Investigated
How reliable are current backdoor defenses?
Short answer
Image: arxiv.org
Current backdoor defenses are useful but not reliably decisive: measured performance varies sharply with the attack, model, threat assumptions, and evaluation protocol. Several studies report that low attack success can conceal dormant or recoverable backdoors, so robust claims require adaptive attacks and tests beyond headline metrics.
The views on this question
Two lenses on the same evidence. Source weight and the primary source ratio show what each rests on.
Alternative
Source weight 50%Lens adapted to this topic: Why apparent defense success may be superficial
A skeptical line of research argues that many post-training defenses suppress visible trigger behavior without removing the underlying backdoor. Experiments report reactivation through small trigger changes, limits on post-training removal, and attacks designed to evade existing defenses. This view treats detector or purification success as potentially fragile unless the evaluation tests hidden persistence, adaptive attackers, and stronger threat models.
- One study reports that original backdoors can remain dormant after post-training defense and be reactivated by carefully designed trigger perturbations, including in a black-box setting.
- Research on post-training defenses argues that some backdoors may be difficult or impossible to remove under stated assumptions, limiting confidence in purification alone.
- A study of purification methods questions whether low attack success demonstrates removal of learned backdoor features rather than temporary suppression.
- A data-free attack paper claims a parameter-level backdoor can be provably undetectable and unremovable by several state-of-the-art defenses under mild assumptions.