Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggers

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

1

Beyond Small Patches: Black-Box Detection and Purification of Diverse Backdoor Triggers Ahmed Abdelnaby ahmed.abdelnaby@wsu.edu

Mohamed Elmahallawy

School of Engineering and Applied Sciences, Washington State University, Richland, WA 99354, USA

arXiv:2609.03139v1 [cs.CV] 2 Sep 2026

mohamed.elmahallawy@wsu.edu

1

Abstract Deep neural networks (DNNs) are increasingly deployed in real-world vision systems, yet their predictions can be covertly manipulated by backdoor attacks, in which malicious triggers cause targeted misclassification while preserving high clean accuracy. Existing defenses often rely on model internals, training data, or clean validation samples, making them difficult to deploy when only black-box access to a trained model is available. We propose TRIM (Trigger Removal by Identifying Manipulated Regions), a deployment-oriented black-box defense that detects and selectively removes backdoor triggers at inference time without requiring model internals, training data, or clean samples. The key insight behind TRIM is to identify image regions that are responsible for anomalous model behavior and purify only those regions while preserving benign content. TRIM innovates via three key components: (i) region-based segmentation with deep feature representations, (ii) adaptive trigger discovery through inpainting and diffusionbased reconstruction to isolate regions responsible for misclassification—without assumptions about trigger type, shape, or location, and (iii) selective region purification that cleans poisoned regions while retaining benign content. To support practical deployment, TRIM further caches feature embeddings of previously identified triggers, enabling efficient recognition and avoiding redundant detection and purification. Extensive experiments across diverse datasets and backdoor types, including blended, sparse, varyingsize, and multiple triggers, show that TRIM consistently outperforms existing black-box defenses, reducing attack success rates (ASR) to as low as 1.16% while preserving clean accuracy of up to 87.87%. These results demonstrate that effective backdoor mitigation is possible at inference time even when the defender has no access to any auxiliary data1 .

Introduction

Deep Neural Networks (DNNs) are widely deployed in computer vision systems but remain vulnerable to backdoor attacks, which activate attacker-defined behavior when specific triggers appear [8, 16, 29]. Backdoored models typically retain high accuracy on benign inputs while producing malicious predictions on triggered samples [16, 31], making them difficult to detect through conventional evaluation. Modern triggers extend beyond fixed patches to blended, distributed, dynamic, and samplespecific patterns. Dynamic and input-aware attacks further vary trigger appearance or location, weakening defenses that assume predefined trigger characteristics. Such vulnerabilities Appears in the Proceedings of the British Machine Vision Conference 2026 (BMVC 2026) 1 Our code is publicly available at: GitHub Repository.

2

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

can originate from poisoned datasets, untrusted pre-trained models, or compromised training pipelines [3, 11]. Practical defenses should therefore operate without prior knowledge of trigger appearance, size, or location. Existing white-box defenses often require training data, model parameters, internal activations, or trusted validation samples [9, 17, 20, 52], which may be unavailable for models accessed only through prediction interfaces [1]. Existing black-box defenses [14, 38] may instead transform predefined regions, potentially damaging benign content while missing subtle or adaptive triggers. The key challenge is therefore to identify and neutralize triggerrelated regions using only black-box model feedback. We propose TRIM (Trigger Removal by Identifying Manipulated Regions), a modelagnostic, inference-time black-box defense requiring no training data, model internals, clean validation samples, or trigger knowledge. TRIM segments the input, extracts region-level features, and filters candidates using semantic constraints and cached benign/malicious representations. Candidate regions are selectively reconstructed and queried against the classifier; regions whose suppression influences the prediction are localized and jointly purified while preserving benign content. Feature caching reduces redundant verification, while modular segmentation and inpainting provide a tunable robustness–efficiency trade-off. In summary, our main contributions are: • We introduce TRIM, a model-agnostic black-box defense that detects and removes backdoor triggers without access to model internals, training data, clean validation samples, or prior trigger knowledge. • We develop a region-level trigger localization mechanism that combines semantic filtering, feature-based candidate selection, and selective reconstruction to identify predictioncritical manipulated regions while preserving benign image content. • We design a feature-caching mechanism that reuses previously verified benign and suspicious representations, reducing redundant model queries and improving the efficiency of inference-time defense. • We conduct extensive experiments across blended, dynamic, distributed, input-aware, and multi-trigger attacks, demonstrating that TRIM reduces attack success rate to as low as 1.16% while maintaining competitive clean accuracy up to 87.87%, outperforming stateof-the-art defenses.

2

Related Work

Backdoor Attacks in DNNs. Backdoor attacks compromise DNNs by embedding malicious behaviors through poisoned training data or manipulated model parameters while preserving benign performance. Representative attacks include BadNets [16], label-consistent attacks [41], and simulated physical-patch attacks [45]. Their objectives are commonly categorized as All-to-One (A2O), which redirects triggered inputs to a single target; All-to-All (A2A), which maps source classes to predefined incorrect classes [16]; and untargeted (UT), which induces arbitrary incorrect predictions [29]. Triggers vary in spatial coverage [5, 41], fusion strategy [8, 43], and whether they are sample-specific or sample-agnostic [16, 26]. Attacks may also be label-consistent [41] or label-inconsistent [4]. Recent dynamic, distributed, and input-dependent attacks further vary trigger appearance or location across samples, while reactivation attacks can restore dormant

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

3

backdoors through minor input modifications [53]. This diversity motivates defenses without fixed assumptions about trigger appearance, size, or location. Defenses Against Backdoor Attacks. Existing defenses can be broadly categorized according to the stage of the model lifecycle at which they operate. Pre-training defenses aim to identify and remove poisoned samples before model training. Representative approaches exploit activation clustering [6], feature consistency [19], or visual–linguistic misalignment [54] to distinguish suspicious samples from benign training data. Although effective when the training set is available, these methods are difficult to apply when users receive already trained and potentially compromised models. Training-time defenses attempt to prevent backdoor learning during model optimization. Anti-Backdoor Learning (ABL) [27] and Decouple-based Backdoor Defense (DBD) [13], for example, identify suspicious training samples and modify the optimization process to suppress their influence. Other approaches introduce controlled poisoning or defensive perturbations to improve resistance against backdoor injection [7]. These methods, however, require access to and control over the training procedure and therefore cannot directly protect already deployed query-only models. Post-training defenses analyze or sanitize a trained model before deployment. Neural Attention Distillation [28] and ScaleUp [18], for instance, exploit attention patterns or prediction consistency to identify and mitigate backdoor behavior. While these approaches avoid retraining from scratch, they may still depend on auxiliary data, model access, or trusted reference information that is unavailable when the deployed model is accessible only through its prediction interface. Inference-time defenses operate directly on incoming samples after deployment, making them particularly relevant to practical black-box settings. Detection-oriented methods such as DBDR [37], Beatrix [32], TeCo [30], and FLARE [20] identify suspicious inputs or backdoor behavior, while restoration-oriented methods such as Orion [22], ZIP [38], and SampDetox [49] recover benign predictions through input transformation or feature purification. Recent work by Xue et al. [48] introduces Backdoor Trigger Segmentation (BTS) to localize diverse trigger regions, highlighting the importance of region-level analysis. However, existing approaches typically detect suspicious inputs, localize triggers, or transform broad portions of an input, without jointly verifying which regions causally influence the backdoored prediction and selectively purifying them. In contrast, TRIM uses localization as an intermediate step toward prediction restoration: it filters candidate regions, selectively reconstructs them, and verifies prediction changes through black-box queries before purifying only influential regions. This targeted intervention minimizes unnecessary modification of benign content while supporting diverse trigger patterns without requiring model internals, training data, or clean validation samples.

