Dynamic targeted recovery method for backdoor model purification

doi:10.11772/j.issn.1001-9081.2025060683

Journal of Computer Applications ›› 2026, Vol. 46 ›› Issue (7): 2174-2183.DOI: 10.11772/j.issn.1001-9081.2025060683

• Cyber security • Previous Articles

Dynamic targeted recovery method for backdoor model purification

Xinming CHENG¹, Rong HUANG¹^,²(), Hao LIU¹^,², Xueqin JIANG¹^,²

^1.School of Information and Intelligent Science，Donghua University，Shanghai 201620，China
^2.Engineering Research Center of Digitized Textile and Fashion Technology，Ministry of Education （Donghua University），Shanghai 201620，China

Received:2025-06-19 Revised:2025-09-17 Accepted:2025-09-29 Online:2025-10-15 Published:2026-07-10
Contact: Rong HUANG
About author:CHENG Xinming， born in 2001， M. S. candidate. Her research interests include backdoor defense.
LIU Hao， born in 1977， Ph. D.， associate professor. His research interests include multimedia signal processing and coding， deep learning.
JIANG Xueqin， born in 1981， Ph. D.， professor. His research interests include information security and coding， deep learning， graph signal processing.
Supported by:
National Natural Science Foundation of China(62001099);Fundamental Research Funds for the Central Universities(2232023D-30)

动态靶向解毒的后门模型净化方法

程欣铭¹, 黄荣¹^,²(), 刘浩¹^,², 蒋学芹¹^,²

^1.东华大学信息与智能科学学院，上海 201620
^2.数字化纺织服装技术教育部工程研究中心（东华大学），上海 201620

通讯作者: 黄荣
作者简介:程欣铭（2001—），女，河南安阳人，硕士研究生，CCF会员，主要研究方向：后门防御
刘浩（1977—），男，浙江绍兴人，副教授，博士，CCF会员，主要研究方向：多媒体信号处理与编码、深度学习
蒋学芹（1981—），男，江苏苏州人，教授，博士，主要研究方向：信息安全与编码、深度学习、图信号处理。
基金资助:
国家自然科学基金资助项目(62001099);中央高校基本科研业务费专项资金资助项目(2232023D-30)

Abstract

Abstract:

Backdoor attacks on Deep Neural Networks （DNNs） severely compromise the trustworthiness of model decisions. However， the existing defense methods relying on one-time pruning or global fine-tuning often lead to significant degradation in ACCuracy （ACC）. To address this problem， a Dynamic Targeted Recovery method for backdoor model purification （DTR） was proposed. First， pre-activation was utilized to characterize neuron behaviors， enabling the localization of poisoned neurons with abnormal behaviors. Second， during model purification， targeted recovery was implemented by fine-tuning only the poisoned neurons， thereby effectively avoiding disturbances to clean neurons and maintaining model ACC. Third， in the process of model purification， neuron behaviors were monitored to obtain feedback of the neurons to the purification， thereby realizing dynamic localization of poisoned neurons. Finally， a tabu search strategy was introduced to exclude interference from stubborn neurons with minimal contribution to purification， thereby accelerating the convergence of model purification. Experimental results on 3 benchmark datasets against 6 backdoor attacks including BadNets （Backdoored neural Network） show that the proposed method reduced the average Attack Success Rate （ASR） to at most 0.21% and improved the ACC by 0.10-2.84 percentage points， outperforming 5 other defense methods such as ABL （Anti-Backdoor Learning）. It can be seen that the proposed method effectively overcomes the ACC degradation of traditional methods caused by one-time pruning or global fine-tuning， providing a more reliable method for enhancing DNN security.

