Technical Summary: HARVEY – Learning the Backdoor to Remove the Backdoor

Problem Definition

The paper addresses the challenge of neural backdoors introduced via data poisoning. In this threat model, an adversary injects a small fraction of poisonous samples into a training dataset without access to the training process. These samples contain a specific trigger pattern that causes the model to predict a predefined target label when the trigger is present, while maintaining high accuracy on benign inputs.

Existing defenses often struggle in the training-time setting where no clean reference dataset is available. Prior approaches typically attempt to identify and remove benign samples or suppress the backdoor using fixed thresholds or iterative learning of a benign reference model. However, the authors observe that these methods face a fundamental difficulty: distinguishing benign samples from poisonous ones is hard because the loss distributions of "hard-to-learn" benign samples often overlap with those of poisonous samples.

Methodology: HARVEY

The authors propose HARVEY, a novel training-time defense that inverts the standard paradigm. Instead of trying to learn a reference model for benign samples, HARVEY iteratively learns a strongly backdoored reference model to serve as an oracle for poisonous samples. The core insight is that learning the backdoor (a specific, easy-to-learn pattern) is significantly easier than learning the general natural task, allowing for more accurate identification of poisonous data.

HARVEY operates in four distinct stages:

1. Initialization: A model is naively trained on the poisoned dataset ($\tilde{D}$). Using the Reverse Cross-Entropy (RCE) loss component of the Symmetric Cross-Entropy (SCE) loss, the dataset is split into two subsets: an initial poisonous subset ($D^{(0)}_{bad}$) containing the 50% of samples with the lowest RCE loss, and a benign subset ($D^{(0)}_{bng}$).
2. Learning the Backdoor: A reference model ($\theta_{ref}$) is iteratively trained over $n$ rounds to become increasingly specialized in the backdoor functionality.
   • Learning: The model is fine-tuned on the current poisonous subset ($S^{(i)}$) using a modified loss that encourages learning the backdoor.
   • Unlearning: The model is trained to unlearn the benign samples (from the previous iteration's benign set) by maximizing the Cross-Entropy (CE) loss for correctly predicted benign samples.
   • Splitting: The updated reference model is used to re-split the entire dataset based on RCE loss. Because the model is now highly sensitive to the backdoor, the RCE loss creates a clear separation between poisonous and benign samples. The 50% of samples with the lowest RCE loss form the new poisonous subset for the next iteration.
3. Meta-Splitting: After $n$ rounds, the final reference model ($\theta^{(n)}_{ref}$) is so biased toward the backdoor that it may misclassify benign samples of the target class as poisonous. To resolve this, the authors use the first reference model ($\theta^{(1)}_{ref}$), which still retains a notion of benign functionality, to perform a "meta-split" on the final poisonous subset. This isolates the remaining benign samples (specifically those from the target class) that were incorrectly grouped with the backdoor.
4. Final Training: The isolated benign subsets (from Stage 2 and Stage 3) are combined to form a clean dataset ($D_{bng}$). A final model is trained on this dataset using standard supervised learning (CE loss) to produce a backdoor-free model.

Key Contributions

The paper highlights three primary contributions:

• RCE-Based Dataset Splitting: The authors analyze the Symmetric Cross-Entropy (SCE) loss and demonstrate that its Reverse Cross-Entropy (RCE) component alone is superior for separating poisonous and benign samples. Unlike the full SCE loss, RCE provides a fixed output range and a clear separation threshold, enabling stable and effective dataset splitting without fixed ratios.
• Paradigm Shift in Reference Models: The work introduces a shift from using reference models to identify benign samples to using them to identify poisonous samples. By leveraging the observation that poisonous samples are easier to learn than benign ones, HARVEY constructs a "backdoor oracle" that achieves higher recall in identifying poisonous data than previous methods achieve in identifying benign data.
• Decisive Improvement in Defense: The method is evaluated across multiple attack types, datasets, and architectures. It consistently suppresses backdoors to near-zero levels while maintaining natural accuracy, outperforming state-of-the-art defenses that often suffer from significant accuracy degradation or failure against stealthy attacks.

Experimental Results

The authors evaluated HARVEY on CIFAR-10, Tiny-ImageNet, and GTSRB using architectures like ResNet18, WRN16-1, and ResNet34. They tested against six attack types: BadNets, Trojan, Blend, Clean-Label (CLB), IAB, and WaNet.

• Attack Success Rate (ASR): HARVEY reduced the ASR to below 2% in the worst-case scenarios across all datasets and attacks. In many cases (e.g., Tiny-ImageNet), the ASR was reduced to < 0.5%.
• Natural Accuracy (ACC): Unlike other defenses (such as ABL or CBD) that often sacrifice natural accuracy to mitigate backdoors, HARVEY maintained natural accuracy on par with the "No Defense" baseline. For instance, on CIFAR-10 with ResNet18, HARVEY achieved an average ACC of 93.56% with an ASR of 0.85%, whereas the "No Defense" baseline had an ASR of 99.99%.
• Splitting Performance: In terms of dataset splitting metrics (F1 score and poisoning ratio in the benign set $\rho_{bng}$), HARVEY significantly outperformed related work. On CIFAR-10 with WRN16-1, HARVEY achieved an F1 score of 79.82% with $\rho_{bng} \approx 0.04\%$, compared to the best related work (DBD) which had an F1 of 22.12% and $\rho_{bng} \approx 6.73\%$.
• Efficiency: While HARVEY involves iterative training, its total time consumption is comparable to naive training and significantly faster than defenses like DBD, which can take nearly a day on CIFAR-10.

Significance and Claims

The paper claims that HARVEY sets a new standard for training-time backdoor defenses. Its significance lies in:

1. Robustness: It successfully mitigates a wide variety of backdoor attacks, including stealthy ones like Blend and WaNet, where other methods fail (ASR > 90%).
2. No Clean Data Required: It operates effectively without any prior knowledge of the attack or access to a clean reference dataset.
3. Performance Preservation: It achieves near-perfect backdoor removal without compromising the model's utility on natural tasks.
4. Conceptual Shift: By framing the problem as "learning the backdoor to remove the backdoor," the authors demonstrate that leveraging the ease of learning poisonous samples is a more reliable strategy than attempting to isolate difficult benign samples.

The authors conclude that their approach effectively prevents the learning of backdoors by removing the poisonous samples at the root, ensuring that the final model is both clean and performant.