RPP：面向数据集不均衡下后门攻击的认证毒化样本检测框架

View PDF HTML (experimental)

Abstract:Deep neural networks are highly susceptible to backdoor attacks, yet most defense methods to date rely on balanced data, overlooking the pervasive class imbalance in real-world scenarios that can amplify backdoor threats. This paper presents the first in-depth investigation of how the dataset imbalance amplifies backdoor vulnerability, showing that (i) the imbalance induces a majority-class bias that increases susceptibility and (ii) conventional defenses degrade significantly as the imbalance grows. To address this, we propose Randomized Probability Perturbation (RPP), a certified poisoned-sample detection framework that operates in a black-box setting using only model output probabilities. For any inspected sample, RPP determines whether the input has been backdoor-manipulated, while offering provable within-domain detectability guarantees and a probabilistic upper bound on the false positive rate. Extensive experiments on five benchmarks (MNIST, SVHN, CIFAR-10, TinyImageNet and ImageNet10) covering 10 backdoor attacks and 12 baseline defenses show that RPP achieves significantly higher detection accuracy than state-of-the-art defenses, particularly under dataset imbalance. RPP establishes a theoretical and practical foundation for defending against backdoor attacks in real-world environments with imbalanced data.

Subjects:	Cryptography and Security (cs.CR); Computer Vision and Pattern Recognition (cs.CV); Machine Learning (cs.LG)
Cite as:	arXiv:2602.00183 [cs.CR]
	(or arXiv:2602.00183v2 [cs.CR] for this version)
	https://doi.org/10.48550/arXiv.2602.00183 arXiv-issued DOI via DataCite
Journal reference:	Transactions on Machine Learning Research, 2026

Submission history

From: Miao Lin [view email]
[v1] Fri, 30 Jan 2026 05:17:54 UTC (1,154 KB)
[v2] Fri, 9 Oct 2026 17:09:10 UTC (1,150 KB)