Mitigating Backdoors via Decoy Shortcuts and Knowledge Decoupling

# Mitigating Backdoors via Decoy Shortcuts and Knowledge Decoupling
Source: [https://arxiv.org/html/2608.00732](https://arxiv.org/html/2608.00732)
Rui Wang1,2Corresponding authorLihua Jing1,2&Jinwen Zhong1,2 1Institute of Information Engineering, Chinese Academy of Sciences 2School of Cyber Security, University of Chinese Academy of Sciences \{zhuzixuan, wangrui, jinglihua, zhongjinwen\}@iie\.ac\.cn

###### Abstract

Backdoor attacks pose a serious threat to deep neural networks, especially when training relies on third\-party data, allowing adversaries to inject malicious behaviors through data poisoning\. In this work, we reveal that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network\. Motivated by this insight, we propose*Trapping and Removing \(TR\)*, a simple yet effective training\-time defense that introduces a lightweight shortcut branch as a “honeypot” to trap backdoor knowledge\. After training, backdoors can be removed by discarding the shortcut, without requiring any additional data\. To further enhance backdoor isolation while maintaining benign performance, we design a knowledge decoupling strategy with entropy\-based weight assignment, encouraging poisoned samples to flow through the honeypot while guiding the main network to focus on benign learning\. In addition, we introduce an automatic shortcut generation strategy to improve generalization across model architectures\. Extensive experiments on four benchmark datasets and five model architectures demonstrate that our approach effectively mitigates a wide range of backdoor attacks while preserving performance on benign data\. Code:[github\.com/Zixuan\-Zhu/TR](https://github.com/Zixuan-Zhu/TR)\.

## 1Introduction

With large\-scale training data and powerful computational resources, deep neural networks \(DNNs\) have achieved remarkable performance and are widely deployed in real\-world applicationsHeet al\.\([2016a](https://arxiv.org/html/2608.00732#bib.bib66)\); Wanget al\.\([2020](https://arxiv.org/html/2608.00732#bib.bib62)\); Zhanget al\.\([2020](https://arxiv.org/html/2608.00732#bib.bib63)\)\. However, the high cost of collecting training data often drives developers to rely on third\-party datasets, inadvertently exposing models to backdoor threats\.

Backdoor attackers can manipulate models by poisoning a small subset of training data, embedding a specific*trigger*and assigning a corresponding*target label*\. During training, the model implicitly learns this malicious association, causing any input containing the trigger to be misclassified as the target label at inference time\. Deploying backdoored models can have severe consequences, especially in safety\-critical applications such as autonomous driving\. Prior work indicates that backdoors, once implanted, are difficult to erase or unlearnYuet al\.\([2025](https://arxiv.org/html/2608.00732#bib.bib94)\), making training\-time countermeasures particularly important\.

![Refer to caption](https://arxiv.org/html/2608.00732v1/x1.png)Figure 1:t\-SNE visualizations of poisoned samples in the feature space produced by ResNet\-18 models: pre\-trained on ImageNet \(left\) vs\. randomly initialized \(right\)\.PBEMuet al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib52)\)and Neural CleanseWanget al\.\([2019](https://arxiv.org/html/2608.00732#bib.bib46)\)show that backdoors tend to form shortcut connections in the model, directly associating trigger patterns with target labels\. These methods exploit this property to detect and erase backdoors after training\. Inspired by this, we are motivated to explore*whether a decoy shortcut can be explicitly introduced during training to trap backdoor knowledge as it forms*\. Several studiesTanget al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib84)\); Liuet al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib86)\)explore backdoor defense in NLP by confining backdoor knowledge within shallow layers or lightweight models, thereby preventing the main network from internalizing it\. These approaches are primarily designed for scenarios where attackers fine\-tune pre\-trained clean models with poisoned data\. In contrast, backdoor injection in image classification is typically performed during training from scratch\. To illustrate this difference, Figure[1](https://arxiv.org/html/2608.00732#S1.F1)compares feature distributions of poisoned samples crafted by BadNetsGuet al\.\([2017](https://arxiv.org/html/2608.00732#bib.bib7)\)on CIFAR\-10Alex \([2009](https://arxiv.org/html/2608.00732#bib.bib64)\), under both pre\-trained and randomly initialized models\. In the left subfigure \(pre\-trained\), poisoned samples cluster in a sparse and relatively isolated region, suggesting a degree of separation from benign ones\. In contrast, in the right subfigure \(from\-scratch\), poisoned and benign samples appear highly entangled, making separation more challenging and limiting the effectiveness of NLP\-oriented defenses in this setting\.

In our experiments, we find that backdoor knowledge can be readily captured by a simple parallel branch when training from scratch, as demonstrated in Section[4\.1](https://arxiv.org/html/2608.00732#S4.SS1)\. Building on this observation, we propose a novel defense mechanism,*Trapping and Removing \(TR\)*, that protects networks from backdoor attacks by trapping all backdoor knowledge within a dedicated “honeypot” branch\. This honeypot is introduced prior to training and implemented as a lightweight shortcut running parallel to the original backbone\. In early epochs, the shortcut can effectively capture backdoor knowledge, albeit along with a few benign knowledge\. To better focus its learning on backdoor knowledge and direct the original network to solely learn benign knowledge in subsequent training, we design a knowledge decoupling strategy equipped with an entropy\-based weight assignment module, which dynamically guides poisoned samples toward learning through the shortcut branch while benign samples are processed by the original network\. In this manner, the backdoor can be effectively removed by discarding the shortcut after training without resorting to any additional data, while maintaining high performance on benign data\. To facilitate practical deployment, we further introduce an adaptive shortcut generation strategy that automatically tailors the shortcut to the backbone network\.

The main contributions of this paper are as follows:

- •We reveal an inherent characteristic of backdoor attacks: backdoor knowledge tends to be learned through a simpler path during the early stages of training\.
- •Building on this insight, we propose*TR*, a training\-time defense based on decoy shortcuts and knowledge decoupling, which enables clean model training under backdoor attacks without any additional data and generalizes to both training\-from\-scratch and fine\-tuning attacks\.
- •We design an adaptive strategy to automatically generate shortcuts for backbone networks, enhancing generalization and facilitating practical deployment\.
- •We evaluate our method on multiple datasets and models against ten backdoor attacks, showing robust performance and outperforming ten state\-of\-the\-art defenses\.

## 2Related Work

### 2\.1Backdoor Attack and Defense

##### Backdoor Attack\.

Based on the attack strategy, poisoning\-based backdoor attacks can be broadly classified into non\-optimized and optimized attacks\.*Non\-optimized attacks*Lvet al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib96)\); Gaoet al\.\([2024](https://arxiv.org/html/2608.00732#bib.bib91)\)craft poisoned samples before training and distribute them to victims, often via third\-party datasets\. Early methodsGuet al\.\([2017](https://arxiv.org/html/2608.00732#bib.bib7)\); Chenet al\.\([2017](https://arxiv.org/html/2608.00732#bib.bib8)\)used simple, visible triggers, while later works such as WaNetNguyen and Tran \([2021](https://arxiv.org/html/2608.00732#bib.bib13)\)and DynamicNguyen and Tran \([2020](https://arxiv.org/html/2608.00732#bib.bib11)\)introduced imperceptible or sample\-specific triggers\. To evade manual inspection, clean\-label variantsBarniet al\.\([2019](https://arxiv.org/html/2608.00732#bib.bib9)\); Wuet al\.\([2025](https://arxiv.org/html/2608.00732#bib.bib97)\)embed triggers into benign samples under the target class\.*Optimized attacks*Liet al\.\([2021c](https://arxiv.org/html/2608.00732#bib.bib25)\); Chenget al\.\([2024](https://arxiv.org/html/2608.00732#bib.bib15)\)instead generate and refine poisoned samples during the victim model’s training process\. These methods often rely on additional losses or co\-trained trigger generators to enhance stealth\. IBALiet al\.\([2021c](https://arxiv.org/html/2608.00732#bib.bib25)\)explicitly encourages backdoor invisibility in feature space, while LOTUSChenget al\.\([2024](https://arxiv.org/html/2608.00732#bib.bib15)\)leverages partition\-specific training to control the backdoor behavior more precisely\. Optimized attacks require control over the model training process, which is beyond the scope of this paper\.

##### Backdoor Defense\.

Backdoor inhibitingZhuet al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib61)\); Yuet al\.\([2025](https://arxiv.org/html/2608.00732#bib.bib94)\)and erasingLiet al\.\([2021b](https://arxiv.org/html/2608.00732#bib.bib48)\); Liuet al\.\([2018](https://arxiv.org/html/2608.00732#bib.bib47)\)are two widely used defense strategies\.*Inhibiting\-based defenses*aim to suppress backdoor formation during training by modifying the training process\. For example, CBDZhanget al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib41)\)applies causal theory to prevent learning the backdoor path, DBDHuanget al\.\([2022](https://arxiv.org/html/2608.00732#bib.bib39)\)decouples the training process, and ASDGaoet al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib32)\)continuously divides the training data\.*Erasing\-based defenses*focus on purifying poisoned models after backdoor training and typically require benign samples\. FPLiuet al\.\([2018](https://arxiv.org/html/2608.00732#bib.bib47)\)prunes low\-activation neurons and fine\-tunes the model, while NADLiet al\.\([2021b](https://arxiv.org/html/2608.00732#bib.bib48)\)performs fine\-tuning followed by knowledge distillation\. The defense proposed in this paper falls into the inhibiting\-based category\.

### 2\.2Honeypot and Shortcut in Backdoor Defense

Several works adopt similar concepts of honeypots or shortcuts for backdoor defense, which differ from our approach\. SSFTYanget al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib85)\)erases backdoors by removing skip connections in ResNets and finetuning with 10% benign samples\. T&RWanget al\.\([2022](https://arxiv.org/html/2608.00732#bib.bib87)\)baits the backdoor into a classification head and replaces it with another head finetuned on benign samples\. DPoELiuet al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib86)\)andTanget al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib84)\)target NLP tasks, using shallow layers to absorb backdoor knowledge while preventing deeper layers from learning it\. DPoE further combines this with a Product\-of\-Experts framework to isolate clean behavior\. However, in NLP, backdoor injection is typically implemented by fine\-tuning pre\-trained clean models with poisoned data, where benign and backdoor knowledge are naturally decoupled, making defense more manageable\. In contrast, we address the more challenging training\-from\-scratch injection, where benign and backdoor knowledge are entangled\. Besides, we introduce a parallel shortcut branch as the honeypot, which is effective not only against training\-from\-scratch attacks but also against fine\-tuning attacks\.

### 2\.3Knowledge Decoupling

Feature decouplingWanget al\.\([2021](https://arxiv.org/html/2608.00732#bib.bib73)\); Yang and Yang \([2022](https://arxiv.org/html/2608.00732#bib.bib76)\)is a representative of knowledge decoupling, aiming to separate feature representations into independent components, minimize redundancy, and improve the model’s ability to learn more discriminative information\. For example, DeAOTYang and Yang \([2022](https://arxiv.org/html/2608.00732#bib.bib76)\)decouples object\-agnostic and object\-specific features for better propagating annotations in semi\-supervised video object segmentation\. FDTrackJinet al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib78)\)applies feature decoupling to balance the conflicting feature requirements for detection and re\-identification in multi\-object tracking\. The specific implementation and objectives of knowledge decoupling can vary depending on the task\. In this paper, we propose to decouple the benign and poisoned knowledge during backdoor training for defending\.

![Refer to caption](https://arxiv.org/html/2608.00732v1/x2.png)\(a\)BA and ASR of two branches under five attacks
![Refer to caption](https://arxiv.org/html/2608.00732v1/x3.png)\(b\)t\-SNE visualization of poisoned samples in the feature spaces of two branches \(epoch 1\)

Figure 2:Visualization of learning behaviors of original and shortcut branches under attacks\.

## 3Preliminaries

### 3\.1Poisoning\-based Backdoor Attacks

We consider poisoning\-based backdoor attacks in image classification\. Let𝒟=\{\(𝒙i,yi\)\}i=1N\\mathcal\{D\}=\\\{\(\\boldsymbol\{x\}\_\{i\},y\_\{i\}\)\\\}\_\{i=1\}^\{N\}be the training set withNNsamples, where each image𝒙i∈\{0,1,…,255\}C×H×W\\boldsymbol\{x\}\_\{i\}\\in\\\{0,1,\\dots,255\\\}^\{C\\times H\\times W\}and labelyi∈\{0,…,K−1\}y\_\{i\}\\in\\\{0,\\dots,K\\mkern\-5\.0mu\-\\mkern\-5\.0mu1\\\}\. Here,KKis the number of classes, andHH,WW,CCdenote image height, width, and channels\. In a backdoor attack, the attacker selects a subset of𝒟\\mathcal\{D\}and applies a modification functionG​\(⋅\)G\(\\cdot\)to generate poisoned samples:𝒟m=\{\(𝒙′,yt\)\|𝒙′=G​\(𝒙\),\(𝒙,y\)∈𝒟∖𝒟b\}\\mathcal\{D\}\_\{m\}=\\\{\(\\boldsymbol\{x\}^\{\\prime\},y\_\{t\}\)\|\\boldsymbol\{x\}^\{\\prime\}=G\(\\boldsymbol\{x\}\),\(\\boldsymbol\{x\},y\)\\in\\mathcal\{D\}\\setminus\\mathcal\{D\}\_\{b\}\\\}, where𝒟b\\mathcal\{D\}\_\{b\}contains the remaining benign samples andyty\_\{t\}is the target label\. The resulting poisoned dataset is𝒟p=𝒟m∪𝒟b\\mathcal\{D\}\_\{p\}=\\mathcal\{D\}\_\{m\}\\cup\\mathcal\{D\}\_\{b\}, which victim users use unknowingly to train their models\. At test time, the attacker triggers misclassification by applyingG​\(⋅\)G\(\\cdot\)\. The poisoning rate is defined asr=\|𝒟m\|\|𝒟\|r=\\frac\{\|\\mathcal\{D\}\_\{m\}\|\}\{\|\\mathcal\{D\}\|\}\.

### 3\.2Threat Model

##### Attacker’s Capability\.

We consider a common threat scenario involving third\-party datasets, where an attacker can arbitrarily modify the training data before releasing it to victim users, but has no access to information beyond the dataset itself, such as the model architecture or loss functions\. The attacker’s objective is to cause the trained model to predict a predefined target label for triggered inputs while maintaining correct predictions on benign inputs\.*We further consider adaptive attack scenarios in Appendix[C](https://arxiv.org/html/2608.00732#A3), where the attacker is aware of the existence of our defense*\.

##### Defender’s Capability\.

The defender is assumed to have full control over the training process, but no prior knowledge of the backdoor and no access to any additional samples\. Whether the training dataset is poisoned is also unknown to the defender\. The defense objective is to prevent the trained model from predicting triggered samples as the target label while preserving accuracy on benign data\.

## 4Method

### 4\.1Distinct Learning Behaviors of Dual Branches under Backdoor Attacks

In this subsection, we analyze the distinct learning behaviors of the original and shortcut branches under backdoor attacks and discuss their inherent mechanisms\.

##### Settings\.

We conduct experiments on CIFAR\-10 using a modified WRN\-16\-1Zagoruyko \([2016](https://arxiv.org/html/2608.00732#bib.bib81)\)architecture, augmented with a two\-layer shortcut that directly connects the input to the classifier\. During training, the final prediction is computed as the average of the outputs from both the shortcut and original branches \(i\.e\., equal weights of 0\.5\)\. Figure[2\(a\)](https://arxiv.org/html/2608.00732#S2.F2.sf1)reports the benign accuracy \(BA\) and attack success rate \(ASR\) of both branches under five different attacks during the early training epochs\. In addition, Figure[2\(b\)](https://arxiv.org/html/2608.00732#S2.F2.sf2)visualizes the feature distributions of BadNets\-poisoned samples produced by the two branches after a single epoch\. More detailed experimental settings can be found in*Appendix*[A\.3](https://arxiv.org/html/2608.00732#A1.SS3)\.

