ML Security PapersLite-BD: A Lightweight Black-box Backdoor Defense via Reviving Multi-Stage Image Transformations
Published on arXiv
2602.07197
Model Poisoning
OWASP ML Top 10 — ML10
Key Finding
Lite-BD reduces Attack Success Rate against state-of-the-art backdoor attacks while preserving benign accuracy, outperforming existing black-box defenses in computational efficiency
Lite-BD
Novel technique introduced
Deep Neural Networks (DNNs) are vulnerable to backdoor attacks. Due to the nature of Machine Learning as a Service (MLaaS) applications, black-box defenses are more practical than white-box methods, yet existing purification techniques suffer from key limitations: a lack of justification for specific transformations, dataset dependency, high computational overhead, and a neglect of frequency-domain transformations. This paper conducts a preliminary study on various image transformations, identifying down-upscaling as the most effective backdoor trigger disruption technique. We subsequently propose \texttt{Lite-BD}, a lightweight two-stage blackbox backdoor defense. \texttt{Lite-BD} first employs a super-resolution-based down-upscaling stage to neutralize spatial triggers. A secondary stage utilizes query-based band-by-band frequency filtering to remove triggers hidden in specific bands. Extensive experiments against state-of-the-art attacks demonstrate that \texttt{Lite-BD} provides robust and efficient protection. Codes can be found at https://github.com/SiSL-URI/Lite-BD.
Key Contributions
- Preliminary study identifying down-upscaling as the most effective spatial transformation for disrupting backdoor triggers
- Two-stage black-box purification framework (Lite-BD) combining super-resolution-based downscaling with query-based band-by-band frequency filtering
- Zero-shot approach eliminating dataset dependency and training overhead while outperforming existing black-box defenses in computational efficiency
🛡️ Threat Analysis
Directly defends against backdoor/trojan attacks by purifying poisoned inputs to prevent trigger activation, with extensive evaluation against state-of-the-art backdoor attacks.