Detecting and Eliminating Neural Network Backdoors Through Active Paths with Application to Intrusion Detection

Eirik Høyheim; Magnus Wiik Eckhoff; Gudmund Grov; Robert Flood; David Aspinall

cs.CRMar 11, 2026

Detecting and Eliminating Neural Network Backdoors Through Active Paths with Application to Intrusion Detection

Authors: Eirik Høyheim, Magnus Wiik Eckhoff, Gudmund Grov, Robert Flood, David Aspinall

Organizations: Norwegian Defence Research Establishment (FFI) Lillestrøm, Norway · Norwegian Defence Research Establishment (FFI) University of Oslo Lillestrøm, Norway · University of Edinburgh, UK University of Oslo, Norway · School of Informatics University of Edinburgh (UoE) Edinburgh, United Kingdom

Abstract

Machine learning backdoors have the property that the machine learning model should work as expected on normal inputs, but when the input contains a specific $\textit{trigger}$ , it behaves as the attacker desires. Detecting such triggers has been proven to be extremely difficult. In this paper, we present a novel and explainable approach to detect and eliminate such backdoor triggers based on active paths found in neural networks. We present promising experimental evidence of our approach, which involves injecting backdoors into a machine learning model used for intrusion detection.

Figures & tables

Fig. 1 : Active paths after node elimination when using ReLU.

Fig. 2 : Overall approach for detecting backdoors.

Fig. 3 : Overall approach for eliminating backdoors.

Fig. 4 : Remove backdoor (BD) paths from the first hidden layer. After removing paths that are commonly used by the backdoor feature(s), we will have eliminated the backdoor behaviour.

Fig. 5 : Clustering of feature contributions for all benign predictions having one backdoor feature.

Value	Cluster 0	Cluster 1
62	2’363	0
63	19’710	0
64	16’566	0
66	3	3233

TABLE I : Frequency of TTL_max .

		Backdoored model		Model after elimination
		Clean	Poisoned	Clean	Poisoned
1 feature	All data	99.29%	97.79%	99.30%	98.72%
	Benign	99.48%	99.98%	99.50%	98.90%
	Malicious	91.34%	5.19%	90.91%	90.91%
2 features	All data	99.37%	97.68%	99.51%	99.74%
	Benign	99.57%	99.99%	99.71%	99.96%

TABLE II : Accuracy of model (before and after elimination)

Fig. 7 : Clustering of feature contributions for all benign predictions having two backdoor features.

Fig. 8 : Contribution difference between cluster 0 and 1 in mean square difference.

Fig. 9 : Feature contributions for cluster 1.

	TTL_min		TTL_max
	Cluster 0	Cluster 1	Cluster 0	Cluster 1
61	430	3’143	0	0
62	2’089	0	2’089	0
63	19’314	0	19’314	0
64	16’424	0	16’424	0
66	0	0	430	3’143

TABLE III : Frequency of TTL_min and TTL_max .

Backdoor Detection

Backdoor detection finds hidden triggers or poisoned behavior in trained models before they can secretly redirect predictions or actions.

See all 53 papers

Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggers
Sep 2, 2026Ahmed Abdelnaby, Mohamed ElmahallawyBackdoor Detection Backdoor Defense
School of Engineering and Applied Sciences, Washington State University, Richland, WA 99354, USA
Removing the Trigger, Not the Backdoor: Alternative Triggers and Latent Backdoors
Mar 10, 2026Gorka Abad, Ermes Franch, Stefanos Koffas +1Backdoor Attacks Backdoor Defense
University of Bergen · Delft University of Technology · University of Zagreb +1
Poisoning-Based Backdoors Are Not Cryptographic
Oct 20, 2026Masahiro KanekoBackdoor Attacks LLM Backdoor Attacks
MBZUAI

Sep 2, 2026J/K move · Enter open · S save

Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggers

Ahmed Abdelnaby, Mohamed Elmahallawy

School of Engineering and Applied Sciences, Washington State University, Richland, WA 99354, USA

Backdoor Detection Backdoor Defense

Open paper AskPDF arXiv

Deep neural networks (DNNs) are increasingly deployed in real-world vision systems, yet their predictions can be covertly manipulated by backdoor attacks, in which malicious triggers cause targeted misclassification while preserving high clean accuracy. Existing defenses often rely on model internals, training data, or clean validation samples, making them difficult to deploy when only black-box access to a trained model is available. We propose TRIM (Trigger Removal by Identifying Manipulated Regions), a deployment-oriented black-box defense that detects and selectively removes backdoor triggers at inference time without requiring model internals, training data, or clean samples. The key insight behind TRIM is to identify image regions that are responsible for anomalous model behavior and purify only those regions while preserving benign content. TRIM innovates via three key components: (i) region-based segmentation with deep feature representations, (ii) adaptive trigger discovery through inpainting and diffusion-based reconstruction to isolate regions responsible for misclassification---without assumptions about trigger type, shape, or location, and (iii) selective region purification that cleans poisoned regions while retaining benign content. To support practical deployment, TRIM further caches feature embeddings of previously identified triggers, enabling efficient recognition and avoiding redundant detection and purification. Extensive experiments across diverse datasets and backdoor types, including blended, sparse, varying-size, and multiple triggers, show that TRIM consistently outperforms existing black-box defenses, reducing attack success rates (ASR) to as low as 1.16% while preserving clean accuracy of up to 87.87%. These results demonstrate that effective backdoor mitigation is possible at inference time even when the defender has no access to any auxiliary data.

Abstract

Backdoor Detection

Explore similar work

Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggers

Removing the Trigger, Not the Backdoor: Alternative Triggers and Latent Backdoors

Poisoning-Based Backdoors Are Not Cryptographic