##### Results\.

As shown in Figure[2\(a\)](https://arxiv.org/html/2608.00732#S2.F2.sf1), the shortcut branch exhibits higher ASR but lower BA than the original branch during early training\. This disparity arises from intrinsic differences between benign and poisoned samples: benign samples contain complex, diverse feature patterns better captured by the deeper original branch, whereas poisoned samples share similar trigger patterns and require only a few neurons to associate with the target labelLiuet al\.\([2018](https://arxiv.org/html/2608.00732#bib.bib47)\)\. Our theoretical analysis \(*Appendix*[B](https://arxiv.org/html/2608.00732#A2)\) further confirms that this structural asymmetry induces a gradient focusing effect \(‖∇θh‖≫‖∇θo‖\|\|\\nabla\_\{\\theta\_\{h\}\}\|\|\\gg\|\|\\nabla\_\{\\theta\_\{o\}\}\|\|\) for poisoned samples\. This mechanism results in a pronounced simplicity bias, where the shortcut establishes a dominant gradient flow to preferentially capture backdoor knowledge\. Figure[2\(b\)](https://arxiv.org/html/2608.00732#S2.F2.sf2)further corroborates this: in the shortcut branch’s feature space, most poisoned samples form a tight cluster while clean samples are relatively scattered; conversely, in the original branch’s space, clean samples of the same class form coherent clusters, and poisoned samples are more dispersed—often near their ground\-truth classes\. These results suggest that backdoor knowledge tends to be learned by the simpler shortcut, while benign knowledge is primarily captured by the more complex original branch\.

![Refer to caption](https://arxiv.org/html/2608.00732v1/x4.png)Figure 3:Our defense pipeline comprises three steps\. First, we add a simple honeypot shortcut that runs parallel to the original backbone\. Next, we train the model on the poisoned dataset while decoupling the knowledge between the original backbone and the honeypot shortcut\. This enables the honeypot to capture backdoor knowledge while the original backbone retains only benign knowledge\. Finally, after training, we erase the backdoor by removing the honeypot shortcut from the model\.

### 4\.2Adaptive Shortcut Generation

As Figure[3](https://arxiv.org/html/2608.00732#S4.F3)illustrates, our defense method consists of three steps\. First, we add a simple honeypot shortcut that runs parallel to the original backbone before training\. The modified network is denoted as\{So,Sh,Sc\}\\\{S\_\{o\},S\_\{h\},S\_\{c\}\\\}, whereSoS\_\{o\}is the original backbone,ShS\_\{h\}is the honeypot shortcut, andScS\_\{c\}is the classifier\. Next, we train the modified network on the poisoned dataset, carefully decoupling the knowledge between the original branch\{So,Sc\}\\\{S\_\{o\},S\_\{c\}\\\}and the shortcut branch\{Sh,Sc\}\\\{S\_\{h\},S\_\{c\}\\\}, enabling the shortcut to stabilize with backdoor\-related information while allowing the original network to retain only benign knowledge\. Finally, the backdoor can be easily erased by simply removing the shortcut from the model, without affecting the original network’s benign performance\.

We construct the honeypot shortcut as a direct path from the input to the final classifier\. Specifically, each2×2\\timesdownsampling operation in the backbone is replaced with a3×33\\times 3convolution of stride 2, while matching the corresponding channel dimensions\. For instance, two convolution blocks suffice for WRN\-16\-1, which has two downsampling operations, while ResNet\-18 requires three\. More details on shortcut designs for CNNs and ViTs are provided in*Appendix*[A\.4](https://arxiv.org/html/2608.00732#A1.SS4)\.

To help the shortcut capture backdoor knowledge more quickly and effectively, we incorporate a spatial attention mechanism to highlight key regions\. Letf∈ℝh×w×cf\\in\\mathbb\{R\}^\{h\\times w\\times c\}be the feature map, wherehh,ww, andccdenote height, width, and channels\. FollowingWooet al\.\([2018](https://arxiv.org/html/2608.00732#bib.bib80)\), the attention mapM∈ℝh×wM\\in\\mathbb\{R\}^\{h\\times\\ w\}is computed by applying a convolution toffwith a single output channel\. We then employ the attention map to highlight informative regions of the feature maps:

f′=R​e​L​U​\(M\)⊗f,f^\{\\prime\}=ReLU\(M\)\\otimes f,\(1\)where⊗\\otimesindicates element\-wise multiplication andf′f^\{\\prime\}represents the output of the attention module\.

For poisoned samples, spatial attention can quickly focus on trigger patterns due to their similarity and strong correlation with the target label\. Consequently, each convolution block in the shortcut is structured as*Conv\-Attention\-BN\-ReLU*to enhance its ability to capture backdoor knowledge\.

### 4\.3Entropy\-based Weight Assignment

In the modified network, we define the final predictionP​\(𝒙\)P\(\\boldsymbol\{x\}\)as a weighted combination of the outputs from both two branches:

P​\(𝒙\)=wo⋅Po​\(𝒙\)\+wh⋅Ph​\(𝒙\),P\(\\boldsymbol\{x\}\)=w\_\{o\}\\cdot P\_\{o\}\(\\boldsymbol\{x\}\)\+w\_\{h\}\\cdot P\_\{h\}\(\\boldsymbol\{x\}\),\(2\)where

wo\+wh=1,\\displaystyle w\_\{o\}\+w\_\{h\}=1,Po​\(𝒙\)=s​o​f​t​m​a​x​\(Sc​\(So​\(𝒙\)\)\),\\displaystyle P\_\{o\}\(\\boldsymbol\{x\}\)=softmax\(S\_\{c\}\(S\_\{o\}\(\\boldsymbol\{x\}\)\)\),\(3\)Ph​\(𝒙\)=s​o​f​t​m​a​x​\(Sc​\(Sh​\(𝒙\)\)\)\.\\displaystyle P\_\{h\}\(\\boldsymbol\{x\}\)=softmax\(S\_\{c\}\(S\_\{h\}\(\\boldsymbol\{x\}\)\)\)\.
Here,wow\_\{o\}andwhw\_\{h\}represent the respective weights assigned to each branch’s prediction\. The classification loss is defined as follows:

Lc=𝔼\(𝒙,y\)∈𝒟p​\[ℒC​E​\(P​\(𝒙\),y\)\]\.L\_\{c\}=\\mathbb\{E\}\_\{\(\\boldsymbol\{x\},y\)\\in\\mathcal\{D\}\_\{p\}\}\[\\mathcal\{L\}\_\{CE\}\(P\(\\boldsymbol\{x\}\),y\)\]\.\(4\)whereℒC​E\\mathcal\{L\}\_\{CE\}denotes the cross\-entropy loss\.

Settingwow\_\{o\}andwhw\_\{h\}is challenging: ifwow\_\{o\}is too large, the original branch may inadvertently learn backdoor knowledge, while a smallerwow\_\{o\}may impede its learning of benign knowledge\. Additionally, as indicated in Figure[2\(a\)](https://arxiv.org/html/2608.00732#S2.F2.sf1), the shortcut initially captures some benign knowledge\. Improper weight settings may cause this portion of benign knowledge to remain permanently embedded in the shortcut, resulting in the original network losing the opportunity to learn it\.

To address this issue, we propose a dynamic weight assignment strategy based on prediction entropy\. This entropy can be calculated by:

E​\(𝒑\)=−∑k=0K−1𝒑k​log⁡𝒑k,E\(\\boldsymbol\{p\}\)=\-\\sum\_\{k=0\}^\{K\-1\}\\boldsymbol\{p\}\_\{k\}\\log\\boldsymbol\{p\}\_\{k\},\(5\)where𝒑\\boldsymbol\{p\}is the softmax prediction\. For each sample𝒙\\boldsymbol\{x\}, we first pass it through both branches to obtain predictionsPo​\(𝒙\)P\_\{o\}\(\\boldsymbol\{x\}\)andPh​\(𝒙\)P\_\{h\}\(\\boldsymbol\{x\}\), then assign their contributions to the final prediction as follows:

wo\\displaystyle w\_\{o\}=E​\(Po​\(𝒙\)\)E​\(Po​\(𝒙\)\)\+E​\(Ph​\(𝒙\)\),\\displaystyle=\\frac\{E\(P\_\{o\}\(\\boldsymbol\{x\}\)\)\}\{E\(P\_\{o\}\(\\boldsymbol\{x\}\)\)\+E\(P\_\{h\}\(\\boldsymbol\{x\}\)\)\},\(6\)wh\\displaystyle w\_\{h\}=E​\(Ph​\(𝒙\)\)E​\(Po​\(𝒙\)\)\+E​\(Ph​\(𝒙\)\)\.\\displaystyle=\\frac\{E\(P\_\{h\}\(\\boldsymbol\{x\}\)\)\}\{E\(P\_\{o\}\(\\boldsymbol\{x\}\)\)\+E\(P\_\{h\}\(\\boldsymbol\{x\}\)\)\}\.
During training, poisoned samples are initially learned by the shortcut branch, inevitably along with a few benign samples\. For these poisoned and benign samples, the entropyE​\(Ph​\(𝒙\)\)E\(P\_\{h\}\(\\boldsymbol\{x\}\)\)is low, and the weightwow\_\{o\}is high, which gives the original branch an opportunity to learn the benign sample among them\. Simultaneously, this weight assignment also enables the original branch to learn from the poisoned ones\. To enhance the backdoor knowledge captured by the shortcut branch and prevent it from leaking to the original branch, we design a knowledge decoupling strategy in Section[4\.4](https://arxiv.org/html/2608.00732#S4.SS4)\.

### 4\.4Knowledge Decoupling

Motivated by the distinct learning behaviors in Figure[2](https://arxiv.org/html/2608.00732#S2.F2), we decouple the shortcut and original branches by enforcing constraints in both feature space and final predictions\. Through this decoupling, we aim for the original branch to correctly predict only benign samples, while the malicious predictions for poisoned samples are provided by the shortcut branch\.

For each sample𝒙\\boldsymbol\{x\}, we obtain feature vectorsSo​\(𝒙\)S\_\{o\}\(\\boldsymbol\{x\}\)andSh​\(𝒙\)S\_\{h\}\(\\boldsymbol\{x\}\)from the original backbone and honeypot shortcut\. We then encourage feature\-level decoupling by maximizing their cosine distance:

Ld​p​f=𝔼\(𝒙,y\)∈𝒟p​⟨So​\(𝒙\),Sh​\(𝒙\)⟩L\_\{dpf\}=\\mathbb\{E\}\_\{\(\\boldsymbol\{x\},y\)\\in\\mathcal\{D\}\_\{p\}\}\\langle S\_\{o\}\(\\boldsymbol\{x\}\),S\_\{h\}\(\\boldsymbol\{x\}\)\\rangle\(7\)where⟨⋅,⋅⟩\\langle\\cdot,\\cdot\\rangledenotes cosine similarity\. However, feature decoupling alone is insufficient, as the classifierScS\_\{c\}may still adjust itself to accommodate backdoor requirements\. Therefore, we introduce an additional prediction\-level decoupling loss that jointly constrains the classifier and feature extractors:

Ld​p​p=−𝔼\(𝒙,y\)∈𝒟p​∥Po​\(𝒙\),Ph​\(𝒙\)∥2L\_\{dpp\}=\-\\mathbb\{E\}\_\{\(\\boldsymbol\{x\},y\)\\in\\mathcal\{D\}\_\{p\}\}\{\\lVert P\_\{o\}\(\\boldsymbol\{x\}\),P\_\{h\}\(\\boldsymbol\{x\}\)\\rVert\}\_\{2\}\(8\)The cooperation betweenLd​p​fL\_\{dpf\}andLd​p​pL\_\{dpp\}effectively enables the original and shortcut branches to produce different predictions for each sample\.

However, both losses only consider the decoupling state at the current epoch, and their constraints are satisfied as long as the two branches learn the same sample as different classes\. This implies that if the shortcut branch fails to make the malicious prediction for a poisoned sample, the original branch may classify it as the target class due to the classification constraint, resulting in the learning of backdoor knowledge\. This issue is more likely when trigger patterns are complex, making it difficult for the shortcut branch to capture stable backdoor knowledge in early epochs\. In such cases, the original branch may continuously compete with the shortcut for backdoor knowledge, even snatching it from the shortcut by leveraging its greater learning capacity\. To address this issue, we leverage previously learned knowledge to guide the current learning direction\. Specifically, we construct a feature prototype set for each branch to summarize their knowledge from the previous epoch, as storing full features for all samples is memory\-intensive\. The prototypes are defined as follows:

𝒄ok=1Nk​∑i=1NkSot−1​\(𝒙ik\),𝒄hk=1Nk​∑i=1NkSht−1​\(𝒙ik\),\\boldsymbol\{c\}\_\{o\}^\{k\}=\\frac\{1\}\{N\_\{k\}\}\\displaystyle\\sum\_\{i=1\}^\{N\_\{k\}\}S\_\{o\}^\{t\-1\}\(\\boldsymbol\{x\}\_\{i\}^\{k\}\),\\quad\\boldsymbol\{c\}\_\{h\}^\{k\}=\\frac\{1\}\{N\_\{k\}\}\\displaystyle\\sum\_\{i=1\}^\{N\_\{k\}\}S\_\{h\}^\{t\-1\}\(\\boldsymbol\{x\}\_\{i\}^\{k\}\),\(9\)where\{𝒙ik\}i=1Nk\\\{\\boldsymbol\{x\}\_\{i\}^\{k\}\\\}\_\{i=1\}^\{N\_\{k\}\}denotes samples with labelkk, andSot−1S\_\{o\}^\{t\-1\}andSht−1S\_\{h\}^\{t\-1\}are the original and shortcut branches from the previous epoch\. The prototype sets for the two branches are denoted as\{𝒄ok\}k=0K−1\\\{\\boldsymbol\{c\}\_\{o\}^\{k\}\\\}\_\{k=0\}^\{K\-1\}and\{𝒄hk\}k=0K−1\\\{\\boldsymbol\{c\}\_\{h\}^\{k\}\\\}\_\{k=0\}^\{K\-1\}\. We push the two branches to learn in different directions by adding a loss that maximizes the distance between their features and the corresponding prototypes of the other branch:

Lg=𝔼\(𝒙,y\)∈𝒟p​\[⟨So​\(𝒙\),𝒄hy⟩\+⟨Sh​\(𝒙\),𝒄oy⟩\]\.L\_\{g\}=\\mathbb\{E\}\_\{\(\\boldsymbol\{x\},y\)\\in\\mathcal\{D\}\_\{p\}\}\[\\langle S\_\{o\}\(\\boldsymbol\{x\}\),\\boldsymbol\{c\}\_\{h\}^\{y\}\\rangle\+\\langle S\_\{h\}\(\\boldsymbol\{x\}\),\\boldsymbol\{c\}\_\{o\}^\{y\}\\rangle\]\.\(10\)Additionally, we enhance the backdoor knowledge in the shortcut branch by encouraging it to learn along its previous direction, which can be interpreted as the backdoor direction:

Lh=−𝔼\(𝒙,y\)∈𝒟p​⟨Sh​\(𝒙\),𝒄hy⟩\.L\_\{h\}=\-\\mathbb\{E\}\_\{\(\\boldsymbol\{x\},y\)\\in\\mathcal\{D\}\_\{p\}\}\\langle S\_\{h\}\(\\boldsymbol\{x\}\),\\boldsymbol\{c\}\_\{h\}^\{y\}\\rangle\.\(11\)Intuitively,LhL\_\{h\}functions as an inertial constraint that encourages the shortcut branch to remain on its discovered backdoor learning trajectory, while its combination withLgL\_\{g\}imposes an exclusivity constraint that prevents the original branch from “stealing” backdoor knowledge, without hindering its capacity to learn benign representations\.

