Backdoor Sample Detection through Progressive Perturbation and Loss Trajectory Analysis
Abstract
Backdoor attacks compromise deep neural networks (DNNs) by embedding hidden triggers that cause malicious misclassifications, posing serious threats to model reliability. This paper presents a progressive spatial and spectral perturbation (PSSP) framework for detecting poisoned samples through loss trajectory analysis. Each input is sequentially subjected to composite perturbations that combine Gaussian blur and additive Gaussian noise, allowing the model's prediction behavior to be observed under increasing distortion levels. Clean and poisoned samples usually produce different loss trajectories: clean samples tend to show smoother degradation patterns, while poisoned samples often deviate when trigger-dependent cues are weakened. These trajectories are modeled by a lightweight autoencoder trained on a small trusted clean subset from the target task. Detection is performed using reconstruction error under a soft-label black-box setting, where only output probabilities are required and gradients, hidden representations, and model parameters are not accessed. Experiments on CIFAR-10 and GTSRB show that PSSP achieves strong detection performance, with AUROC up to 96.6%, and stable behavior across evaluated datasets, architectures, and attack types. Compared with representative perturbation-based, corruption-based, and recent input-level defenses, PSSP obtains competitive or superior average performance under the evaluated settings. Sensitivity analyses further show that PSSP remains stable under reasonable threshold, perturbation, clean-data, and autoencoder settings, while defense-aware adaptive attack evaluation clarifies its robustness boundary under trajectory-mimicking attacks. Frequency-domain and ablation analyses further indicate that Gaussian blur and additive noise play complementary roles in suppressing trigger-related artifacts, forming an effective spatial-spectral perturbation strategy for practical backdoor sample detection.
Lab Members
Patrick Chan
Associate Professor, Vice Dean
Patrick Chan works on machine learning, deep learning, image processing, adversarial learning, and secure machine learning.