{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/backdoor-defense-with-non-adversarial","title":"Beating Backdoor Attack at Its Own Game","arxiv_id":"2307.15539","date":"2023-07-28","proceeding":"ICCV 2023 1","authors":["Min Liu","Alberto Sangiovanni-Vincentelli","Xiangyu Yue"],"abstract":"Deep neural networks (DNNs) are vulnerable to backdoor attack, which does not affect the network's performance on clean data but would manipulate the network behavior once a trigger pattern is added. Existing defense methods have greatly reduced attack success rate, but their prediction accuracy on clean data still lags behind a clean model by a large margin. Inspired by the stealthiness and effectiveness of backdoor attack, we propose a simple but highly effective defense framework which injects non-adversarial backdoors targeting poisoned samples. Following the general steps in backdoor attack, we detect a small set of suspected samples and then apply a poisoning strategy to them. The non-adversarial backdoor, once triggered, suppresses the attacker's backdoor on poisoned data, but has limited influence on clean data. The defense can be carried out during data preprocessing, without any modification to the standard end-to-end training pipeline. We conduct extensive experiments on multiple benchmarks with different architectures and representative attacks. Results demonstrate that our method achieves state-of-the-art defense effectiveness with by far the lowest performance drop on clean data. Considering the surprising defense ability displayed by our framework, we call for more attention to utilizing backdoor for backdoor defense. Code is available at https://github.com/minliu01/non-adversarial_backdoor.","url_abs":"https://arxiv.org/abs/2307.15539v4","url_pdf":"https://arxiv.org/pdf/2307.15539v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"backdoor-defense-with-non-adversarial","repo_url":"https://github.com/damianliumin/non-adversarial_backdoor","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"backdoor-defense-with-non-adversarial","repo_url":"https://github.com/minliu01/non-adversarial_backdoor","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"backdoor-defense","task_name":"backdoor defense"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2307.15539","atlas_url":"https://app.syntology.ai/?focus=2307.15539","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2307.15539"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/minliu01/non-adversarial_backdoor","reach":{"status":"ok"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/damianliumin/non-adversarial_backdoor","reach":null}],"summary":{"ran":5,"unverified":4},"by_repo_kind":{"official":{"samples":9,"ran":5,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":9,"samples":[{"code_sha256_prefix":"00d271be23c3c5d5","entry":"test","repo":"minliu01/non-adversarial_backdoor","repo_kind":"official","path":"backdoor_detection_lga.py","file_url":"https://github.com/minliu01/non-adversarial_backdoor/blob/HEAD/backdoor_detection_lga.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"00d271be23c3c5d5"}},{"code_sha256_prefix":"f3b4889b05be5e1c","entry":"test","repo":"minliu01/non-adversarial_backdoor","repo_kind":"official","path":"pseudo_label_vd.py","file_url":"https://github.com/minliu01/non-adversarial_backdoor/blob/HEAD/pseudo_label_vd.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f3b4889b05be5e1c"}},{"code_sha256_prefix":"c3acbb8209baf8f8","entry":"test","repo":"minliu01/non-adversarial_backdoor","repo_kind":"official","path":"train_nab.py","file_url":"https://github.com/minliu01/non-adversarial_backdoor/blob/HEAD/train_nab.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c3acbb8209baf8f8"}},{"code_sha256_prefix":"d5941b8a7c50c3ca","entry":"train","repo":"minliu01/non-adversarial_backdoor","repo_kind":"official","path":"pseudo_label_vd.py","file_url":"https://github.com/minliu01/non-adversarial_backdoor/blob/HEAD/pseudo_label_vd.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d5941b8a7c50c3ca"}},{"code_sha256_prefix":"e2eb7479b4c550f3","entry":"train","repo":"minliu01/non-adversarial_backdoor","repo_kind":"official","path":"train_nab.py","file_url":"https://github.com/minliu01/non-adversarial_backdoor/blob/HEAD/train_nab.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e2eb7479b4c550f3"}},{"code_sha256_prefix":"cdbaa2ed64661734","entry":"isolation","repo":"damianliumin/non-adversarial_backdoor","repo_kind":"official","path":"backdoor_detection_lga.py","file_url":"https://github.com/damianliumin/non-adversarial_backdoor/blob/HEAD/backdoor_detection_lga.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"cdbaa2ed64661734"}},{"code_sha256_prefix":"b29eade7be00b4cf","entry":"load_checkpoint","repo":"minliu01/non-adversarial_backdoor","repo_kind":"official","path":"src/utils.py","file_url":"https://github.com/minliu01/non-adversarial_backdoor/blob/HEAD/src/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b29eade7be00b4cf"}},{"code_sha256_prefix":"a75a3c29ed6a7130","entry":"load_from_pretrained","repo":"minliu01/non-adversarial_backdoor","repo_kind":"official","path":"src/utils.py","file_url":"https://github.com/minliu01/non-adversarial_backdoor/blob/HEAD/src/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a75a3c29ed6a7130"}},{"code_sha256_prefix":"935ebb95d885640f","entry":"train","repo":"minliu01/non-adversarial_backdoor","repo_kind":"official","path":"backdoor_detection_lga.py","file_url":"https://github.com/minliu01/non-adversarial_backdoor/blob/HEAD/backdoor_detection_lga.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"935ebb95d885640f"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}