In summary, the training loss can be expressed as follows:

L=Lc\+Lg\+Lh\+Ld​p​f\+α⋅Ld​p​p,L=L\_\{c\}\+L\_\{g\}\+L\_\{h\}\+L\_\{dpf\}\+\\alpha\\cdot L\_\{dpp\},\(12\)whereα\\alphacontrols the strength of decoupling at the prediction level\. Specifically,LcL\_\{c\}is applied alone during the first epoch to warm up the network, allowing each branch to initially learn its respective knowledge\. In the subsequent decoupling, the backdoor knowledge will be channeled into the shortcut branch, while the benign knowledge will flow to the original branch\. This behavior is analyzed in Section[5\.3](https://arxiv.org/html/2608.00732#S5.SS3), and the dynamic ofwow\_\{o\}andwhw\_\{h\}are further examined in Section[5\.4](https://arxiv.org/html/2608.00732#S5.SS4.SSS0.Px1)\.

## 5Experiments

DatasetAttackNo DefenseFPNADABLDBDCBDASDV&BPIPDPDBESTITR \(Ours\)BAASRBAASRBAASRBAASRBAASRBAASRBAASRBAASRBAASRBAASRBAASRBAASRCIFAR\-10None91\.19\-86\.44\-87\.34\-70\.35\-70\.10\-84\.51\-85\.96\-84\.37\-85\.92\-82\.60\-82\.22\-90\.37\-BadNet90\.4699\.9387\.215\.6386\.571\.9386\.113\.0486\.941\.7687\.461\.0684\.581\.5188\.281\.8489\.130\.6481\.600\.2188\.920\.0089\.850\.00Blended90\.3098\.6386\.926\.9975\.975\.4885\.3416\.2386\.835\.1287\.481\.9686\.512\.0288\.152\.0887\.352\.6980\.900\.9587\.5464\.5489\.060\.01WaNet89\.7192\.2785\.872\.6286\.974\.2175\.7422\.2484\.605\.8686\.554\.2484\.852\.0384\.213\.3486\.394\.7381\.161\.8083\.5512\.0288\.901\.33Dynamic89\.7885\.0386\.5910\.4987\.072\.7085\.3418\.4685\.4210\.2185\.670\.8683\.644\.4981\.9247\.6389\.520\.6380\.401\.9289\.600\.2390\.011\.06DataFree90\.8299\.9686\.532\.0778\.383\.1680\.130\.9671\.1613\.4185\.752\.0085\.952\.8988\.171\.4185\.270\.2581\.370\.5390\.500\.0090\.270\.00DUBA89\.6695\.3180\.7726\.8986\.4643\.8565\.5599\.5669\.7812\.7387\.132\.2786\.042\.8884\.554\.1887\.385\.1980\.712\.1820\.010\.0188\.181\.58SIG90\.8570\.5086\.7213\.6280\.440\.6373\.190\.3369\.5213\.3886\.6026\.0386\.293\.0785\.533\.4687\.830\.7082\.120\.0790\.970\.1389\.420\.00CL85\.3495\.4483\.3319\.1784\.898\.8986\.181\.8669\.973\.6187\.461\.1784\.653\.9385\.372\.8485\.122\.3982\.511\.7688\.740\.2689\.330\.74Narcissus90\.7395\.5385\.4769\.0387\.3444\.2071\.9545\.6670\.0299\.7484\.9826\.4382\.4998\.5884\.6932\.4189\.556\.8182\.371\.2589\.150\.8589\.900\.53PCBA90\.1199\.5186\.2551\.5984\.8826\.4665\.7497\.7468\.1298\.6185\.5481\.8481\.7699\.9766\.930\.0080\.9210\.3882\.010\.9489\.731\.4489\.050\.41Average89\.7893\.2185\.5720\.8183\.9014\.1577\.5330\.6176\.2426\.4486\.4614\.7984\.6822\.1483\.789\.9286\.853\.4481\.521\.1681\.877\.9589\.400\.57GTSRBNone99\.33\-94\.94\-97\.01\-83\.90\-91\.16\-75\.45\-96\.12\-98\.05\-93\.88\-92\.91\-97\.87\-98\.90\-BadNet98\.64100\.0096\.870\.0396\.940\.0692\.580\.0386\.130\.0084\.652\.3296\.520\.1088\.720\.3596\.500\.0192\.770\.0296\.720\.0098\.570\.00Blended98\.6299\.8495\.0312\.8893\.461\.3089\.075\.5286\.2599\.9876\.0588\.1896\.210\.1275\.8448\.3894\.590\.8392\.610\.2995\.020\.0697\.880\.62WaNet96\.1893\.5396\.5218\.0896\.1767\.2094\.5038\.2984\.710\.0590\.5086\.1195\.9142\.2683\.167\.5095\.043\.4889\.420\.7793\.840\.8496\.590\.05DataFree97\.04100\.0096\.900\.0397\.370\.0395\.210\.0392\.710\.3876\.182\.5695\.050\.0998\.310\.1496\.420\.2292\.200\.1897\.220\.0098\.800\.00DUBA98\.8393\.9195\.4820\.8193\.268\.6194\.043\.8488\.090\.0590\.8692\.8595\.950\.0390\.779\.6596\.354\.3790\.623\.5780\.213\.7098\.580\.03SIG98\.94100\.0094\.5814\.1988\.780\.0286\.9099\.8886\.8469\.8289\.8424\.1796\.2645\.9391\.282\.8092\.395\.2793\.1659\.7597\.499\.0497\.170\.00Narcissus98\.5067\.4094\.6118\.5697\.675\.8387\.4632\.8392\.580\.4590\.8758\.3794\.6093\.7597\.6436\.7193\.743\.6192\.8213\.8097\.560\.0098\.990\.00Average98\.1193\.5395\.7112\.0894\.8111\.8691\.3925\.7788\.1924\.3985\.5650\.6595\.7926\.0489\.3915\.0895\.002\.5491\.9411\.2094\.011\.9598\.080\.10

Table 1:The performance of 11 defense methods against multiple backdoor attacks on two datasets\. The best results are highlighted inbold, and the second\-best results areunderlined\.*None*denotes the totoally clean datasets\.### 5\.1Experimental Settings

##### Datasets and Models\.

In the main paper, we evaluate our defense on CIFAR\-10 with WRN\-16\-1 and on GTSRBStallkampet al\.\([2011](https://arxiv.org/html/2608.00732#bib.bib65)\)with ResNet\-18 to demonstrate effectiveness across architectures\. To further evaluate generalization across datasets and architectures, we include additional experiments on CIFAR\-100Alex \([2009](https://arxiv.org/html/2608.00732#bib.bib64)\), ImageNet\-1kDenget al\.\([2009](https://arxiv.org/html/2608.00732#bib.bib67)\), as well as on PreActResNet\-18Heet al\.\([2016b](https://arxiv.org/html/2608.00732#bib.bib83)\), VGG\-16Simonyan and Zisserman \([2014](https://arxiv.org/html/2608.00732#bib.bib90)\), and ViTsDosovitskiyet al\.\([2020](https://arxiv.org/html/2608.00732#bib.bib88)\)in*Appendix*[D](https://arxiv.org/html/2608.00732#A4)\. Dataset details are provided in*Appendix*[A\.1](https://arxiv.org/html/2608.00732#A1.SS1)\.

##### Attack Configures\.

We consider ten state\-of\-the\-art backdoor attacks, including six dirty\-label methods: BadNets, BlendChenet al\.\([2017](https://arxiv.org/html/2608.00732#bib.bib8)\), WaNetNguyen and Tran \([2021](https://arxiv.org/html/2608.00732#bib.bib13)\), DynamicNguyen and Tran \([2020](https://arxiv.org/html/2608.00732#bib.bib11)\), DataFreeLvet al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib96)\), and DUBAGaoet al\.\([2024](https://arxiv.org/html/2608.00732#bib.bib91)\), and four clean\-label attacks: SIGBarniet al\.\([2019](https://arxiv.org/html/2608.00732#bib.bib9)\), CLTurneret al\.\([2019](https://arxiv.org/html/2608.00732#bib.bib10)\), NarcissusZenget al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib95)\), and PCBAWuet al\.\([2025](https://arxiv.org/html/2608.00732#bib.bib97)\)\. All attacks are implemented according to their released code to ensure strong performance\. Target labels are set to 0 for CIFAR\-10 and 1 for GTSRB, with a default poisoning rate of 10%\. Implementation details are provided in*Appendix*[A\.2](https://arxiv.org/html/2608.00732#A1.SS2)\.

##### Defense Configures and Training Details\.

We compare our method with ten state\-of\-the\-art defenses: FPLiuet al\.\([2018](https://arxiv.org/html/2608.00732#bib.bib47)\), NADLiet al\.\([2021b](https://arxiv.org/html/2608.00732#bib.bib48)\), ABLLiet al\.\([2021a](https://arxiv.org/html/2608.00732#bib.bib40)\), DBDHuanget al\.\([2022](https://arxiv.org/html/2608.00732#bib.bib39)\), CBDZhanget al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib41)\), ASDGaoet al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib32)\), V&BZhuet al\.\([2023](https://arxiv.org/html/2608.00732#bib.bib61)\), PIPDChenet al\.\([2024](https://arxiv.org/html/2608.00732#bib.bib93)\), PDBWeiet al\.\([2024](https://arxiv.org/html/2608.00732#bib.bib98)\), and ESTIYuet al\.\([2025](https://arxiv.org/html/2608.00732#bib.bib94)\)\. FP and NAD require 5% local benign samples, while ASD, PDB, and ESTI use 0\.2%, 10%, and 1% of the training data as seed samples, respectively\. Our model is trained for 200 epochs using SGD with an initial learning rate of 0\.1, decayed by a factor of 10 every 50 epochs\. The weighting factorα\\alphais set to 1 for CIFAR\-10 and linearly decreased from 2 to 1 over the first 50 epochs for GTSRB\.

##### Evaluation Metrics\.

We evaluate the defense performance using two metrics: Benign Accuracy \(BA\) on clean data and Attack Success Rate \(ASR\) on poisoned data\. The lower the ASR and the higher BA, the more effective the defense\.

### 5\.2Effectiveness and Efficiency

We compare TR with ten SOTA defenses in Table[1](https://arxiv.org/html/2608.00732#S5.T1)\.*No Defense*serves as the attack baseline\. Overall, TR achieves the best average BA and ASR on both datasets, even compared with defenses requiring benign samples\. It consistently reduces ASR to below or near 1% \(often 0%\) while maintaining high BA, especially on clean datasets\. TR also remains robust under different poisoning rates, as shown in*Appendix*[E\.1](https://arxiv.org/html/2608.00732#A5.SS1)\.

Defenses based on data partitioning, such as ABL, DBD, ASD, V&B, and ESTI, inevitably treat a portion of the training samples as poisoned, even when the dataset is clean, which leads to degraded BA\. Moreover, all other defenses can be ineffective under certain attack settings, resulting in higher ASR or reduced BA\. As for TR, when the data is clean, the shortcut branch captures only a few of easily learned benign information and does not interfere with the main branch in learning generalizable features from harder samples\. When the data is poisoned, the shortcut rapidly absorbs backdoor knowledge, thereby preventing the main network from learning it\. We further analyze class\-wise BA in*Appendix*[E\.2](https://arxiv.org/html/2608.00732#A5.SS2), showing that TR has minimal impact on benign performance\.

We report the training cost of TR in*Appendix*Table[5](https://arxiv.org/html/2608.00732#A1.T5), showing that TR is more efficient than others\. This efficiency stems from introducing only a shallow shortcut, without repeated data partitioning or iterative multi\-network training\.

Results on a broader range of dataset–architecture combinations, reported in*Appendix*Tables[6](https://arxiv.org/html/2608.00732#A2.T6),[7](https://arxiv.org/html/2608.00732#A2.T7),[8](https://arxiv.org/html/2608.00732#A4.T8),[9](https://arxiv.org/html/2608.00732#A4.T9), and[10](https://arxiv.org/html/2608.00732#A4.T10), further demonstrates the generalization capability of TR, including our adaptive shortcut generation strategy\. Notably, the Table[7](https://arxiv.org/html/2608.00732#A2.T7)and[10](https://arxiv.org/html/2608.00732#A4.T10)results also verify that our method remains effective against fine\-tuning attacks\.

![Refer to caption](https://arxiv.org/html/2608.00732v1/x5.png)Figure 4:The BA and ASR of both branches during the decoupling training process on CIFAR\-10 under the same settings in Table[1](https://arxiv.org/html/2608.00732#S5.T1)\.
### 5\.3Performance of the Two Branches

To better illustrate the decoupling process, Figure[4](https://arxiv.org/html/2608.00732#S5.F4)presents BA and ASR of the original and shortcut branches\. The original branch’s BA steadily increases, while that of the shortcut decreases, with both eventually stabilizing\. Although the shortcut retains a small amount of benign knowledge \(BA≈\\approx10%\), it does not impede the original branch due to entropy\-based weight assignment\. In early epochs, the shortcut’s ASR is markedly higher than the original’s, indicating it captures most backdoor knowledge\. As training progresses, the original branch’s ASR rapidly drops to 0%, while the shortcut remains at 100%, demonstrating that the shortcut effectively traps backdoor behavior and shields the original branch\.

ChoicesBadNetsBlendWaNetDynamicSIGMeanLd​p​fL\_\{dpf\}Ld​p​pL\_\{dpp\}LhL\_\{h\}LgL\_\{g\}BAASRBAASRBAASRBAASRBAASRASR90\.77%99\.91%90\.20%98\.46%88\.59%92\.92%89\.78%85\.86%90\.88%76\.80%90\.79%✓✓90\.93%99\.70%90\.36%97\.96%88\.65%93\.10%89\.55%82\.01%90\.41%70\.72%88\.70%✓✓✓90\.56%96\.84%90\.37%97\.72%88\.97%92\.04%89\.55%83\.24%90\.14%75\.82%89\.13%✓✓✓89\.74%0\.00%89\.10%0\.00%88\.49%82\.81%89\.15%65\.13%89\.65%73\.37%44\.26%✓✓90\.16%96\.98%89\.26%0\.00%88\.64%83\.59%89\.05%88\.34%89\.65%0\.00%36\.30%✓✓✓89\.53%99\.69%88\.38%0\.00%88\.15%83\.64%88\.97%66\.72%89\.60%0\.00%30\.07%✓✓✓89\.93%0\.00%88\.77%0\.00%88\.48%83\.84%89\.06%83\.67%89\.93%80\.94%49\.69%✓✓✓✓89\.83%0\.00%89\.06%0\.01%88\.90%1\.33%90\.01%1\.06%89\.42%0\.00%0\.48%

Table 2:Ablation study of the four losses on CIFAR\-10\. The deleted cases indicatedefense failures\. It is evident that combining all four losses is essential for achieving robust defense performance\.
### 5\.4Ablation Studies

##### Weight Assignment\.

To evaluate our entropy\-based weight assignment, we replace it with several fixed schemes in Table[3](https://arxiv.org/html/2608.00732#S5.T3)\. Assigning equal weights \(0\.5\) to both branches reduces ASR to 0%, but results in lower benign accuracy, as benign knowledge captured by the shortcut is not learned by the original branch\. To address this, we gradually increasewow\_\{o\}and decreasewhw\_\{h\}, which improves BA \(*e\.g*\.with 0\.8/0\.2 and 0\.9/0\.1\) but also raises ASR\. This highlights the difficulty of balancing BA and ASR using fixed weights\. Without the entropy\-based weight assignment, certain benign knowledge may be sacrificed and permanently retained in the shortcut branch to obtain a clean original network\. In the last column, we reverse the roles ofwow\_\{o\}andwhw\_\{h\}in Equation[6](https://arxiv.org/html/2608.00732#S4.E6), which also lowers BA\. As indicated in Figure[2\(a\)](https://arxiv.org/html/2608.00732#S2.F2.sf1), the shortcut inevitably captures some easy benign samples early on\. In the reversed setting, a consistently higherwhw\_\{h\}limits the original branch from learning these samples, resulting in BA degradation\.

