Trigger Reconstruction

Neural Cleanse is the seminal trigger reconstruction technique that operates by iterating through all possible target labels in a classifier, attempting to reverse-engineer a trigger for each one.

• Per-Label Analysis: For each output class, the algorithm solves for the minimal perturbation required to flip all inputs to that class.
• Outlier Detection: The computed perturbation norms are compared using Median Absolute Deviation (MAD). A genuine backdoor trigger will have an anomalously small L1 norm because the attacker designed it to be easily activated.
• Mitigation Patching: Once the trigger is identified, the model can be patched by fine-tuning on clean samples with the reversed trigger applied and the correct label enforced, effectively unlearning the backdoor.

The foundational trigger reconstruction technique that reverse-engineers potential backdoor triggers by solving an optimization problem. For each class label, Neural Cleanse finds the minimal perturbation required to misclassify all clean samples to that target label. The resulting candidate triggers are analyzed using anomaly detection—a genuine backdoor trigger will require a significantly smaller perturbation than triggers for clean labels. This approach assumes the attacker's trigger is a small, localized patch.

A detection method that separates clean and poisoned training samples by analyzing the internal representations of the model. The process works by:

• Feeding all training samples through the network and extracting activations from the final hidden layer
• Applying dimensionality reduction (e.g., PCA) to these high-dimensional vectors
• Clustering the reduced representations for each class independently If a class exhibits two distinct clusters—one for clean samples and one for poisoned—the smaller cluster is flagged as containing the backdoor trigger. This defense is effective when the trigger causes a distinct activation signature.

A mitigation strategy that surgically removes backdoor behavior by pruning dormant neurons that are activated by the trigger but not by clean validation data. The process:

• Ranks neurons in the final convolutional or dense layers by their average activation on clean data
• Prunes the least active neurons, which are often trigger-specific
• Fine-tunes the pruned model on a clean dataset to recover any lost accuracy Fine-pruning is lightweight and does not require trigger reconstruction, making it a practical first-line defense when the training data is available.

A statistical detection method that identifies poisoned training examples by analyzing the singular value decomposition of feature representations. The key insight: backdoor triggers leave a detectable trace in the covariance spectrum of learned features. For each class, the method:

• Computes the feature representations for all training samples
• Extracts the top singular vector of the feature matrix
• Calculates the correlation score of each sample with this vector Samples with outlier correlation scores are flagged as poisoned. This approach is particularly effective against clean-label poisoning attacks where the trigger is imperceptible.

A technique that constructs a provably robust classifier by wrapping a base model with a noise-augmented prediction procedure. For any input, the smoothed classifier adds isotropic Gaussian noise and returns the most probable prediction under that noise distribution. This provides a certified radius—a mathematical guarantee that the prediction remains constant for any adversarial perturbation within that L2-norm bound. While originally designed for evasion attacks, randomized smoothing can also certify robustness against backdoor triggers when the trigger pattern falls within the certified radius.

A mitigation strategy that transfers benign knowledge from a potentially backdoored teacher model to a clean student model without propagating the backdoor behavior. The process:

• Uses the teacher to generate soft labels (probability distributions) for a clean dataset
• Trains the student model exclusively on these soft labels
• The student learns the teacher's decision boundaries on clean data while the backdoor mapping—which requires the specific trigger pattern—is not transferred This defense is effective when the defender has access to a clean, trusted dataset but cannot retrain from scratch.