NC NAD Spectral FT Super-FT 0.0 0.5 1.0 GPU Hours BadNets ABL AC FP NC NAD Spectral FT Super-FT 0.0 0.5 1.0 Blended ABL AC FP NC NAD Spectral FT Super-FT 0.0 0.5 1.0 Inputaware ABL AC FP NC NAD Spectral FT Super-FT 0.0 0.5 1.0 LF ABL AC FP NC NAD Spectral FT Super-FT 0.0 0.5 1.0 WaNet Figure 6: The time cost of different defense methods. The X-axis represents different methods. The Y-axis represents the GPU hours required for this method. Note that in each box, we include the time cost on all datasets. antee performance in defending against all attacks. For in- stance, although only NC and super-fine-tuning can mitigate Blended attacks on CIFAR10, NC cannot detect Inputaware, LF, and WaNet attacks. We then consider another important aspect, i.e., each de- fense’s computational cost. The results are shown in Fig- 8 0.20.40.60.81.0 Size of the Fine-tuning Dataset 0 20 40 60 80 100 ASR BadNets Blended Inputaware LF WaNet (a) CIFAR10 0.20.40.60.81.0 Size of the Fine-tuning Dataset 0 20 40 60 80 100 ASR (b) CIFAR100 0.20.40.60.81.0 Size of the Fine-tuning Dataset 0 20 40 60 80 100 ASR (c) GTSRB 0.20.40.60.81.0 Size of the Fine-tuning Dataset 0 20 40 60 80 100 CA BadNets Blended Inputaware LF WaNet (d) CIFAR10 0.20.40.60.81.0 Size of the Fine-tuning Dataset 0 20 40 60 80 100 CA (e) CIFAR100 0.20.40.60.81.0 Size of the Fine-tuning Dataset 0 20 40 60 80 100 CA (f) GTSRB Figure 7: The impact of fine-tuning dataset size on defense performance. The first row shows fine-tuning dataset size’s impacts on attack success rate. The second row shows fine-tuning dataset size’s impacts on clean samples accuracy. The X-axis represents the ratio of the fine-tuning dataset, which is used to conduct fine-tuning. 121416181100 Epoch 0 20 40 60 80 100 ASR LR = 0.1 LR = 0.01 LR = 0.001 LR = 0.0001 (a) ASR 121416181100 Epoch 20 40 60 80 CA (b) CA Figure 8: The impact of different learning rates of conventional fine-tuning on removing backdoor attacks. The X-axis repre- sents training epochs. The Y-axis represents the accuracy of backdoor samples and clean samples. ure 6. We can observe that, among all defenses against dif- ferent attacks, NC has the largest computational cost, while super-fine-tuning has the lowest computational cost. For in- stance, to detect and remove BadNets on CIFAR100, NC takes 0.997 GPU hours, while super-fine-tuning only needs 0.147 GPU hours, which is significantly lower. In general, we conclude that super-fine-tuning outper- forms other defenses in terms of the lowest ASR, highest CA, and lowest computational cost. 5.5 Ablation Study Here, we conduct some ablation studies to show the impact of fine-tuning dataset size and learning rate on the backdoor removal performance. Note that we only focus on the stan- dalone scenario here because: (i) in both encoder-based and transfer-based scenarios, fine-tuning is a necessary step, so we do not modify the fine-tuning dataset size and learning rate; (i) standalone is the most challenging scenario, as we mentioned before. Impact of Fine-Tuning Dataset Size.We first explore the impact of fine-tuning dataset size. Previously, we used the whole dataset to conduct super-fine-tuning. We have shown that, even with the whole dataset, super-fine-tuning con- sumes limited computational resources compared to other methods. Then, we further explore how much data is suf- ficient to conduct a successful super-fine-tuning. We show our experimental results in Figure 7. We can see that even with 20% of the fine-tuning dataset, super-fine-tuning can ef- fectively mitigate the backdoor attacks in most cases. For instance, with 20% of the fine-tuning dataset (CIFAR10), super-fine-tuning reduces the ASR of the Blended backdoor attack to 0.044. Also, from Figure 7, we can see that the size of the fine-tuning dataset has a limited impact on the utility of the model. The clean accuracy remains high with 10% to 100% of the fine-tuning dataset. Therefore, it can be concluded that super-fine-tuning requires significantly fewer fine-tuning data samples for a stable performance, which fur- ther reduces the computational cost. Note that super-fine-tuning is less effective with 10% of the fine-tuning dataset. For instance, when only using a 10% clean training dataset and 0.1 as LR MAX1, the defender can only achieve 0.954 ASR with the Blended attack on CI- FAR10. We show later that the backdoor attacks can still be effectively mitigated by increasing LR MAX1 if the defender only has 10% of the fine-tuning dataset. Impact of Learning Rate Change.During our experiments, we first find that backdoor attacks are very sensitive to dif- ferent learning rates. We show different learning rates’ re- sults of conventional fine-tuning in Figure 8. It can be seen that if the defender uses the same small learning rate as in the pre-training phase, the ASR remains high