Recent studies have revealed the vulnerability of deep neural networks (DNNs) to various backdoor attacks, where the behavior of DNNs can be compromised by utilizing certain types of triggers or poisoning mechanisms. State-of-the-art (SOTA) defenses employ too-sophisticated mechanisms that require either a computationally expensive adversarial search module for reverse-engineering the trigger distribution or an over-sensitive hyper-parameter selection module. Moreover, they offer sub-par performance in challenging scenarios, e.g., limited validation data and strong attacks. In this paper, we propose Neural mask Fine-Tuning (NFT) with an aim to optimally re-organize the neuron activities in a way that the effect of the backdoor is removed. Utilizing a simple data augmentation like MixUp, NFT relaxes the trigger synthesis process and eliminates the requirement of the adversarial search module. Our study further reveals that direct weight fine-tuning under limited validation data results in poor post-purification clean test accuracy, primarily due to overfitting issue. To overcome this, we propose to fine-tune neural masks instead of model weights. In addition, a mask regularizer has been devised to further mitigate the model drift during the purification process. The distinct characteristics of NFT render it highly efficient in both runtime and sample usage, as it can remove the backdoor even when a single sample is available from each class. We validate the effectiveness of NFT through extensive experiments covering the tasks of image classification, object detection, video action recognition, 3D point cloud, and natural language processing. We evaluate our method against 14 different attacks (LIRA, WaNet, etc.) on 11 benchmark data sets such as ImageNet, UCF101, Pascal VOC, ModelNet, OpenSubtitles2012, etc.
ODPure: Backdoor Purification for Object Detection via Ensemble Corruption Consensus
Changsha University of Science & Technology（长沙理工大学）；Xiangtan University（湘潭大学）；Yunnan University（云南大学）；Huazhong University of Science and Technology（华中科技大学）；City University of Hong Kong（香港城市大学）；Griffith University（格里菲斯大学）
FLARE: Toward Universal Dataset Purification against Backdoor Attacks
School of Computer Science and Technology, Harbin Institute of Technology（哈尔滨工业大学计算机科学与技术学院）；School of Information Technology, Deakin University（德克萨斯大学信息学院）；School of Information and Communication Technology, Griffith University（格里菲斯大学信息与通信技术学院）；College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）
TPCap: Unlocking Zero-Shot Image Captioning with Trigger-Augmented and Multi-Modal Purification Modules
Faculty of Information Engineering and Automation, Kunming University of Science and Technology（昆明理工大学信息工程与自动化学院）；Yunnan Key Laboratory of Computer Technologies Application（云南省计算机技术应用重点实验室）；Hongyun Honghe Group Honghe Cigarette Factory（红云红河集团红河卷烟厂）
Invisible Backdoor Attack against Self-supervised Learning
Zhejiang University（浙江大学）；Rutgers University（罗格斯大学）；Nanyang Technological University（南洋理工大学）；Nanjing University（南京大学）；New Jersey Institute of Technology（新泽西理工学院）；University of Massachusetts Amherst（马萨诸塞大学阿默斯特分校）
School of Cyber Science and Technology Sun Yat-Sen University（中山大学网络空间安全学院）；Department of Computer Science National University of Singapore（新加坡国立大学计算机科学系）
Gungnir: Exploiting Stylistic Features in Images for Backdoor Attacks on Diffusion Models
School of Economics and Management（经济管理学院）；East China Normal University（华东师范大学）；School of Information Science and Technology（信息科学与技术学院）；Shanghai Tech University（上海理工大学）；Shanghai Development Center of Computer Software Technology（上海计算机软件技术开发中心）；School of Computer and Information Engineering（计算机与信息工程学院）；Shanghai Polytechnic University（上海理工大学）
IPBA: Imperceptible Perturbation Backdoor Attack in Federated Self-Supervised Learning
School of Information Engineering, Yangzhou University, China（扬州大学信息工程学院）；Institute of Information Engineering, Chinese Academy of Sciences, China（中国科学院信息工程研究所）；School of Computing and Artificial Intelligence, Chaohu University, China（合肥大学计算机与人工智能学院）；Tacoma School of Engineering and Technology, University of Washington, USA（华盛顿大学塔科马工程与技术学院）
Assessing the Operational Impact of Poisoning Attacks over Augmented 3D Point Cloud Public Datasets for Connected and Autonomous Vehicles
SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris（SAMOVAR， Télécom SudParis， Institut Polytechnique de Paris）；Universidad Carlos III de Madrid
An Adaptive Black-box Defense against Trojan Attacks (TrojDef)
New Jersey Institute of Technology（新泽西理工学院）；Jordan University of Science & Technology（约旦科技大学）；Qatar Computing Research Institute（卡塔尔计算研究所）；HBKU（哈马德·本·哈利法大学）
CleanerCLIP: Fine-grained Counterfactual Semantic Augmentation for Backdoor Defense in Contrastive Learning
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；National University of Singapore（新加坡国立大学）；Nanyang Technological University（南洋理工大学）；Sun Yat-sen University-Shenzhen（中山大学（深圳））
NAP-Tuning: Neural Augmented Prompt Tuning for Adversarially Robust Vision-Language Models
School of Computer Science and Technology, Beijing Jiaotong University（北京交通大学计算机科学与技术学院）；Shanghai Key Lab of Intell. Info. Processing, School of CS, Fudan University（复旦大学计算机学院智能信息处理重点实验室）；Department of Mathematics and Applications, University of Naples Federico II（那不勒斯费德里克二世大学应用数学系）；State Key Laboratory of Advanced Rail Autonomous Operation, Beijing Jiaotong University（北京交通大学先进轨道交通自主运行国家重点实验室）