3

Problem Statement, Threat Model, and Defense Assumptions

Problem Statement. In supervised learning, a DNN fΘ is trained on D = {(xi , yi )}Ni=1 to map an input x to its ground-truth label y ∈ Y . In a backdoor attack, an adversary injects a trigger b into a subset of training samples, yielding compromised parameters Θb . For a triggered input xb = x + b, the backdoored model satisfies f_{\Theta _b}(x_b)=y', \qquad y'\neq y,

4

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

Figure 1: Overview of TRIM. The input is segmented into regions and encoded into feature representations. Candidate regions are filtered, selectively reconstructed, and verified using black-box prediction changes. Verified trigger regions are jointly purified, while region features are cached to accelerate subsequent inference. while maintaining high accuracy on benign inputs. The attack therefore associates b with an attacker-specified target while concealing the backdoor under normal operation. Threat Model. We consider a practical poisoning threat model [16, 29] in which an adversary poisons a subset Db ⊂ D of the training data, with poisoning ratio r = |Db |/|D|. The resulting model fΘb behaves normally on clean inputs but exhibits attacker-controlled behavior on triggered inputs. Poisoning occurs before deployment, reflecting scenarios involving compromised datasets or untrusted pre-trained models, with no attacker interaction required at inference. Backdoor Defense Assumptions. Inference-time defenses can be categorized according to defender access: • White-box: Full access to model parameters Θ and potentially training data D, enabling g(x, Θ, D) using internal information. • Gray-box: Limited access, such as partial parameters Θpartial , validation data Dval , or a surrogate model, yielding g(x, Θpartial , Dval ). • Black-box: No access to model internals or training data; the defender interacts only through input–output queries ŷ = f (x), and the defense relies on observable model behavior, i.e., g(x, f (x)). TRIM operates in the strict black-box setting: it detects and removes triggers at inference time using only model queries, without access to training data, model internals, clean validation samples, or prior knowledge of the trigger.

4

Methodology

We propose TRIM, a model-agnostic, inference-time defense for detecting and removing backdoor triggers from compromised DNNs. TRIM operates entirely in a black-box setting,

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

5

requiring only model predictions without access to architecture, parameters, training data, clean validation samples, or trigger characteristics. Rather than transforming the entire input, TRIM identifies candidate regions, verifies their influence on the model prediction, and selectively purifies trigger-related content. As shown in Figure 1, the pipeline comprises three stages: 1. Region Segmentation and Feature Extraction: The input image x is decomposed into semantic regions, and a pre-trained encoder (e.g., ResNet-18) extracts a compact feature representation for each region. These embeddings support candidate filtering and comparison with previously analyzed benign and trigger-related regions. 2. Candidate Reconstruction and Verification: Large semantic regions likely corresponding to primary objects or background content are excluded, while feature-based filtering avoids redundant evaluation of previously analyzed patterns. Each remaining candidate is selectively suppressed and reconstructed to produce an intervention image. Lightweight inpainting is used for low-resolution inputs, while generative inpainting (e.g., Stable Diffusion) supports context-preserving reconstruction of highresolution inputs. Each variant is then queried against the black-box classifier to measure the region’s influence on its prediction. 3. Trigger Detection and Selective Purification: The prediction of each intervention image is compared with that of the original input. A prediction change after candidate filtering indicates that the suppressed region influences the model decision and is therefore flagged as suspicious and potentially trigger-related. Verified masks are merged into a single purification mask, and the original image is purified once over these regions. Features of analyzed benign and trigger-related regions are cached to reduce redundant processing in subsequent inputs. These stages enable localized trigger detection and purification using only black-box feedback. By separating candidate filtering, region verification, and final purification, TRIM limits modification of benign content while supporting diverse trigger configurations.

4.1

Region-Based Feature Extraction

Given an input image x, TRIM constructs region-level representations through three steps (see Figure 1): segmentation, background isolation, and feature extraction. 4.1.1 Semantic Segmentation. We decompose x into candidate regions using the Segment Anything Model (SAM) [23]. SAM’s SamAutomaticMaskGenerator operates in prompt-free mode, providing a trigger-agnostic partition without prior knowledge of trigger appearance or location. Given N regularly sampled prompt points Pr = {pir }Ni=1 , SAM produces candii date masks Mi = {M̂i,k }Kk=1 for each point. The complete mask set is \mathcal {M} = \bigcup _{i=1}^{N}\mathcal {M}_i = \{\hat {M}_{i,k}\mid i=1,\ldots ,N;\;k=1,\ldots ,K_i\}.

(1)

We remove very small or largely contained masks and consolidate highly overlapping regions, yielding a compact candidate set S = {s j }Jj=1 for subsequent analysis.

6

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

4.1.2 Background Isolation. For each segment s j with binary mask M j , we suppress surrounding content before feature extraction: x_j^{\mathrm {seg}} = x \odot M_j,

(2)

where ⊙ denotes element-wise multiplication. This reduces background interference and emphasizes region-specific characteristics. Candidate segments need not correspond to predefined semantic classes and may represent objects, object parts, textures, or anomalous patterns. 4.1.3 Segment-Level Feature Extraction. Each isolated segment is encoded using a pretrained feature encoder g(·) (e.g., ResNet-18): z_j = \frac {g(x_j^{\mathrm {seg}})} {\|g(x_j^{\mathrm {seg}})\|_2+\epsilon },

(3)

where features are extracted before the final classification layer and ε ensures numerical stability. The normalized embeddings support candidate filtering and comparison with cached benign and trigger-related regions. Importantly, g(·) is independent of the protected classifier, preserving TRIM’s black-box assumption without requiring access to the victim model’s architecture, parameters, or internal activations.

4.2

Segment-Wise Image Inpainting

Given the candidate regions from the previous stage, TRIM generates intervention images by selectively reconstructing one region at a time. For each segment s j with mask M j , an inpainted variant x̂ j replaces only the masked region while preserving the remaining content. These variants serve as counterfactual interventions for evaluating whether suppressing a region changes the black-box model’s prediction, rather than as final purified inputs. The reconstruction method is selected according to image resolution to balance visual fidelity and efficiency. High-Resolution Inputs. For high-resolution images, we use Stable Diffusion Inpainting (SDI) [35] to generate contextually plausible replacements. Given image x, mask M j ∈ {0, 1}H×W , and a generic prompt P, the intervention is \hat {x}_j=\mathcal {D}_{\theta }(x,M_j,P),

(4)

where Dθ denotes the diffusion inpainting model. Pixels outside M j remain unchanged, while masked content is replaced: \hat {x}_j(p)= \begin {cases} x(p), & M_j(p)=0,\\ \mathcal {D}_{\theta }(x,M_j,P)(p), & M_j(p)=1. \end {cases}

(5)

Rather than recovering the original region, which may preserve the trigger, SDI generates a plausible replacement that suppresses its influence. This is well suited to high-resolution natural images such as Caltech-101 [12] and ImageNet [10]. Low-Resolution Inputs. For low-resolution images, diffusion reconstruction can introduce unnecessary overhead with limited contextual benefit. We therefore use the lightweight Telea algorithm [40], implemented by cv2.inpaint: \hat {x}_j= \operatorname {Inpaint}_{\mathrm {Telea}}(x,M_j,r),

(6)

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

7

where r is the inpainting radius. Masked pixels are reconstructed from neighboring known pixels Nr (p): \hat {x}_j(p)= \begin {cases} x(p), & M_j(p)=0,\\[1mm] \displaystyle \frac {\sum _{q\in \mathcal {N}_r(p)}w(p,q)x(q)} {\sum _{q\in \mathcal {N}_r(p)}w(p,q)}, & M_j(p)=1, \end {cases}

(7)

where w(p, q) denotes the spatial weights used to propagate neighboring information. This provides an efficient intervention for low-resolution datasets such as CIFAR-10 [24]. For S = {s j }Jj=1 , the procedure produces X̂ = {x̂ j }Jj=1 . TRIM subsequently queries the black-box classifier with these interventions and uses the prediction responses to verify trigger-related regions before final purification.

