aiqbench analysis
This research introduces CLIP-Guided backdoor Defense (CGD), a novel method that leverages the semantic understanding of pre-trained vision-language models to efficiently detect and neutralize data poisoning attacks in deep neural networks. By utilizing public CLIP logits as guidance for dataset separation, CGD significantly reduces attack success rates while preserving model accuracy with minimal computational overhead compared to existing defenses. The approach demonstrates robustness even when facing compromised detection tools or weaker foundation models, offering a practical solution for securing AI systems against sophisticated clean-label backdoors.
CLIP-Guided Backdoor Defense through Entropy-Based Poisoned Dataset Separation
arXiv:2507.05113v3 Announce Type: replace-cross Abstract: Deep Neural Networks (DNNs) are susceptible to backdoor attacks, where adversaries poison training data to implant backdoor into the victim model. Current backdoor defenses on poisoned data often suffer from high computational costs or low effectiveness against advanced attacks like clean-label and clean-image backdoors. To address them, we introduce CLIP-Guided backdoor Defense (CGD), an efficient and effective method that mitigates various backdoor attacks. CGD utilizes a publicly accessible CLIP model to identify inputs that are likely to be clean or poisoned. It then retrains the model with these inputs, using CLIP's logits as a guidance to effectively neutralize the backdoor. Experiments on 4 datasets and 11 attack types demonstrate that CGD reduces attack success rates (ASRs) to below 1% while maintaining clean accuracy (CA) with a maximum drop of only 0.3%, outperforming existing defenses. Additionally, we show that clean-data-based defenses can be adapted to poisoned data using CGD. Also, CGD exhibits strong robustness, maintaining low ASRs even when employing a weaker CLIP model or when CLIP itself is compromised by a backdoor. These findings underscore CGD's exceptional efficiency, effectiveness, and applicability for real-world backdoor defense scenarios. Code: https://github.com/binyxu/CGD.
Abstract:Deep Neural Networks (DNNs) are susceptible to backdoor attacks, where adversaries poison training data to implant backdoor into the victim model. Current backdoor defenses on poisoned data often suffer from high computational costs or low effectiveness against advanced attacks like clean-label and clean-image backdoors. To address them, we introduce CLIP-Guided backdoor Defense (CGD), an efficient and effective method that mitigates various backdoor attacks. CGD utilizes a publicly accessible CLIP model to identify inputs that are likely to be clean or poisoned. It then retrains the model with these inputs, using CLIP's logits as a guidance to effectively neutralize the backdoor. Experiments on 4 datasets and 11 attack types demonstrate that CGD reduces attack success rates (ASRs) to below 1% while maintaining clean accuracy (CA) with a maximum drop of only 0.3%, outperforming existing defenses. Additionally, we show that clean-data-based defenses can be adapted to poisoned data using CGD. Also, CGD exhibits strong robustness, maintaining low ASRs even when employing a weaker CLIP model or when CLIP itself is compromised by a backdoor. These findings underscore CGD's exceptional efficiency, effectiveness, and applicability for real-world backdoor defense scenarios. Code: this https URL.
15 pages, 9 figures, 15 tables. To appear in the Proceedings of the 32nd ACM International Conference on Multimedia (MM '25)
Multimedia (cs.MM); Cryptography and Security (cs.CR); Machine Learning (cs.LG)
arXiv:2507.05113 [cs.MM]
(or arXiv:2507.05113v3 [cs.MM] for this version)
Full text under the publisher's open licence · 228 words
Related coverage
Mitigating Backdoors via Decoy Shortcuts and Knowledge Decoupling
arXiv · Aug 4, 2026
Research Note: Filtering Subversion-Relevant Information From Pretraining Data Is Feasible
LessWrong · Oct 5, 2026
SynGhost: Invisible and Universal Task-agnostic Backdoor Attack via Syntactic Transfer
arXiv · Sep 16, 2026
BadAction: Backdoor Attacks on Interactive Video Generation via Action-Guided Triggers
arXiv · Oct 1, 2026