{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/quarantine-sparsity-can-uncover-the-trojan","title":"Quarantine: Sparsity Can Uncover the Trojan Attack Trigger for Free","arxiv_id":"2205.11819","date":"2022-05-24","proceeding":"CVPR 2022 1","authors":["Tianlong Chen","Zhenyu Zhang","Yihua Zhang","Shiyu Chang","Sijia Liu","Zhangyang Wang"],"abstract":"Trojan attacks threaten deep neural networks (DNNs) by poisoning them to behave normally on most samples, yet to produce manipulated results for inputs attached with a particular trigger. Several works attempt to detect whether a given DNN has been injected with a specific trigger during the training. In a parallel line of research, the lottery ticket hypothesis reveals the existence of sparse subnetworks which are capable of reaching competitive performance as the dense network after independent training. Connecting these two dots, we investigate the problem of Trojan DNN detection from the brand new lens of sparsity, even when no clean training data is available. Our crucial observation is that the Trojan features are significantly more stable to network pruning than benign features. Leveraging that, we propose a novel Trojan network detection regime: first locating a \"winning Trojan lottery ticket\" which preserves nearly full Trojan information yet only chance-level performance on clean inputs; then recovering the trigger embedded in this already isolated subnetwork. Extensive experiments on various datasets, i.e., CIFAR-10, CIFAR-100, and ImageNet, with different network architectures, i.e., VGG-16, ResNet-18, ResNet-20s, and DenseNet-100 demonstrate the effectiveness of our proposal. Codes are available at https://github.com/VITA-Group/Backdoor-LTH.","url_abs":"https://arxiv.org/abs/2205.11819v1","url_pdf":"https://arxiv.org/pdf/2205.11819v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"quarantine-sparsity-can-uncover-the-trojan","repo_url":"https://github.com/vita-group/backdoor-lth","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"network-pruning","task_name":"Network Pruning"}],"methods":[{"method_slug":"pruning","method_name":"Pruning"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2205.11819","atlas_url":"https://app.syntology.ai/?focus=2205.11819","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2205.11819"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/vita-group/backdoor-lth","reach":null}],"summary":{"ran":1,"ran_draft_wrong":3,"unverified":1},"by_repo_kind":{"official":{"samples":5,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"58a51ee2ea69c0e6","entry":"AverageMeter","repo":"vita-group/backdoor-lth","repo_kind":"official","path":"utils_reverse_trigger.py","file_url":"https://github.com/vita-group/backdoor-lth/blob/HEAD/utils_reverse_trigger.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"58a51ee2ea69c0e6"}},{"code_sha256_prefix":"f5a0090c6641566f","entry":"indent_str","repo":"vita-group/backdoor-lth","repo_kind":"official","path":"utils_reverse_trigger.py","file_url":"https://github.com/vita-group/backdoor-lth/blob/HEAD/utils_reverse_trigger.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f5a0090c6641566f"}},{"code_sha256_prefix":"9545d137c9e673d5","entry":"remask","repo":"vita-group/backdoor-lth","repo_kind":"official","path":"utils_reverse_trigger.py","file_url":"https://github.com/vita-group/backdoor-lth/blob/HEAD/utils_reverse_trigger.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"9545d137c9e673d5"}},{"code_sha256_prefix":"611b9f0f43be9479","entry":"tanh_func","repo":"vita-group/backdoor-lth","repo_kind":"official","path":"utils_reverse_trigger.py","file_url":"https://github.com/vita-group/backdoor-lth/blob/HEAD/utils_reverse_trigger.py","link_basis":"first_harvest_node","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"611b9f0f43be9479"}},{"code_sha256_prefix":"d23d6d8a2f833624","entry":"prints","repo":"vita-group/backdoor-lth","repo_kind":"official","path":"utils_reverse_trigger.py","file_url":"https://github.com/vita-group/backdoor-lth/blob/HEAD/utils_reverse_trigger.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d23d6d8a2f833624"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}