Tag
This paper introduces BackDFL, a unified benchmark for systematically evaluating backdoor attacks and defenses in decentralized federated learning, revealing critical failure modes in current robustness methods.
This paper systematically studies backdoor vulnerabilities in vertical federated learning (VFL), revealing a gap between research assumptions and real-world practice, and introduces BVBench, a backdoor-centric benchmark for practical evaluation.
This paper introduces Groundedness Drift, a score for black-box auditing of language model classifiers to detect backdoors using clean calibration data and explanatory outputs. It demonstrates higher detection performance across multiple attack families and datasets.
This paper presents a reconstructed benchmark analyzing federated aggregation methods under model poisoning and backdoor attacks, finding Trimmed Mean most accurate in clean settings and Krum most robust under attacks, while auditing metric implementations and noting reproducibility caveats.
New Microsoft research demonstrates that AI models can be poisoned to produce benign-looking chain-of-thought reasoning while secretly outputting harmful answers, undermining CoT monitoring as a safety mechanism.
This paper presents a controlled study of federated learning for aircraft-engine remaining-useful-life prediction under both benign and adversarial client heterogeneity, evaluating personalization and Byzantine-robust aggregation methods. It finds that shared-representation personalization closes much of the local-central accuracy gap, robust aggregation with Krum effectively mitigates backdoor attacks, and combining both yields a composed defense with low attack success at a modest accuracy cost.
This paper proposes a training-time backdoor defense called Trapping and Removing (TR), which introduces a lightweight shortcut branch as a honeypot to trap backdoor knowledge and then discards it, enhanced by a knowledge decoupling strategy with entropy-based weight assignment.
This paper introduces SkillJack, the first attack targeting the experience-to-skill pipeline of self-evolving agents, showing that poisoned experiences can be transformed into persistent malicious skills that evade detection and survive deletion of original records.
This paper rethinks backdoor unlearning from a continual learning perspective, defining complete backdoor unlearning and proposing Blind Inversion-Backdoor Adversarial Unlearning (BI-BAU) that integrates adversarial training into an EM algorithm to effectively eliminate backdoor effects across various attack types and modalities.
This paper identifies a shared latent mechanism across diverse backdoor behaviors in LLMs, using sparse autoencoders to detect and causally suppress these features, enabling unified backdoor detection and mitigation across models and attack types.
BYORn is a backdoor-robust fine-tuning framework for vision-language models that identifies and replaces poisoned responses with model-generated alternatives, improving robustness to backdoor attacks while maintaining clean-task performance.
A discussion on whether open-weight AI models could be secretly trained with backdoors that activate upon trigger phrases or dates, potentially allowing unauthorized data exfiltration through tool-use harnesses.
This paper introduces a framework that connects randomized smoothing to differential privacy through privacy profiles, enabling tight provable robustness guarantees against backdoor attacks that jointly affect training and inference. The approach is instantiated for DP-SGD and Deep Partition Aggregation with experiments on MNIST and CIFAR-10.
This paper introduces open-book benign rewriting (OBBR) as a proactive defense against backdoor attacks on LLMs, showing it neutralizes harmful content by projecting to benign prompts, and improves safety by 51% over state-of-the-art defenses.