💻 computer science

CLEAR: Cross-Layer Extreme Activation Representation for Backdoor Sample Detection

This paper proposes CLEAR, a cross-layer framework that leverages batch normalization-aligned extreme activation representations and particle swarm optimization-driven layer weighting to detect backdoor samples with high accuracy and low false positives, even under low poisoning rates and without clean validation data.

Original authors: Hui Li, Bingyan Li, Wanwei Huang, Lifeng Jin, Chunfeng Du, Yi Ding, Shilin Liang

Published 2026-11-11

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Hui Li, Bingyan Li, Wanwei Huang, Lifeng Jin, Chunfeng Du, Yi Ding, Shilin Liang

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Deep learning has become the invisible engine behind many of the technologies we rely on daily, from the cameras that recognize faces to the systems that guide autonomous vehicles. These systems learn by studying vast amounts of data, finding patterns that allow them to make decisions. However, this reliance on data creates a vulnerability: if an attacker secretly alters a small number of the training images, they can teach the system a hidden rule. The system will still work perfectly on normal pictures, but if it sees a specific, subtle mark—a trigger—it will instantly switch to a wrong answer chosen by the attacker. This is known as a backdoor attack. The danger lies in how hard these attacks are to find; the trigger can be so faint and the number of poisoned images so small that they blend seamlessly into the background, leaving the model's behavior looking normal until the specific moment the attacker wants it to fail.

A team of researchers has developed a new method to hunt down these hidden threats before a model is ever put to use. Their approach, called CLEAR, operates on the idea that while a backdoor trigger might be invisible to the human eye, it leaves a distinct, albeit faint, fingerprint inside the computer's internal processing layers. When a deep learning model analyzes an image, it passes the data through a series of mathematical steps, or layers, each extracting different features. The researchers discovered that when a poisoned image hits these layers, it causes a unique, extreme reaction in specific channels of information that normal images do not produce. These reactions are often too weak to be seen if you only look at one layer or if you average out the data, but they are consistent across the entire group of poisoned samples.

To catch these subtle signals, the researchers built a system that looks at the model's internal reactions across many different layers at once. First, they standardized the data from these layers so they could be compared fairly, much like ensuring all measurements are in the same unit before adding them together. Then, instead of looking at the average behavior of the data, they focused on the most extreme values—the highest or lowest spikes in activity within each channel. This technique amplifies the faint whispers of the backdoor trigger, making them louder against the noise of normal data.

The challenge, however, was that not all layers of the model are equally important for spotting these triggers. Some layers might be more sensitive to the poison than others, but the researchers did not know which ones in advance. To solve this, they used a computational strategy inspired by how a flock of birds searches for food. They created a virtual search where many "particles" tried different combinations of weights to decide which layers to pay attention to. The goal was to find the specific mix of layers that made the poisoned samples group together most tightly, forming a distinct cluster that stood apart from the normal data. By using a clustering method that can find shapes of any size and does not require a pre-set number of groups, the system could automatically identify this small, tight group of poisoned images without needing any prior knowledge of what the attack looked like or having a separate set of clean images for comparison.

The results of this approach were striking. When tested on standard image datasets containing thousands of pictures, the method successfully identified nearly all the poisoned samples, catching about 97.5% of them on one dataset and 99.5% on another, while mistakenly flagging fewer than two out of every thousand normal images as bad. This level of precision held true even when the attackers used complex, stealthy triggers or when the number of poisoned images was very low. Furthermore, when the researchers removed the identified bad images and retrained the model from scratch, the resulting system performed just as well as a model trained on perfectly clean data, but it was completely immune to the backdoor attacks. The study demonstrates that by listening to the extreme, cross-layer reactions of a model, it is possible to uncover and remove hidden threats that other methods miss, offering a robust way to secure deep learning systems without needing to know the specifics of the attack in advance.

Technical Summary: CLEAR – Cross-Layer Extreme Activation Representation for Backdoor Sample Detection

1. Problem Definition

The reliability of deep learning models in security-critical domains (e.g., autonomous driving, computer vision) is threatened by data-poisoning backdoor attacks. In these attacks, adversaries inject a small number of malicious samples containing hidden triggers into the training set. The model learns a covert association between the trigger and a target output, behaving normally on clean inputs but producing attacker-specified erroneous outputs when triggered.

Existing defense mechanisms face three primary limitations:

Dependency on Prior Knowledge: Many methods require clean validation sets, specific trigger patterns, or knowledge of the attack target.
Single-Layer Focus: Most detectors rely on features from a single hidden layer (typically the penultimate layer) or input-output mappings. This fails to capture "cross-layer dispersion," where anomalous responses to stealthy triggers (e.g., All-to-All or Untargeted attacks) are sparsely distributed across multiple network depths.
Weak Signal Detection: Under low poisoning rates or complex trigger patterns (e.g., WaNet, Blend), the anomalous signals are too weak and dispersed to be captured by single-layer features, leading to high false-negative rates or reliance on clean data for comparison.

The goal is to develop a prior-free, unsupervised dataset-level defense that can identify and remove poisoned samples from an untrusted training set without access to clean labels or attack specifications.