4.3

Trigger Detection, Isolation, and Purification

This stage identifies candidate regions associated with backdoor behavior and selectively removes their influence from the input. TRIM performs three operations: (i) candidate filtering and region-level verification, (ii) feature-based caching to avoid redundant analysis, and (iii) mask aggregation followed by selective purification. 1. Candidate Filtering and Trigger Verification. A prediction change after suppressing an image region does not necessarily indicate a backdoor trigger, since removing task-relevant content can also alter the classifier’s decision. TRIM therefore filters candidate regions before prediction-based verification. Specifically, large regions likely to correspond to primary objects or dominant background content are excluded from trigger analysis. When cached representations are available, candidate embeddings are additionally compared with previously analyzed benign and trigger-related regions to avoid redundant evaluation. For each remaining candidate segment si , we use the intervention image x̃i generated in Sec. 4.2, in which only si is suppressed and reconstructed. Let f (·) denote the protected black-box classifier. We obtain y_0=f(x), \qquad y_i=f(\tilde {x}_i),

(8)

where y0 and yi are the predictions for the original and intervened inputs, respectively. We define the region-level verification indicator as d_i=\mathbf {1}\!\left [y_i\neq y_0\right ],

(9)

where 1[·] denotes the indicator function. A candidate with di = 1 is flagged as suspicious because suppressing the corresponding region changes the model decision, providing evidence that the region influences the backdoored prediction. Candidates with di = 0 are not flagged by the current intervention. Importantly, prediction change is used as a verification signal after candidate filtering, rather than as the sole criterion for trigger localization. 2. Trigger Isolation and Feature Caching. To reduce redundant computation across subsequent inputs, TRIM maintains two feature-memory pools, B and T , containing embeddings of previously analyzed benign and trigger-related regions, respectively. Given a candidate embedding zi and a cached representation z j , their similarity is measured using the Radial Basis Function (RBF) kernel: \kappa (z_i,z_j) = \exp \!\left (-\gamma \|z_i-z_j\|_2^2\right ),

(10)

8

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

where γ controls sensitivity to feature distance. For a memory pool C ∈ {B, T }, we compute \rho _i(\mathcal {C}) = \max _{z_j\in \mathcal {C}}\kappa (z_i,z_j).

(11)

If the similarity to a cached representation exceeds a threshold τ (τ = 0.9 in our experiments), its previous assignment can be reused, avoiding redundant reconstruction and classifier queries. Otherwise, the candidate undergoes region-level verification, and its embedding is subsequently added to the corresponding memory pool. The cache therefore becomes progressively more informative as additional regions are analyzed, reducing repeated processing of recurring visual patterns. 3. Mask Aggregation and Selective Purification. After region-level verification, the masks of all flagged regions are combined into a single purification mask: M_{\mathrm {pur}} = \bigvee _{i:\,d_i=1} M_i,

(12)

W

where denotes the pixel-wise union of the verified masks. The intermediate variants x̃i are used only to assess individual region influence; they are not retained as final purified inputs. Instead, TRIM performs a single final purification of the original image over Mpur , thereby limiting unnecessary modification of benign content. The purification operator is selected according to the input resolution. Stable Diffusion Inpainting (SDI) is used for high-resolution natural images, whereas cv2.inpaint provides a lightweight alternative for low-resolution inputs. The final purified image is x_{\mathrm {pur}} = \mathcal {P}(x,M_{\mathrm {pur}}),

(13)

where P(·) denotes the selected reconstruction operator. The protected classifier then produces the final prediction f (xpur ). During evaluation, purification is considered successful when this prediction recovers the ground-truth class. To limit over-sanitization, regions exceeding a predefined area threshold are excluded from verification and purification because they are more likely to represent primary objects or dominant scene content. We select this threshold empirically through the sensitivity analysis reported in Table 6. Multi-Trigger Behavior and Limitation. When multiple triggers occur in the same input, TRIM evaluates their regions independently. If one trigger dominates the model’s prediction, suppressing a weaker trigger alone may not cause a prediction change, leaving it undetected in that image. However, once the dominant trigger is detected, its representation is cached; in subsequent images containing the same dominant pattern, TRIM can reuse the cached decision and focus verification on the remaining candidates, increasing the likelihood of detecting weaker or non-dominant triggers. For attacks whose trigger consists of multiple spatially distributed components, removing even a subset of these components can weaken the collective trigger effect sufficiently to alter the prediction, allowing the corresponding regions to be identified and purified. Nevertheless, interacting non-dominant triggers that individually produce no measurable prediction change within a single previously unseen input remain a limitation of the current region-wise verification strategy. Deployment Efficiency. Although TRIM involves segmentation, region-level reconstruction, and black-box classifier queries, candidate filtering and feature caching reduce redundant computation, while final purification is restricted to the union of verified regions. The

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

9

framework also supports different computational operating points: high-quality segmentation and diffusion-based reconstruction prioritize reconstruction fidelity, whereas lightweight components such as MobileSAM [50] and cv2.inpaint provide substantially faster alternatives. We therefore characterize TRIM as deployment-tunable rather than universally real-time. Detailed latency and computational analyses are reported in Table 8.

5

Experiments and Results

We conduct extensive experiments to address five questions: (Q1) How effectively does TRIM suppress diverse backdoor attacks while preserving clean accuracy? (Q2) Does TRIM generalize across attack objectives, trigger sizes, locations, and generation mechanisms? (Q3) How reliably does its region-level intervention identify and purify trigger-related regions while preserving benign content? (Q4) How do the segmentation threshold and feature caching affect robustness and efficiency? (Q5) What is the computational overhead of the complete defense pipeline?

5.1

Experimental Settings

Datasets. We evaluate TRIM on CIFAR-10 [24] and ImageNet-10 [21], covering low- and high-resolution settings. CIFAR-10 images are bilinearly upsampled from 32 × 32 to 224 × 224 to provide sufficient granularity for segmentation. ImageNet-10 contains 13,394 images (9,469 training and 3,925 validation) resized to 256 × 256. Together, these datasets evaluate TRIM across different resolutions and visual complexities. Backdoor Attacks. We consider diverse trigger constructions: BadNets [16], Blended [8], Label-Consistent (LC) [41], Physical [45], Dynamic [36], Distributed (DBA) [47], InputAware [33], and VSSC [42], covering localized, blended, physical, dynamic, distributed, and sample-specific triggers. We also evaluate a multi-trigger setting containing two spatially separated triggers to assess the region-wise verification limitation discussed in Sec. 4.3. Attack Objectives. We evaluate All-to-One (A2O), All-to-All (A2A), and untargeted (UT) attacks. A2O maps triggered samples to one target class, A2A maps each source class to a predefined incorrect class, and UT considers any incorrect prediction successful. These settings evaluate robustness across different attack objectives. Backdoored Model Preparation. Unless otherwise specified, 10% of training samples are poisoned with the corresponding trigger and jointly trained with clean samples. ResNet-50 is the primary protected classifier. During inference, TRIM accesses only its predictions, without parameters, gradients, activations, or training data. Evaluation Metrics. We primarily report Attack Success Rate (ASR) and Clean Accuracy (CA). ASR measures successful attacks on triggered samples, while CA measures accuracy on clean inputs. We additionally report False Positive Rate (FPR), Detection Accuracy (DA), Purified Accuracy (PA), and Artifact Ratio (AR). AR measures visual artifacts introduced on benign inputs: \mathrm {AR} =\frac {N_{\mathrm {artifact}}}{N_{\mathrm {clean}}}\times 100\%.