even after 100 epochs. However, with an increased learning rate (from 0.0001 to 0.001), backdoor triggers are forgotten gradually in 100 epochs. Moreover, when the learning rate increases to 0.1, the backdoor can be immediately removed within one 9 0.20.40.60.81.0 LR MAX1 0 20 40 60 80 100 ASR BadNets Blended Inputaware LF WaNet (a) CIFAR10 0.20.40.60.81.0 LR MAX1 0 20 40 60 80 100 ASR (b) CIFAR100 0.20.40.60.81.0 LR MAX1 0 20 40 60 80 100 ASR (c) GTSRB 0.20.40.60.81.0 LR MAX1 0 20 40 60 80 100 CA BadNets Blended Inputaware LF WaNet (d) CIFAR10 0.20.40.60.81.0 LR MAX1 0 20 40 60 80 100 CA (e) CIFAR100 0.20.40.60.81.0 LR MAX1 0 20 40 60 80 100 CA (f) GTSRB Figure 9: Impact of LR MAX1 of super-fine-tuning on defense performance. The first row shows LR MAX1’s impacts on attack success rate. The second row shows LR MAX1’s impacts on clean sample accuracy. The X-axis represents how many data samples are used to conduct fine-tuning. Note that we only use 10% of the fine-tuning dataset to conduct super-fine-tuning. epoch. We can conclude that learning rates have a significant impact on backdoor removal. In particular, larger learning rates tend to mitigate backdoor attacks faster. From Figure 8, we can also find that although increasing learning rates can effectively mitigate backdoor attacks, it also causes utility drops. From the utility perspective, small learning rates lead to higher clean accuracy. Therefore, com- bining large and small learning rates becomes a promising idea to achieve both goals. This is also the general intuition for super-fine-tuning. In our previous super-fine-tuning experiments, we set LR MAX1 to 0.1 as we find that 0.1 is enough for removing backdoors with sufficient fine-tuning datasets. Here, we also explore the impact of LR MAX1 on super-fine-tuning. To better show the learning rate’s impact, we only use 10% of the fine-tuning dataset. In the previous section, when the defender only has 10% of the fine-tuning dataset, super- fine-tuning does not achieve good performance, especially in Blended and LF attacks. Our experimental results are shown in Figure 9. When increasing the LR MAX1 from 0.1 to 0.3, even when us- ing 10% of the fine-tuning dataset, super-fine-tuning can still successfully remove backdoors. For instance, when the LR MAX1 is 0.1, Blended attacks on CIFAR100 still achieve 0.988 ASR under super-fine-tuning. However, when LR MAX1 increases to 0.3, the ASR drops to 0.004. Although increasing LR MAX1 can more effectively remove the back- doors, it also leads to a small drop in the model’s utility. We show these results in Figure 9. For instance, when the learn- ing rate increases from 0.1 to 0.3, the utility of the fine-tuned model from Blended on CIFAR10 drops from 0.919 to 0.881. Therefore, if users have enough clean data, we recommend using 0.1 as the largest learning rate. However, when users only have limited data, increasing the largest learning rate (e.g., from 0.1 to 0.3) also helps mitigate almost all attacks without suffering a large utility drop. 5.6 Summary In this section, we have shown that backdoor attacks can be easily defended by fine-tuning or super-fine-tuning. We show that in the encoder-based and transfer-based scenarios, fine- tuning as the necessary step can naturally remove the exist- ing backdoors. Also, our proposed super-fine-tuning method can better mitigate the backdoor attacks in the transfer-based scenario. In the standalone scenario, super-fine-tuning can effectively prevent backdoor attacks with a limited size of the training dataset and limited computational resources com- pared to other existing defenses. Our ablation study on the fine-tuning dataset size and learning rate setting further demonstrates the effectiveness and efficiency of super-fine- tuning. 6 Backdoor Sequela We have previously shown that super-fine-tuning outper- forms other defenses against backdoor attacks. However, since the defense modifies the model’s parameters, it is worthwhile to explore whether the model will be more or less vulnerable to certain attacks after removing the backdoor at- tacks. To this end, we coin the term and investigate backdoor sequela. Due to the fact that super-fine-tuning needs to use a clean dataset to make the model forget the backdoor, it is natural to wonder whether the process will lead the model to bet- ter remember the clean dataset. To verify this, we conduct membership inference attacks against the backdoored mod- els and the models defended by super-fine-tuning (and other defenses) to see whether the membership leakage becomes larger after applying the defense. Also, since the backdoors are easily removed after a few epochs, we are also curious 10 BadNets Blended Inputaware LF WaNet 0.6 0.7 0.8 0.9 Accuracy Original Super-Fine-Tuning ABL AC FP NAD (a) CIFAR10 BadNets Blended Inputaware LF WaNet 0.6 0.7 0.8 0.9 Accuracy (b) CIFAR100 BadNets Blended Inputaware LF WaNet 0.6 0.7 0.8 0.9 Accuracy (c) GTSRB Figure 10: The performance of membership inference attacks on different defended models and backdoored models. The X-axis represents different attack methods. The Y-axis represents membership inference attack accuracy. if it is easier to re-inject the backdoor into the model. Note that, following the same reasons as in Section 5.4, we only consider the standalone scenario in this section. 