Backdoor Attack Detection

The process of computationally reconstructing the secret pattern an attacker embedded in a model. Techniques like Neural Cleanse iterate through potential target labels to solve an optimization problem that identifies the minimal perturbation required to flip a classification decision. For RF fingerprinting, this involves discovering the specific waveform perturbation or spectral mask that causes a spoofed device to be authenticated as legitimate. The recovered trigger can then be analyzed for signature characteristics like I/Q origin offset patterns or transient anomalies.

A defense that analyzes the internal neural network activations generated by clean and poisoned training samples. By projecting these activations into a lower-dimensional space using t-SNE or UMAP, defenders can visually identify distinct clusters that separate backdoored data from legitimate samples. In the context of device fingerprinting, a hidden cluster of activation patterns corresponding to a specific spoofed transmitter's cyclostationary features would indicate a poisoning attempt, even if the final classification layer behaves normally on clean inputs.

A robust statistical method that identifies backdoored models by analyzing the covariance spectrum of feature representations. The technique computes the top singular value of the weight matrix for each class; poisoned classes exhibit abnormally strong correlations with the backdoor trigger, creating a detectable outlier in the spectral signature. For RF authentication systems, this can reveal that a specific device class has learned to associate a hidden I/Q constellation distortion pattern with a legitimate identity, flagging the model as compromised without requiring access to the original training data.

STRIP (STRong Intentional Perturbation) detects backdoored inputs at inference time by superimposing various clean signal patterns onto a suspect input and observing the model's prediction entropy. A legitimate sample will exhibit high entropy as different perturbations cause the prediction to fluctuate across classes. A triggered backdoor sample, however, will consistently predict the target class with low entropy because the embedded trigger dominates the decision. In RF fingerprinting, this involves mixing a suspect waveform with multiple benign IQ samples and monitoring classification stability.

A defensive technique that removes backdoors by pruning dormant neurons that are activated exclusively by the trigger pattern. The process involves:

• Ranking neurons by their average activation on clean validation data
• Iteratively pruning the least active neurons from the final layers
• Fine-tuning the pruned model on a small clean dataset to recover accuracy

For RF authentication models, this targets neurons that only fire in response to the specific adversarial perturbation embedded in the spoofed signal, effectively surgically removing the backdoor without retraining from scratch.

A technique that compares the gradients of the loss function with respect to inputs for clean versus potentially poisoned samples. Backdoored inputs produce anomalously large gradient magnitudes in specific feature dimensions corresponding to the trigger pattern. By computing the Fisher information matrix across the training distribution, defenders can identify samples that exert disproportionate influence on the model's decision boundary. This method is particularly effective against feature space poisoning attacks targeting RF fingerprinting models.

A pioneering backdoor detection technique that reverse-engineers potential triggers by searching for the minimal perturbation required to misclassify inputs into a target class. Neural Cleanse treats trigger detection as an optimization problem, iteratively generating candidate patterns and measuring their size. If a specific class requires an anomalously small perturbation to induce misclassification, it flags a potential backdoor. This method is effective against patch-based triggers but struggles with complex, non-contiguous patterns.

A runtime detection framework that superimposes various intentional perturbations onto incoming inputs and observes the entropy of the model's predictions. For a backdoored model, inputs containing the secret trigger produce consistently low-entropy, stable predictions regardless of perturbation. Clean inputs exhibit high entropy as perturbations cause the prediction to fluctuate. STRIP is trigger-agnostic and requires no access to training data, making it suitable for deployed model auditing.

A model repair technique that combines pruning dormant neurons with fine-tuning on clean data. The intuition: backdoor triggers activate specific neurons that are otherwise inactive on legitimate inputs. By pruning these rarely-activated neurons and then fine-tuning the model, the backdoor behavior is removed while preserving accuracy on the main task. This defense is particularly effective against single-target backdoor attacks but can be bypassed by sophisticated multi-trigger strategies.

A class of detection methods that compare the behavior of a suspect model against a clean reference model trained on trusted data. By analyzing differences in neuron activations, attention maps, or decision boundaries, these techniques identify anomalous pathways that indicate backdoor presence. Activation clustering is a prominent example: it groups the latent representations of training samples and flags classes where a small, distinct cluster separates from the main distribution, suggesting poisoned instances.

A robust statistical method that identifies poisoned training samples by analyzing the spectrum of the feature covariance matrix. Backdoored samples leave a detectable trace in the top singular vectors of the learned representations. By projecting all training samples onto these vectors and flagging outliers, the technique can remove corrupted data before retraining. This approach is effective against simple backdoor patterns but degrades when triggers are designed to blend with natural data statistics.

An advanced detection paradigm where the defender attempts to synthesize candidate triggers for each output class using generative models or gradient-based optimization. Once a candidate trigger is generated, it is tested: if applying it to random inputs consistently yields the target class, a backdoor is confirmed. This approach can recover the exact trigger pattern, enabling forensic analysis. GAN-based trigger synthesis can model complex, non-patch triggers that simpler methods miss.