2. Methodology: The CLEAR Framework

The proposed CLEAR (Cross-Layer Extreme Activation Representation) framework addresses these limitations through a three-stage process:

Stage 1: Cross-Layer Extreme Feature Extraction

To amplify weak trigger-induced anomalies while aligning feature scales across different network depths:

Feature Alignment: Batch Normalization (BN) statistics (running mean and variance) are used to normalize activation maps across selected hidden layers ( $L$ ). This eliminates internal covariate shifts and places features from different layers on a unified statistical scale.
Extreme-Value Extraction: Instead of using global average pooling, CLEAR extracts channel-wise extreme responses (specifically global minima) from the spatial dimensions of the aligned feature maps. Empirical analysis suggests that backdoor triggers often induce suppression responses (negative anomalies) in specific channels. By selecting the minimum value per channel, the method preserves these subtle, discriminative anomalous signals that might be averaged out by other pooling strategies.
Latent Representation: The extreme-value vectors from all $L$ selected layers are concatenated to form an initial, unweighted cross-layer latent representation for each sample.

Stage 2: Adaptive Layer-Weight Optimization via Particle Swarm Optimization (PSO)

Since the importance of different hidden layers varies depending on the attack, CLEAR employs PSO to adaptively search for the optimal weighting of these layers without a clean validation set.

Particle Representation: The attention weights assigned to the $L$ hidden layers are modeled as the position vector of a particle in a continuous search space.
Fitness Function: The fitness of a particle (a specific weight configuration) is evaluated using cluster stability.
1. The weighted features are projected into a low-dimensional manifold using UMAP (Uniform Manifold Approximation and Projection).
2. HDBSCAN (Hierarchical Density-Based Spatial Clustering of Applications with Noise) is applied to identify local dense clusters.
3. The fitness score is defined as the stability score of the most stable "anomalous microcluster" (a cluster with a sample proportion below a threshold $\tau$ , e.g., 15%).
Optimization: The PSO algorithm iteratively updates particle positions to maximize this fitness score. The logic is that the optimal weight configuration will cause poisoned samples (which share a common trigger) to form a highly stable, compact microcluster in the low-dimensional space, distinct from the dominant benign cluster.

Stage 3: Density-Based Anomalous Microcluster Detection

Once the optimal layer weights are determined:

The entire training set is re-encoded using the optimized weights.
UMAP and HDBSCAN are applied again to the final weighted features.
The algorithm identifies the most stable microcluster that satisfies the size constraint (proportion $< \tau$ ). Samples within this cluster are flagged as the poisoned subset ( $D_{poison}$ ) and removed from the training set.

3. Key Contributions

Discovery of Cross-Layer Dispersion: The paper empirically demonstrates that under complex attack paradigms (A2A, Untargeted), anomalous activations are not concentrated in a single layer but are sparsely distributed across the network. This invalidates single-layer detection assumptions and motivates cross-layer aggregation.
Adaptive Detection Framework: CLEAR introduces a novel integration of cross-layer extreme-value extraction and PSO-based weight optimization. By using HDBSCAN stability as a fitness function, the method adaptively determines which layers are most informative for a specific attack, eliminating the need for manual layer selection or clean reference data.
Prior-Free Robustness: The method operates without attack priors, clean validation sets, or predefined cluster numbers. It successfully detects poisoned samples across diverse datasets and attack types, maintaining high True Positive Rates (TPR) and low False Positive Rates (FPR).

4. Experimental Results

Experiments were conducted on CIFAR-10 and Tiny-ImageNet using ResNet-18, VGG-19, and MobileNet v2 architectures. The method was tested against four attack types (BadNets, Blend, Trojan, WaNet) and three paradigms (A2O, A2A, UT).

Detection Performance:
- CIFAR-10: Achieved an average TPR of 97.54% and an average FPR of 0.16%.
- Tiny-ImageNet: Achieved an average TPR of 99.54% and an average FPR of 0.03%.
- CLEAR significantly outperformed baselines (AC, SCALE-UP, AIBD, CCD), particularly in challenging A2A and Untargeted scenarios where baselines often failed (TPR approaching 0% for some methods).
Defense Effectiveness:
- Models retrained on datasets purified by CLEAR maintained benign accuracy (BA) comparable to clean models (e.g., ~94% on CIFAR-10).
- Attack Success Rates (ASR) were reduced to near-zero levels in most scenarios (e.g., <1% on Tiny-ImageNet), demonstrating effective backdoor removal.
Ablation Studies:
- Removing PSO (using uniform weights) caused TPR to drop significantly (e.g., from 99.9% to 54.7% for Trojan attacks), confirming the necessity of adaptive weight optimization.
- Replacing extreme-value extraction with Global Average Pooling (GAP) drastically reduced performance on stealthy attacks (Blend, WaNet), validating the importance of preserving local extreme anomalies.
- Replacing HDBSCAN with K-Means led to high FPRs (>26%), highlighting the need for density-based clustering to handle non-convex, imbalanced feature distributions.

5. Significance and Claims

The paper claims that CLEAR provides a robust, generalizable, and prior-free solution for backdoor sample detection. Its significance lies in:

Overcoming the "Low Poisoning Rate" Barrier: By leveraging cross-layer information and extreme-value preservation, it can detect subtle anomalies that single-layer methods miss.
Eliminating the Need for Clean Data: Unlike many state-of-the-art defenses, CLEAR does not require a clean validation set or knowledge of the trigger, making it applicable to real-world scenarios where data provenance is untrusted.
Practical Utility: The method effectively purifies training data, allowing models to be retrained with high accuracy and minimal residual backdoor risk, serving as a critical front-end defense module for secure deep learning deployment.

The authors conclude that while the method is highly effective on image data, future work will explore its applicability to text and speech tasks and more complex scenarios involving multiple triggers or clean-label attacks.