6.1 Membership Inference Attack We first explore whether the model is more vulnerable to membership inference attacks [47] or not after fine-tuning. Membership inference attacks aim to infer whether a given sample is in the training set of a target model or not. A successful membership inference attack can cause severe privacy leakage. Normally, there are three different ways to conduct membership inference attacks: neural network- based attacks [38, 47], metric-based attacks [27, 49, 50, 59], and query-based attacks [11, 32]. In this work, we use the neural network-based attack due to its popularity. Threat Model.We first assume that the adversary only has black-box access to the target model, which means they can only query the model and obtain the output. Then, following previous works [36,39], we further assume that the adversary has part of the target model’s training data (treated as mem- bers) and testing data (non-members). The adversary can use them for training an attack model and inferring the member- ship status for other data samples. Note that we adopt the strongest attacker assumption defined in [36] to estimate the worst-case scenario for membership leakage. Methodology.Our method can be described in two steps: 1. The adversary first queries the target model with both the target model’s (partial) training and testing samples, and they label the corresponding outputs as members and non-members. 2. Second, the adversary uses the outputs and the corre- sponding labels to train their attack model, which is a three-layer neural network model. The evaluations are conducted on both the backdoored model and the super-fine-tuned model to see whether fine- tuning will increase or decrease membership inference risks. Experimental Settings.We evaluate the membership infer- ence attack in the standalone scenario, which means that the fine-tuning dataset is the same as the pre-training dataset. For each dataset, we randomly sample half of its testing sam- ples and the same number of training samples as the attack training dataset. Then, we select the other half of its testing samples (serving as non-members) and the same number of training samples (serving as members with no overlap on the attack training dataset) to evaluate the attack performance. Note that we use the datasets and backdoor attacks/defenses introduced in Section 4.1. Results.We show our membership inference results in Fig- ure 10. Surprisingly, we observe that instead of increas- ing the privacy risks, super-fine-tuning mitigates the perfor- mance of membership inference. In almost all cases, fine- tuned models have lower attack performance than the origi- nal models. For instance, membership inference attacks on the original model (backdoored by BadNets) on CIFAR10 can achieve 0.618 accuracy, while the performance drops to 0.569 after conducting super-fine-tuning on the original model. This is contradictory to previous work [45], where more training epochs led to higher attack performance due to the increasing overfitting level. We suspect the reason is that super-fine-tuning actually increases the generalization ability of the model, which leads to a lower overfitting level. Though super-fine-tuning does not cause backdoor sequela with respect to membership inference, we do observe that some of the other defense methods make membership in- ference more unstable. For instance, in most cases, ABL makes the model more vulnerable to membership inference attacks (accuracy increases from 0.765 to 0.815 in Blended CIFAR10). However, when ABL is used to mitigate LF attacks on CIFAR10, the membership inference risk drops from 0.726 to 0.653. From Figure 10, we can also see that different kinds of backdoor attacks make a huge difference in membership in- ference performance. For example, the adversary can achieve a 0.765 accuracy when conducting membership inference at- tacks using CIFAR10 on Blended attacks. However, they can only achieve a 0.618 accuracy when conducting the same attacks on the BadNets model. We leave it to future work to further explore the relationship between backdoor attacks and membership inference attacks. 