Figure[5](https://arxiv.org/html/2608.00732#S5.F5)illustrates the weight dynamics in our defense\. For benign samples,wow\_\{o\}starts high and quickly reaches 1, as the shortcut initially learns little benign knowledge constrained by its limited capacity\. The decoupling loss then drives the shortcut toward confidently incorrect predictions, reflected in its low BA in Figure[4](https://arxiv.org/html/2608.00732#S5.F4)\.

For poisoned samples,whw\_\{h\}is initially low because the shortcut strongly learns the backdoor, confidently predicting poisoned samples as the target label, as reflected in its high initial ASR in Figure[4](https://arxiv.org/html/2608.00732#S5.F4)\. Given the lowwhw\_\{h\}, poisoned samples are learned primarily through the original branch\. However, the decoupling lossLd​p​pL\_\{dpp\}prevents the original branch from mimicking the shortcut’s malicious predictions, increasing the uncertainty and entropy of the original branch for poisoned samples, which further reduceswhw\_\{h\}\. Since the shortcut possesses strong backdoor knowledge and is reinforced byLhL\_\{h\}, it is easier to shift the predictions of the original branch for poisoned samples than those of the shortcut\. Consequently, the original branch increasingly predicts non\-target labels for poisoned samples with high confidence \(evidenced by its reduced ASR in Figure[4](https://arxiv.org/html/2608.00732#S5.F4)\), as detailed in the case study in*Appendix*[E\.6](https://arxiv.org/html/2608.00732#A5.SS6)\.

To better clarify these weight dynamics, we provide a detailed analysis in*Appendix*[E\.5](https://arxiv.org/html/2608.00732#A5.SS5), and visualize the decoupling process in*Appendix*[E\.7](https://arxiv.org/html/2608.00732#A5.SS7)\.

![Refer to caption](https://arxiv.org/html/2608.00732v1/x6.png)Figure 5:Visualization ofwow\_\{o\}for benign samples andwhw\_\{h\}for poisoned samples during decoupling training on CIFAR\-10\.
##### Loss Effect\.

In Table[5\.4](https://arxiv.org/html/2608.00732#S5.SS4), we examine the impact of each additional loss on the defense performance\. First, we train the network without any additional losses as the baseline in row 3, which fails to defend against all attacks\. Rows 4∼\\sim6 reveal that the defense is ineffective in most cases when eitherLd​p​fL\_\{dpf\}orLd​p​pL\_\{dpp\}is omitted, highlighting the necessity of decoupling both in feature space and prediction results\. Relaying solely on feature decoupling fails in all cases, as the classifier can adapt to satisfy the backdoor requirements\. Similarly, decoupling only predictions proves ineffective against complex attacks, such as WaNet and Dynamic \(noisy mode\)\. Without constraints in the feature space, the original branch eventually learns these complex patterns, even if the shortcut captures them initially, thereby undermining defense performance\.

Rows 7∼\\sim9 explore the role of learning direction guidance lossesLhL\_\{h\}andLgL\_\{g\}, where all cases against WaNet and Dynamic fail\. For these two complex attacks,LhL\_\{h\}allows the shortcut sufficient epochs to capture stable backdoor knowledge, whileLgL\_\{g\}helps prevent the original branch from learning leaked backdoor knowledge during this period by preventing it from learning along the poisoned direction\. WithoutLgL\_\{g\}, although the shortcut initially learns backdoor knowledge well against BadNets, the original branch may still become contaminated by several leaked poisoned samples\. For the clean\-label attack SIG, backdoor knowledge is more delicate due to competition between the trigger and the target\-class ground\-truth pattern\. Here, strengthening the shortcut’s captured knowledge is critical, as applyingLgL\_\{g\}alone will disrupt the backdoor knowledge in the shortcut, causing too many poisoned samples to leak to the original branch\. Ultimately, all four losses are required for a robust defense\. The selection of loss weightα\\alphais provided in*Appendix*[E\.3](https://arxiv.org/html/2608.00732#A5.SS3)\.

wo/whw\_\{o\}/w\_\{h\}0\.5/0\.50\.6/0\.40\.7/0\.30\.8/0\.20\.9/0\.1wh/wow\_\{h\}/w\_\{o\}BA82\.22%81\.90%82\.04%85\.09%88\.71%88\.78%ASR0\.00%0\.00%0\.00%47\.70%92\.28%0\.00%

Table 3:Performance under different weight assignments on the BadNets attack\. The case ‘0\.9/0\.1’ indicateswo=0\.9w\_\{o\}=0\.9andwh=0\.1w\_\{h\}=0\.1\. The last case indicates switching the assignment forwow\_\{o\}andwhw\_\{h\}\.

## 6Conclusions

We reveal that backdoor knowledge can be naturally captured by a parallel shortcut branch and propose TR, a simple and effective defense\. By introducing a honeypot shortcut and a decoupling mechanism, TR isolates backdoor knowledge from benign ones, enabling backdoor removal via post\-training shortcut pruning without requiring additional data\. We further incorporate an adaptive shortcut generation strategy to enhance generalization\. Extensive experiments demonstrate the effectiveness and robustness of our TR\. Future work will extend TR to counter optimized attacks with higher semantic complexity that may challenge the shortcut\-based capture\.

## References

- K\. Alex \(2009\)Learning multiple layers of features from tiny images\.\.Cited by:[§1](https://arxiv.org/html/2608.00732#S1.p3.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px1.p1.1)\.
- M\. Barni, K\. Kallas, and B\. Tondi \(2019\)A New Backdoor Attack in CNNS by Training Set Corruption Without Label Poisoning\.In2019 IEEE International Conference on Image Processing,pp\. 101–105\.Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px2.p1.1)\.
- X\. Chen, C\. Liu, B\. Li, K\. Lu, and D\. Song \(2017\)Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning\.arXiv preprint arXiv:1712\.05526\.Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px2.p1.1)\.
- Y\. Chen, H\. Wu, and J\. Zhou \(2024\)Progressive poisoned data isolation for training\-time backdoor defense\.InThirty\-Eighth AAAI Conference on Artificial Intelligence \(AAAI 2024\), Vancouver, Canada,M\. J\. Wooldridge, J\. G\. Dy, and S\. Natarajan \(Eds\.\),pp\. 11425–11433\.Cited by:[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px3.p1.1)\.
- S\. Cheng, G\. Tao, Y\. Liu, G\. Shen, S\. An, S\. Feng, X\. Xu, K\. Zhang, S\. Ma, and X\. Zhang \(2024\)Lotus: evasive and resilient backdoor attacks through sub\-partitioning\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 24798–24809\.Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px1.p1.1)\.
- J\. Deng, W\. Dong, R\. Socher, L\. Li, K\. Li, and L\. Fei\-Fei \(2009\)ImageNet: A Large\-Scale Hierarchical Image Database\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 248–255\.Cited by:[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px1.p1.1)\.
- A\. Dosovitskiy, L\. Beyer, A\. Kolesnikov, D\. Weissenborn, X\. Zhai, T\. Unterthiner, M\. Dehghani, M\. Minderer, G\. Heigold, S\. Gelly,et al\.\(2020\)An image is worth 16x16 words: transformers for image recognition at scale\.arXiv preprint arXiv:2010\.11929\.Cited by:[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px1.p1.1)\.
- K\. Gao, Y\. Bai, J\. Gu, Y\. Yang, and S\. Xia \(2023\)Backdoor defense via adaptively splitting poisoned dataset\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 4005–4014\.Cited by:[Appendix C](https://arxiv.org/html/2608.00732#A3.SS0.SSS0.Px1.p1.1),[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px3.p1.1)\.
- Y\. Gao, H\. Chen, P\. Sun, J\. Li, A\. Zhang, Z\. Wang, and W\. Liu \(2024\)A dual stealthy backdoor: from both spatial and frequency perspectives\.InThirty\-Eighth AAAI Conference on Artificial Intelligence, AAAI 2024, Vancouver, Canada,pp\. 1851–1859\.Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px2.p1.1)\.
- T\. Gu, B\. Dolan\-Gavitt, and S\. Garg \(2017\)Badnets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain\.arXiv preprint arXiv:1708\.06733\.Cited by:[§1](https://arxiv.org/html/2608.00732#S1.p3.1),[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px1.p1.1)\.
- K\. He, X\. Zhang, S\. Ren, and J\. Sun \(2016a\)Deep Residual Learning for Image Recognition\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 770–778\.Cited by:[§1](https://arxiv.org/html/2608.00732#S1.p1.1)\.
- K\. He, X\. Zhang, S\. Ren, and J\. Sun \(2016b\)Identity mappings in deep residual networks\.InComputer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part IV 14,pp\. 630–645\.Cited by:[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px1.p1.1)\.
- K\. Huang, Y\. Li, B\. Wu, Z\. Qin, and K\. Ren \(2022\)Backdoor Defense via Decoupling the Training Process\.InThe Tenth International Conference on Learning Representations,Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px3.p1.1)\.
- Y\. Jin, F\. Gao, J\. Yu, J\. Wang, and F\. Shuang \(2023\)Multi\-object tracking: decoupling features to solve the contradictory dilemma of feature requirements\.IEEE Transactions on Circuits and Systems for Video Technology33\(9\),pp\. 5117–5132\.Cited by:[§2\.3](https://arxiv.org/html/2608.00732#S2.SS3.p1.1)\.
- Y\. Li, X\. Lyu, N\. Koren, L\. Lyu, B\. Li, and X\. Ma \(2021a\)Anti\-Backdoor Learning: Training Clean Models on Poisoned Data\.Advances in Neural Information Processing Systems34,pp\. 14900–14912\.Cited by:[§B\.1\.1](https://arxiv.org/html/2608.00732#A2.SS1.SSS1.p1.2),[§C\.1](https://arxiv.org/html/2608.00732#A3.SS1.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px3.p1.1)\.
- Y\. Li, X\. Lyu, N\. Koren, L\. Lyu, B\. Li, and X\. Ma \(2021b\)Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks\.InInternational Conference on Learning Representations,Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px3.p1.1)\.
- Y\. Li, Y\. Li, B\. Wu, L\. Li, R\. He, and S\. Lyu \(2021c\)Invisible Backdoor Attack With Sample\-Specific Triggers\.InProceedings of the IEEE/CVF International Conference on Computer Vision,pp\. 16463–16472\.Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px1.p1.1)\.
- K\. Liu, B\. Dolan\-Gavitt, and S\. Garg \(2018\)Fine\-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks\.InInternational Symposium on Research in Attacks, Intrusions, and Defenses,pp\. 273–294\.Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.00732#S4.SS1.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px3.p1.1)\.
- Q\. Liu, F\. Wang, C\. Xiao, and M\. Chen \(2023\)From shortcuts to triggers: backdoor defense with denoised poe\.arXiv preprint arXiv:2305\.14910\.Cited by:[§1](https://arxiv.org/html/2608.00732#S1.p3.1),[§2\.2](https://arxiv.org/html/2608.00732#S2.SS2.p1.1)\.
- P\. Lv, C\. Yue, R\. Liang, Y\. Yang, S\. Zhang, H\. Ma, and K\. Chen \(2023\)A data\-free backdoor injection approach in neural networks\.In32nd USENIX Security Symposium \(USENIX Security 23\),pp\. 2671–2688\.Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px2.p1.1)\.
- A\. Mkadry, A\. Makelov, L\. Schmidt, D\. Tsipras, and A\. Vladu \(2017\)Towards deep learning models resistant to adversarial attacks\.stat1050\(9\)\.Cited by:[§C\.1](https://arxiv.org/html/2608.00732#A3.SS1.p3.5)\.
- B\. Mu, Z\. Niu, L\. Wang, X\. Wang, Q\. Miao, R\. Jin, and G\. Hua \(2023\)Progressive backdoor erasing via connecting backdoor and adversarial attacks\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 20495–20503\.Cited by:[§1](https://arxiv.org/html/2608.00732#S1.p3.1)\.
- A\. Nguyen and A\. Tran \(2021\)WaNet–Imperceptible Warping\-based Backdoor Attack\.arXiv preprint arXiv:2102\.10369\.Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px2.p1.1)\.
- T\. A\. Nguyen and A\. Tran \(2020\)Input\-Aware Dynamic Backdoor Attack\.Advances in Neural Information Processing Systems33,pp\. 3454–3464\.Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px2.p1.1)\.
- H\. Shah, K\. Tamuly, A\. Raghunathan, P\. Jain, and P\. Netrapalli \(2020\)The pitfalls of simplicity bias in neural networks\.Advances in Neural Information Processing Systems33,pp\. 9573–9585\.Cited by:[§B\.1\.3](https://arxiv.org/html/2608.00732#A2.SS1.SSS3.p1.2)\.
- K\. Simonyan and A\. Zisserman \(2014\)Very deep convolutional networks for large\-scale image recognition\.arXiv preprint arXiv:1409\.1556\.Cited by:[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px1.p1.1)\.
- J\. Stallkamp, M\. Schlipsing, J\. Salmen, and C\. Igel \(2011\)The german traffic sign recognition benchmark: a multi\-class classification competition\.InThe 2011 international joint conference on neural networks,pp\. 1453–1460\.Cited by:[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px1.p1.1)\.
- A\. Subramanya, S\. A\. Koohpayegani, A\. Saha, A\. Tejankar, and H\. Pirsiavash \(2024\)A closer look at robustness of vision transformers to backdoor attacks\.InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision,pp\. 3874–3883\.Cited by:[Table 7](https://arxiv.org/html/2608.00732#A2.T7),[Table 7](https://arxiv.org/html/2608.00732#A2.T7.4.2),[§D\.3](https://arxiv.org/html/2608.00732#A4.SS3.p1.1)\.
- R\. R\. Tang, J\. Yuan, Y\. Li, Z\. Liu, R\. Chen, and X\. Hu \(2023\)Setting the trap: capturing and defeating backdoors in pretrained language models through honeypots\.Advances in Neural Information Processing Systems36,pp\. 73191–73210\.Cited by:[§D\.4](https://arxiv.org/html/2608.00732#A4.SS4.p1.1),[§D\.4](https://arxiv.org/html/2608.00732#A4.SS4.p2.1),[Table 10](https://arxiv.org/html/2608.00732#A4.T10.4.1.4.1),[§1](https://arxiv.org/html/2608.00732#S1.p3.1),[§2\.2](https://arxiv.org/html/2608.00732#S2.SS2.p1.1)\.
- A\. Turner, D\. Tsipras, and A\. Madry \(2019\)Label\-Consistent Backdoor Attacks\.arXiv preprint arXiv:1912\.02771\.Cited by:[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px2.p1.1)\.
- B\. Wang, Y\. Yao, S\. Shan, H\. Li, B\. Viswanath, H\. Zheng, and B\. Y\. Zhao \(2019\)Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks\.In2019 IEEE Symposium on Security and Privacy,pp\. 707–723\.Cited by:[§1](https://arxiv.org/html/2608.00732#S1.p3.1)\.
- H\. Wang, J\. Hong, A\. Zhang, J\. Zhou, and Z\. Wang \(2022\)Trap and replace: defending backdoor attacks by trapping them into an easy\-to\-replace subnetwork\.Advances in neural information processing systems35,pp\. 36026–36039\.Cited by:[§2\.2](https://arxiv.org/html/2608.00732#S2.SS2.p1.1)\.
- Y\. Wang, J\. Zhang, S\. Guo, H\. Yin, C\. Li, and H\. Chen \(2021\)Decoupling representation learning and classification for gnn\-based anomaly detection\.InProceedings of the 44th international ACM SIGIR conference on research and development in information retrieval,pp\. 1239–1248\.Cited by:[§2\.3](https://arxiv.org/html/2608.00732#S2.SS3.p1.1)\.
- Y\. Wang, A\. Fathi, A\. Kundu, D\. A\. Ross, C\. Pantofaru, T\. Funkhouser, and J\. Solomon \(2020\)Pillar\-Based Object Detection for Autonomous Driving\.InEuropean Conference on Computer Vision,pp\. 18–34\.Cited by:[§1](https://arxiv.org/html/2608.00732#S1.p1.1)\.
- S\. Wei, H\. Zha, and B\. Wu \(2024\)Mitigating backdoor attack by injecting proactive defensive backdoor\.Advances in Neural Information Processing Systems37,pp\. 80674–80705\.Cited by:[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px3.p1.1)\.
- S\. Woo, J\. Park, J\. Lee, and I\. S\. Kweon \(2018\)Cbam: convolutional block attention module\.InProceedings of the European conference on computer vision \(ECCV\),pp\. 3–19\.Cited by:[§4\.2](https://arxiv.org/html/2608.00732#S4.SS2.p3.6)\.
- Z\. Wu, Y\. Lu, J\. Wen, H\. Sun, Q\. Zhou, and G\. Lu \(2025\)A set of generalized components to achieve effective poison\-only clean\-label backdoor attacks with collaborative sample selection and triggers\.InAdvances in Neural Information Processing Systems,Cited by:[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px2.p1.1)\.
- S\. Yang, Y\. Li, Y\. Jiang, and S\. Xia \(2023\)Backdoor defense via suppressing model shortcuts\.InICASSP 2023\-2023 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\),pp\. 1–5\.Cited by:[§2\.2](https://arxiv.org/html/2608.00732#S2.SS2.p1.1)\.
- Z\. Yang and Y\. Yang \(2022\)Decoupling features in hierarchical propagation for video object segmentation\.Advances in Neural Information Processing Systems35,pp\. 36324–36336\.Cited by:[§2\.3](https://arxiv.org/html/2608.00732#S2.SS3.p1.1)\.
- H\. Yu, L\. Qi, W\. Lin, J\. Chen, H\. Sun, and C\. Sun \(2025\)Backdoor defense via enhanced splitting and trap isolation\.InProceedings of the IEEE/CVF International Conference on Computer Vision,pp\. 1708–1717\.Cited by:[§1](https://arxiv.org/html/2608.00732#S1.p2.1),[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px3.p1.1)\.
- S\. Zagoruyko \(2016\)Wide residual networks\.arXiv preprint arXiv:1605\.07146\.Cited by:[§4\.1](https://arxiv.org/html/2608.00732#S4.SS1.SSS0.Px1.p1.1)\.
- Y\. Zeng, M\. Pan, H\. A\. Just, L\. Lyu, M\. Qiu, and R\. Jia \(2023\)Narcissus: a practical clean\-label backdoor attack with limited information\.InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security,pp\. 771–785\.Cited by:[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px2.p1.1)\.
- Y\. Zhang, S\. Xu, B\. Wu, J\. Shi, W\. Meng, and X\. Zhang \(2020\)Unsupervised Multi\-View Constrained Convolutional Network for Accurate Depth Estimation\.IEEE Transactions on Image Processing29,pp\. 7019–7031\.Cited by:[§1](https://arxiv.org/html/2608.00732#S1.p1.1)\.
- Z\. Zhang, Q\. Liu, Z\. Wang, Z\. Lu, and Q\. Hu \(2023\)Backdoor defense via deconfounded representation learning\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 12228–12238\.Cited by:[Appendix C](https://arxiv.org/html/2608.00732#A3.SS0.SSS0.Px1.p1.1),[§C\.1](https://arxiv.org/html/2608.00732#A3.SS1.p2.1),[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px3.p1.1)\.
- Z\. Zhu, R\. Wang, C\. Zou, and L\. Jing \(2023\)The victim and the beneficiary: exploiting a poisoned model to train a clean model on poisoned data\.InProceedings of the IEEE/CVF International Conference on Computer Vision,pp\. 155–164\.Cited by:[§B\.1\.1](https://arxiv.org/html/2608.00732#A2.SS1.SSS1.p1.2),[§2\.1](https://arxiv.org/html/2608.00732#S2.SS1.SSS0.Px2.p1.1),[§5\.1](https://arxiv.org/html/2608.00732#S5.SS1.SSS0.Px3.p1.1)\.

