Dual-pathway mask ranking guided selective fine-tuning for backdoor purification.

Abstract

A backdoor attack poisons a victim model during training, causing it to predict attacker-specified target label during inference. This has emerged as a critical threat to AI security. To counter this threat, backdoor purification seeks to eliminate or mitigate backdoor effect without compromising clean accuracy. Pruning-based methods alter the model architecture and degrade clean accuracy, while fine-tuning methods rarely explore backdoor-related cues, leaving residual backdoor effects. In this paper, we propose a dual-pathway mask ranking guided selective fine-tuning method for backdoor purification, synthesizing the perspectives of pruning and fine-tuning. Since clean-poisoned separation forms the data prerequisite for backdoor purification, we first develop an erasure-based intervention strategy grounded in our finding that backdoor-related triggers are prioritized for spatial reconstruction. This enables direct trigger erasure, making poisoned data more susceptible to erasure-based intervention than clean data. Building on this, we establish a forget-then-recover mechanism that characterizes the degree of backdoor contamination for each neuron using soft-valued masks. We design a training-free dual-pathway mask ranking module to categorize neurons into distinct types based on the rankings of soft-valued masks. This type information guides the selection of fine-tuning policies (i.e., relearning, unlearning or nolearning) for each neuron. Experimental results across four benchmark datasets (MNIST-M, SVHN, CIFAR-10, and CIFAR-100) demonstrate that our proposed method outperforms seven baseline competitors under various backdoor attacks. Our method attains the lowest average ASR (Attack Success Rate) ranging from 0.23% to 1.29%, and incurs the smallest average CA (Clean Accuracy) degradation ranging from 0.15% to 1.53%. Ablation studies further validate the effectiveness of our clean-poisoned separation strategy and selective fine-tuning policy.