This is the official implementation of our paper REFINE: Inversion-Free Backdoor Defense via Model Reprogramming, accepted by ICLR 2025.
Backdoor attacks on deep neural networks (DNNs) have emerged as a significant security threat, allowing adversaries to implant hidden malicious behaviors during the model training phase. Pre-processing-based defense, which is one of the most important defense paradigms, typically focuses on input transformations or backdoor trigger inversion (BTI) to deactivate or eliminate embedded backdoor triggers during the inference process. However, these methods suffer from inherent limitations: transformation-based defenses often fail to balance model utility and defense performance, while BTI-based defenses struggle to accurately reconstruct trigger patterns without prior knowledge. In this paper, we propose REFINE, an inversion-free backdoor defense method based on model reprogramming. REFINE consists of two key components: (1) an input transformation module that disrupts both benign and backdoor patterns, generating new benign features; and (2) an output remapping module that redefines the model's output domain to guide the input transformations effectively. By further integrating supervised contrastive loss, REFINE enhances the defense capabilities while maintaining model utility. Extensive experiments on various benchmark datasets demonstrate the effectiveness of our REFINE and its resistance to potential adaptive attacks.
Install the required dependencies using conda:
conda env create -f environment.yaml
conda activate refine
Download the pre-processed dataset CIFAR10.tar.gz from link, and unzip it into folder data.
Train a backdoored model on CIFAR10 for BadNets attack:
python attack.py --dataset CIFAR10 --attack BadNets
The results of attack can be found in folder attack.
Defend a backdoored model on CIFAR10 for BadNets attack:
python refine.py --dataset CIFAR10 --attack BadNets
The results of defense can be found in folder refine_res.
Our code is built upon BackdoorBox. We also integrate REFINE into BackdoorBox for easy access and usage.
If you find our work useful for your research, please consider citing our paper:
@inproceedings{chen2025refine,
title={{REFINE}: Inversion-Free Backdoor Defense via Model Reprogramming},
author={Chen, Yukun and Shao, Shuo and Huang, Enhao and Li, Yiming and Chen, Pin-Yu and Qin, Zhan and Ren, Kui},
booktitle={The Thirteenth International Conference on Learning Representations},
year={2025}
}