## Appendix ADetailed Settings

All experiments were conducted on a workstation equipped with an RTX 3090 GPU \(24GB\) and 64GB of RAM\.

### A\.1Details about Datasets

The detailed dataset information is summarized in Table[4](https://arxiv.org/html/2608.00732#A1.T4)\.

DatasetClassesInput SizeTraining ImagesTest ImagesCIFAR\-101032 x 32 x 35000010000GTSRB4332 x 32 x 33920912630CIFAR\-10010032 x 32 x 35000010000ImageNet\-1k1000224 x 224 x 3128116750000

Table 4:Detailed information of the datasets used in our experiments\.
### A\.2Details about Attacks

We trained all attack baselines for 200 epochs using the SGD optimizer with an initial learning rate of 0\.1, a weight decay of1×10−41\\times 10^\{\-4\}, and a momentum of 0\.9\. The learning rate is reduced by a factor of 10 every 50 epochs\. We use a batch size of 128 for CIFAR\-10, GTSRB, and CIFAR\-100, and a batch size of 64 for ImageNet\-1k\. The poisoned samples are randomly selected\.

### A\.3Settings for Learning Behaviors Analysis

The introduced shortcut consists of two*Conv\-Attention\-BN\-ReLU*blocks, as described in Section[4\.2](https://arxiv.org/html/2608.00732#S4.SS2)\. The final output of the modified WRN\-16\-1 network is computed as:

P​\(𝒙\)=0\.5⋅Po​\(𝒙\)\+0\.5⋅Ph​\(𝒙\),P\(\\boldsymbol\{x\}\)=0\.5\\cdot P\_\{o\}\(\\boldsymbol\{x\}\)\+0\.5\\cdot P\_\{h\}\(\\boldsymbol\{x\}\),\(13\)We train the modified network for 5 epochs using stochastic gradient descent \(SGD\) with a momentum of 0\.9, weight decay of 0\.0005, and an initial learning rate of 0\.1\. The batch size is set to 128\.

In Figure[2\(b\)](https://arxiv.org/html/2608.00732#S2.F2.sf2), we visualize 2,500 randomly selected training samples using t\-SNE\.

NormalDBDCDBASDV&BPDBESTITR\(Ours\)105213691215988587750336053091332

Table 5:Time \(seconds\) of four defenses versus normal training, evaluated on CIFAR\-10 with WRN\-16\-1\.
### A\.4Adaptive Shortcut Designing

For CNNs, the shortcut branch is composed of repeated*Conv\-Attention\-BN\-ReLU*blocks\. Each block begins with a3×33\\times 3convolution with stride 2 to perform2×2\\timesdownsampling\. The attention layer is implemented as a 1\-channel convolution that maintains the spatial dimensions of the input and produces an attention mapMM\. This map is applied element\-wise to the convolution outputff, as described in Equation[1](https://arxiv.org/html/2608.00732#S4.E1)\. The number of such blocks is determined by the number of downsampling stages in the original network\. For example, the WRN\-16\-1 backbone performs two 2× downsamplings, so we construct the shortcut branch using two*Conv\-Attention\-BN\-ReLU*blocks to align its spatial resolution with that of the backbone\. To facilitate effective decoupling, we also match the output channel dimensions between the shortcut and backbone branches\.

For ViTs, we construct the shortcut branch as a lightweight transformer network consisting of half the number of blocks as in the original architecture\. The performance is not highly sensitive to this choice—other ratios such as 1/4 or 3/4 also achieve competitive results, as shown in Table[13](https://arxiv.org/html/2608.00732#A5.T13)\.

## Appendix BGradient\-Based Analysis and Verification of Learning Behaviors

### B\.1Theoretical Analysis

To understand why poisoned samples are preferentially captured by the honeypot shortcut, we analyze the learning dynamics through the lens of gradient flow\. Let𝒙\\boldsymbol\{x\}be an input sample with labelyy\. We denote the original \(deep\) backbone and the shortcut \(shallow\) branch asSo​\(⋅;θo\)S\_\{o\}\(\\cdot;\\theta\_\{o\}\)andSh​\(⋅;θh\)S\_\{h\}\(\\cdot;\\theta\_\{h\}\), producing feature vectors𝒇o∈ℝd\\boldsymbol\{f\}\_\{o\}\\in\\mathbb\{R\}^\{d\}and𝒇h∈ℝd\\boldsymbol\{f\}\_\{h\}\\in\\mathbb\{R\}^\{d\}, respectively\. A shared classifierSc​\(⋅;ϕ\)S\_\{c\}\(\\cdot;\\phi\), parameterized by weightsWWand biasbb, computes the logits:

𝒛o=W​𝒇o\+b,𝒛h=W​𝒇h\+b\.\\boldsymbol\{z\}\_\{o\}=W\\boldsymbol\{f\}\_\{o\}\+b,\\quad\\boldsymbol\{z\}\_\{h\}=W\\boldsymbol\{f\}\_\{h\}\+b\.\(14\)
The final prediction is the weighted average of the softmax outputs from both branches:

P​\(𝒙\)=wo⋅softmax​\(𝒛o\)\+wh⋅softmax​\(𝒛h\),P\(\\boldsymbol\{x\}\)=w\_\{o\}\\cdot\\mathrm\{softmax\}\(\\boldsymbol\{z\}\_\{o\}\)\+w\_\{h\}\\cdot\\mathrm\{softmax\}\(\\boldsymbol\{z\}\_\{h\}\),\(15\)wherewo\+wh=1w\_\{o\}\+w\_\{h\}=1\(initialized as0\.50\.5\)\. We minimize the standard cross\-entropy lossL=−log⁡Py​\(𝒙\)L=\-\\log P\_\{y\}\(\\boldsymbol\{x\}\)\. Applying the chain rule, the parameter updates for each branch are governed by:

∇θoL=wo⋅∇𝒛oL⋅W⋅∂𝒇o∂θo,∇θhL=wh⋅∇𝒛hL⋅W⋅∂𝒇h∂θh\.\\nabla\_\{\\theta\_\{o\}\}L=w\_\{o\}\\cdot\\nabla\_\{\\boldsymbol\{z\}\_\{o\}\}L\\cdot W\\cdot\\frac\{\\partial\\boldsymbol\{f\}\_\{o\}\}\{\\partial\\theta\_\{o\}\},\\nabla\_\{\\theta\_\{h\}\}L=w\_\{h\}\\cdot\\nabla\_\{\\boldsymbol\{z\}\_\{h\}\}L\\cdot W\\cdot\\frac\{\\partial\\boldsymbol\{f\}\_\{h\}\}\{\\partial\\theta\_\{h\}\}\.\(16\)
The shortcut’s learning preference is driven by a cascade of three factors: the consistency of optimization signals provides the basis, structural simplicity \(Simplicity Bias\) enables rapid capture, and attention\-induced gradient focusing significantly amplifies this dominance\.

![Refer to caption](https://arxiv.org/html/2608.00732v1/x7.png)Figure 6:Consistent gradient dominance dynamics during early training stages\.We track the evolution of thelogit gradient norm ratio\(‖∇𝒛hL‖/‖∇𝒛oL‖\\\|\\nabla\_\{\\boldsymbol\{z\}\_\{h\}\}L\\\|/\\\|\\nabla\_\{\\boldsymbol\{z\}\_\{o\}\}L\\\|\) from Initialization \(Init\) to Epoch 6 across 8 attacks\.Divergence:Despite starting from a balanced state \(Init≈1\.0\\approx 1\.0\), the shortcut branch rapidly establishes a dominant gradient flow for poisoned samples \(Red line\), while the ratio for clean samples \(Blue line\) remains constant at≈1\.0\\approx 1\.0\. This confirms the specific structural sensitivity of the shortcut to trigger patterns\.Magnitude:Note that for clean\-label attacks like SIG, PCBA, and CL \(bottom row\), the y\-axis is presented inlog scaleto visualize the exponential surge in gradient magnitude \(reaching\>103\>10^\{3\}\)\. This massive disparity indicates a “winner\-take\-all” mechanism where the optimization signal is almost exclusively channeled through the shortcut branch\.#### B\.1\.1Consistent Optimization Signal via Trigger Patterns

Prior workLiet al\.\[[2021a](https://arxiv.org/html/2608.00732#bib.bib40)\]; Zhuet al\.\[[2023](https://arxiv.org/html/2608.00732#bib.bib61)\]suggests that poisoned samples converge faster due to the high consistency of trigger patterns\. In our dual\-branch architecture, this consistency creates a stable optimization signal that propagates to both branches\. Since the classifier head is randomly initialized and shared with balanced weights \(0\.5\), the error gradients with respect to the logits,∇𝒛oL\\nabla\_\{\\boldsymbol\{z\}\_\{o\}\}Land∇𝒛hL\\nabla\_\{\\boldsymbol\{z\}\_\{h\}\}L, are highly synchronized and comparable in magnitude \(as empirically verified in Sec\.[B\.2](https://arxiv.org/html/2608.00732#A2.SS2)\)\. However, for poisoned samples, the invariant trigger pattern causes these gradients toaccumulate constructivelyacross the training batch, which can be approximated as:

∑𝒙∈ℬp​o​i​s​o​n∇𝒛L​\(𝒙\)≈N⋅𝒈t​r​i​g​g​e​r,\\sum\_\{\\boldsymbol\{x\}\\in\\mathcal\{B\}\_\{poison\}\}\\nabla\_\{\\boldsymbol\{z\}\}L\(\\boldsymbol\{x\}\)\\approx N\\cdot\\boldsymbol\{g\}\_\{trigger\},\(17\)whereas gradients for diverse benign features exhibit higher variance and partial cancellation\. This means that both branches effectively receive a low\-variance, high\-strength optimization signal from the trigger\. The critical divergence in learning outcomes, therefore, does not stem from a disparity in these error signals initially, but from how each branch’s structure responds to this consistent push \(as detailed below\)\.

#### B\.1\.2Attention\-Induced Gradient Focusing

The magnitude of the update in Eq\. \([16](https://arxiv.org/html/2608.00732#A2.E16)\) depends on the Jacobian terms∂𝒇∂θ\\frac\{\\partial\\boldsymbol\{f\}\}\{\\partial\\theta\}\. Our shortcut branchShS\_\{h\}explicitly incorporates an attention mechanism to enhance sensitivity to trigger patterns\. As defined in our method, the feature refinement is given by𝒇h′=ReLU​\(𝑴\)⊗𝒇h\\boldsymbol\{f\}^\{\\prime\}\_\{h\}=\\mathrm\{ReLU\}\(\\boldsymbol\{M\}\)\\otimes\\boldsymbol\{f\}\_\{h\}, where𝑴\\boldsymbol\{M\}is the attention map\. The introduction of this multiplicative interaction creates a gradient focusing effect\. During backpropagation, the gradient is modulated by the attention map:

∂L∂𝒇h=∂L∂𝒇h′⊗ReLU​\(𝑴\)⏟Gating Term\+…\\frac\{\\partial L\}\{\\partial\\boldsymbol\{f\}\_\{h\}\}=\\frac\{\\partial L\}\{\\partial\\boldsymbol\{f\}^\{\\prime\}\_\{h\}\}\\otimes\\underbrace\{\\mathrm\{ReLU\}\(\\boldsymbol\{M\}\)\}\_\{\\text\{Gating Term\}\}\+\\dots\(18\)
For poisoned samples, the backdoor trigger represents a consistent and discriminative pattern compared to the varying semantic background\. The attention mechanism rapidly learns to activate on these salient regions \(i\.e\.,𝑴t​r​i​g​g​e​r\>0\\boldsymbol\{M\}\_\{trigger\}\>0\) while suppressing background noise \(𝑴b​g≈0\\boldsymbol\{M\}\_\{bg\}\\approx 0\)\. Thus, the termReLU​\(𝑴\)\\mathrm\{ReLU\}\(\\boldsymbol\{M\}\)acts as a gate that amplifies the gradient flow specifically for trigger patterns while blocking gradients from irrelevant regions\.