(14)

Implementation Details. We use SAM ViT-H for segmentation and pretrained ResNet-18 for independent region-level feature encoding. Embeddings are ℓ2 -normalized before RBF comparison. Unless otherwise specified, the cache threshold is τ = 0.9 and the segmentarea threshold is 0.25 (Table 6). Low-resolution images use cv2.inpaint, whereas highresolution images use Stable Diffusion inpainting.

10 AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

Table 1: Comparison of TRIM vs. baselines on various attack modes for CIFAR-10 and ImageNet-10 with 3×3-pixel triggers. Bold indicates best performance (↑ higher CA, ↓ lower ASR). All values are percentages (%). TRIM results are reported as mean±standard deviation over five independent random seeds. No Defense

ShrinkPad

ZIP

FLARE

CA↑

CA↑ ASR↓

CA↑ ASR↓

CA↑ ASR↓

BadNets Blended Physical LC Dynamic

91.29 97.17 70.37 7.42 90.98 100.00 41.66 7.10 93.72 99.99 86.12 10.13 92.03 99.01 85.11 9.13 91.41 93.53 83.42 10.34

78.84 5.56 82.54 3.62 77.32 23.66 80.13 88.20 82.11 55.13

82.31 72.17 73.34 57.14 67.13

Average

91.89

97.94

73.34

8.82

80.19 35.23

70.42 18.62

85.83 ± 0.66 3.77 ± 0.42

BadNets Blended Physical LC Dynamic

85.12 83.26 79.75 75.16 84.63

96.03 99.97 88.64 97.16 10.46

72.15 65.02 77.09 37.89 62.80

8.43 19.50 76.15 77.78 10.11

67.67 63.15 61.19 54.16 61.28

13.23 88.12 20.03 81.36 10.31

81.20 19.45 68.14 20.03 16.33 6.37 53.11 9.55 81.74 12.20

78.68 ± 0.82 77.12 ± 0.91 78.37 ± 0.88 71.50 ± 0.95 78.37 ± 1.02

Average

81.58

78.45

62.99 38.39

61.49 42.61

60.20 13.52

76.81 ± 0.92 5.06 ± 0.58

ImageNet-10

CIFAR-10

Dataset Attack

ASR↓

12.09 17.80 17.89 11.30 34.00

TRIM (Ours) CA↑

ASR↓

87.22 ± 0.58 87.87 ± 0.64 84.50 ± 0.71 82.53 ± 0.66 87.01 ± 0.73

3.30 ± 0.41 6.13 ± 0.52 4.70 ± 0.47 1.16 ± 0.28 3.56 ± 0.44

5.98 ± 0.61 6.12 ± 0.67 5.18 ± 0.56 2.10 ± 0.36 5.90 ± 0.72

Environmental Setup. Experiments use Ubuntu 20.04, an NVIDIA RTX 4090 (24 GB), Intel i9-13900K (24 cores), and 128 GB RAM, with Python 3.10, PyTorch 2.1.0/CUDA 12.1, OpenCV 4.8.0, and SAM ViT-H.

5.2

Comparison with Baseline Defenses

Table 1 compares TRIM with ShrinkPad, ZIP, and FLARE under the standard attack configuration. TRIM consistently achieves a strong robustness–utility trade-off: on CIFAR10, it reduces average ASR from 97.94% to 3.77% while retaining 85.83% CA, and on ImageNet-10, from 78.45% to 5.06% while maintaining 76.81% CA. In contrast, competing defenses can substantially sacrifice clean accuracy; for example, under ImageNet-10 Physical, FLARE achieves 6.37% ASR with only 16.33% CA, whereas TRIM achieves 5.18% ASR with 78.37% CA. Although ZIP performs better for CIFAR-10 Blended (3.62% vs. 6.13% ASR), TRIM provides more consistent performance across attacks. To assess statistical robustness, we repeat all TRIM experiments over five seeds and report mean±standard deviation. The low variability, e.g., 87.22 ± 0.58% CA/3.30 ± 0.41% ASR on CIFAR-10 BadNets and 78.68 ± 0.82%/5.98 ± 0.61% on ImageNet-10 BadNets, further indicates stable performance across runs.

5.3

Robustness Across Attack Objectives

CIFAR-10. Table 2 evaluates whether the effectiveness of TRIM depends on the attacker’s target-label strategy. Across A2O, A2A, and UT attacks, TRIM achieves average ASRs of 4.71%, 4.56%, and 4.04%, respectively, while maintaining average CAs of 86.53%, 84.86%, and 80.03%. Thus, its effectiveness does not rely on a fixed A2O target mapping. Several individual cases further illustrate the robustness–utility trade-off. ShrinkPad attains higher CA for Physical A2O and Physical UT, but its corresponding ASRs increase to 10.13% and 27.50%, respectively. ZIP obtains the lowest ASR for Blended A2O (3.62%) and Blended A2A (4.13%), but its robustness varies considerably across the remaining set-

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES 11

Mode

No Defense

ShrinkPad

CA ↑

ASR ↓

CA↑

ASR ↓

CA↑

ASR ↓

CA↑

ASR ↓

CA↑

ASR ↓

A2O

BadNets Blended Physical

91.29 90.98 93.72

97.17 100.00 99.99

70.37 41.66 86.12

7.42 7.10 10.13

78.84 82.54 77.32

5.56 3.62 23.66

82.31 72.17 73.34

12.09 17.80 17.89

87.22 87.87 84.50

3.30 6.13 4.70

Average BadNets Blended Physical

91.99 90.88 90.24 92.11

99.05 89.15 83.67 91.40

66.05 70.10 49.93 84.98

8.88 8.60 40.10 18.60

79.57 80.76 77.12 79.17

10.95 15.24 4.13 33.56

75.94 81.95 72.17 74.00

15.93 13.07 17.80 13.89

86.53 87.00 81.30 86.29

4.71 3.41 8.07 2.20

Average BadNets Blended Physical

91.08 89.45 90.12 89.20

88.07 89.31 80.13 93.45

68.34 69.54 44.17 81.80

22.43 13.60 47.10 27.50

79.68 79.55 78.32 79.31

18.98 17.93 9.88 30.19

76.04 81.56 74.11 74.09

14.92 12.69 14.74 12.32

84.86 76.15 85.76 78.19

4.56 2.32 6.93 2.87

Average

89.59

87.63

66.23

29.40

79.06

19.33

76.59

13.25

80.03

4.04

UT

Attack

A2A

Table 2: Comparison of TRIM vs. baselines on various attack modes for CIFAR-10. Bold indicates best performance (↑ higher CA, ↓ lower ASR). All values are percentages (%). ZIP

FLARE

TRIM (Ours)

Table 3: Comparison of TRIM vs. baselines on various attack modes for ImageNet-10. Bold indicates best performance (↑ higher CA, ↓ lower ASR). All values are percentages (%). Mode

