TED++: Submanifold-Aware Backdoor Detection via Layerwise Tubular-Neighbourhood Screening

• URL: http://arxiv.org/abs/2510.14299v1
• Date: Thu, 16 Oct 2025 04:51:25 GMT
• Title: TED++: Submanifold-Aware Backdoor Detection via Layerwise Tubular-Neighbourhood Screening
• Abstract summary: TED++ is a submanifold-aware framework that effectively detects subtle backdoors.<n>It captures how faithfully an admissible input remains on the evolving class submanifolds.<n>It achieves near-perfect detection, achieving gains of up to 14% in AUROC over the next-best method.
• Score: 62.75464575596457
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: As deep neural networks power increasingly critical applications, stealthy backdoor attacks, where poisoned training inputs trigger malicious model behaviour while appearing benign, pose a severe security risk. Many existing defences are vulnerable when attackers exploit subtle distance-based anomalies or when clean examples are scarce. To meet this challenge, we introduce TED++, a submanifold-aware framework that effectively detects subtle backdoors that evade existing defences. TED++ begins by constructing a tubular neighbourhood around each class's hidden-feature manifold, estimating its local ``thickness'' from a handful of clean activations. It then applies Locally Adaptive Ranking (LAR) to detect any activation that drifts outside the admissible tube. By aggregating these LAR-adjusted ranks across all layers, TED++ captures how faithfully an input remains on the evolving class submanifolds. Based on such characteristic ``tube-constrained'' behaviour, TED++ flags inputs whose LAR-based ranking sequences deviate significantly. Extensive experiments are conducted on benchmark datasets and tasks, demonstrating that TED++ achieves state-of-the-art detection performance under both adaptive-attack and limited-data scenarios. Remarkably, even with only five held-out examples per class, TED++ still delivers near-perfect detection, achieving gains of up to 14\% in AUROC over the next-best method. The code is publicly available at https://github.com/namle-w/TEDpp.

Related papers

• Secret Stealing Attacks on Local LLM Fine-Tuning through Supply-Chain Model Code Backdoors [9.503673758168693]
  Local fine-tuning datasets routinely contain sensitive secrets such as API keys, personal identifiers, and financial records.<n>We exploit a practical but overlooked supply-chain vector -- model code camouflaged as standard architectural definitions.<n>We introduce a deterministic full-chain mechanism: it locks onto token-level secrets in dynamic computation flows via online tensor-rule matching.
  arXiv  Detail & Related papers  (2026-04-30T05:03:08Z)
• The Trojan Knowledge: Bypassing Commercial LLM Guardrails via Harmless Prompt Weaving and Adaptive Tree Search [58.8834056209347]
  Large language models (LLMs) remain vulnerable to jailbreak attacks that bypass safety guardrails to elicit harmful outputs.<n>We introduce the Correlated Knowledge Attack Agent (CKA-Agent), a dynamic framework that reframes jailbreaking as an adaptive, tree-structured exploration of the target model's knowledge base.
  arXiv  Detail & Related papers  (2025-12-01T07:05:23Z)
• TED-LaST: Towards Robust Backdoor Defense Against Adaptive Attacks [9.664747681518465]
  Topological Evolution Dynamics (TED) has emerged as a powerful tool for detecting backdoor attacks in Deep Neural Networks (DNNs)<n>TED can be vulnerable to backdoor attacks that adaptively distort topological representation distributions across network layers.<n>We propose TED-LaST, a novel defense strategy that enhances TED's robustness against adaptive attacks.
  arXiv  Detail & Related papers  (2025-06-12T14:12:15Z)
• Robust Backdoor Detection for Deep Learning via Topological Evolution Dynamics [18.28911572993562]
  A backdoor attack in deep learning inserts a hidden backdoor in the model to trigger malicious behavior upon specific input patterns. We show that this assumption has a severe limitation by introducing a novel SSDT (Source-Specific and Dynamic-Triggers) backdoor. We propose TED (Topological Evolution Dynamics) as a model-agnostic basis for robust backdoor detection.
  arXiv  Detail & Related papers  (2023-12-05T11:29:12Z)
• Improved Activation Clipping for Universal Backdoor Mitigation and Test-Time Detection [27.62279831135902]
  Deep neural networks are vulnerable toTrojan attacks, where an attacker poisons the training set with backdoor triggers. Recent work shows that backdoor poisoning induces over-fitting (abnormally large activations) in the attacked model. We devise a new such approach, choosing the activation bounds to explicitly limit classification margins.
  arXiv  Detail & Related papers  (2023-08-08T22:47:39Z)
• Backdoor Attack with Sparse and Invisible Trigger [57.41876708712008]
  Deep neural networks (DNNs) are vulnerable to backdoor attacks. backdoor attack is an emerging yet threatening training-phase threat. We propose a sparse and invisible backdoor attack (SIBA)
  arXiv  Detail & Related papers  (2023-05-11T10:05:57Z)
• Backdoor Defense via Suppressing Model Shortcuts [91.30995749139012]
  In this paper, we explore the backdoor mechanism from the angle of the model structure. We demonstrate that the attack success rate (ASR) decreases significantly when reducing the outputs of some key skip connections.
  arXiv  Detail & Related papers  (2022-11-02T15:39:19Z)
• Invisible Backdoor Attacks Using Data Poisoning in the Frequency Domain [8.64369418938889]
  We propose a generalized backdoor attack method based on the frequency domain. It can implement backdoor implantation without mislabeling and accessing the training process. We evaluate our approach in the no-label and clean-label cases on three datasets.
  arXiv  Detail & Related papers  (2022-07-09T07:05:53Z)
• Hidden Backdoor Attack against Semantic Segmentation Models [60.0327238844584]
  The emphbackdoor attack intends to embed hidden backdoors in deep neural networks (DNNs) by poisoning training data. We propose a novel attack paradigm, the emphfine-grained attack, where we treat the target label from the object-level instead of the image-level. Experiments show that the proposed methods can successfully attack semantic segmentation models by poisoning only a small proportion of training data.
  arXiv  Detail & Related papers  (2021-03-06T05:50:29Z)
• Anomaly Detection-Based Unknown Face Presentation Attack Detection [74.4918294453537]
  Anomaly detection-based spoof attack detection is a recent development in face Presentation Attack Detection. In this paper, we present a deep-learning solution for anomaly detection-based spoof attack detection. The proposed approach benefits from the representation learning power of the CNNs and learns better features for fPAD task.
  arXiv  Detail & Related papers  (2020-07-11T21:20:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.