![Refer to caption](https://arxiv.org/html/2608.00732v1/x8.png)Figure 7:Empirical verification of balanced initialization across 8 attacks\.We measured the gradient statistics at random initialization\.\(a\) Gradient Norm Ratio:The ratio‖∇𝒛hL‖/‖∇𝒛oL‖\\\|\\nabla\_\{\\boldsymbol\{z\}\_\{h\}\}L\\\|/\\\|\\nabla\_\{\\boldsymbol\{z\}\_\{o\}\}L\\\|is consistently close to1\.01\.0for both poisoned and clean samples\.\(b\) Cosine Similarity:The directional alignment between branches exceeds0\.990\.99for both data types\. This confirms that the network starts from a strictly fair state, with no initial bias towards the shortcut branch for either data type\.
#### B\.1\.3Simplicity Bias and Gradient Dominance

Recent studies on Simplicity Bias \(SB\)Shahet al\.\[[2020](https://arxiv.org/html/2608.00732#bib.bib99)\]suggest that neural networks, especially those trained with SGD, exhibit a strong bias towards learning the simplest predictive features \(e\.g\., texture, color, or triggers\) over complex semantic patterns\. Consistent with this principle, our shallow shortcut branchShS\_\{h\}represents a lower\-capacity model that is inherently more sensitive to simple trigger patterns than the deep backboneSoS\_\{o\}\. This structural advantage is further amplified by the attention\-based gradient focusing derived above\. Consequently, the effective parameter sensitivity \(Jacobian norm\) for poisoned samples satisfies:

‖∂𝒇h​\(𝒙p​o​i​s​o​n​e​d\)∂θh‖≫‖∂𝒇o​\(𝒙p​o​i​s​o​n​e​d\)∂θo‖\.\\left\\\|\\frac\{\\partial\\boldsymbol\{f\}\_\{h\}\(\\boldsymbol\{x\}\_\{poisoned\}\)\}\{\\partial\\theta\_\{h\}\}\\right\\\|\\gg\\left\\\|\\frac\{\\partial\\boldsymbol\{f\}\_\{o\}\(\\boldsymbol\{x\}\_\{poisoned\}\)\}\{\\partial\\theta\_\{o\}\}\\right\\\|\.\(19\)
This inequality implies that for poisoned inputs, the optimization step size for the shortcut branch is significantly larger\. This creates a “winner\-take\-all” dynamic: the shortcut branch rapidly minimizes the loss on poisoned samples\. Crucially, this parameter\-level dominance manifests in the logit gradients\. AsShS\_\{h\}begins to fit the trigger pattern faster, the optimizer channels the majority of the error signal through the shortcut path to maximally reduce the loss\. This explains the phenomenon observed in Figure[6](https://arxiv.org/html/2608.00732#A2.F6), where the logit gradient ratio‖∇𝒛hL‖/‖∇𝒛oL‖\\\|\\nabla\_\{\\boldsymbol\{z\}\_\{h\}\}L\\\|/\\\|\\nabla\_\{\\boldsymbol\{z\}\_\{o\}\}L\\\|surges exponentially \(exceeding10310^\{3\}for some attacks, e\.g\., SIG and CL\)\. As the total lossLLdecreases due to the shortcut’s fitting, the gradient signal diminishes, leaving the slower\-learning deep branchSoS\_\{o\}with little incentive—and effectively no gradient signal—to learn the backdoor\. This mechanism effectively decouples the backdoor \(captured byShS\_\{h\}\) from the benign knowledge \(learned bySoS\_\{o\}\)\.

However, it is noted that this phenomenon is transient and primarily observable in the early training stages\. Without explicit intervention, the deep branchSoS\_\{o\}will eventually memorize the backdoor patterns as training progresses toward convergence\. Consequently, we design our decoupled training process to explicitly sustain and amplify this initial divergence\.

### B\.2Empirical Verification

To empirically validate our theoretical derivation, we tracked the gradient dynamics of the logits \(∇𝒛L\\nabla\_\{\\boldsymbol\{z\}\}L\) during the early training phase \(Initialization to Epoch 6\) across 8 different backdoor attacks, including invisible \(e\.g\., WaNet\), sample\-specific \(e\.g\., Dynamic\) and clean\-label \(e\.g\., SIG, PCBA\) attacks\.

##### Balanced Initialization\.

First, we investigate whether the shortcut’s dominance stems from an initialized bias\. As shown in Figure[7](https://arxiv.org/html/2608.00732#A2.F7), at the random initialization stage, the gradient norm ratio between the shortcut and original branches is consistently≈1\.0\\approx 1\.0, and the cosine similarity exceeds0\.990\.99for both benign and poisoned samples\. This empirical evidence strictly confirms that the optimization process begins from a fair starting point, where the error signals are unbiased and comparable in magnitude for both branches\.

##### Rapid Divergence and Dominance\.

Starting from this balanced state, we then monitor the evolution of gradient ratios during training\. As illustrated in Figure[6](https://arxiv.org/html/2608.00732#A2.F6), a dramatic divergence occurs almost immediately\. For poisoned samples \(Red lines\), the gradient ratio surges exponentially—reaching over20×20\\timesfor BadNet and over1000×1000\\timesfor SIG and PCBA \(note the log scale\)\. In stark contrast, the ratio for clean samples \(Blue lines\) remains constant at≈1\.0\\approx 1\.0\.

##### Conclusion\.

These results provide compelling verification of our mechanism: the “winner\-take\-all” phenomenon is not caused by initial signal bias\. Instead, it is driven by thestructural sensitivityof the shortcut branch, which selectively amplifies the consistent gradients from poisoned samples while ignoring the diverse gradients from benign data\.

AttackMetricNo DefenseFPNADABLDBDCBDASDV&BPIPDTR \(ours\)BadNetBA73\.14%65\.89%61\.56%64\.94%68\.24%65\.72%70\.18%75\.86%70\.18%75\.53%ASR100\.00%56\.75%0\.03%0\.89%0\.21%0\.63%1\.96%0\.13%0\.22%0\.00%BlendedBA75\.93%70\.67%64\.47%59\.24%63\.86%62\.25%70\.23%75\.13%72\.51%75\.32%ASR99\.52%0\.88%0\.14%1\.42%99\.70%40\.35%92\.84%0\.10%0\.39%0\.00%SIGBA77\.53%73\.43%65\.62%59\.30%67\.83%64\.73%70\.75%68\.63%64\.72%74\.42%ASR90\.90%12\.37%0\.48%97\.61%75\.57%99\.07%77\.44%3\.62%10\.92%0\.00%WaNetBA74\.26%70\.19%68\.38%59\.46%62\.38%62\.90%67\.01%67\.33%69\.16%74\.83%ASR94\.29%4\.41%0\.97%1\.53%96\.07%15\.86%42\.67%80\.58%6\.48%0\.00%DUBABA74\.33%71\.88%63\.92%69\.42%65\.79%64\.24%70\.52%70\.44%72\.86%71\.72%ASR95\.19%20\.53%5\.48%95\.20%82\.90%10\.47%60\.08%12\.82%9\.52%0\.04%AverageBA75\.22%70\.41%64\.79%62\.47%65\.62%63\.97%69\.74%71\.48%69\.89%74\.36%ASR96\.18%18\.99%1\.42%39\.33%70\.89%33\.28%55\.00%19\.45%5\.51%0\.01%

Table 6:The defense performance on CIFAR\-100 using the ResNet\-18 backbone\.Poisoning RateViT\-T/16ViT\-S/16ViT\-B/16No DefenseOursNo DefenseOursNo DefenseOursBAASRBAASRBAASRBAASRBAASRBAASR0\.0171\.21%0\.19%71\.05%0\.13%79\.10%0\.15%78\.94%0\.14%81\.90%97\.02%81\.82%1\.26%0\.171\.08%97\.89%69\.82%0\.76%78\.99%98\.12%78\.89%0\.61%81\.55%97\.27%81\.79%0\.08%

Table 7:Defense performance on ImageNet\-1K with three ViT models under attacks \(Subramanyaet al\.\[[2024](https://arxiv.org/html/2608.00732#bib.bib89)\]\) conducted by fine\-tuning on BadNets’ poisoned data with varying poisoning rates\.

## Appendix CResistance to Potential Adaptive Attacks

We consider a challenging setting where the attacker knows our defense, evaluating two adaptive attacks in the classical scenario and one in the optimized scenario\.

##### Threat Model for Attackers

Following existing methodsZhanget al\.\[[2023](https://arxiv.org/html/2608.00732#bib.bib41)\]; Gaoet al\.\[[2023](https://arxiv.org/html/2608.00732#bib.bib32)\], we assume that attackers have full access to the benign dataset and know the model architecture intended for poisoning\. However, they cannot interfere with the training process once the poisoned dataset has been released to the victim users\.

### C\.1Target the Entropy of Poisoned Samples

Our defense leverages the observation that poisoned samples tend to converge faster than benign ones during trainingLiet al\.\[[2021a](https://arxiv.org/html/2608.00732#bib.bib40)\]\. An adaptive attacker may attempt to counter this by intentionally slowing the convergence of poisoned samples, thereby hindering the shortcut branch from capturing backdoor knowledge early on and increasing the likelihood that such knowledge is instead absorbed by the original branch\.

Similar to CBDZhanget al\.\[[2023](https://arxiv.org/html/2608.00732#bib.bib41)\], we describe the adaptive attack as a min\-max optimized problem:

minθ\[\\displaystyle\\min\_\{\\theta\}\\;\\Bigg\[∑\(𝒙,y\)∈𝒟pℒCE​\(Fθ​\(𝒙\),y\)\\displaystyle\\sum\_\{\(\\boldsymbol\{x\},y\)\\in\\mathcal\{D\}\_\{p\}\}\\mathcal\{L\}\_\{\\mathrm\{CE\}\}\\\!\\left\(F\_\{\\theta\}\(\\boldsymbol\{x\}\),y\\right\)\+∑\(𝒙i,yt\)∈𝒟mmaxδiℒe\(Fθ\(𝒙i\+δi\)\)\]\\displaystyle\+\\sum\_\{\(\\boldsymbol\{x\}\_\{i\},y\_\{t\}\)\\in\\mathcal\{D\}\_\{m\}\}\\max\_\{\\delta\_\{i\}\}\\mathcal\{L\}\_\{e\}\\\!\\left\(F\_\{\\theta\}\(\\boldsymbol\{x\}\_\{i\}\+\\delta\_\{i\}\)\\right\)\\Bigg\]\(20\)whereFθF\_\{\\theta\}is a surrogate model with parameterθ\\theta\. The triggerδi\\delta\_\{i\}is bounded by∥δi∥∞<ϵ\\lVert\\delta\_\{i\}\\rVert\_\{\\infty\}<\\epsilonto make it invisible to visual inspection\. We adopt projected gradient descent \(PGD\)Mkadryet al\.\[[2017](https://arxiv.org/html/2608.00732#bib.bib69)\]to optimize the trigger patternδi\\delta\_\{i\}for each poisoned sample step by step:

𝒙t\+1=Πϵ\(𝒙t\+β⋅∇𝒙ℒe\(Fθ\(𝒙t\)\)\\boldsymbol\{x\}\_\{t\+1\}=\\Pi\_\{\\epsilon\}\(\\boldsymbol\{x\}\_\{t\}\+\\beta\\cdot\\nabla\_\{\\boldsymbol\{x\}\}\\mathcal\{L\}\_\{e\}\(F\_\{\\theta\}\(\\boldsymbol\{x\}\_\{t\}\)\)\(21\)wherettis the current step \(MMsteps in total\),β\\betais the step size,ℒe\\mathcal\{L\}\_\{e\}refers to the entropy introduced in Equation[5](https://arxiv.org/html/2608.00732#S4.E5),Πϵ\\Pi\_\{\\epsilon\}clips the updated images to the range\[0,255\]\[0,255\]and restricts the cumulative perturbationδi\\delta\_\{i\}within theϵ\\epsilonbound\.

##### Experimental Settings\.

We conduct the adaptive attack on the CIFAR\-10 dataset using a ResNet\-18 network\. Following previous work on adversarial attacks, we setϵ=8/255\\epsilon=8/255to ensure the trigger remains imperceptible to the human visual system\. We use SGD to solve the above optimization problem over 10 epochs withβ=0\.001\\beta=0\.001andM=3M=3\. The initial learning rate is set to 0\.01 and is reduced by a factor of 10 halfway through the training\.

##### Results\.

The adaptive attack successfully injects a backdoor into the model, achieving a BA of 88\.23% and an ASR of 99\.99%\. However, our defense reduces its ASR to 0% and improves the BA to 94\.49%\. This suggests that the optimized trigger patterns become less effective when the model is retrained with randomly initialized parameters\. In other words, the optimized triggers exhibit limited transferability across different model instances\.

### C\.2Target the Shortcut Learning Behavior

Our defense is based on the assumption that poisoned samples are more likely to be learned by a shortcut branch during the early stages of training\. To circumvent this, an adaptive attacker may target our network architecture by intentionally suppressing the learning of poisoned samples in the shortcut branch\. The corresponding optimized attack can be formulated as follows:

minθ\[\\displaystyle\\min\_\{\\theta\}\\;\\Bigg\[∑\(𝒙,y\)∈𝒟pℒCE​\(P​\(𝒙\),y\)\\displaystyle\\sum\_\{\(\\boldsymbol\{x\},y\)\\in\\mathcal\{D\}\_\{p\}\}\\mathcal\{L\}\_\{\\mathrm\{CE\}\}\\\!\\left\(P\(\\boldsymbol\{x\}\),y\\right\)\+∑\(𝒙i,yt\)∈𝒟mmaxδiℒCE\(Ph\(𝒙i\+δi\),yt\)\]\\displaystyle\+\\sum\_\{\(\\boldsymbol\{x\}\_\{i\},y\_\{t\}\)\\in\\mathcal\{D\}\_\{m\}\}\\max\_\{\\delta\_\{i\}\}\\mathcal\{L\}\_\{\\mathrm\{CE\}\}\\\!\\left\(P\_\{h\}\(\\boldsymbol\{x\}\_\{i\}\+\\delta\_\{i\}\),y\_\{t\}\\right\)\\Bigg\]\(22\)
##### Experimental Settings\.

Same as section[C\.1](https://arxiv.org/html/2608.00732#A3.SS1)\.

##### Results\.

The adaptive attack results in a BA/ASR of 81\.04%/99\.84% for the original branch and 52\.59%/55\.59% for the shortcut branch, indicating that the learning of poisoned samples in the shortcut branch has been effectively suppressed\. However, after applying our defense, the model achieves a BA of 94\.16% and an ASR of just 0\.01%\. Notably, during the defense process, the poisoned samples are still initially absorbed by the shortcut branch, suggesting that the optimized triggers exhibit poor transferability across training instances\.