11 01020 Epoch 0.0 0.5 1.0 ASR Clean ABL AC NC NAD FP Super-FT (a) Poison Ratio: 0.1 01020 Epoch 0.0 0.5 1.0 ASR (b) Poison Ratio: 0.01 01020 Epoch 0.0 0.5 1.0 ASR (c) Poison Ratio: 0.001 01020 Epoch 0.0 0.5 1.0 ASR (d) Poison Ratio: 0.0001 Figure 11: Performance of BadNets backdoor re-injection attacks on different defense methods. The X-axis represents training epochs in the re-injection phase. The Y-axis represents the accuracy of poison samples. Note that epoch 0 represents different defense methods’ results before re-injection. 6.2 Backdoor Re-injection Attack Another backdoor sequela we study is the backdoor re- injection attack. Since super-fine-tuning can easily remove backdoors within a few epochs, it is interesting to see whether the fine-tuned models are more vulnerable to inject- ing (the same) backdoor attacks again. To our knowledge, there is no prior work measuring whether existing backdoor defense methods will make the re-injection process easier. Threat Model.We first assume that the adversary has white- box access to the fine-tuned model. Also, the adversary has knowledge of the previous backdoor attack on the model. The goal of the adversary is to re-inject the same backdoor into the model while keeping model utility. Methodology.To measure the vulnerability of the fine-tuned models on backdoor re-injection attacks, we take the follow- ing steps: 1. The adversary first generates new triggered samples based on the knowledge of the previous attack. 2. Then, the adversary re-trains the fine-tuned model with the poison dataset and the corresponding training pro- cess to re-inject the backdoor into the fine-tuned model. Results.To measure how easily the adversary can re-inject a backdoor into the model, we consider training epochs, poi- son ratio, and ASR as the evaluation metrics. If the model is more vulnerable to backdoor re-injection attacks, the ad- versary only needs fewer epochs and a smaller poison ratio to achieve a similar (or even better) ASR compared to inject- ing the backdoor on a clean model. Note that in this setting, we assume a very powerful adversary who has knowledge of the previous attack. Thus, the adversary can follow the same procedure to conduct the attack, i.e., they use the exact same injection process and strategies, including the same attack method, the same learning rate, etc. Figure 11 shows our results of BadNets backdoor re- injection attacks. Other attacks’ results, including Blended (Figure 14), Inputaware (Figure 15), LF (Figure 16), and WaNet (Figure 17) are shown in the appendix. For the poi- son ratio, we adjust it from 0.1 to 0.0001 for completeness. Note that 0.1 is the poison ratio we used in previous back- door attacks. For the training process, we only show the first 25 epochs to see whether the backdoor can be injected within a few epochs. From Figure 11, it can first be observed that almost all de- fense methods we have tried can make the defended model more vulnerable to backdoor re-injection attacks. For in- stance, when the attack method is BadNets with a poison ratio of 0.01 (Figure 11b), the adversary needs 15 epochs to insert the backdoor into the clean model (ASR=0.819) while the backdoor re-injection attacks against defended models only need 3-6 epochs to achieve even higher ASR. We also see that, in all cases, fine-tuned models are not the most vulnerable models to backdoor re-injection attacks. For in- stance, when the poison ratio is 0.001, the adversary can achieve 0.023 ASR in three epochs on models defended by super-fine-tuning, while other defense methods like ABL in- creases the ASR to 0.763. 6.3 Summary In this section, we propose the new term,backdoor sequela, to measure how backdoor defense methods affect a model’s vulnerability to other attacks.Specifically, we consider membership inference attacks and backdoor re-injection at- tacks. Our evaluation results show that super-fine-tuning can even make the model more robust to membership inference attacks. We also find that, in general, existing defense meth- ods considered in our experiments make the defended models more vulnerable to backdoor re-injection attacks compared to the attacks on the clean model. To our knowledge, we are the first to study backdoor sequela, and we argue that back- door sequela should be considered as an important metric to evaluate a backdoor defense’s efficacy. We plan to investi- gate more backdoor sequela, i.e., attacks, in the future. 