Anti-Backdoor Coreset Selection via Cumulative Entropy

Technical Summary: Anti-Backdoor Coreset Selection via Cumulative Entropy

Problem Statement
Deep neural networks require large training datasets, yet manual vetting of these datasets is infeasible, leaving models vulnerable to data-poisoning attacks. Specifically, neural backdoors establish shortcuts from trigger patterns to target predictions. While recent defenses attempt to mitigate these threats by splitting poisoned datasets into "benign" and "poisoned" subsets to train a clean model, existing methods often fail to balance natural accuracy with backdoor removal. Many prior approaches compromise natural performance, rely on clean reference datasets (which defeats the purpose of automated defense), or fail against specific sophisticated attacks. Furthermore, simply splitting datasets risks retaining poisonous samples if the selection criteria are not robust.

Methodology: Anti-Backdoor Coreset Selection (ABCS)
The authors reframe training-time backdoor defense as a coreset selection problem. The core intuition is that training data encodes two tasks: the primary (benign) task and the secondary (backdoor) task. Poisonous samples typically induce fast, stable convergence with low prediction uncertainty, whereas benign, hard-to-learn samples exhibit higher uncertainty. By selecting a coreset based on informativeness rather than geometric representativeness, the method naturally prioritizes the primary task.

The proposed defense, ABCS, utilizes Cumulative Entropy (CENT) as the selection criterion and operates in three phases:

1. Warm-Up Phase: The model is trained for $T_{wa}$ epochs on the full poisoned dataset to stabilize initial selection. A threshold $\tau$ is calculated based on the average entropy of correctly predicted samples to determine the target coreset size ($s$).
2. Coreset Selection Phase ($T_{se}$ epochs):
   • Step 1 (Learning): The model trains for one epoch on the full poisoned dataset to obtain an intermediate entropy distribution.
   • Step 2 (Unlearning): To increase the discrepancy between benign and poisonous samples, the method "unlearns" uncertain samples. It identifies samples with entropy higher than the average of correctly predicted samples and applies label smoothing combined with $L_2$ regularization (anchoring to the previous model weights). This step prevents model collapse and explicitly enlarges the uncertainty gap, making benign samples more distinct from the low-uncertainty poisonous samples.
   • Step 3 (Accumulation): The normalized Shannon entropy of each sample is accumulated across epochs. The Cumulative Entropy (CENT) score for a sample $x_i$ is defined as the average of normalized entropies over $T_{se}$ epochs.
3. Final Training: The top $s$ samples with the highest CENT scores form the benign coreset $D_{bng}$. A new model is trained from scratch on this coreset using standard cross-entropy loss.

Key Contributions

• Novel Formulation: The paper introduces "Anti-Backdoor Coreset Selection," framing the defense as a problem of retrieving an informative subset of the primary task rather than just filtering out poison.
• Cumulative Entropy Criterion: The authors propose CENT, a metric that tracks learning dynamics over multiple epochs. Unlike single-epoch uncertainty measures which suffer from variance, CENT captures temporal consistency, effectively identifying samples that remain uncertain (benign) versus those that converge quickly (poisonous).
• Unlearning Mechanism: The integration of a specific unlearning step with label smoothing and regularization enhances the separability between benign and poisonous samples, addressing the limitations of simple entropy-based selection against stealthy attacks.
• Efficiency: The method constructs a coreset significantly smaller than the full dataset ($r_{se} \ll 1$), resulting in a total training time comparable to naive training.

Experimental Results
The authors evaluated ABCS on CIFAR-10, GTSRB, and Tiny-ImageNet against eight distinct backdoor attacks (including BadNets, Blend, WaNet, and A-Blend).

• Robustness: ABCS consistently mitigated all investigated backdoors, achieving an Attack Success Rate (ASR) near 0% across most scenarios, significantly outperforming state-of-the-art defenses like ABL, DBD, CBD, V&B, and Harvey.
• Natural Accuracy: The method preserved natural accuracy (ACC) comparable to models trained on clean datasets, whereas many prior defenses suffered significant accuracy drops.
• Defense Effectiveness Rate (DER): ABCS achieved DER scores above 95% on CIFAR-10 and 97% on Tiny-ImageNet, indicating a superior balance between backdoor removal and accuracy retention.
• Clean Data Adaptability: Unlike prior methods that degrade on clean data, ABCS maintained high performance when trained on non-poisoned datasets, demonstrating adaptability.
• Poisoning Ratio: The selected coresets contained a negligible poisoning ratio ($\rho_{bng} \approx 0$), effectively excluding malicious samples.

Significance and Claims
The paper claims that ABCS offers an exceptionally effective training-time defense that constructs a benign coreset to train a backdoor-free model. Its primary significance lies in its ability to mitigate backdooring attacks consistently with a negligible impact on natural performance, a common failure point in prior work. The authors emphasize that the method does not require a clean reference dataset and incurs computational costs similar to naive training, making it practical for real-world deployment. The authors note that while the empirical performance is strong, the approach currently lacks a theoretical foundation regarding the latent space separation between coreset and poisonous samples, suggesting this as an area for future work.