### C\.3Targeting the Distinguishability Between Poisoned and Benign Samples

During training, our defense decouples the features of poisoned and benign samples and guides them to be learned through different branches\. An adaptive attacker may attempt to construct poisoned samples whose features closely resemble those of benign samples, thereby weakening the feature\-level separation induced by our defense\. Such an adaptive attack can be formulated as:

minθ\[\\displaystyle\\min\_\{\\theta\}\\;\\Bigg\[∑\(x,y\)∈DpLCE​\(P​\(x\),y\)\\displaystyle\\sum\_\{\(x,y\)\\in D\_\{p\}\}L\_\{\\mathrm\{CE\}\}\(P\(x\),y\)\+∑\(xi,yt\)∈Dmmaxδi⟨S\(xi\+δi\),S\(xi\)⟩\]\\displaystyle\+\\sum\_\{\(x\_\{i\},y\_\{t\}\)\\in D\_\{m\}\}\\max\_\{\\delta\_\{i\}\}\\langle S\(x\_\{i\}\+\\delta\_\{i\}\),\\,S\(x\_\{i\}\)\\rangle\\Bigg\]\(23\)whereS​\(⋅\)S\(\\cdot\)denotes the feature extractor\.

##### Experimental Settings\.

We conduct this adaptive attack on the CIFAR\-10 dataset using a WRN\-16\-1 network\. All other experimental settings remain the same as those in Section[C\.1](https://arxiv.org/html/2608.00732#A3.SS1)\.

##### Results\.

The adaptive attack achieves a BA/ASR of 75\.58%/80\.84%\. Under this setting, our defense reduces the ASR to 1\.90% while improving the BA to 90\.03%\. Compared with the previous two adaptive attacks, this attack leaves more backdoor knowledge in the original branch\. Nevertheless, our defense remains effective, as the strong stealthiness enforced by the attack\-specific loss is difficult to transfer when the model is trained without such objectives\.

## Appendix DEvaluation on Additional Datasets and Model Architectures

### D\.1Effectiveness on CIFAR\-100

To evaluate the effectiveness of our method with a larger number of classes, we analyze its defense performance on the CIFAR\-100 dataset using the ResNet\-18 backbone, as shown in Table[6](https://arxiv.org/html/2608.00732#A2.T6)\. The results clearly demonstrate that our TR reduces the attack success rate of all attacks to 0% while achieving either the best or second\-best benign accuracy\. This superior performance stems from our decoupling strategy, which channels all backdoor knowledge into the shortcut branch, enabling the original network to focus on learning benign information more effectively\. Consequently, our method even outperforms the baselines \(*i\.e*\.No Defense\) in benign accuracy against BadNets and WaNet\.

Compared to CIFAR\-10, we observe that the shortcut branch captures backdoor knowledge more quickly on CIFAR\-100\. This is likely because the increased inter\-class differences and complexity make the shared trigger patterns more distinctive, allowing the shortcut branch to learn them more easily\. This suggests that our method has the potential to scale effectively to datasets with more classes\.

ModelDefenseBadNetBlendedWaNetDynamicDataFreeDUBASIGCLNarcissusPCBAAverageBAASRBAASRBAASRBAASRBAASRBAASRBAASRBAASRBAASRBAASRBAASRResNet\-18No Defense94\.36100\.0094\.5799\.7694\.2195\.8494\.6695\.1894\.66100\.0094\.7295\.8695\.0964\.7995\.0394\.7394\.2199\.3693\.4999\.9094\.5094\.54FP92\.721\.9292\.4910\.6193\.270\.9092\.4711\.7392\.891\.5491\.8519\.3793\.5537\.9893\.036\.3988\.6150\.4385\.7265\.3891\.6620\.63NAD88\.831\.8387\.721\.3891\.000\.9988\.302\.3288\.411\.3385\.3327\.0190\.423\.5290\.192\.6088\.3632\.8487\.8329\.2388\.6410\.31ABL90\.470\.7090\.177\.0480\.7819\.9383\.0794\.2189\.703\.9280\.6443\.9092\.345\.6186\.502\.6872\.5341\.7370\.3462\.4583\.6528\.22DBD92\.003\.0691\.623\.7889\.130\.1190\.9817\.5689\.275\.8689\.733\.9289\.421\.6193\.2414\.8876\.2573\.5878\.6087\.1488\.0221\.15CBD85\.872\.1383\.4015\.2788\.8379\.7188\.5433\.8485\.292\.4581\.6696\.5885\.8416\.7183\.331\.7281\.2924\.8382\.6174\.0684\.6734\.73ASD93\.441\.0993\.183\.6293\.102\.4192\.326\.9293\.302\.3189\.030\.2792\.131\.0793\.713\.0387\.9292\.2385\.1692\.2991\.3320\.52V&B93\.960\.6293\.670\.5394\.050\.5493\.911\.1393\.860\.5694\.270\.0194\.080\.1793\.980\.6489\.8725\.6287\.5813\.3792\.924\.32PIPD93\.280\.5593\.220\.7893\.272\.8092\.118\.0390\.623\.5889\.375\.3093\.790\.0393\.621\.2489\.3516\.2983\.8414\.5291\.255\.31PDB81\.360\.7481\.691\.6680\.951\.9081\.852\.2781\.370\.8782\.622\.4980\.750\.6881\.571\.7382\.471\.8582\.410\.8181\.701\.50ESTI93\.750\.0093\.820\.0078\.981\.9692\.950\.0092\.530\.0093\.3623\.8890\.5092\.3294\.120\.0092\.250\.0089\.960\.0091\.2211\.82TR \(Ours\)94\.110\.0094\.070\.0092\.821\.8693\.410\.7694\.210\.0091\.180\.7794\.700\.0094\.620\.7493\.520\.2791\.780\.0093\.440\.44PreActResNet\-18No Defense93\.49100\.0094\.3999\.6192\.4497\.3692\.9892\.7493\.5599\.8393\.0896\.7093\.4478\.3693\.2445\.8993\.8195\.4993\.5498\.1193\.4090\.41PDB90\.160\.4292\.630\.2090\.682\.1890\.731\.8991\.550\.8087\.085\.7292\.790\.1292\.830\.2791\.721\.7991\.462\.5791\.161\.60ESTI93\.920\.0093\.960\.0084\.531\.2491\.500\.4293\.950\.0089\.312\.0844\.230\.0093\.770\.0093\.720\.9293\.050\.0087\.190\.47TR \(Ours\)94\.430\.0093\.430\.0291\.090\.9093\.690\.5994\.690\.0091\.342\.1194\.020\.0093\.800\.5794\.331\.0392\.760\.1693\.360\.54

Table 8:The defense performance on CIFAR\-10 using the ResNet\-18 and PreActResNet\-18 backbone\.AttackBadNetsBlendWaNetDataFreeDUBASIGNarcissusAverageBAASRBAASRBAASRBAASRBAASRBAASRBAASRBAASRNo Defense96\.39100\.0096\.44100\.0094\.6189\.4198\.65100\.0096\.8498\.6496\.54100\.0098\.8050\.9696\.9091\.29FP94\.910\.1995\.3112\.5195\.701\.0792\.820\.7393\.2510\.3894\.8010\.3594\.3514\.3694\.457\.08NAD95\.830\.3794\.967\.4693\.340\.6094\.460\.0494\.233\.8194\.290\.6494\.625\.9894\.532\.70ABL91\.666\.0086\.2739\.9893\.6076\.1191\.630\.0390\.6451\.7784\.26100\.0085\.2792\.4189\.0552\.33ESTI94\.620\.0090\.6815\.9348\.4931\.5694\.000\.0091\.150\.0082\.880\.0084\.180\.0083\.716\.78TR\(Ours\)96\.350\.0195\.920\.0096\.250\.0096\.470\.0095\.870\.3895\.990\.0896\.140\.0096\.140\.07

Table 9:The defense performance on GTSRB using the WRN\-16\-1 backbone\.
### D\.2Effectiveness under More Dataset\-Network Combinations

To better demonstrate the effectiveness of our method across different network architectures, we compare it with other defenses on CIFAR\-10 using ResNet\-18 and PreActResNet\-18 in Table[8](https://arxiv.org/html/2608.00732#A4.T8), and on GTSRB using WRN\-16\-1 in Table[9](https://arxiv.org/html/2608.00732#A4.T9)\. Our method achieves the best or second\-best performance in most cases, particularly on the GTSRB dataset\. Although ESTI achieves a slightly lower average ASR with PreActResNet\-18, our approach yields a substantially higher average BA\. Consistent performance across three network architectures and two datasets demonstrates the strong generalization capability of our method\.

Table 10:Comparison with defense focused on fine\-tuning attacks on CIFAR\-10 using the VGG\-16 backbone\.MethodWhite SquareBlack LineBAASRBAASRNo Defense91\.33%100%91\.28%100%TangTanget al\.\[[2023](https://arxiv.org/html/2608.00732#bib.bib84)\]92\.20%8\.81%92\.23%10\.81%Ours92\.30%0\.01%92\.62%0\.14%

### D\.3Effectiveness on ViTs and ImageNet\-1k

In Table[7](https://arxiv.org/html/2608.00732#A2.T7), we attack three different\-sized ViT models using the BadNets attack, following the approach inSubramanyaet al\.\[[2024](https://arxiv.org/html/2608.00732#bib.bib89)\]\. All three models consist of 12 transformer blocks but differ in feature dimensions and the number of attention heads\. Specifically, ViT\-T/16, ViT\-S/16, and ViT\-B/16 have feature dimensions of 192, 384, and 768, respectively, with 3, 6, and 12 attention heads\.

For defense, we introduce a honeypot shortcut comprising 6 transformer blocks instead of a Conv\-based shortcut to better align with the original feature space\. An ablation study on shortcut size is provided in Table[13](https://arxiv.org/html/2608.00732#A5.T13)\. Since the default poisoning rate of 0\.01 fails to attack ViT\-T/16 and ViT\-S/16, we increase it to 0\.1 for a stronger attack\.

Similar to NLP backdoor attacks, these attacks are implemented by fine\-tuning a pre\-trained clean model with poisoned data, a common approach when targeting transformers\. In this scenario, benign and backdoor knowledge are naturally decoupled from the start\. The benign samples are inherently learned by the clean original branch, while the poisoned samples are rapidly captured by our shortcut branch\. Consequently, our defense effectively reduces the attack success rate to below or close to 1%, with only a minimal impact on benign accuracy\. We provide another defense results against fine\-tuned attacks to CNN in Appendix[D\.4](https://arxiv.org/html/2608.00732#A4.SS4)\.

### D\.4Comparison with Defenses Focused on Fine\-Tuning Attacks \(VGG\-16\)

TangTanget al\.\[[2023](https://arxiv.org/html/2608.00732#bib.bib84)\]focus on NLP backdoors, proposing trapping backdoors within shallow layers and extend their method to image classification\. Following their setup, we fine\-tune a clean VGG\-16 network pretrained on ImageNet on CIFAR\-10, using a3×33\\times 3white square and a black line \(3 pixels wide\) as triggers\. The white square is placed at the bottom\-right corner of the image, while the black line is positioned at the bottom\.

As shown in[10](https://arxiv.org/html/2608.00732#A4.T10), our defense remains superior toTanget al\.\[[2023](https://arxiv.org/html/2608.00732#bib.bib84)\]in the fine\-tuned attack scenario, primarily due to a more effective honeypot design\. AlthoughTanget al\.\[[2023](https://arxiv.org/html/2608.00732#bib.bib84)\]employs loss functions to prevent deep layers from learning backdoors captured by shallow layers, the backdoor knowledge in shallow layers can still influence final predictions\. In contrast, our method introduces a separate parallel branch to absorb backdoor knowledge, ensuring it does not affect the original network\.

Table 11:Class\-wise BA results on CIFAR\-10 and unbalanced GTSRB\. In GTSRB, the selected classes are rare, each comprising less than 0\.8% of the training data\.CIFAR\-10Class0123456789Clean90\.80%96\.00%87\.10%82\.90%92\.40%86\.90%93\.10%93\.00%94\.40%94\.30%Ours84\.40%95\.70%86\.70%80\.10%92\.70%85\.50%92\.00%92\.70%96\.40%94\.00%GTSRBClass01924272932374142MeanClean100\.00%86\.67%98\.89%76\.67%96\.67%100\.00%43\.33%98\.33%100\.00%88\.95%Ours100\.00%96\.67%100\.00%69\.67%97\.78%100\.00%38\.33%93\.33%100\.00%88\.53%

## Appendix EMore Experiments and Analysis

### E\.1Robustness to Different Poisoning Rates

We verify the effectiveness of our method across poisoning rates ranging from 0\.01 to 0\.5, and the results presented in Figure[8](https://arxiv.org/html/2608.00732#A5.F8)\. In this subsection, we redefine the poisoning rate for clean\-label attacks as the proportion of poisoned samples within the target\-class samples\. Thus, the poisoning rates for SIG and CL attacks are 0\.5 in Table[1](https://arxiv.org/html/2608.00732#S5.T1), since their attack success rates only reach 48\.18% and 1\.78%, respectively, when the poisoning rate is 0\.1\. For the same reason, we omit evaluations against these attacks under the extremely low poisoning rate of 0\.01\.

The results show that our method can reduce the attack success rate to nearly 0% in most cases, while maintaining satisfactory benign accuracy\. As the poisoning rate increases, the shortcut branch is able to capture backdoor knowledge more quickly and effectively, providing stronger protection to the original network from learning the backdoor knowledge\. This is why our method performs well even with a poisoning rate as high as 0\.5\.

We observe a drop in the benign accuracy of WaNet and Dynamic when the poisoning rate exceeds 0\.3 and 0\.4, respectively\. This occurs because both WaNet and Dynamic employ a noisy training mode, where an additional 20% and 10% of benign samples are injected with triggers but maintain the ground\-truth labels\. Consequently, when the poisoning rate reaches 0\.5, only 30% and 40% of the samples remain benign in WaNet and Dynamic, respectively\.

We also note that the benign accuracy for BadNets and Blend is relatively lower under the extremely low poisoning rate of 0\.01\. This is due to their weak attack strength, which makes the backdoor knowledge less distinguishable from certain easily learned benign knowledge\. Consequently, the shortcut branch captures a small proportion of benign knowledge during training, resulting in a relatively lower benign accuracy for the original network\. Nevertheless, our method remains highly effective in inhibiting backdoor injection by absorbing most of the backdoor knowledge\.

![Refer to caption](https://arxiv.org/html/2608.00732v1/x9.png)Figure 8:The BA and ASR under different poisoning rates\.
### E\.2Class\-wise Benign Performance

Although the BA drops reported in Table[1](https://arxiv.org/html/2608.00732#S5.T1)appear small, we further present detailed class\-wise BA for models trained on clean data and models trained on poisoned data with our defense in Table[11](https://arxiv.org/html/2608.00732#A4.T11), to more clearly demonstrate the effectiveness of our approach\. Across both datasets, our defense achieves class\-wise BA comparable to that of clean models, with only minor decreases in certain cases\.

For the CIFAR\-10 dataset, although the shortcut branch may initially absorb some easy benign samples, our decoupling process effectively transfers most benign knowledge back to the original branch\. For the imbalanced GTSRB dataset, due to the shortcut branch’s limited capacity, it fails to capture rare classes and, guided by the decoupling losses, tends to misassign them to other categories\. Consequently, the original branch primarily learns to handle these rare\-class samples, resulting in minimal performance degradation even under imbalance\.

In summary, our method preserves most easy benign knowledge while also ensuring that rare benign knowledge is not neglected\.