7 Related Work 7.1 Backdoor Attacks Backdoor attacks, as one of the major threats to ML systems, have been widely studied. BadNets [15] is the first work to show that the adversary can insert a backdoor into the ma- chine learning model via poisoning training datasets. Then, targeted backdoor [10] was proposed to show that with un- detectable and random-position triggers, the adversary can still successfully launch backdoor attacks. After that, more 12 works focus on how to design better trigger patterns for back- door attacks [37, 40, 44]. Zheng et al. [60] propose backdoor attacks that are undetectable from the frequency perspective. Nguyen et al. [40] argue that different images should have different triggers. Therefore, they propose the generator to produce triggers for different images. Besides better trig- ger patterns, there are also many works focused on designing better injection processes [5, 35, 37, 58, 61]. In these works, they find that the adversary can even inject a backdoor into the model without changing the label of the poison samples. Other studies on backdoor attacks in various scenarios in- clude [23, 46]. 7.2 Backdoor Defenses Following the increasing popularity of backdoor attacks, var- ious defense methods have been proposed. Current defense methods can be divided into three categories. The most popular defense methods are based on reverse engineering, where the defender aims to reverse the possible backdoor triggers to judge whether the given model is the backdoored model or not [7, 16, 22, 34, 55]. Besides reverse engineer- ing, another line of works [6, 13, 53, 54] focuses on mitigat- ing the backdoor by detecting the poison samples. Due to the fact that backdoor attacks may involve more carefully designed triggers to bypass potential defenses, such detec- tion methods look like the arms race with evolving attacks. The last type of backdoor defense method is based on meta- learning to learn the difference between the backdoored mod- els and the clean models by training with a large number of backdoored shadow models [57]. Besides different detec- tion methods, fine-tuning has also been proposed to mitigate backdoor attacks. Previous fine-tuning-based methods either adapt pruning [33] or distillation [30]. Liu et al. [33] argue that fine-tuning itself cannot effectively mitigate backdoor at- tacks. However, pruning, distillation, or other methods based on fine-tuning will cost much more computational resources and sacrifice the models’ utility. In this work, we show for the first time that carefully designed fine-tuning is sufficient to remove the backdoor and maintain the model’s utility with limited cost (e.g., with limited epochs). 8 Conclusion In this paper, we have demonstrated that fine-tuning is a very effective backdoor removal method. We consider three scenarios, namely encoder-based, transfer-based, and stan- dalone. Our experimental results show that in the encoder- based scenario, whole model conventional fine-tuning can effectively remove backdoors within a few epochs. As fine- tuning is a necessary step for users to train downstream clas- sifiers, it can be argued that fine-tuning as a defense method incurszero-cost. In the transfer-based scenario, fine-tuning is still a necessary step. However, we find that conventional fine-tuning cannot always effectively remove backdoor at- tacks. Therefore, we propose super-fine-tuning, a newly de- signed fine-tuning method for backdoor removal tasks. Our experimental results show that super-fine-tuning can effec- tively mitigate backdoor attacks in this scenario. In the most difficult standalone scenario, we show that super-fine-tuning is still effective. We also compare super-fine-tuning with state-of-the-art defense methods and demonstrate that super- fine-tuning outperforms them. Furthermore, we propose a new term,backdoor sequela, to measure the defended model’s vulnerability to other at- tacks. Experiments show that super-fine-tuning does not have a strong impact on the defended models with respect to membership inference and backdoor re-injection attacks. We hope that, in the future, backdoor sequela will be con- sidered an important aspect for judging a backdoor defense’s efficacy. Our results demonstrate that backdoor defenses can be per- formed in an easier way than previously considered. Fine- tuning or super-fine-tuning is sufficient in most cases. We hope our methods can help ML model owners better shield their models from backdoor attacks. Also, it further calls for the design of more advanced attacks in order to compre- hensively assess machine learning models’ vulnerabilities to backdoor attacks. References [1]https://w.cs.toronto.edu/~kriz/cifar.html. 1, 2, 5 [2]https://cs.stanford.edu/%7Eacoates/stl10/. 2, 5 [3]http://benchmark.ini.rub.de/?section=gtsrb. 5 [4]http://ufldl.stanford.edu/housenumbers/. 5 [5] Mauro Barni, Kassem Kallas, and Benedetta Tondi. A New Backdoor Attack in CNNS by Training Set Corruption With- out Label Poisoning. InIEEE International Conference on Image Processing (ICIP), pages 101–105. IEEE, 2019. 3, 13 [6] Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian M. Mol- loy, and Biplav Srivastava.Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering.CoRR abs/1811.03728, 2018. 