{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/mitigating-backdoor-attack-by-injecting","title":"Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoor","arxiv_id":"2405.16112","date":"2024-05-25","proceeding":null,"authors":["Shaokui Wei","Hongyuan Zha","Baoyuan Wu"],"abstract":"Data-poisoning backdoor attacks are serious security threats to machine learning models, where an adversary can manipulate the training dataset to inject backdoors into models. In this paper, we focus on in-training backdoor defense, aiming to train a clean model even when the dataset may be potentially poisoned. Unlike most existing methods that primarily detect and remove/unlearn suspicious samples to mitigate malicious backdoor attacks, we propose a novel defense approach called PDB (Proactive Defensive Backdoor). Specifically, PDB leverages the home-field advantage of defenders by proactively injecting a defensive backdoor into the model during training. Taking advantage of controlling the training process, the defensive backdoor is designed to suppress the malicious backdoor effectively while remaining secret to attackers. In addition, we introduce a reversible mapping to determine the defensive target label. During inference, PDB embeds a defensive trigger in the inputs and reverses the model's prediction, suppressing malicious backdoor and ensuring the model's utility on the original task. Experimental results across various datasets and models demonstrate that our approach achieves state-of-the-art defense performance against a wide range of backdoor attacks. The code is available at https://github.com/shawkui/Proactive_Defensive_Backdoor.","url_abs":"https://arxiv.org/abs/2405.16112v2","url_pdf":"https://arxiv.org/pdf/2405.16112v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"mitigating-backdoor-attack-by-injecting","repo_url":"https://github.com/shawkui/Proactive_Defensive_Backdoor","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}},{"paper_slug":"mitigating-backdoor-attack-by-injecting","repo_url":"https://github.com/sclbd/backdoorbench","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"data-poisoning","task_name":"Data Poisoning"},{"task_slug":"backdoor-defense","task_name":"backdoor defense"}],"methods":[{"method_slug":"focus","method_name":"Focus"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2405.16112","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2405.16112"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/shawkui/Proactive_Defensive_Backdoor","reach":{"status":"ok","spdx":"NOASSERTION"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/sclbd/backdoorbench","reach":{"status":"ok","spdx":"NOASSERTION"}}],"summary":{"ran_draft_wrong":1,"ran":3,"unverified":1},"by_repo_kind":{"official":{"samples":5,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":5,"samples":[{"code_sha256_prefix":"efd3b8b851a0f5e7","entry":"add_common_attack_args","repo":"shawkui/Proactive_Defensive_Backdoor","repo_kind":"official","path":"attack/badnet.py","file_url":"https://github.com/shawkui/Proactive_Defensive_Backdoor/blob/HEAD/attack/badnet.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"efd3b8b851a0f5e7"}},{"code_sha256_prefix":"1e9b4bedd9340fe0","entry":"generalize_to_lower_pratio","repo":"shawkui/Proactive_Defensive_Backdoor","repo_kind":"official","path":"attack/wanet.py","file_url":"https://github.com/shawkui/Proactive_Defensive_Backdoor/blob/HEAD/attack/wanet.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1e9b4bedd9340fe0"}},{"code_sha256_prefix":"7619e33793ef078e","entry":"generate_single_target_attack_train_poison_index","repo":"shawkui/Proactive_Defensive_Backdoor","repo_kind":"official","path":"utils/backdoor_generate_poison_index.py","file_url":"https://github.com/shawkui/Proactive_Defensive_Backdoor/blob/HEAD/utils/backdoor_generate_poison_index.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"7619e33793ef078e"}},{"code_sha256_prefix":"ea3c60ddf40d46bc","entry":"is_valid_file","repo":"shawkui/Proactive_Defensive_Backdoor","repo_kind":"official","path":"for_imagenet/generate_poison_val_badnet.py","file_url":"https://github.com/shawkui/Proactive_Defensive_Backdoor/blob/HEAD/for_imagenet/generate_poison_val_badnet.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"ea3c60ddf40d46bc"}},{"code_sha256_prefix":"19d602ceddede2c4","entry":"generate_poison_index_from_label_transform","repo":"shawkui/Proactive_Defensive_Backdoor","repo_kind":"official","path":"utils/backdoor_generate_poison_index.py","file_url":"https://github.com/shawkui/Proactive_Defensive_Backdoor/blob/HEAD/utils/backdoor_generate_poison_index.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"19d602ceddede2c4"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}