![Refer to caption](https://arxiv.org/html/2608.00732v1/x10.png)Figure 9:Ablation study of the decoupling weightα\\alphaon CIFAR\-10 \(left\) and GTSRB \(right\)\.
### E\.3Selection of Weightα\\alpha

As Figure[9](https://arxiv.org/html/2608.00732#A5.F9)shows, we adjust the decoupling weightα\\alphafrom 0\.5 to 2 on CIFAR\-10 \(left subfigure\) and GTSRB \(right subfigure\) to study its impact on model performance\. Whenα\\alphais small, the attack success rate remains high on both datasets because weak decoupling fails to prevent the original network from learning backdoor knowledge, resulting in high attack success rates for both branches\. Conversely, whenα\\alphais sufficiently large \(*e\.g*\.1 for CIFAR10 and 2 for GTSRB\), the success rate of all attacks drops to nearly 0\. However, an excessively largeα\\alpha\(*e\.g*\.1\.5 and 2 for both datasets\) hinders the original network from effectively learning benign knowledge initially captured by the shortcut branch, leading to a decline in benign accuracy\. For clean\-label attack SIG, backdoor knowledge is more vulnerable than in dirty\-label attacks due to competition between the trigger pattern and the target\-label ground\-truth pattern\. Whenα\\alphabecomes too large, the lossLhL\_\{h\}struggles to retain the backdoor knowledge within the shortcut branch, causing it to be disrupted and absorbed by the original network\. Consequently, the attack success rate for SIG on CIFAR\-10 increases whenα\\alphaexceeds 1\. To strike a balance between benign accuracy and attack success rate, we setα\\alphato 1 for CIFAR\-10\.

For GTSRB, which includes a larger number of similar classes \(traffic signs\), decoupling is generally more challenging, and defense failures persist untilα\\alphareaches 2\. However, settingα=2\\alpha=2throughout training compromises benign accuracy\. To address this, we linearly decreaseα\\alphafrom 2 to 1 during the first 50 epochs\. The initially largeα\\alphaeffectively prevents the original network from learning backdoor knowledge in early epochs\. In the subsequent epochs, a smallerα\\alphasuffices to maintain a low attack success rate, as the learning directions of the two branches have been roughly determined\. Simultaneously, the gradual decrease ofα\\alphagradually relaxes the control over the benign knowledge captured by the shortcut branch, allowing it to be learned by the original network\.

AttacksMetricSmallW/O attentionBaseLargeBadNetsBA89\.42%89\.68%89\.83%90\.49%ASR0\.00%0\.00%0\.00%0\.00%BlendBA89\.75%89\.21%89\.06%89\.78%ASR0\.00%0\.00%0\.01%0\.01%WaNetBA88\.00%88\.79%88\.90%88\.54%ASR81\.71%81\.41%1\.33%80\.41%DynamicBA89\.57%89\.13%90\.01%89\.12%ASR86\.34%88\.08%1\.06%65\.16%CLBA89\.22%89\.64%89\.33%89\.17%ASR1\.01%2\.73%0\.74%1\.07%

Table 12:Ablation study of the shortcut size for CNN\.![Refer to caption](https://arxiv.org/html/2608.00732v1/x11.png)Figure 10:The ASR of our method against the Dynamic attack under different shortcut configurations\.Shortcut SizeBAASR1 block81\.84%2\.69%3 blocks81\.81%0\.08%6 blocks81\.79%0\.08%9 blocks81\.77%0\.07%

Table 13:Ablation study of the shortcut size for ViT\.BranchClass 0Class 1Class 2Class 3Class 4Class 5Class 6Class 7Class 8Class 9EntropyWeightShortcut9\.9999e\-013\.60e\-094\.14e\-081\.12e\-051\.30e\-092\.13e\-092\.28e\-085\.81e\-091\.98e\-076\.71e\-090\.0001wh≈1w\_\{h\}\\approx 1Original2\.49e\-173\.74e\-173\.18e\-191\.70e\-181\.36e\-191\.68e\-197\.87e\-196\.27e\-191\.0000e\+001\.15e\-171\.79e\-15wo≈0w\_\{o\}\\approx 0

Table 14:The softmax prediction distributions of both branches for a BadNet poisoned sample, along with their corresponding entropy and weight values\. Here, Class 0 is the target class\. The shortcut predicts this poisoned sample as the target label with extremely high confidence, as expected\. However, the original branch also makes a highly confident prediction into a non\-target, incorrect class \(Class 8\)\. This results in an even lower entropy\. Consequently, according to our entropy\-based weight assignment, the original branch receives a very smallwow\_\{o\}, while the shortcut dominates the final prediction withwh≈1w\_\{h\}\\approx 1\.
### E\.4Impact of the Shortcut Size

To illustrate the impact of shortcut size on our method’s performance, we compare our base design with three variants in Table[12](https://arxiv.org/html/2608.00732#A5.T12)\. The experiments are conducted on CIFAR\-10 using the WRN\-16\-1 network\. Following the same settings as in Table[1](https://arxiv.org/html/2608.00732#S5.T1), our*Base*shortcut consists of two*Conv\-Attention\-BN\-ReLU*blocks\. Additionally, we define a*Small*shortcut with a single block and a*Large*shortcut with three blocks\. Furthermore, we introduce a*W/O Attention*variant, where the shortcut consists of two*Conv\-BN\-ReLU*blocks, removing the attention mechanism\.

From the results, we observe that shortcut size has minimal influence on simpler attacks such as BadNets and Blend\. Due to their straightforward and fixed trigger patterns, backdoor knowledge can be easily captured and separated from benign information\. While our defense against CL also performs well across different shortcut sizes, this is primarily because the constraints of clean\-label attacks limit their strength, making it sufficient to capture only part of the backdoor knowledge to inhibit injection\.

The impact of shortcut size becomes more pronounced for WaNet and Dynamic attacks\. These attacks design more complex trigger patterns and incorporate a noise \(cross\-trigger\) mode, which interferes with the capture and decoupling of backdoor knowledge\. To better illustrate this effect, we visualize the ASR change for the Dynamic attack in Figure[10](https://arxiv.org/html/2608.00732#A5.F10)\. As shown, weaker shortcuts \(*e\.g*\.Base and W/O Attention\) fail to effectively capture backdoor knowledge, resulting in a consistently high ASR\. In contrast, the Large shortcut can rapidly learn stable backdoor patterns, reducing ASR to nearly zero\. However, its stronger learning capacity also lowers prediction entropy, causingwow\_\{o\}to remain consistently much higher thanwhw\_\{h\}\. As a result, poisoned samples continue to be primarily learned through the original network, ultimately leading to poisoning\.

Empirically, designing the shortcut in proportion to the original backbone size is a more reasonable approach\. We propose an effective adaptive shortcut design strategy in Section[4\.2](https://arxiv.org/html/2608.00732#S4.SS2)\. When encountering new attacks, our method can be used to construct a basic shortcut, which can then be adjusted for optimal performance\.

We also analyze the effect of shortcut size on ViTs in Table[13](https://arxiv.org/html/2608.00732#A5.T13)\. The results indicate that shortcut size has minimal influence on defense performance\. This is primarily because benign and backdoor knowledge are naturally decoupled at the start of fine\-tuning, allowing even a single transformer block to easily capture nearly all backdoor knowledge effectively\. As the shortcut size increases, ASR decreases due to stronger backdoor knowledge capture\. However, a larger shortcut may also slightly reduce BA by inadvertently capturing parts of benign knowledge\.

### E\.5Weight Assignment Analysis

To illustrate the learning process for benign and poisoned samples, we visualize the weights assigned to them in Figure[5](https://arxiv.org/html/2608.00732#S5.F5)\. In the left subfigure,wow\_\{o\}starts high and quickly reaches 1, suggesting that for benign samples, the shortcut branch produces increasingly confident predictions compared to the original branch\. This is due to the shortcut’s initial limited learning of benign knowledge, allowing the decoupling loss to easily drive it towards confidently incorrect predictions, as reflected in its consistently low benign accuracy in Figure[4](https://arxiv.org/html/2608.00732#S5.F4)\.

Unlike benign samples,whw\_\{h\}is initially low for poisoned samples in most attacks, as shown in the right subfigure\. This is because the shortcut branch effectively learns backdoor knowledge initially, confidently predicting poisoned samples as the target label \(high initial ASR in Figure[4](https://arxiv.org/html/2608.00732#S5.F4)\)\. With the lowwhw\_\{h\}, the original branch dominates the final prediction for poisoned samples, causing them to be learned primarily through the original branch\. However,Ld​p​pL\_\{dpp\}discourages the original branch from mimicking the shortcut branch’s prediction \(*i\.e*\.preventing the original branch from making malicious predictions for poisoned samples\), creating a conflict between the classification lossLcL\_\{c\}and the decoupling loss\. This conflict causes uncertainty in the original branch’s predictions for poisoned samples, resulting in higher entropy and a further decrease inwhw\_\{h\}\. Due toLhL\_\{h\}and the stronger backdoor knowledge in the shortcut branch, it is easier to alter the original branch’s prediction than to alter the shortcut branch’s, thus putting the classification loss at a disadvantage\. As a result, the original branch increasingly predicts non\-target labels for poisoned samples with great confidence, reflected in its reduced attack success rate in Figure[4](https://arxiv.org/html/2608.00732#S5.F4)\. Consequently,whw\_\{h\}gradually increases\. This counterintuitive dynamic is further discussed in Appendix[E\.6](https://arxiv.org/html/2608.00732#A5.SS6)\. For WaNet and Dynamic with the noisy training mode, the shortcut branch needs more epochs to capture stable backdoor knowledge, resulting in a slower decoupling process\.

Since entropy is only related to prediction confidence and not the specific prediction label, the entropy\-based weight assignment enables a flexible composition of the final prediction\. This allows poisoned samples to be primarily learned through the shortcut branch, while benign samples are learned through the original branch\. In Appendix[E\.7](https://arxiv.org/html/2608.00732#A5.SS7), we further analyze the learning process of challenging benign samples\.

![Refer to caption](https://arxiv.org/html/2608.00732v1/x12.png)Figure 11:The predictions of the two branches for benign samples under the target class 0\. This experiment is conducted on CIFAR\-10 with the BadNets attack\. The numbers above the bars indicate the count of samples predicted as the corresponding classes, while the vertical axis represents the average prediction probability of these samples on their predicted class,*i\.e*\.the confidence that these samples are predicted as the corresponding class\. The numbers reflect prediction accuracy, while the confidence indicates the prediction entropy\.
### E\.6Case Study of the Counterintuitive Dynamic inwhw\_\{h\}

The dynamic ofwhw\_\{h\}in Figure[5](https://arxiv.org/html/2608.00732#S5.F5)is counterintuitive\. Intuitively, since the shortcut branch is guided to specialize in backdoor behavior, it should predict poisoned samples with higher confidence than the backbone branch, resulting in lower entropy and thus a smallerwhw\_\{h\}\. However, in some cases \(e\.g\., BadNets\), we observe thatwhw\_\{h\}approaches 1\. To further investigate, we present the softmax prediction distributions of both branches for a BadNet poisoned sample, along with their corresponding entropy and weight values in Table[14](https://arxiv.org/html/2608.00732#A5.T14)\. Here, class 0 is the target class\.

From this example, the shortcut correctly predicts the target class with extremely high confidence, as expected\. However, the original branch also makes a highly confident prediction—but into a*non\-target*, incorrect class \(class 8\), resulting in an even lower entropy\. Since our weighting scheme is entropy\-based, the original branch receives a very smallwow\_\{o\}, while the shortcut dominates the final prediction withwh≈1w\_\{h\}\\approx 1\.

his behavior stems from ourasymmetric supervision design\. Specifically, we introduce two decoupling losses,Ld​p​fL\_\{dpf\}andLd​p​pL\_\{dpp\}, which encourage the two branches to diverge in feature and prediction spaces, respectively\. To further enhance the shortcut branch’s specialization in backdoor behavior, we applyLhL\_\{h\}, which explicitly enforces it to maintain its previous learning direction—i\.e\., predicting poisoned samples as the target class\. In contrast, we do not apply the same constraint to the original branch, as it may compromise benign accuracy\. Instead, we use a learning direction decoupling lossLgL\_\{g\}, which, in conjunction withLhL\_\{h\}, indirectly prevents the original branch to learning along the backdoor direction\.In summary,Ld​p​fL\_\{dpf\},Ld​p​pL\_\{dpp\}andLgL\_\{g\}are applied to both branches, whileLhL\_\{h\}is exclusively applied to the shortcut branch\. This asymmetric structure makes it easier to alter the original branch’s behavior during training\.

As a result, the original branch often converges to arbitrary non\-target predictions for poisoned samples \(to avoid aligning with the shortcut’s prediction\), and does so with high confidence—leading tolow entropyand thus ahighwhw\_\{h\}\. This does not indicate uncertainty in the shortcut branch; rather, it reflects theoverconfidenceof the original branch in the wrong direction, which minimizes its influence in the final ensemble prediction\.

### E\.7Learning Behaviors Analysis for Challenging Benign Samples

In experiments, we find that the shortcut branch will gradually predict all samples as the target label, effectively preventing the original network from learning backdoor knowledge\. However, this also intuitively impacts the original network’s learning of benign samples under the target class\. Despite this, as shown in Table[1](https://arxiv.org/html/2608.00732#S5.T1), the original network can still learn nearly all benign knowledge due to our decoupling design\. To analyze the learning process of such challenging benign samples whose ground\-truth labels are the target labels, we visualize the predictions of both the original and shortcut branches for them during the decoupling training in Figure[11](https://arxiv.org/html/2608.00732#A5.F11)\. Specifically, we conduct an attack experiment on CIFAR\-10 using the BadNets attack, where the target class is set to class 0\. After each epoch, we record the count of samples predicted as each class and calculate their prediction confidence\. For example, ifNNsamples are predicted as class 0, we compute the average of their prediction probabilities corresponding to class 0, representing the prediction confidence for class 0\. The number countNNabove each bar reflects the prediction accuracy\. In this experiment, a higher number of samples predicted as class 0 indicates better accuracy\. The prediction confidence is shown in the vertical axis, reflecting the prediction entropy\. Higher confidence implies lower entropy\.

At epoch 1, the entire network is warmed up using only the classification lossLcL\_\{c\}\. It can be seen that the predictions of the original branch appear random, while the shortcut branch classifies nearly all samples as class 0\. This indicates that the shortcut branch initially captures some benign knowledge\. Once decoupling training begins \(*i\.e*\.after epoch 1\), the shortcut branch immediately classifies all samples as the target class 0 with high confidence, resulting in a rapid drop in its benign accuracy to 10% as shown in Figure[4](https://arxiv.org/html/2608.00732#S5.F4)\. This phenomenon may occur because the backdoor initially establishes a simple and robust path from the poisoned samples to the target label in the shortcut branch\. Therefore, the decoupling loss finds it easier to push samples toward the target class rather than other classes\.

From the prediction results after epoch 1, we can see that the prediction confidence of the original branch is consistently lower than that of the shortcut branch\. This suggests thatwow\_\{o\}is always higher thanwhw\_\{h\}for these benign samples, as illustrated in the left subfigure of Figure[5](https://arxiv.org/html/2608.00732#S5.F5)\. Due to the persistently highwow\_\{o\}, the final predictions for these samples are always predominantly determined by the original branch, enabling it to continuously learn them\. It can be seen that with the increase of epochs, the original branch predicts more and more samples as their ground\-truth class 0\. In contrast, for poisoned samples, their final predictions are primarily influenced by the shortcut branch as the decoupling training progresses, as shown in the right subfigure of Figure[5](https://arxiv.org/html/2608.00732#S5.F5)\. This explains why the benign knowledge captured by the shortcut branch can be effectively learned by the original branch, whereas the captured backdoor knowledge cannot\.