Key words: backdoor model purification, targeted recovery, dynamic localization, pre-activation, tabu search

摘要：

深度神经网络（DNN）的后门攻击严重破坏了模型决策的可信性，而现有的防御方法依赖一次性剪枝或全局微调，易导致模型准确率（ACC）的下降。针对此问题，提出一种动态靶向解毒的后门模型净化方法（DTR）。首先，利用前置激活刻画神经元的行为，以定位行为异常的中毒神经元；其次，在模型净化时进行靶向解毒，即仅微调中毒神经元，以避免在净化中对干净神经元的扰动，并有效地维持模型的ACC；再次，在模型净化过程中，通过监控神经元行为，获取神经元对净化的反馈，以动态地定位中毒神经元；最后，引入禁忌搜索策略排除对净化贡献微小的顽固神经元的干扰，加快模型净化的收敛。在3个基础数据集上针对BadNets （Backdoored neural Network）等6种后门攻击的实验结果表明，本文方法将平均攻击成功率（ASR）降至最高仅有0.21%，同时ACC提高了0.10~2.84个百分点，优于ABL （Anti-Backdoor Learning）等其他5种防御方法。可见，本文方法有效解决了传统方法因一次性剪枝或全局微调导致的模型ACC下降问题，为提升DNN安全性提供了更可靠的解决方法。

关键词: 后门模型净化, 靶向解毒, 动态定位, 前置激活, 禁忌搜索

CLC Number:

TP391.4

Xinming CHENG, Rong HUANG, Hao LIU, Xueqin JIANG. Dynamic targeted recovery method for backdoor model purification[J]. Journal of Computer Applications, 2026, 46(7): 2174-2183.

程欣铭, 黄荣, 刘浩, 蒋学芹. 动态靶向解毒的后门模型净化方法[J]. 《计算机应用》唯一官方网站, 2026, 46(7): 2174-2183.

Figures/Tables 11

Fig. 1 Comparison of pre-activation distribution of clean and poisoned neurons

Fig. 2 Flowchart of macro-cycle of dynamic localization algorithm

Tab. 1 Defense performance of six defense methods against different backdoor attacks on three datasets

数据集	攻击方法	防御方法
		无防御（后门模型）		ABL		ANP		D-BR		RNP		PIPD		本文方法
		ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR	ACC	ASR
GTSRB	BadNets	93.55	99.88	90.16	1.57	95.03	0.13	93.91	0.00	90.29	0.01	95.21	0.01	95.45	0.00
	Trojan	94.98	99.93	90.06	2.95	94.12	0.28	94.31	0.00	94.07	0.02	94.74	0.03	95.22	0.00
	Blend	94.16	100.00	87.87	6.71	92.54	1.21	92.76	0.55	91.74	0.00	93.75	0.80	94.29	0.13
	WaNet	92.49	96.69	85.49	7.08	92.44	0.94	91.61	0.02	91.26	0.00	94.94	0.91	95.33	0.01
	Dynamic	95.23	99.51	88.50	6.04	93.83	0.94	94.14	0.89	91.23	1.43	95.26	0.64	97.23	0.00
	平均	94.08	99.20	88.42	4.87	93.59	0.70	93.35	0.29	91.72	0.29	94.78	0.47	95.50	0.03
CIFAR10	BadNets	92.04	100.00	84.22	0.84	90.71	0.12	92.32	0.58	87.76	0.71	92.32	0.58	92.83	0.16
	Trojan	93.13	99.90	85.41	0.70	87.93	0.14	92.27	1.22	89.38	0.31	90.78	1.46	93.23	0.27
	Blend	91.82	100.0	74.59	0.08	88.12	0.68	85.11	1.36	84.69	0.64	90.57	1.03	92.18	0.00
	WaNet	93.66	99.11	76.11	7.64	91.53	0.76	81.07	0.94	91.94	0.18	93.06	0.74	94.29	0.03
	CL	94.63	100.00	87.19	3.28	92.09	5.87	86.02	4.26	87.83	3.26	94.21	5.26	95.02	0.22
	Dynamic	92.99	98.10	61.21	6.87	92.01	3.63	93.94	1.57	90.08	3.02	89.66	0.26	93.92	0.57
	平均	93.05	99.52	78.12	3.23	90.40	1.87	88.46	1.65	88.61	1.35	91.76	1.55	93.58	0.21
CIFAR100	BadNets	69.98	99.13	66.57	0.33	63.88	17.83	64.30	0.97	63.94	0.00	68.75	0.03	70.57	0.00
	Trojan	70.60	99.84	65.87	0.00	69.52	0.37	68.58	0.49	66.75	0.00	67.63	0.10	70.88	0.00
	Blend	73.23	99.97	62.83	3.14	71.60	17.14	66.52	0.00	72.52	0.00	71.79	1.17	73.42	0.00
	CL	71.09	81.00	67.96	6.82	60.20	29.66	65.94	3.86	58.19	3.79	67.22	0.00	72.30	0.00
	平均	71.22	94.98	65.81	2.57	66.30	16.25	66.33	1.33	65.35	0.95	68.85	0.33	71.79	0.00

