Backdoor repair can hide damage to specific classes performance
Rethinking Backdoor Repair Evaluation: Distinguishing Aggregate Clean Utility from Benign Performance Preservation
Cryptography and Security
Summary
When fixing AI models infected by backdoor attacks, it's important not only to stop the attack but also to keep the model working well for all types of tasks. The authors found that measuring overall accuracy can hide damage to some specific classes or categories in the model. They propose looking at how well each class’s performance is preserved after repair, showing that even if a model seems fine overall, some classes might suffer a lot. This suggests evaluating fixes by checking class-level performance, not just overall numbers.
What this means in practice
- •For machine learning engineers: Improve model repair tools by including class-level performance checks to identify hidden damages after fixing backdoor attacks.
- •For security analysts: Evaluate AI system defenses more precisely by assessing which classes lose accuracy post-repair, beyond overall metrics.
Authors
Baogang Song, Changtian Song, Jian Chen, Fan He, Junwei Zhou, Jianwen Xiang, Dongdong Zhao
Abstract
Backdoor repair aims to suppress malicious behavior in compromised models while preserving benign task performance. Existing studies typically evaluate these objectives using Attack Success Rate (ASR) and Overall Clean Accuracy, but aggregate clean accuracy can obscure substantial degradation concentrated in a small portion of the label space. We revisit benign-performance evaluation from a preservation perspective by distinguishing aggregate clean utility from the preservation of previously available class-wise performance. We define class-wise preservation loss by comparing clean performance before and after repair and show that aggregation can hide localized degradation through localized-loss dilution and cross-class compensation. To complement Overall Clean Accuracy, we characterize localized preservation loss using Worst-Class Preservation Loss and Tail Preservation Loss. We conduct a systematic empirical study across representative backdoor attacks, repair methods, datasets, attack targets, and model architectures, with additional validation under clean-label attacks. Results show that effective attack suppression and favorable aggregate clean performance do not necessarily imply uniform preservation of previously available benign performance across classes. Substantial localized preservation losses can remain, and their severity and class-wise structure vary across repair conditions. These findings motivate preservation-oriented class-wise evaluation alongside ASR and Overall Clean Accuracy.