A2O

A2A

Attack

No Def. CA↑ ASR↓

ShrinkPad CA↑ ASR↓

ZIP CA↑ ASR↓

FLARE CA↑ ASR↓

TRIM CA↑ ASR↓

BadNets Blended Physical Avg

85.12 83.26 79.75 82.04

96.03 99.97 88.64 94.21

72.15 8.43 65.02 19.50 77.09 76.15 71.89 34.69

67.67 63.15 61.19 64.12

81.20 19.45 68.14 20.03 16.33 6.37 55.22 15.28

78.68 77.12 78.37 78.06

5.98 6.12 5.18 5.76

BadNets Blended Physical Avg

73.92 70.16 74.76 72.95

46.56 58.13 48.65 51.78

70.06 7.65 67.11 15.15 74.98 39.69 70.19 20.83

70.74 7.13 67.98 23.30 73.45 30.87 70.38 20.43

72.03 69.56 25.37 55.64

74.71 68.47 73.69 72.29

6.14 9.20 5.35 6.90

13.23 88.12 20.03 40.46

21.89 29.08 13.43 21.47

tings. In contrast, TRIM maintains ASR below 8.1% in every reported CIFAR-10 attackmode configuration. ImageNet-10. Table 11 shows a similar trend at higher resolution. TRIM achieves average ASRs of 5.76% and 6.90% under A2O and A2A, respectively, while retaining average CAs of 78.06% and 72.29%. In comparison, FLARE attains average CAs of only 55.22% and 55.64% in the corresponding settings. These results suggest that region-selective intervention remains effective across different attack objectives and image resolutions.

5.4

Robustness to Trigger Size

To examine sensitivity to trigger scale, we additionally evaluate 7 × 7 triggers on CIFAR-10. Table 4 shows that TRIM achieves an average ASR of only 1.07%, compared with 13.06%, 63.93%, and 7.06% for ShrinkPad, ZIP, and FLARE, respectively. At the same time, TRIM retains an average CA of 85.49%. For the Physical attack, for example, TRIM reduces ASR to 1.79% while retaining 86.70% CA. Under LC, it obtains 0.87% ASR and 82.56% CA. These results indicate that the region-based defense remains effective when the trigger scale differs from the primary evaluation configuration.

12 AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

Table 4: Comparison of TRIM vs. baselines on CIFAR-10 dataset with larger 7×7-pixel triggers. Bold indicates best performance (↑ higher CA, ↓ lower ASR). All values are percentages (%). ShrinkPad

ZIP

FLARE

TRIM (Ours)

Attack

CA ↑

ASR ↓

CA ↑

ASR ↓

CA ↑

ASR ↓

CA ↑

ASR ↓

CA ↑

ASR ↓

CIFAR-10

No Defense

Dataset

BadNets Physical LC

82.31 89.12 78.79

98.99 97.77 94.17

70.37 79.76 79.15

9.42 12.10 17.67

76.90 53.16 76.18

39.12 71.12 81.56

49.83 29.60 57.54

8.12 4.90 8.17

87.20 86.70 82.56

0.55 1.79 0.87

Average

83.41

96.98

76.43

13.06

68.75

63.93

45.66

7.06

85.49

1.07

Table 5: Comparison of TRIM with baseline defenses under diverse backdoor attacks on CIFAR-10 and ImageNet-10. Bold indicates best performance (↑ higher CA, ↓ lower ASR, ↓ lower FPR). All values are percentages (%). Dataset

Attack

CIFAR-10

Two Triggers 89.73 91.56 71.50 38.50 10.20 79.50 19.80 7.80 81.80 11.50 6.10 84.13 3.45 5.16 Distributed (DBA) 86.45 88.21 72.80 19.60 7.50 78.20 18.20 7.00 83.00 7.20 3.95 84.56 2.03 2.92 Input-Aware 90.56 98.12 69.90 47.30 11.50 77.60 31.40 9.30 83.50 21.60 6.90 86.03 16.34 5.06

ImageNet-10 VSSC

5.5

No Defense ShrinkPad ZIP FLARE TRIM (Ours) CA↑ ASR↓ CA↑ ASR↓ FPR↓ CA↑ ASR↓ FPR↓ CA↑ ASR↓ FPR↓ CA↑ ASR↓ FPR↓

84.17 91.61 68.50 58.90 11.00 66.90 41.20 9.40 80.20 35.60 8.20 78.73 5.13

6.19

Generalization to Diverse Trigger Constructions

Table 5 extends the evaluation beyond conventional fixed patch triggers to multi-trigger, distributed, input-aware, and semantic trigger constructions. Without defense, these attacks remain highly effective, reaching ASRs of up to 98.12%. TRIM substantially reduces attack success across all evaluated settings. For CIFAR-10, ASR decreases from 97.17% to 3.30% for a single trigger, from 91.56% to 3.45% when two triggers coexist, and from 88.21% to 2.03% for DBA. The corresponding FPRs remain between 2.92% and 5.16%. On ImageNet-10, TRIM reduces VSSC ASR from 91.61% to 5.13% while maintaining 78.73% CA. Input-aware triggers constitute the most challenging evaluated setting: although TRIM reduces ASR from 98.12% to 16.34%, the residual ASR is higher than for the other attacks. This result exposes an important limitation: highly sample-specific patterns are less likely to match cached trigger representations and can be more difficult to isolate using region-wise intervention. We therefore report this case explicitly rather than claiming uniform robustness across all trigger-generation mechanisms. The two-trigger result further shows that TRIM can identify and purify multiple spatially separated suspicious regions in many cases. However, as discussed in Sec. 4.3, region-wise prediction-change verification may miss a weaker trigger when another dominant trigger independently maintains the backdoored prediction. The multi-trigger experiment should therefore be interpreted as empirical robustness under the evaluated configuration rather than a guarantee for arbitrary interacting triggers.

5.6

Sensitivity and Component Analysis

Effect of Segment-Area Threshold. Table 6 studies the effect of the segment-area threshold on the number of evaluated regions, computational cost, artifact ratio (AR), and postpurification ASR. The results reveal a clear trade-off: restrictive thresholds reduce candidate regions and computational cost but may miss trigger-related regions, increasing residual

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES 13

(a) BadNets.

(b) Physical.

(c) LC.

(d) Dynamic.

Figure 2: TRIM performance under poisoning rates of 5%–20% on CIFAR-10 and ImageNet-10, reporting DA, PA, and ASR for BadNets, Physical, LC, and Dynamic attacks.

