{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/mask-and-restore-blind-backdoor-defense-at","title":"Mask and Restore: Blind Backdoor Defense at Test Time with Masked Autoencoder","arxiv_id":"2303.15564","date":"2023-03-27","proceeding":null,"authors":["Tao Sun","Lu Pang","Chao Chen","Haibin Ling"],"abstract":"Deep neural networks are vulnerable to backdoor attacks, where an adversary maliciously manipulates the model behavior through overlaying images with special triggers. Existing backdoor defense methods often require accessing a few validation data and model parameters, which are impractical in many real-world applications, e.g., when the model is provided as a cloud service. In this paper, we address the practical task of blind backdoor defense at test time, in particular for black-box models. The true label of every test image needs to be recovered on the fly from a suspicious model regardless of image benignity. We focus on test-time image purification methods that incapacitate possible triggers while keeping semantic contents intact. Due to diverse trigger patterns and sizes, the heuristic trigger search in image space can be unscalable. We circumvent such barrier by leveraging the strong reconstruction power of generative models, and propose a framework of Blind Defense with Masked AutoEncoder (BDMAE). It detects possible triggers in the token space using image structural similarity and label consistency between the test image and MAE restorations. The detection results are then refined by considering trigger topology. Finally, we fuse MAE restorations adaptively into a purified image for making prediction. Our approach is blind to the model architectures, trigger patterns and image benignity. Extensive experiments under different backdoor settings validate its effectiveness and generalizability. Code is available at https://github.com/tsun/BDMAE.","url_abs":"https://arxiv.org/abs/2303.15564v2","url_pdf":"https://arxiv.org/pdf/2303.15564v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"mask-and-restore-blind-backdoor-defense-at","repo_url":"https://github.com/tsun/bdmae","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"image-generation","task_name":"Image Generation"},{"task_slug":"backdoor-defense","task_name":"backdoor defense"}],"methods":[{"method_slug":null,"method_name":null},{"method_slug":"mae","method_name":"MAE"},{"method_slug":"test","method_name":"Test"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2303.15564","atlas_url":"https://app.syntology.ai/?focus=2303.15564","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2303.15564"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/tsun/bdmae","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":7,"ran_honours":1,"unverified":7},"by_repo_kind":{"official":{"samples":15,"ran":8,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"66cb9e0f5d3c2483","entry":"Februus_GTSRB","repo":"tsun/bdmae","repo_kind":"official","path":"models/februus.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/models/februus.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"66cb9e0f5d3c2483"}},{"code_sha256_prefix":"44b42f1277dd9e3b","entry":"Februus_cifar10","repo":"tsun/bdmae","repo_kind":"official","path":"models/februus.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/models/februus.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"44b42f1277dd9e3b"}},{"code_sha256_prefix":"c296d9923af6a494","entry":"create_targets_bd","repo":"tsun/bdmae","repo_kind":"official","path":"attack/inputaware_attack.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/attack/inputaware_attack.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c296d9923af6a494"}},{"code_sha256_prefix":"48b9ca43caa5a8d6","entry":"create_window","repo":"tsun/bdmae","repo_kind":"official","path":"defense/pytorch_ssim.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/defense/pytorch_ssim.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"48b9ca43caa5a8d6"}},{"code_sha256_prefix":"c56b7ef16f309a45","entry":"gaussian","repo":"tsun/bdmae","repo_kind":"official","path":"defense/pytorch_ssim.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/defense/pytorch_ssim.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c56b7ef16f309a45"}},{"code_sha256_prefix":"6470f17e85b4a1aa","entry":"make_layers","repo":"tsun/bdmae","repo_kind":"official","path":"models/februus.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/models/februus.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"6470f17e85b4a1aa"}},{"code_sha256_prefix":"7f8ea158f543bdb1","entry":"poisson_blend_old","repo":"tsun/bdmae","repo_kind":"official","path":"defense/Februus.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/defense/Februus.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7f8ea158f543bdb1"}},{"code_sha256_prefix":"d0b60b04b5634496","entry":"ssim","repo":"tsun/bdmae","repo_kind":"official","path":"defense/pytorch_ssim.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/defense/pytorch_ssim.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d0b60b04b5634496"}},{"code_sha256_prefix":"5394691602c74e1b","entry":"add_args","repo":"tsun/bdmae","repo_kind":"official","path":"attack/lc_attack.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/attack/lc_attack.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5394691602c74e1b"}},{"code_sha256_prefix":"47506a60457acdcf","entry":"add_args","repo":"tsun/bdmae","repo_kind":"official","path":"attack/badnet_attack.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/attack/badnet_attack.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"47506a60457acdcf"}},{"code_sha256_prefix":"8ade85bc4607042e","entry":"fine_tuning","repo":"tsun/bdmae","repo_kind":"official","path":"defense/ft.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/defense/ft.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8ade85bc4607042e"}},{"code_sha256_prefix":"12035a2f77d8016c","entry":"get_1d_sincos_pos_embed_from_grid","repo":"tsun/bdmae","repo_kind":"official","path":"mae/pos_embed.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/mae/pos_embed.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"12035a2f77d8016c"}},{"code_sha256_prefix":"3185afc3e87293ed","entry":"get_2d_sincos_pos_embed","repo":"tsun/bdmae","repo_kind":"official","path":"mae/pos_embed.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/mae/pos_embed.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3185afc3e87293ed"}},{"code_sha256_prefix":"f10004e059714d42","entry":"get_2d_sincos_pos_embed_from_grid","repo":"tsun/bdmae","repo_kind":"official","path":"mae/pos_embed.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/mae/pos_embed.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f10004e059714d42"}},{"code_sha256_prefix":"c56a11461aa35268","entry":"newblend","repo":"tsun/bdmae","repo_kind":"official","path":"defense/Februus.py","file_url":"https://github.com/tsun/bdmae/blob/HEAD/defense/Februus.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c56a11461aa35268"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}