1, 2, 5, 13 [7] Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. DeepInspect: A Black-box Trojan Detection and Mitigation Framework for Deep Neural Networks. InInternational Joint Conferences on Artifical Intelligence (IJCAI), pages 4658– 4664. IJCAI, 2019. 1, 13 [8] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geof- frey E. Hinton. A Simple Framework for Contrastive Learn- ing of Visual Representations. InInternational Conference on Machine Learning (ICML), pages 1597–1607. PMLR, 2020. 1, 2, 4, 6 [9] Xinlei Chen and Kaiming He. Exploring Simple Siamese Rep- resentation Learning. InIEEE Conference on Computer Vi- sion and Pattern Recognition (CVPR), pages 15750–15758. IEEE, 2021. 1 [10] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning.CoRR abs/1712.05526, 2017. 1, 2, 3, 4, 6, 12 [11] Christopher A. Choquette Choo, Florian Tramèr, Nicholas Carlini, and Nicolas Papernot. Label-Only Membership Infer- ence Attacks. InInternational Conference on Machine Learn- ing (ICML), pages 1964–1974. PMLR, 2021. 11 13 [12] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. ImageNet: A large-scale hierarchical image database. InIEEE Conference on Computer Vision and Pat- tern Recognition (CVPR), pages 248–255. IEEE, 2009. 1 [13] Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. STRIP: A Defence Against Trojan Attacks on Deep Neural Networks. InAnnual Computer Security Applications Conference (ACSAC), pages 113–125. ACM, 2019. 1, 13 [14] Jean-Bastien Grill, Florian Strub, Florent Altché, Corentin Tallec, Pierre H. Richemond, Elena Buchatskaya, Carl Doer- sch, Bernardo Ávila Pires, Zhaohan Guo, Mohammad Ghesh- laghi Azar, Bilal Piot, Koray Kavukcuoglu, Rémi Munos, and Michal Valko. Bootstrap Your Own Latent - A New Approach to Self-Supervised Learning. InAnnual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2020. 1 [15] Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Grag. Bad- nets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain.CoRR abs/1708.06733, 2017. 1, 2, 3, 4, 6, 12 [16] Wenbo Guo, Lun Wang, Xinyu Xing, Min Du, and Dawn Song.TABOR: A Highly Accurate Approach to Inspect- ing and Restoring Trojan Backdoors in AI Systems.CoRR abs/1908.01763, 2019. 1, 13 [17] Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross B. Girshick. Masked Autoencoders Are Scal- able Vision Learners.CoRR abs/2111.06377, 2021. 2 [18] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross B. Girshick. Momentum Contrast for Unsupervised Visual Rep- resentation Learning.InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 9726–9735. IEEE, 2020. 1 [19] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep Residual Learning for Image Recognition. InIEEE Con- ference on Computer Vision and Pattern Recognition (CVPR), pages 770–778. IEEE, 2016. 1, 6 [20] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity Mappings in Deep Residual Networks.InEuro- pean Conference on Computer Vision (ECCV), pages 630– 645. Springer, 2016. 6 [21] Xinlei He, Zheng Li, Weilin Xu, Cory Cornelius, and Yang Zhang. Membership-Doctor: Comprehensive Assessment of Membership Inference Against Machine Learning Models. CoRR abs/2208.10445, 2022. 2 [22] Xijie Huang, Moustafa Alzantot, and Mani B. Srivastava. NeuronInspect: Detecting Backdoors in Neural Networks via Output Explanations.CoRR abs/1911.07399, 2019. 1, 13 [23] Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong. BadEn- coder: Backdoor Attacks to Pre-trained Encoders in Self- Supervised Learning. InIEEE Symposium on Security and Privacy (S&P). IEEE, 2022. 1, 2, 3, 4, 5, 13 [24] Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sarna, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan. Supervised Contrastive Learning. InAn- nual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2020. 4, 6 [25] Diederik P. Kingma and Jimmy Ba.Adam: A Method for Stochastic Optimization. InInternational Conference on Learning Representations (ICLR), 2015. 6 [26] Simon Kornblith, Jonathon Shlens, and Quoc V. Le. Do Bet- ter ImageNet Models Transfer Better? InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 2661–2671. IEEE, 2019. 2 [27] Klas Leino and Matt Fredrikson. Stolen Memories: Lever- aging Model Memorization for Calibrated White-Box Mem- bership Inference. InUSENIX Security Symposium (USENIX Security), pages 1605–1622. USENIX, 2020. 11 [28] Hao Li, Pratik Chaudhari, Hao Yang, Michael Lam, Avinash Ravichandran, Rahul Bhotika, and Stefano Soatto. Rethinking the Hyperparameters for Fine-tuning. InInternational Confer- ence on Learning Representations (ICLR), 2020. 2 [29] Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Anti-Backdoor Learning: Training Clean Models on Poisoned Data. InAnnual Conference on Neu- ral Information Processing Systems (NeurIPS), pages 14900– 14912. NeurIPS, 2021. 2, 5 [30] Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural Attention Distillation: Erasing Back- door Triggers from Deep Neural Networks. InInternational Conference on Learning Representations (ICLR), 2021. 