Seg. Area

ASR. In contrast, permissive thresholds process more regions and risk modifying benign semantic content. For both CIFAR-10 and ImageNet-Table 6: Effect of the segment-area threshold on the 10, ASR is minimized around average number of segments per image, inference-time thresholds of 0.2–0.3. We there- inpainting cost (T ), AR, and post-purification ASR. fore set 0.25 as the default threshCIFAR-10 ImageNet-10 old, balancing robustness and artiSegs T(ms) AR ASR Segs T(s) AR ASR fact preservation, and fix it across 0.1 2.81 3.02 2.30 7.5 47.82 6.71 0.60 10.5 0.2 3.71 3.68 2.77 2.1 51.01 7.17 1.00 3.2 all remaining experiments without 0.3 4.24 4.06 3.18 2.0 52.70 7.40 1.60 3.0 attack-specific tuning. 0.4 4.56 4.35 3.50 3.5 53.93 7.57 2.20 5.0 AR complements ASR by quan4.83 4.62 3.75 4.8 54.74 7.68 2.70 6.2 0.5 0.6 5.05 4.83 4.00 5.6 55.31 7.76 3.10 7.5 tifying unintended changes to clean 0.7 5.20 5.01 4.20 6.3 55.81 7.83 3.50 8.3 inputs: a configuration with low 0.8 5.28 5.06 4.35 7.0 55.99 7.86 3.90 9.0 ASR but high AR would indi0.9 5.34 5.12 4.50 7.8 56.13 7.88 4.20 9.8 1.0 6.39 6.32 5.00 8.5 57.25 8.04 4.50 10.6 cate overly aggressive purification, whereas low AR with high ASR would indicate insufficient trigger removal. We assess reconstruction artifacts using SSIM [44] and LPIPS [51], together with manual inspection of flagged cases. Robustness Across Poisoning Rates. Figure 2 evaluates TRIM across poisoning rates of 5%–20%. Across BadNets, Physical, LC, and Dynamic attacks, DA and PA remain stable, while ASR stays below 6%. For BadNets, DA remains above 82% and ASR ranges from 3.0% to 5.9%. For Physical attacks, DA ranges from approximately 80% to 94%, while ASR remains between 4.4% and 5.3%. LC yields ASR between approximately 1% and 3.35%, and Dynamic attacks remain between 3.10% and 4.60%. These results indicate that TRIM’s effectiveness is relatively stable over the evaluated poisoning-rate range rather than being tied to the default 10% training-poisoning configuration. Effectiveness of Feature Caching. Table 7 quantifies Table 7: Percentage reduction of the computational benefit of RBF-based feature inpainted segments as the number caching. At initialization, all candidate regions require of processed images increases. analysis. As the cache accumulates previously verified Images Proc. CIFAR-10 ImageNet-10 benign and trigger-related representations, the fraction 0 100.00 100.00 50 78.54 93.16 of regions requiring inpainting decreases substantially. 100 37.12 75.78 After 1,000 processed images, only 10.23% of candi250 31.50 69.49 500 17.23 49.98 date regions on CIFAR-10 and 27.66% on ImageNet750 11.05 32.11 10 require inpainting, compared with 100% initially. 1000 10.23 27.66 This result provides direct evidence for the role of fea-

14 AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

Table 8: Per-image runtime, peak VRAM usage, and computational cost (FLOPs) of major components in the proposed TRIM defense pipeline on ImageNet-10-scale inputs. Results are reported on a single GPU. Category Segmentation Feature Extraction Inpainting Inference I/O & Masking

Component SAM ViT-H Segmentation MobileSAM ResNet-18 Feature Extraction ResNet-50 Feature Extraction RBF Similarity Matching Stable Diffusion 2 Inpainting cv2.inpaint Classifier Query (ResNet-18) Classifier Query (ResNet-50) I/O + Mask Post-processing

Time (s) 0.53 0.022 0.02 0.04 0.001 5.87 0.020 0.02 0.04 0.003

VRAM (GB) 7.00 0.08 0.04 0.10 < 0.01 4.85 0 0.04 0.10 0

FLOPs (G) 2.7 × 103 3.9 × 101 1.8 4.1 5 × 10−3 1.7 × 104 5 × 10−3 1.8 4.1 –

ture caching in reducing repeated reconstruction and black-box classifier queries. The larger remaining fraction on ImageNet-10 is consistent with its greater visual diversity, which yields fewer repeated region representations than CIFAR-10.

5.7

Computational and Deployment Analysis

Table 8 reports the per-component runtime, peak VRAM usage, and FLOPs of TRIM. The results clarify that computational cost depends strongly on the selected segmentation and reconstruction modules. SAM ViT-H requires 0.53 s and approximately 7.00 GB of peak VRAM per ImageNet10-scale input, whereas MobileSAM reduces segmentation time to 0.022 s with 0.08 GB. Feature extraction and RBF matching introduce comparatively small overhead. The dominant cost in the high-fidelity configuration is Stable Diffusion inpainting, requiring approximately 5.87 s per reconstruction and 4.85 GB of VRAM. In contrast, cv2.inpaint requires approximately 0.020 s. These measurements show that TRIM should not be characterized as universally realtime when diffusion-based reconstruction is enabled. Instead, the framework provides a configurable robustness–latency trade-off: SAM ViT-H and diffusion inpainting prioritize segmentation and reconstruction quality, whereas MobileSAM and classical inpainting provide a substantially lighter deployment configuration. Feature caching further reduces amortized cost by decreasing the number of candidate regions requiring reconstruction as more inputs are processed.

6

Conclusion

We presented TRIM, a black-box inference-time defense that detects and mitigates backdoor attacks without access to model parameters, training data, or clean validation sets. By combining semantic segmentation, segment-level features, and selective inpainting, TRIM localizes and removes trigger regions to restore correct predictions. Experiments on CIFAR10 and ImageNet-10 show that TRIM significantly reduces ASR—from 97.94% to 3.77% and from 78.45% to 5.06%, respectively—while maintaining high clean accuracy. Compared with ShrinkPad, ZIP, and FLARE, TRIM provides stronger protection against diverse triggers, including small, large, blended, and spatially sparse patterns.

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES 15

References [1] Ahmed Abdelnaby and Mohamed Elmahallawy. Region-level black-box defense against stealthy embedding-space backdoors in clip. In Pacific-Asia Conference on Knowledge Discovery and Data Mining, pages 240–255. Springer, 2026. [2] Hiroki Azuma and Yusuke Matsui. Defense-prefix for preventing typographic attacks on clip. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3644–3653, 2023. [3] Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International conference on artificial intelligence and statistics, pages 2938–2948. PMLR, 2020. [4] Yang Bai, Gaojie Xing, Hongyan Wu, Zhihong Rao, Chuan Ma, Shiping Wang, Xiaolei Liu, Yimin Zhou, Jiajia Tang, Kaijun Huang, et al. Backdoor attack and defense on deep learning: A survey. IEEE Transactions on Computational Social Systems, 12(1): 404–434, 2024. [5] Mauro Barni, Kassem Kallas, and Benedetta Tondi. A new backdoor attack in cnns by training set corruption without label poisoning. In 2019 IEEE International Conference on Image Processing (ICIP), pages 101–105. IEEE, 2019. [6] Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728, 2018. [7] Weixin Chen, Baoyuan Wu, and Haoqian Wang. Effective backdoor defense by exploiting sensitivity of poisoned samples. Advances in Neural Information Processing Systems, 35:9727–9737, 2022. [8] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017. [9] Yukun Chen, Shuo Shao, Enhao Huang, Yiming Li, Pin-Yu Chen, Zhan Qin, and Kui Ren. Refine: Inversion-free backdoor defense via model reprogramming. arXiv preprint arXiv:2502.18508, 2025. [10] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. [11] Khoa Doan, Yingjie Lao, and Ping Li. Backdoor attack with imperceptible input and latent modification. Advances in Neural Information Processing Systems, 34:18944– 18957, 2021. [12] Li Fei-Fei, Rob Fergus, and Pietro Perona. Learning generative visual models from few training examples: An incremental bayesian approach tested on 101 object categories. In 2004 conference on computer vision and pattern recognition workshop, pages 178– 178. IEEE, 2004.

