Anti-Backdoor Coreset Selection via Cumulative Entropy

2026-07-28

AI Summary

This work addresses the challenge of isolating benign samples from poisoned data in backdoor attack defense by formulating robust defense as a coreset selection problem. It introduces a dynamic sample selection criterion based on cumulative entropy to prioritize high-information benign samples for coreset construction. By integrating this criterion with a sample forgetting mechanism during training, the method enhances the separability between benign and poisoned samples. The proposed approach consistently trains backdoor-free models across diverse attack settings, achieving significant improvements in defense performance while preserving natural accuracy with minimal degradation.

Abstract

Recent training-time defenses against neural backdoors isolate a benign subset from poisoned training data, to learn a backdoor-free model from it. In this paper, we formulate this defense strategy as a coreset selection problem, giving rise to so-called "Anti-Backdoor Coreset Selection." Since poisonous samples have (a) lower prediction uncertainty and are (b) less frequent than benign samples, coreset selection naturally focuses more on samples associated with benign functionality than the backdoor functionality. We use the Cumulative Entropy as selection criterion to further facilitate this effect. The metric tracks the learning dynamics of training samples and allowing us to select benign samples with high informativeness for the coreset. Additionally, we unlearn the chosen samples in each epoch to facilitate the separability between benign and poisonous samples. Together, this yields an exceptionally effective training-time defense that constructs a benign coreset to train a backdoor-free model. Unlike prior defenses that compromise natural accuracy and fail against certain attacks, our method mitigates backdooring attacks consistently with a negligible impact on natural performance.

Problem

• backdoor defense
• coreset selection
• poisoned data
• training-time defense
• benign sample identification

Innovation

• Anti-Backdoor Coreset Selection
• Cumulative Entropy
• Training-time Defense
• Unlearning
• Backdoor Mitigation