2, 5, 13 [31] Yuezun Li, Yiming Li, Baoyuan Wu, Longkang Li, Ran He, and Siwei Lyu.Invisible Backdoor Attack with Sample- Specific Triggers. InIEEE International Conference on Com- puter Vision (ICCV), pages 16443–16452. IEEE, 2021. 1 [32] Zheng Li and Yang Zhang. Membership Leakage in Label- Only Exposures. InACM SIGSAC Conference on Computer and Communications Security (CCS), pages 880–895. ACM, 2021. 11 [33] Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Fine- Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. InResearch in Attacks, Intrusions, and De- fenses (RAID), pages 273–294. Springer, 2018. 2, 5, 6, 13 [34] Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. ABS: Scanning Neural Networks for Back-Doors by Artificial Brain Stimulation. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 1265–1282. ACM, 2019. 1, 13 [35] Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning Attack on Neural Networks. InNetwork and Distributed System Se- curity Symposium (NDSS). Internet Society, 2018. 1, 2, 3, 13 [36] Yugeng Liu, Rui Wen, Xinlei He, Ahmed Salem, Zhikun Zhang, Michael Backes, Emiliano De Cristofaro, Mario Fritz, and Yang Zhang.ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models. InUSENIX Security Symposium (USENIX Security), pages 4525–4542. USENIX, 2022. 11 [37] Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Re- flection Backdoor: A Natural Backdoor Attack on Deep Neu- ral Networks. InEuropean Conference on Computer Vision (ECCV), pages 182–199. Springer, 2020. 3, 13 [38] Milad Nasr, Reza Shokri, and Amir Houmansadr.Ma- chine Learning with Membership Privacy using Adversarial Regularization. InACM SIGSAC Conference on Computer and Communications Security (CCS), pages 634–646. ACM, 2018. 11 [39] Milad Nasr, Reza Shokri, and Amir Houmansadr. Compre- hensive Privacy Analysis of Deep Learning: Passive and Ac- tive White-box Inference Attacks against Centralized and Fed- erated Learning. InIEEE Symposium on Security and Privacy (S&P), pages 1021–1035. IEEE, 2019. 11 14 [40] Tuan Anh Nguyen and Anh Tran.Input-Aware Dynamic Backdoor Attack. InAnnual Conference on Neural Informa- tion Processing Systems (NeurIPS). NeurIPS, 2020. 1, 3, 5, 13 [41] Tuan Anh Nguyen and Anh Tuan Tran. WaNet - Imperceptible Warping-based Backdoor Attack. InInternational Conference on Learning Representations (ICLR), 2021. 3, 5 [42] Ren Pang, Hua Shen, Xinyang Zhang, Shouling Ji, Yevgeniy Vorobeychik, Xiapu Luo, Alex X. Liu, and Ting Wang. A Tale of Evil Twins: Adversarial Inputs versus Poisoned Models. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 85–99. ACM, 2020. 1 [43] Ren Pang, Zheng Zhang, Xiangshan Gao, Zhaohan Xi, Shoul- ing Ji, Peng Cheng, and Ting Wang. TROJANZOO: Every- thing You Ever Wanted to Know about Neural Backdoors (But Were Afraid to Ask).CoRR abs/2012.09302, 2020. 1, 2 [44] Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, and Yang Zhang. Dynamic Backdoor Attacks Against Machine Learning Models. InIEEE European Symposium on Security and Privacy (Euro S&P), pages 703–718. IEEE, 2022. 3, 13 [45] Ahmed Salem, Yang Zhang, Mathias Humbert, Pascal Berrang, Mario Fritz, and Michael Backes. ML-Leaks: Model and Data Independent Membership Inference Attacks and De- fenses on Machine Learning Models. InNetwork and Dis- tributed System Security Symposium (NDSS). Internet Society, 2019. 2, 11 [46] Xinyue Shen, Xinlei He, Zheng Li, Yun Shen, Michael Backes, and Yang Zhang. Backdoor Attacks in the Supply Chain of Masked Image Modeling.CoRR abs/2210.01632, 2022. 1, 13 [47] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership Inference Attacks Against Machine Learning Models. InIEEE Symposium on Security and Pri- vacy (S&P), pages 3–18. IEEE, 2017. 2, 11 [48] Leslie N. Smith and Nicholay Topin. Super-Convergence: Very Fast Training of Neural Networks Using Large Learning Rates.CoRR abs/1708.07120, 2018. 2, 4 [49] Liwei Song and Prateek Mittal. Systematic Evaluation of Pri- vacy Risks of Machine Learning Models. InUSENIX Security Symposium (USENIX Security). USENIX, 2021. 11 [50] Liwei Song, Reza Shokri, and Prateek Mittal. Privacy Risks of Securing Machine Learning Models against Adversarial Ex- amples. InACM SIGSAC Conference on Computer and Com- munications Security (CCS), pages 241–257. ACM, 2019. 11 [51] Yonglong Tian, Dilip Krishnan, and Phillip Isola. Contrastive Representation Distillation. InInternational Conference on Learning Representations (ICLR), 2020. 6 [52] Yonglong Tian, Chen Sun, Ben Poole, Dilip Krishnan, Cordelia Schmid, and Phillip Isola. What Makes for Good Views for Contrastive Learning? InAnnual Conference on Neural Information Processing Systems (NeurIPS). NeurIPS, 2020. 