16 AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

[13] Kuofeng Gao, Yang Bai, Jindong Gu, Yong Yang, and Shu-Tao Xia. Backdoor defense via adaptively splitting poisoned dataset. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 4005–4014, 2023. [14] Yansong Gao, Bao Gia Doan, Zhi Zhang, Siqi Ma, Jiliang Zhang, Anmin Fu, Surya Nepal, and Hyoungshick Kim. Backdoor attacks and countermeasures on deep learning: A comprehensive review. arXiv preprint arXiv:2007.10760, 2020. [15] Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. Figstep: Jailbreaking large vision-language models via typographic visual prompts. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23951–23959, 2025. [16] Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733, 2017. [17] Jiyang Guan, Jian Liang, and Ran He. Backdoor defense via test-time detecting and repairing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24564–24573, 2024. [18] Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. Scaleup: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. arXiv preprint arXiv:2302.03251, 2023. [19] Jonathan Hayase, Weihao Kong, Raghav Somani, and Sewoong Oh. Spectre: Defending against backdoor attacks using robust statistics. In International Conference on Machine Learning, pages 4129–4139. PMLR, 2021. [20] Linshan Hou, Wei Luo, Zhongyun Hua, Songhua Chen, Leo Yu Zhang, and Yiming Li. Flare: Towards universal dataset purification against backdoor attacks. IEEE Transactions on Information Forensics and Security, 2025. [21] Jeremy Howard. Imagenette: A smaller subset of 10 easily classified classes from imagenet. https://github.com/fastai/imagenette, 2020. [22] Huayang Huang, Qian Wang, Xueluan Gong, and Tao Wang. Orion: Online backdoor sample detection via evolution deviance. In IJCAI, pages 864–874, 2023. [23] Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C Berg, Wan-Yen Lo, et al. Segment anything. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4015–4026, 2023. [24] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. [25] Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In International conference on machine learning, pages 19730–19742. PMLR, 2023.

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES 17

[26] Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, and Xinpeng Zhang. Invisible backdoor attacks on deep neural networks via steganography and regularization. IEEE Transactions on Dependable and Secure Computing, 18(5):2088–2105, 2020. [27] Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Antibackdoor learning: Training clean models on poisoned data. Advances in Neural Information Processing Systems, 34:14900–14912, 2021. [28] Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. arXiv preprint arXiv:2101.05930, 2021. [29] Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: A survey. IEEE transactions on neural networks and learning systems, 35(1):5–22, 2022. [30] Xiaogeng Liu, Minghui Li, Haoyu Wang, Shengshan Hu, Dengpan Ye, Hai Jin, Libing Wu, and Chaowei Xiao. Detecting backdoors during the inference stage based on corruption robustness consistency. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16363–16372, 2023. [31] Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In 25th Annual Network And Distributed System Security Symposium (NDSS 2018). Internet Soc, 2018. [32] Wanlun Ma, Derui Wang, Ruoxi Sun, Minhui Xue, Sheng Wen, and Yang Xiang. The" beatrix”resurrections: Robust backdoor detection via gram matrices. arXiv preprint arXiv:2209.11715, 2022. [33] Tuan Anh Nguyen and Anh Tran. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems, 33:3454–3464, 2020. [34] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 8748–8763. PmLR, 2021. [35] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684– 10695, 2022. [36] Ahmed Salem, Rui Wen, Michael Backes, Shiqing Ma, and Yang Zhang. Dynamic backdoor attacks against machine learning models. In 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P), pages 703–718. IEEE, 2022. [37] Kun Shao, Junan Yang, Yang Ai, Hui Liu, and Yu Zhang. Bddr: An effective defense against textual backdoor attacks. Computers & Security, 110:102433, 2021. [38] Yucheng Shi, Mengnan Du, Xuansheng Wu, Zihan Guan, Jin Sun, and Ninghao Liu. Black-box backdoor defense via zero-shot image purification. Advances in Neural Information Processing Systems, 36:57336–57366, 2023.

18 AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

[39] Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. The german traffic sign recognition benchmark: a multi-class classification competition. In The 2011 international joint conference on neural networks, pages 1453–1460. IEEE, 2011. [40] Alexandru Telea. An image inpainting technique based on the fast marching method. Journal of graphics tools, 9(1):23–34, 2004. [41] Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771, 2019. [42] Ruotong Wang, Hongrui Chen, Zihao Zhu, Li Liu, Yong Zhang, Yanbo Fan, and Baoyuan Wu. Robust backdoor attack with visible, semantic, sample-specific and compatible triggers. 2023. [43] Tong Wang, Yuan Yao, Feng Xu, Shengwei An, Hanghang Tong, and Ting Wang. Backdoor attack through frequency domain. arXiv preprint arXiv:2111.10991, 2021. [44] Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE transactions on image processing, 13(4):600–612, 2004. [45] Emily Wenger, Josephine Passananti, Arjun Nitin Bhagoji, Yuanshun Yao, Haitao Zheng, and Ben Y Zhao. Backdoor attacks against deep learning systems in the physical world. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6206–6215, 2021. [46] Justus Westerhoff, Erblina Purelku, Jakob Hackstein, Jonas Loos, Leo Pinetzki, Erik Rodner, and Lorenz Hufe. Scam: A real-world typographic robustness evaluation for multimodal foundation models. arXiv preprint arXiv:2504.04893, 2025. [47] Chulin Xie, Keli Huang, Pin-Yu Chen, and Bo Li. Dba: Distributed backdoor attacks against federated learning. ICLR, 2020:1–19, 2020. [48] Dizhan Xue, Shengsheng Qian, and Changsheng Xu. A unified framework for backdoor trigger segmentation. IEEE Transactions on Image Processing, 2026. [49] Yanxin Yang, Chentao Jia, DengKe Yan, Ming Hu, Tianlin Li, Xiaofei Xie, Xian Wei, and Mingsong Chen. Sampdetox: Black-box backdoor defense via perturbationbased sample detoxification. Advances in Neural Information Processing Systems, 37: 121236–121264, 2024. [50] Chaoning Zhang, Dongshen Han, Yu Qiao, Jung Uk Kim, Sung-Ho Bae, Seungkyu Lee, and Choong Seon Hong. Faster segment anything: Towards lightweight sam for mobile applications. arXiv preprint arXiv:2306.14289, 2023. [51] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586–595, 2018. [52] Zaixi Zhang, Qi Liu, Zhicai Wang, Zepu Lu, and Qingyong Hu. Backdoor defense via deconfounded representation learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12228–12238, 2023.

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES 19

[53] Mingli Zhu, Siyuan Liang, and Baoyuan Wu. Breaking the false sense of security in backdoor defense through re-activation attack. Advances in Neural Information Processing Systems, 37:114928–114964, 2024. [54] Zihao Zhu, Mingda Zhang, Shaokui Wei, Bingzhe Wu, and Baoyuan Wu. Vdc: Versatile data cleanser based on visual-linguistic inconsistency by multimodal large language models. arXiv preprint arXiv:2309.16211, 2023.

20 AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

Appendix A

Evaluation of TRIM on Additional Datasets

To further demonstrate TRIM’s robustness, generalizability, and purification effectiveness, we extend our evaluation to a broader set of datasets covering both low- and high-resolution settings. For low-resolution data, we use CIFAR-100 [24], which contains 60,000 images of size 32×32 across 100 fine-grained classes, offering a more diverse and challenging classification problem than CIFAR-10. For high-resolution evaluation, we adopt Caltech-101 [12], which contains around 9,000 images spanning 101 object categories with varied shapes, textures, and backgrounds; its higher resolution of 300×200 and intra-class variability introduce additional complexity for trigger localization and purification. We also include GTSRB [39] (German Traffic Sign Recognition Benchmark), consisting of over 50,000 traffic sign images with significant variations in illumination, viewpoint, occlusion, and resolutions ranging from 15×15 to 250×250 pixels – a setting where localized triggers can be especially difficult to distinguish from natural patterns. Together, these datasets allow us to assess TRIM’s performance across diverse visual domains, resolutions, and structural complexities. In Table 9, we observe that TRIM consistently suppresses ASR across diverse datasets and attack types while preserving strong CA. Classical backdoor attacks such as BadNets and Blended, which typically achieve extremely high ASR (95–99%), are almost completely neutralized by TRIM, with post-defense ASR reduced to 0.34–6% in most settings. For more challenging scenarios, including Physical attacks and higher-variability datasets such as GTSRB and Caltech-101, TRIM still achieves substantial reductions in the attack success rate. For instance, on GTSRB, ASR drops from 99.21% to 4.22%, and on Caltech-101, from 95.33% to 2.26%, demonstrating that TRIM remains effective even when triggers blend naturally with complex backgrounds or high-resolution content. Notably, CA remains stable—and in some cases slightly improves—after purification, reaching 99.01%, indicating that TRIM avoids over-purification and preserves task-relevant visual features. These results collectively highlight the robustness, generality, and scalability of TRIM across heterogeneous datasets, resolutions, and trigger designs.

