{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/fmt-removing-backdoor-feature-maps-via","title":"Adversarial Feature Map Pruning for Backdoor","arxiv_id":"2307.11565","date":"2023-07-21","proceeding":null,"authors":["Dong Huang","Qingwen Bu"],"abstract":"Deep neural networks have been widely used in many critical applications, such as autonomous vehicles and medical diagnosis. However, their security is threatened by backdoor attacks, which are achieved by adding artificial patterns to specific training data. Existing defense strategies primarily focus on using reverse engineering to reproduce the backdoor trigger generated by attackers and subsequently repair the DNN model by adding the trigger into inputs and fine-tuning the model with ground-truth labels. However, once the trigger generated by the attackers is complex and invisible, the defender cannot reproduce the trigger successfully then the DNN model will not be repaired, as the trigger is not effectively removed. In this work, we propose Adversarial Feature Map Pruning for Backdoor (FMP) to mitigate backdoor from the DNN. Unlike existing defense strategies, which focus on reproducing backdoor triggers, FMP attempts to prune backdoor feature maps, which are trained to extract backdoor information from inputs. After pruning these backdoor feature maps, FMP will fine-tune the model with a secure subset of training data. Our experiments demonstrate that, compared to existing defense strategies, FMP can effectively reduce the Attack Success Rate (ASR) even against the most complex and invisible attack triggers (e.g., FMP decreases the ASR to 2.86\\% in CIFAR10, which is 19.2\\% to 65.41\\% lower than baselines). Second, unlike conventional defense methods that tend to exhibit low robust accuracy (that is, the accuracy of the model on poisoned data), FMP achieves a higher RA, indicating its superiority in maintaining model performance while mitigating the effects of backdoor attacks (e.g., FMP obtains 87.40\\% RA in CIFAR10). Our code is publicly available at: https://github.com/retsuh-bqw/FMP.","url_abs":"https://arxiv.org/abs/2307.11565v2","url_pdf":"https://arxiv.org/pdf/2307.11565v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"fmt-removing-backdoor-feature-maps-via","repo_url":"https://github.com/ase2023paper/fmt","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"fmt-removing-backdoor-feature-maps-via","repo_url":"https://github.com/retsuh-bqw/fmp","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}}],"tasks":[{"task_slug":"autonomous-vehicles","task_name":"Autonomous Vehicles"},{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"medical-diagnosis","task_name":"Medical Diagnosis"}],"methods":[{"method_slug":"focus","method_name":"Focus"},{"method_slug":"pruning","method_name":"Pruning"},{"method_slug":"repair","method_name":"Repair"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2307.11565","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2307.11565"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/retsuh-bqw/FMP","reach":{"status":"ok","spdx":"NOASSERTION"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/retsuh-bqw/fmp","reach":{"status":"ok","spdx":"NOASSERTION"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ase2023paper/fmt","reach":null}],"summary":{"ran_draft_wrong":3,"ran_violates":1,"ran":2,"unverified":1},"by_repo_kind":{"official":{"samples":7,"ran":6,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":7,"samples":[{"code_sha256_prefix":"efd3b8b851a0f5e7","entry":"add_common_attack_args","repo":"retsuh-bqw/fmp","repo_kind":"official","path":"attack/badnet.py","file_url":"https://github.com/retsuh-bqw/fmp/blob/HEAD/attack/badnet.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"efd3b8b851a0f5e7"}},{"code_sha256_prefix":"450c80c1f2967167","entry":"dynamiccluster","repo":"retsuh-bqw/fmp","repo_kind":"official","path":"defense/fgsm-feature.py","file_url":"https://github.com/retsuh-bqw/fmp/blob/HEAD/defense/fgsm-feature.py","link_basis":"first_harvest_node","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"450c80c1f2967167"}},{"code_sha256_prefix":"1e9b4bedd9340fe0","entry":"generalize_to_lower_pratio","repo":"retsuh-bqw/FMP","repo_kind":"official","path":"attack/wanet.py","file_url":"https://github.com/retsuh-bqw/FMP/blob/HEAD/attack/wanet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1e9b4bedd9340fe0"}},{"code_sha256_prefix":"ee4996a2c442fcea","entry":"initialize","repo":"ase2023paper/fmt","repo_kind":"official","path":"defense/feature.py","file_url":"https://github.com/ase2023paper/fmt/blob/HEAD/defense/feature.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"ee4996a2c442fcea"}},{"code_sha256_prefix":"ea3c60ddf40d46bc","entry":"is_valid_file","repo":"retsuh-bqw/FMP","repo_kind":"official","path":"for_imagenet/generate_poison_val_badnet.py","file_url":"https://github.com/retsuh-bqw/FMP/blob/HEAD/for_imagenet/generate_poison_val_badnet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ea3c60ddf40d46bc"}},{"code_sha256_prefix":"d01e01e22a12d3dc","entry":"ranking","repo":"retsuh-bqw/fmp","repo_kind":"official","path":"defense/fgsm-feature.py","file_url":"https://github.com/retsuh-bqw/fmp/blob/HEAD/defense/fgsm-feature.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"d01e01e22a12d3dc"}},{"code_sha256_prefix":"a55348359ff9d8f1","entry":"PreActResNet18","repo":"retsuh-bqw/FMP","repo_kind":"official","path":"models/preact_resnet.py","file_url":"https://github.com/retsuh-bqw/FMP/blob/HEAD/models/preact_resnet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a55348359ff9d8f1"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}