{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/anti-backdoor-learning-training-clean-models","title":"Anti-Backdoor Learning: Training Clean Models on Poisoned Data","arxiv_id":"2110.11571","date":"2021-10-22","proceeding":"NeurIPS 2021 12","authors":["Yige Li","Xixiang Lyu","Nodens Koren","Lingjuan Lyu","Bo Li","Xingjun Ma"],"abstract":"Backdoor attack has emerged as a major security threat to deep neural networks (DNNs). While existing defense methods have demonstrated promising results on detecting or erasing backdoors, it is still not clear whether robust training methods can be devised to prevent the backdoor triggers being injected into the trained model in the first place. In this paper, we introduce the concept of \\emph{anti-backdoor learning}, aiming to train \\emph{clean} models given backdoor-poisoned data. We frame the overall learning process as a dual-task of learning the \\emph{clean} and the \\emph{backdoor} portions of data. From this view, we identify two inherent characteristics of backdoor attacks as their weaknesses: 1) the models learn backdoored data much faster than learning with clean data, and the stronger the attack the faster the model converges on backdoored data; 2) the backdoor task is tied to a specific class (the backdoor target class). Based on these two weaknesses, we propose a general learning scheme, Anti-Backdoor Learning (ABL), to automatically prevent backdoor attacks during training. ABL introduces a two-stage \\emph{gradient ascent} mechanism for standard training to 1) help isolate backdoor examples at an early training stage, and 2) break the correlation between backdoor examples and the target class at a later training stage. Through extensive experiments on multiple benchmark datasets against 10 state-of-the-art attacks, we empirically show that ABL-trained models on backdoor-poisoned data achieve the same performance as they were trained on purely clean data. Code is available at \\url{https://github.com/bboylyg/ABL}.","url_abs":"https://arxiv.org/abs/2110.11571v3","url_pdf":"https://arxiv.org/pdf/2110.11571v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"anti-backdoor-learning-training-clean-models","repo_url":"https://github.com/bboylyg/abl","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2110.11571","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2110.11571"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/bboylyg/ABL","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/bboylyg/abl","reach":null}],"summary":{"unverified":6},"by_repo_kind":{"official":{"samples":6,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":6,"samples":[{"code_sha256_prefix":"c0c89905b88ee3f3","entry":"compute_loss_value","repo":"bboylyg/ABL","repo_kind":"official","path":"backdoor_isolation.py","file_url":"https://github.com/bboylyg/ABL/blob/HEAD/backdoor_isolation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c0c89905b88ee3f3"}},{"code_sha256_prefix":"5ca7e1171c0643ff","entry":"isolate_data","repo":"bboylyg/abl","repo_kind":"official","path":"backdoor_isolation.py","file_url":"https://github.com/bboylyg/abl/blob/HEAD/backdoor_isolation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5ca7e1171c0643ff"}},{"code_sha256_prefix":"cc45337733627b8a","entry":"test","repo":"bboylyg/ABL","repo_kind":"official","path":"quick_unlearning_demo.py","file_url":"https://github.com/bboylyg/ABL/blob/HEAD/quick_unlearning_demo.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cc45337733627b8a"}},{"code_sha256_prefix":"707ba14f7cb744e4","entry":"test","repo":"bboylyg/ABL","repo_kind":"official","path":"backdoor_isolation.py","file_url":"https://github.com/bboylyg/ABL/blob/HEAD/backdoor_isolation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"707ba14f7cb744e4"}},{"code_sha256_prefix":"e70250f71aba3296","entry":"test","repo":"bboylyg/ABL","repo_kind":"official","path":"backdoor_unlearning.py","file_url":"https://github.com/bboylyg/ABL/blob/HEAD/backdoor_unlearning.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e70250f71aba3296"}},{"code_sha256_prefix":"9f1d099a331c24ab","entry":"train","repo":"bboylyg/ABL","repo_kind":"official","path":"backdoor_isolation.py","file_url":"https://github.com/bboylyg/ABL/blob/HEAD/backdoor_isolation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9f1d099a331c24ab"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}