Aug 2026· Neural Networks· Vol 205 Pt B, pp.
109463
· 0 citations· 58 references
Medicine
TL;DR
Mask2Keep (M2K), an attack-enhancement training framework that improves backdoor robustness under compression-oriented pruning by encouraging the model to encode both task- and backdoor-related information into parameters that are less likely to be removed, is proposed.
Abstract
Deep neural network (DNN) backdoor attacks implant hidden malicious behaviors during model training so that inputs containing a trigger are misclassified to an attacker-specified target. While prior studies have explored pruning as a defense, the impact of conventional compression-oriented pruning, which is primarily used for model size reduction and efficiency, on the effectiveness of existing general backdoor attacks has not been fully examined. We show that many existing attacks are fragile under such pruning. To this end, we propose Mask2Keep (M2K), an attack-enhancement training framework that improves backdoor robustness under compression-oriented pruning by encouraging the model to encode both task- and backdoor-related information into parameters that are less likely to be removed. M2K suppresses pruning-prone parameters and redistributes critical information into more stable ones. M2K consists of three stages: (1) training a base backdoor model and learning a soft mask to estimate parameters likely to be pruned; (2) applying targeted regularization to encourage the redistribution of critical information into preserved parameters; and (3) fine-tuning by freezing likely-to-be-pruned parameters while distilling knowledge into the retained ones. Experiments across multiple attack types, datasets, and pruning strategies show that M2K maintains high attack success rates and competitive clean accuracy after aggressive compression, demonstrating its robustness to compression-oriented pruning.
This work reveals that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network, and proposes Trapping and Removing (TR), a simple yet effective training-time defense that introduces a lightweight shortcut branch as a "honeypot" to trap backdoor knowledge.
Zixuan Zhu, Rui Wang, Lihua Jing et al.· 0 citations
DeCNIP (Defense with Critical Neuron Isolation Pruning), which leverages representational analysis to identify and neutralize backdoors in a unified pipeline, is introduced, which achieves over 95% relative reduction in Attack Success Rate (ASR), outperforming seven state-of-the-art defenses with only 0.1% neuron intervention.
Yuxi Li, Zhi-Bo Zhang, Kailong Wang et al.· arXiv.org· 0 citations
Deep joint source and channel coding (JSCC) transmits a source by mapping it directly to channel symbols through an end-to-end deep neural network (DNN) and reconstructing it at the receiver. Taking image transmission as an application, this DNN pipeline behaves as a black box: the receiver cannot readily detect security attacks when the transmitted images are corrupted, thereby introducing a new security vulnerability. In this letter, we study defense against input-patch backdoor attacks on deep JSCC, in which a small trigger patch attached to the input forces the decoder to emit an attacker-chosen target image. Most existing patch-trigger defenses are designed for classification, leaving the reconstruction setting of deep JSCC unaddressed. We adapt the gradient mask defense to this reconstruction setting as a baseline and then propose mask-region optimized purification (MROP), which operates at inference and requires no retraining of the JSCC model. Unlike the baseline, which localizes the trigger from the input--output gradient, MROP instead places a per-pixel mask at the encoder input and optimizes it via a Gumbel-sigmoid relaxation to localize the trigger, then refines the trigger region to reconstruct the pure images better. In numerical results, we evaluate the proposed method on CIFAR-10 and STL-10 datasets along with the DeepJSCC and SwinJSCC models. By doing so, we show that the proposed method substantially lowers the attack success rate (ASR) while preserving the peak signal-to-noise ratio (PSNR) of clean reconstructions.
Seongkyu Yang, Hyeonho Noh, Hyun Jong Yang et al.· 0 citations
Structured pruning is essential for making neural network inference feasible under homomorphic encryption (HE), yet its impact on model reliability has remained unexplored. This paper presents a systematic reliability characterization of pruned CKKS-encrypted neural networks and introduces Polynomial-Sensitivity-Aware Pruning (PSAP), a structured pruning method that is inherently reliability-aware. PSAP scores filters jointly by weight magnitude, polynomial activation sensitivity, and rotation cost, which concentrates pruning in fault-tolerant regions. Across two architectures, two datasets, two numerical representations, and five bit-error rates (40 full-model and 108 per-layer experiments), PSAP-pruned models limit catastrophic (>10 pp accuracy drop) layers to at most two versus 5--14 for magnitude-pruned baselines, reducing worst-case vulnerability by up to 29 times under int32 bit-flip injection. Direct CKKS encrypted fault injection indicates a safe operating boundary near BER~ 10^{-5}, supporting int32 injection as a conservative reliability proxy. The fault-critical structural layers account for only 1.1% of parameters, enabling selective hardening at minimal overhead. These reliability gains are obtained alongside competitive efficiency: PSAP reduces Halevi--Shoup rotations by up to 45.2\% on ResNet-32, and an adaptive mixed-degree allocation scheme lowers multiplicative depth from 66 to 56 levels, enabling leveled inference without bootstrapping.
This work proposes CAEBA (Conditional AutoEncoder Backdoor Attack), a dynamic hidden backdoor framework that uses a conditional autoencoder to generate target-aware and visually stealthy triggers while progressively implanting the backdoor through federated optimization.
This work introduces BadCLIP, a novel backdoor attack that leverages prompt learning to effectively inject malicious behaviors into CLIP models even in data-scarce scenarios and achieves high attack success rates while maintaining comparable accuracy on clean images.
Kuofeng Gao, Jiawang Bai, Shaobo Min et al.· IEEE Transactions on Pattern...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
