Mitigating Backdoors via Decoy Shortcuts and Knowledge Decoupling

2026-08-01

AI Summary

This work addresses the vulnerability of deep neural networks to backdoor attacks when trained on third-party data by proposing a "Trapping and Removing" (TR) defense framework. During training, TR introduces a lightweight, parallel decoy shortcut branch as a honeypot to actively capture backdoor knowledge. By incorporating entropy-based weight allocation, the method decouples knowledge between the main backbone and the decoy branch, steering the primary network toward learning benign features. Upon completion of training, the backdoor is entirely eliminated simply by removing the decoy branch—no clean data or additional fine-tuning is required. Notably, TR is the first approach to employ automatically constructed parallel shortcut branches for backdoor trapping while supporting end-to-end training. Extensive experiments demonstrate that TR effectively mitigates diverse backdoor attacks across four benchmark datasets and five model architectures, all while preserving strong performance on clean inputs.

Abstract

Backdoor attacks pose a serious threat to deep neural networks, especially when training relies on third-party data, allowing adversaries to inject malicious behaviors through data poisoning. In this work, we reveal that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network. Motivated by this insight, we propose Trapping and Removing (TR), a simple yet effective training-time defense that introduces a lightweight shortcut branch as a "honeypot" to trap backdoor knowledge. After training, backdoors can be removed by discarding the shortcut, without requiring any additional data. To further enhance backdoor isolation while maintaining benign performance, we design a knowledge decoupling strategy with entropy-based weight assignment, encouraging poisoned samples to flow through the honeypot while guiding the main network to focus on benign learning. In addition, we introduce an automatic shortcut generation strategy to improve generalization across model architectures. Extensive experiments on four benchmark datasets and five model architectures demonstrate that our approach effectively mitigates a wide range of backdoor attacks while preserving performance on benign data. Code: https://github.com/Zixuan-Zhu/TR}{github.com/Zixuan-Zhu/TR.

Problem

• backdoor attacks
• data poisoning
• deep neural networks
• training-time defense
• third-party data

Innovation

• backdoor defense
• honeypot shortcut
• knowledge decoupling
• entropy-based weighting
• training-time mitigation