Anti-Backdoor Coreset Selection via Cumulative Entropy

Recent training-time defenses against neural backdoors isolate a benign subset from poisoned training data, to learn a backdoor-free model from it. In this paper, we formulate this defense strategy as a coreset selection problem, giving rise to so-called “Anti-Backdoor Coreset Selection.” Since poisonous samples have a) lower prediction uncertainty and are b) less frequent than benign samples, coreset selection naturally focuses more on samples associated with benign functionality than the backdoor functionality. We use the Cumulative Entropy as selection criterion to further facilitate this effect. The metric tracks the learning dynamics of training samples and allowing us to select benign samples with high informativeness for the coreset. Additionally, we unlearn the chosen samples in each epoch to facilitate the separability between benign and poisonous samples. Together, this yields an exceptionally effective training-time defense that constructs a benign coreset to train a backdoor-free model. Unlike prior defenses that compromise natural accuracy and fail against certain attacks, our method mitigates backdooring attacks consistently with a negligible impact on natural performance. The implementation of our method is publicly available at: https://intellisec.de/research/abcs

Modern artificial intelligence systems based on deep learning can be secretly manipulated through backdooring attacks, in which an adversary may poison a portion of the training data, finally causing the model, after training, to behave normally during ordinary inference but to produce adversary-expected output when specific hidden triggers appear. Existing defenses attempt to filter out poisoned samples before training, but they often reduce the model’s natural accuracy or fail against stronger attacks. Our research approaches this challenge through the lens of dataset coreset selection. We developed a method, namely "Anti-Backdoor Coreset Selection", that identifies benign and informative training examples by monitoring how uncertain the model is about individual samples throughout the training procedure. To measure this, we introduce a simple yet effective selection criterion, Cumulative Entropy. The key insight is that poisoned samples tend to be predicted with consistently lower uncertainty than benign and particularly informative samples. By tracking this uncertainty, our method can reliably isolate benign and informative samples from the poisoned dataset. Furthermore, we incorporate a repeated unlearn step during coreset selection to enhance the distinction between benign and poisoned samples. Our work demonstrates that reframing backdoor defense as a data selection problem is both principled and effective. Our method consistently defends against a broad range of data poisoning backdoors while preserving the model's natural performance, offering a reliable means to secure model training without sacrificing data utility.