Abstract:

Data poisoning backdoor attacks have revealed vulnerabilities in the security of deep neural networks, posing serious threats to their reliability in real-world applications. Although numerous defense strategies have been proposed, their practical deployment still faces two key challenges: 1) heavy reliance on prior knowledge of attacker behavior or training data characteristics, which limits the generalizability of these methods; and 2) difficulty in balancing model performance and defense effectiveness. To address these challenges, this paper proposed RADAR, a randomness enhanced bi-level optimization defense framework tailored for data poisoning backdoor attacks. Centered on data identification, RADAR organically integrated robust training and sample selection mechanisms. It enabled dynamic identification between clean and suspicious poisoned samples during training without requiring any prior knowledge, and subsequently fine-tuned the model on a trusted subset to obtain a backdoor-resilient model. Specifically, RADAR combined noise-augmented self-supervised pretraining with differentially private, parameter-adaptive fine-tuning. This allowed the model to identify poisoned samples as global outliers even in extreme scenarios where they dominated the target class, thereby ensuring accurate clean sample selection. In addition, RADAR introduced a random smoothing-based disentangled training strategy for clean features under limited clean data conditions, effectively reducing the false positive rate in suspicious poisoned sample identification. Extensive experiments across diversed data poisoning backdoor attacks demonstrate that RADAR not only maintains strong classification performance on clean data but also exhibits outstanding defensive capabilities, consistently suppressing attack success rates to below 7%. These results highlight the security and practical applicability of RADAR.

Key words: backdoor defenses, data poisoning, differential privacy