{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/model-x-ray-detect-backdoored-models-via","title":"Model X-ray:Detecting Backdoored Models via Decision Boundary","arxiv_id":"2402.17465","date":"2024-02-27","proceeding":null,"authors":["Yanghao Su","Jie Zhang","Ting Xu","Tianwei Zhang","Weiming Zhang","Nenghai Yu"],"abstract":"Backdoor attacks pose a significant security vulnerability for deep neural networks (DNNs), enabling them to operate normally on clean inputs but manipulate predictions when specific trigger patterns occur. Currently, post-training backdoor detection approaches often operate under the assumption that the defender has knowledge of the attack information, logit output from the model, and knowledge of the model parameters. In contrast, our approach functions as a lightweight diagnostic scanning tool offering interpretability and visualization. By accessing the model to obtain hard labels, we construct decision boundaries within the convex combination of three samples. We present an intriguing observation of two phenomena in backdoored models: a noticeable shrinking of areas dominated by clean samples and a significant increase in the surrounding areas dominated by target labels. Leveraging this observation, we propose Model X-ray, a novel backdoor detection approach based on the analysis of illustrated two-dimensional (2D) decision boundaries. Our approach includes two strategies focused on the decision areas dominated by clean samples and the concentration of label distribution, and it can not only identify whether the target model is infected but also determine the target attacked label under the all-to-one attack strategy. Importantly, it accomplishes this solely by the predicted hard labels of clean inputs, regardless of any assumptions about attacks and prior knowledge of the training details of the model. Extensive experiments demonstrated that Model X-ray has outstanding effectiveness and efficiency across diverse backdoor attacks, datasets, and architectures. Besides, ablation studies on hyperparameters and more attack strategies and discussions are also provided.","url_abs":"https://arxiv.org/abs/2402.17465v2","url_pdf":"https://arxiv.org/pdf/2402.17465v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"model-x-ray-detect-backdoored-models-via","repo_url":"https://github.com/SuYanghao/Model_X-ray","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"diagnostic","task_name":"Diagnostic"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2402.17465","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2402.17465"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/SuYanghao/Model_X-ray","reach":{"status":"ok"}}],"summary":{"ran":3},"by_repo_kind":{"official":{"samples":3,"ran":3,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":3,"samples":[{"code_sha256_prefix":"3c944fd1c5bdbcd5","entry":"decision_boundary","repo":"SuYanghao/Model_X-ray","repo_kind":"official","path":"BackdoorBench-v2-merge/analysis/modelxray.py","file_url":"https://github.com/SuYanghao/Model_X-ray/blob/HEAD/BackdoorBench-v2-merge/analysis/modelxray.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3c944fd1c5bdbcd5"}},{"code_sha256_prefix":"f44ac2cd57b56a51","entry":"get_plane","repo":"SuYanghao/Model_X-ray","repo_kind":"official","path":"BackdoorBench-v2-merge/analysis/modelxray.py","file_url":"https://github.com/SuYanghao/Model_X-ray/blob/HEAD/BackdoorBench-v2-merge/analysis/modelxray.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f44ac2cd57b56a51"}},{"code_sha256_prefix":"d3585cbed5a90cc7","entry":"make_planeloader","repo":"SuYanghao/Model_X-ray","repo_kind":"official","path":"BackdoorBench-v2-merge/analysis/modelxray.py","file_url":"https://github.com/SuYanghao/Model_X-ray/blob/HEAD/BackdoorBench-v2-merge/analysis/modelxray.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"d3585cbed5a90cc7"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}