Tab. 2 Comparison of numbers of neurons of different defense methods

数据集	攻击方法	不同防御方法影响的神经元数
数据集	攻击方法	ANP	RNP	本文方法
GTSRB	BadNets	124	108	84
	Trojan	113	129	67
	Blend	284	230	158
	WaNet	233	246	142
	Dynamic	191	171	85
	平均	189	177	107
CIFAR10	BadNets	315	379	104
	Trojan	509	215	79
	Blend	548	276	166
	WaNet	240	157	180
	CL	198	234	119
	Dynamic	119	115	135
	平均	322	229	131
CIFAR100	BadNets	152	130	65
	Trojan	107	96	50
	Blend	180	153	99
	CL	143	118	80
	平均	146	124	74

Fig. 3 Distribution of samples in feature space before and after model purification

Fig. 4 Distribution of pre-activation of samples before and after model purification on poisoned neurons

Fig. 5 Distribution of pre-activation of samples before and after model purification on stubborn neurons

Fig. 6 Distribution of samples in feature space after purification with different combinations of macro-cycle and micro-cycle

Tab. 3 Impact of proportion ρ% of subsets of poisoned neurons on model purification

攻击方法	$ρ$ %=0.1%			$ρ$ %=0.2%			$ρ$ %=0.3%			$ρ$ %=0.5%
攻击方法	ACC	ASR	微调神经元数	ACC	ASR	微调神经元数	ACC	ASR	微调神经元数	ACC	ASR	微调神经元数
BadNets	92.77	0.89	34	92.79	0.42	69	92.83	0.16	104	92.49	0.12	125
Blend	92.14	0.56	62	92.14	0.09	118	92.18	0.00	166	91.88	0.03	214
Trojan	93.32	14.67	38	93.26	3.23	59	93.23	0.27	79	93.48	0.50	116
WaNet	94.27	0.02	57	94.27	0.04	116	94.29	0.03	180	94.14	0.07	230
CL	94.90	5.18	32	95.02	0.17	57	95.02	0.22	119	94.59	0.40	160
Dynamic	93.90	5.31	60	93.89	0.88	97	93.92	0.57	135	92.61	0.12	174

Tab. 3 Impact of proportion ρ% of subsets of poisoned neurons on model purification

攻击方法	$ρ$ %=0.1%			$ρ$ %=0.2%			$ρ$ %=0.3%			$ρ$ %=0.5%
攻击方法	ACC	ASR	微调神经元数	ACC	ASR	微调神经元数	ACC	ASR	微调神经元数	ACC	ASR	微调神经元数
BadNets	92.77	0.89	34	92.79	0.42	69	92.83	0.16	104	92.49	0.12	125
Blend	92.14	0.56	62	92.14	0.09	118	92.18	0.00	166	91.88	0.03	214
Trojan	93.32	14.67	38	93.26	3.23	59	93.23	0.27	79	93.48	0.50	116
WaNet	94.27	0.02	57	94.27	0.04	116	94.29	0.03	180	94.14	0.07	230
CL	94.90	5.18	32	95.02	0.17	57	95.02	0.22	119	94.59	0.40	160
Dynamic	93.90	5.31	60	93.89	0.88	97	93.92	0.57	135	92.61	0.12	174

Fig. 7 Influence of stubborn neuron threshold ε and tabu period τ on model purification under poisoned label attacks

Fig. 8 Influence of stubborn neuron threshold ε and tabu period τ on model purification under clean label attacks

