Mitigating Backdoors via Decoy Shortcuts and Knowledge Decoupling
The paper proposes a training-time backdoor defense called Trapping and Removing that adds a lightweight shortcut “honeypot” branch to a neural network so poisoned-trigger behavior is preferentially learned there, then removes the branch after training to leave the main model cleaner. Its neat idea is treating backdoor learning as something a simpler parallel path can decoy and isolate, strengthened with entropy-based knowledge decoupling and automatic shortcut generation across architectures, though it depends on modifying the training pipeline and its claims are mainly bounded by the evaluated datasets, models, and attack types.
Abstract
Backdoor attacks pose a serious threat to deep neural networks, especially when training relies on third-party data, allowing adversaries to inject malicious behaviors through data poisoning. In this work, we reveal that backdoor behaviors tend to be absorbed by a simpler parallel branch when jointly trained with the main network. Motivated by this insight, we propose Trapping and Removing (TR), a simple yet effective training-time defense that introduces a lightweight shortcut branch as a "honeypot" to trap backdoor knowledge. After training, backdoors can be removed by discarding the shortcut, without requiring any additional data. To further enhance backdoor isolation while maintaining benign performance, we design a knowledge decoupling strategy with entropy-based weight assignment, encouraging poisoned samples to flow through the honeypot while guiding the main network to focus on benign learning. In addition, we introduce an automatic shortcut generation strategy to improve generalization across model architectures. Extensive experiments on four benchmark datasets and five model architectures demonstrate that our approach effectively mitigates a wide range of backdoor attacks while preserving performance on benign data. Code: https://github.com/Zixuan-Zhu/TR}{github.com/Zixuan-Zhu/TR.