3, 4 [53] Brandon Tran, Jerry Li, and Aleksander Madry. Spectral Sig- natures in Backdoor Attacks. InAnnual Conference on Neu- ral Information Processing Systems (NeurIPS), pages 8011– 8021. NeurIPS, 2018. 1, 2, 5, 13 [54] Sakshi Udeshi, Shanshan Peng, Gerald Woo, Lionell Loh, Louth Rawshan, and Sudipta Chattopadhyay. Model Agnos- tic Defence Against Backdoor Attacks in Machine Learning. IEEE Transactions on Reliability, 2022. 1, 13 [55] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Net- works. InIEEE Symposium on Security and Privacy (S&P), pages 707–723. IEEE, 2019. 1, 2, 5, 13 [56] Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, Chao Shen, and Hongyuan Zha. BackdoorBench: A Comprehensive Benchmark of Backdoor Learning.CoRR abs/2206.12654, 2022. 1 [57] Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A. Gunter, and Bo Li. Detecting AI Trojans Using Meta Neural Analysis. InIEEE Symposium on Security and Privacy (S&P). IEEE, 2021. 1, 13 [58] Yuanshun Yao, Huiying Li, Haitao Zheng, and Ben Y. Zhao. Latent Backdoor Attacks on Deep Neural Networks. InACM SIGSAC Conference on Computer and Communications Secu- rity (CCS), pages 2041–2055. ACM, 2019. 3, 13 [59] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting. InIEEE Computer Security Foundations Symposium (CSF), pages 268–282. IEEE, 2018. 11 [60] Yi Zeng, Won Park, Z. Morley Mao, and Ruoxi Jia. Rethink- ing the Backdoor Attacks’ Triggers: A Frequency Perspec- tive. InIEEE International Conference on Computer Vision (ICCV), pages 16453–16461. IEEE, 2021. 3, 4, 13 [61] Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. Clean-Label Backdoor Attacks on Video Recognition Models. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 14443–144528. IEEE, 2020. 3, 13 [62] Fuzhen Zhuang, Zhiyuan Qi, Keyu Duan, Dongbo Xi, Yongchun Zhu, Hengshu Zhu, Hui Xiong, and Qing He. A Comprehensive Survey on Transfer Learning.CoRR abs/1911.02685, 2019. 1 9 Appendix 15 0.600.650.70 CA 0.0 0.2 0.4 0.6 0.8 ASR BadNets 0.600.650.70 CA 0.2 0.4 0.6 0.8 1.0 ASR Blended 0.600.650.70 CA 0.00 0.25 0.50 0.75 ASR Inputaware 0.600.650.70 CA 0.00 0.25 0.50 0.75 ASR LF 0.60.7 CA 0.00 0.25 0.50 0.75 1.00 ASR WaNet ABL AC FP NC NAD Spectral Conventional Fine-tuning Super-fine-tuning Figure 12: Comparison between existing state-of-the-art backdoor defense methods and super-fine-tuning on CIFAR100. The X-axis represents accuracy on clean samples. The Y-axis represents the attack success rate. Points closer to the lower right corner are better points. 0.970.98 CA 0.00 0.25 0.50 0.75 1.00 ASR BadNets 0.9750.980 CA 0.00 0.25 0.50 0.75 1.00 ASR Blended 0.9700.9750.980 CA 0.4 0.6 0.8 ASR Inputaware 0.970.98 CA 0.00 0.25 0.50 0.75 1.00 ASR LF 0.960.98 CA 0.0 0.2 0.4 0.6 0.8 ASR WaNet ABL AC FP NC NAD Spectral Conventional Fine-tuning Super-fine-tuning Figure 13: Comparison between existing state-of-the-art backdoor defense methods and super-fine-tuning on GTSRB. The X-axis represents accuracy on clean samples. The Y-axis represents the attack success rate. Points closer to the lower right corner are better points. 01020 Epoch 0.0 0.5 1.0 ASR Clean ABL AC NC NAD FP Super-FT (a) Poison Ratio: 0.1 01020 Epoch 0.0 0.5 1.0 ASR (b) Poison Ratio: 0.01 01020 Epoch 0.0 0.5 1.0 ASR (c) Poison Ratio: 0.001 01020 Epoch 0.0 0.5 1.0 ASR (d) Poison Ratio: 0.0001 Figure 14: Performance of Blended backdoor re-injection attacks on different defense methods. The X-axis represents training epochs in the re-injection phase. The Y-axis represents the accuracy of poison samples. 01020 Epoch 0.0 0.5 1.0 ASR Clean ABL AC NC NAD FP Super-FT (a) Poison Ratio: 0.1 01020 Epoch 0.0 0.5 1.0 ASR (b) Poison Ratio: 0.01 01020 Epoch 0.0 0.5 1.0 ASR (c) Poison Ratio: 0.001 01020 Epoch 0.0 0.5 1.0 ASR (d) Poison Ratio: 0.0001 Figure 15: Performance of Inputaware backdoor re-injection attacks on different defense methods. The X-axis represents training epochs in the re-injection phase. The Y-axis represents the accuracy of poison samples. 16 01020 Epoch 0.0 0.5 1.0 ASR Clean ABL AC NC NAD FP Super-FT (a) Poison Ratio: 0.1 01020 Epoch 0.0 0.5 1.0 ASR (b) Poison Ratio: 0.01 01020 Epoch 0.0 0.5 1.0 ASR (c) Poison Ratio: 0.001 01020 Epoch 0.0 0.5 1.0 ASR (d) Poison Ratio: 0.0001 Figure 16: Performance of LF backdoor re-injection attacks on different defense methods. The X-axis represents training epochs in the re-injection phase. The Y-axis represents the accuracy of poison samples. 01020 Epoch 0.0 0.5 1.0 ASR Clean ABL AC NC NAD FP Super-FT (a) Poison Ratio: 0.1 01020 Epoch 0.0 0.5 1.0 ASR (b) Poison Ratio: 0.01 01020 Epoch 0.0 0.5 1.0 ASR (c) Poison Ratio: 0.001 01020 Epoch 0.0 0.5 1.0 ASR (d) Poison Ratio: 0.0001 Figure 17: Performance of WaNet backdoor re-injection attacks on different defense methods. The X-axis represents training epochs in the re-injection phase. The Y-axis represents the accuracy of poison samples. 17

Instant research discovery