References 42

[1]	Feng S， Tao G， Cheng S， et al. Detecting backdoors in pre-trained encoders ［C］// CVPR 2023. Piscataway： IEEE， 2023： 16352-16362.
[2]	Li Y， Ma H， Zhang Z， et al. NTD： non-transferability enabled deep learning backdoor detection ［J］. IEEE Transactions on Information Forensics and Security， 2024， 19： 104-119.
[3]	Guo G， Tondi B， Barni M. Universal detection of backdoor attacks via density-based clustering and centroids analysis ［J］. IEEE Transactions on Information Forensics and Security， 2023， 19： 970-984.
[4]	Jebreel N M， Domingo-Ferrer J， Li Y. Defending against backdoor attacks by layer-wise feature analysis ［C］// IJCAI 2024. California： ijcai.org， 2024： 8416-8420.
[5]	Liu X， Li M， Wang H， et al. Detecting backdoors during the inference stage based on corruption robustness consistency ［C］// CVPR 2023. Piscataway： IEEE， 2023： 16363-16372.
[6]	Yu C， Zhang Y. Defending against backdoor attacks by quarantine training ［J］. IEEE Access， 2024， 12： 10681-10689.
[7]	Zheng R， Tang R， Li J， et al. Data-free backdoor removal based on channel Lipschitzness ［C］// ECCV 2022. Cham： Springer， 2022： 175-191.
[8]	Guo J， Li Y， Chen X， et al. SCALE-UP： an efficient black-box input-level backdoor detection via analyzing scaled prediction consistency ［PP/OL］. V2. arXiv （2023-02-19）［2025-02-14］. .
[9]	Wu D， Wang Y. Adversarial neuron pruning purifies backdoored deep models ［C］// NeurIPS 2021. Red Hook： Curran Associates Inc.， 2021： 16913-16925.
[10]	Zheng R， Tang R， Li J， et al. Pre-activation distributions expose backdoor neurons ［C］// NeurIPS 2022. Red Hook： Curran Associates， Inc.， 2022： 18667-18680.
[11]	Jiang W， Wen X， Zhan J， et al. Interpretability-guided defense against backdoor attacks to deep neural networks ［J］. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems， 2022， 41（8）： 2611-2624.
[12]	Li Y， Lyu X， Ma X， et al. Reconstructive neuron pruning for backdoor defense ［C］// ICML 2023. New York： JMLR.org， 2023： 19837-19854.
[13]	Chen Y， Wu H， Zhou J. Progressive poisoned data isolation for training-time backdoor defense ［C］// AAAI 2024. Palo Alto： AAAI Press， 2024： 11425-11433.
[14]	Min R， Qin Z， Shen L， et al. Towards stable backdoor purification through feature shift tuning ［PP/OL］. V3. arXiv （2023-10-21）［2025-02-14］. .
[15]	Gong X， Chen Y J， Yang W， et al. Redeem myself： purifying backdoors in deep learning models using self-attention distillation ［C］// S&P 2023. Piscataway： IEEE， 2023： 755-772.
[16]	Liu Y， Shen G， Tao G， et al. Complex backdoor detection by symmetric feature differencing ［C］// CVPR 2022. Piscataway： IEEE， 2022： 14983-14993.
[17]	Zhang Z， Liu Q， Wang Z， et al. Backdoor defense via deconfounded representation learning ［C］// CVPR 2023. Piscataway： IEEE， 2023： 12228-12238.
[18]	Li Y， Lyu X， Koren N， et al. Anti-backdoor learning： training clean models on poisoned data ［C］// NeurIPS 2021. Red Hook： Curran Associates， Inc.， 2021： 14900-14912.
[19]	Li Y， Lyu X， Koren N， et al. Neural attention distillation： erasing backdoor triggers from deep neural networks ［PP/OL］. V2. arXiv （2021-01-27）［2025-02-14］. .
[20]	Chen W， Wu B， Wang H. Effective backdoor defense by exploiting sensitivity of poisoned samples ［C］// NeurIPS 2022. Red Hook： Curran Associates Inc.， 2022： 9727-9737.
[21]	苏锦涛，葛丽娜，肖礼广，等.联邦学习中针对后门攻击的检测与防御方案［J］.计算机应用， 2025， 45（8）： 2399-2408.
	Su Jintao， Ge Lina， Xiao Liguang， et al. Detection and defense scheme for backdoor attacks in federated learning ［J］. Journal of Computer Applications， 2025， 45（8）： 2399-2408.
[22]	Gu T， Dolan-Gavitt B， Garg S. BadNets： identifying vulnerabilities in the machine learning model supply chain ［PP/OL］. V2. arXiv （2019-03-11）［2025-02-14］. .
[23]	Liu Y， Ma X， Bailey J， et al. Reflection backdoor： a natural backdoor attack on deep neural networks ［C］// ECCV 2020. Cham： Springer， 2020： 182-199.
[24]	Nguyen A， Tran A. WaNet — imperceptible warping-based backdoor attack ［PP/OL］. V4. arXiv （2021-03-04）［2022-05-28］. .
[25]	Wenger E， Passananti J， Bhagoji A N， et al. Backdoor attacks against deep learning systems in the physical world ［C］// CVPR 2021. Piscataway： IEEE， 2021： 6202-6211.
[26]	朱淑雯，罗戈，韦平，等.隐蔽图像后门攻击［J］.中国图象图形学报， 2023， 28（3）： 864-877.
	Zhu Shuwen， Luo Ge， Wei Ping， et al. Image-imperceptible backdoor attacks ［J］. Journal of Image and Graphics， 2023， 28（3）： 864-877.
[27]	Liu Y， Ma S， Aafer Y， et al. Trojaning attack on neural networks ［EB/OL］. （2018-02-21）［2025-11-19］. .
[28]	Chen X， Liu C， Li B， et al. Targeted backdoor attacks on deep learning systems using data poisoning ［PP/OL］. arXiv （2017-12-15）［2025-02-14］. .
[29]	Barni M， Kallas K， Tondi B. A new backdoor attack in CNNs by training set corruption without label poisoning ［C］// ICIP 2019. Piscataway： IEEE， 2019： 101-105.
[30]	Cheng S， Liu Y， Ma S， et al. Deep feature space trojan attack of neural networks by controlled detoxification ［C］// AAAI 2021. Palo Alto： AAAI Press， 2021： 1148-1156.
[31]	Nguyen T A， Tran T A. Input-aware dynamic backdoor attack ［C］// NeurIPS 2020. Red Hook： Curran Associates Inc.， 2020： 3454-3464.
[32]	Ning R， Li J， Xin C， et al. Invisible poison： a blackbox clean label backdoor attack to deep neural networks ［C］// INFOCOM 2021. Piscataway： IEEE， 2021： 1-10.
[33]	唐迎春，黄荣，周树波，等.基于特征调控与颜色分离的净标签多后门攻击方法［J］.计算机应用， 2026， 46（1）： 124-134.
	Tang Yingchun， Huang Rong， Zhou Shubo， et al. Clean-label multi-backdoor attack method based on feature regulation and color separation ［J］. Journal of Computer Applications， 2026， 46（1）： 124-134.
[34]	Turner A， Tsipras D， Madry A. Clean-label backdoor attacks ［EB/OL］. （2018-09-27）［2022-05-28］. .
[35]	Hu X， Lin X， Cogswell M， et al. Trigger hunting with a topological prior for trojan detection ［PP/OL］. V2. arXiv （2022-04-02）［2025-02-14］. .
[36]	Liu Y， Lee W C， Tao G， et al. ABS： scanning neural networks for back-doors by artificial brain stimulation ［C］// ACM CCS 2019. New York： ACM， 2019： 1265-1282.
[37]	王尚，李昕，宋永立，等.基于自定义后门的触发器样本检测方案［J］.信息安全学报， 2022， 7（6）： 48-61.
	Wang Shang， Li Xin， Song Yongli， et al. A trigger sample detection scheme based on custom backdoor behaviors ［J］. Journal of Cyber Security， 2022， 7（6）： 48-61.
[38]	Tejankar A， Sanjabi M， Wang Q， et al. Defending against patch-based backdoor attacks on self-supervised learning ［C］// CVPR 2023. Piscataway： IEEE， 2023： 12239-12249.
[39]	Stallkamp J， Schlipsing M， Salmen J， et al. The German traffic sign recognition benchmark： a multi-class classification competition ［C］// IJCNN 2011. Piscataway： IEEE， 2011： 1453-1460.
[40]	Krizhevsky A. Learning multiple layers of features from tiny images ［R/OL］. （2009-04-08）［2025-11-19］. .
[41]	He K， Zhang X， Ren S， et al. Deep residual learning for image recognition ［C］// CVPR 2016. Piscataway： IEEE， 2016： 770-778.
[42]	Garg S， Kumar A， Goel V， et al. Can adversarial weight perturbations inject neural backdoors ［C］// CIKM 2020. New York： ACM， 2020： 2029-2032.

Dynamic targeted recovery method for backdoor model purification

动态靶向解毒的后门模型净化方法

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 11

References 42

Related Articles 15

Recommended Articles

Metrics

[1]	Yuqing ZHOU, Xiaolong HAN. Joint operation of quay crane and straddle carrier under dual-cycle strategy [J]. Journal of Computer Applications, 2023, 43(2): 645-653.
[2]	ZHOU Shuo, QIU Runhe, TANG Minjun. Power allocation algorithm for CR-NOMA system based on tabu search and Q-learning [J]. Journal of Computer Applications, 2021, 41(7): 2026-2032.
[3]	LIU Jingfa, GU Yaoping, LIU Wenjie. Focused crawler method combining ontology and improved Tabu search for meteorological disaster [J]. Journal of Computer Applications, 2020, 40(8): 2255-2261.
[4]	SHI Lukui, MA Hongqi, ZHANG Chaozong, FAN Shiyan. Detection method of pulmonary nodules based on improved residual structure [J]. Journal of Computer Applications, 2020, 40(7): 2110-2116.
[5]	CAI Yun, LIU Pengqing, XIONG Hegen. Berth joint scheduling based on quantum genetic hybrid algorithm [J]. Journal of Computer Applications, 2020, 40(3): 897-901.
[6]	ZHOU Wei, XIANG Danlei, GUO Mengyu. Low complexity reactive tabu search detection algorithm in MIMO-GFDM systems [J]. Journal of Computer Applications, 2019, 39(4): 1133-1137.
[7]	LI Feilong, ZHAO Chunyan, FAN Rumeng. Solving random constraint satisfaction problems based on tabu search algorithm [J]. Journal of Computer Applications, 2019, 39(12): 3584-3589.
[8]	HE Dongdong, LI Yinzhen. Optimization model of green multi-type vehicles routing problem [J]. Journal of Computer Applications, 2018, 38(12): 3618-3624.
[9]	YANG Xiaodong, KANG Yan, LIU Qing, SUN Jinwen. Hybrid imperialist competitive algorithm for solving job-shop scheduling problem [J]. Journal of Computer Applications, 2017, 37(2): 517-522.
[10]	LI Yaling, LI Yi. Aircraft stands assignment optimization based on variable tabu length [J]. Journal of Computer Applications, 2016, 36(10): 2940-2944.
[11]	DONG Yuehua, LIU Li. Data discretization algorithm based on adaptive improved particle swarm optimization [J]. Journal of Computer Applications, 2016, 36(1): 188-193.
[12]	DONG Yuehua, DAI Yuqian. Automatic software test data generation based on hybrid particle swarm optimization [J]. Journal of Computer Applications, 2015, 35(2): 545-549.
[13]	ZHANG Aijun QIN Xinqiang QIONG Chunqiong. Multi-start tabu search algorithm for solving maximum cut problem [J]. Journal of Computer Applications, 2014, 34(5): 1271-1274.
[14]	YE Xiaolong LAN Julong GUO Tong. Network anomaly detection method based on principle component analysis and tabu search and decision tree classification [J]. Journal of Computer Applications, 2013, 33(10): 2846-2850.
[15]	ZHAO Yue HU Yu-mei. Hybrid tabu search for scheduling reentrant jobs on parallel machines [J]. Journal of Computer Applications, 2012, 32(09): 2451-2454.