B

Sensitivity Analysis

Table 10 presents a sensitivity analysis of several key hyperparameters used in TRIM. Experiments are conducted on a subset of ImageNet-10 with a poisoning rate of 10%, where a physical patch trigger of size 24 × 24 pixels is applied. Additionally, in this analysis, SDI is used to reconstruct suspicious regions detected through segmentation and similarity filtering; however, cv2.inpaint can also be used for faster processing. The table reports CA, ASR without defense (w/o defense), ASR with defense (w/ defense), the average number of generated segments per image (Segs.), and the average defense time per image in seconds (Td ). The segmentation ratio controls the proportion of candidate regions selected for purification. Lower values (e.g., 0.15) concentrate the defense on the most suspicious regions, preserving CA (78.5%) while significantly reducing post-defense ASR to 3.6%. In contrast, larger ratios increase the number of processed segments and may degrade CA due to unnecessary modifications. The similarity threshold determines when two segments are considered redundant based on the RBF feature similarity. Higher thresholds (e.g., 0.95) avoid repeated purification

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES 21

Table 9: Comparison of TRIM and the no-defense baseline on MNIST, CIFAR-100, GTSRB, and Caltech-101. We report clean accuracy (CA, ↑) and attack success rate (ASR, ↓) for three backdoor attacks (BadNets, Blended, and Physical).

BadNets

Blended

Physical

Dataset

Setting

CA ↑

ASR ↓

CA ↑

ASR ↓

CA ↑

ASR ↓

MNIST

w/o defense TRIM

98.19 99.01

99.67 0.34

97.19 95.24

99.89 3.43

97.54 97.13

99.14 0.23

CIFAR-100

w/o defense TRIM

76.15 77.43

99.49 6.36

73.34 71.21

99.90 10.08

70.15 68.14

98.40 5.32

GTSRB

w/o defense TRIM

97.03 95.78

97.86 3.14

96.13 89.13

97.89 6.45

96.98 87.78

99.21 4.22

Caltech-101

w/o defense TRIM

89.93 85.46

88.42 1.31

85.78 86.05

92.65 9.94

88.78 86.81

95.33 2.26

of similar regions, improving efficiency while maintaining strong attack mitigation. The minimum SAM mask area (i.e., 32) controls the smallest region retained after segmentation. Increasing this value filters out very small segments, reducing segmentation density and improving runtime, although overly large thresholds may remove useful region boundaries. The mask merging IoU threshold determines when overlapping masks are combined. Moderate values (e.g., 0.5) provide a balance between segmentation precision and region compactness, whereas extreme values may either fragment or over-merge regions. Finally, the number of SAM sampling points per side controls segmentation granularity: fewer points generate coarser masks with faster runtime, while larger values produce more detailed segmentation at the cost of higher computation. Overall, the results indicate that the proposed framework remains robust across a wide range of parameter settings, while moderate segmentation ratios and similarity thresholds provide the best trade-off between clean accuracy preservation, attack mitigation, and computational efficiency.

C

Comprehensive Comparison Across Attack Modes for ImageNet-10

As shown in Table 11, the five evaluated defenses exhibit markedly different behaviors across both A2One and All2All attack settings. Without any defense, the models suffer from extremely high ASR values (e.g., 96.03% for A2One BadNets and 99.97% for A2One Blended), indicating that ImageNet-scale backdoor attacks remain highly effective on unprotected models. Traditional input-level defenses such as ShrinkPad and ZIP reduce the ASR to moderate levels (e.g., ShrinkPad achieves 8.43% ASR for A2One BadNets and 7.65% ASR in All2All), but these gains often come at the cost of reduced clean accuracy, with average CA dropping to 71.89% and 70.19% for A2One and A2A, respectively. FLARE shows mixed behavior: while it suppresses ASR in some cases (e.g., 6.37% for A2One Physical), its average CA remains substantially lower, especially under complex different attack settings (e.g., A2One average CA of only 55.22%). In contrast, our TRIM

22 AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

Table 10: Sensitivity analysis of defense hyperparameters on an ImageNet-10 subset under 10% poisoning with a 24 × 24 physical patch trigger. CA (%), ASR w/o defense (%), and ASR w/ defense (%) denote clean accuracy and attack success rate before and after applying the defense. Segs. is the average number of segments and Td (s) is the runtime per image.

Experiment

Without Defense CA↑ ASR↓

CA↑

With Defense ASR↓ Segs.↓

Td (s)↓

0.15 0.35 0.50 0.75

79.11 79.11 79.11 79.11

Segmentation Ratio 90.7 78.5 3.6 90.7 62.0 9.3 90.7 38.2 12.1 90.7 37.4 12.4

0.80 0.85 0.90 0.95

79.11 79.11 79.11 79.11

Similarity Threshold 90.7 24.9 11.8 90.7 46.2 11.8 90.7 62.0 9.3 90.7 73.1 6.4

51.83 51.83 51.83 51.83

6.89 6.98 7.19 7.39

32 64 128

79.11 79.11 79.11

SAM Minimum Area 90.7 62.0 9.3 90.7 62.0 9.3 90.7 60.3 9.8

51.83 51.83 48.84

7.21 7.19 2.14

79.11 79.11 79.11

Mask Merge IoU 90.7 60.6 90.7 62.0 90.7 55.5

18.1 9.3 10.4

44.69 51.83 58.07

7.03 7.20 7.36

79.11 79.11 79.11

SAM Points Per Side 90.7 64.3 9.5 90.7 62.0 9.3 90.7 62.6 8.7

31.37 51.83 61.54

6.05 6.20 10.36

0.30 0.50 0.70 16 32 64

49.04 51.83 53.36 53.69

7.09 7.19 7.32 7.36

defense consistently delivers the strongest robustness–utility trade-off. TRIM achieves the lowest average ASR across all settings (5.76% for A2One and 6.90% for All2All) while simultaneously maintaining high clean accuracy comparable to the undefended model (e.g., 78.06% CA for A2One and 72.29% CA for All2All). These results demonstrate that TRIM effectively removes or neutralizes trigger regions without degrading semantic content, providing reliable resilience against diverse backdoor attacks on ImageNet-10.

D

Grad-CAM Ablation: Trigger Effects and TRIM’s Response

To better understand how different trigger types influence model behavior—and how TRIM’s purification rectifies these effects—we conduct a Grad-CAM ablation study on both GTSRB and ImageNet-10 samples (Fig. 3). For GTSRB, we evaluate a ResNet-18 classifier under

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES 23

Table 11: Comparison of TRIM vs. baselines on various attack modes for ImageNet-10. Bold indicates best performance (↑ higher CA, ↓ lower ASR). All values are percentages. No Def. CA↑ ASR↓

ShrinkPad CA↑ ASR↓

ZIP CA↑ ASR↓

FLARE CA↑ ASR↓

TRIM CA↑ ASR↓

BadNets Blended Physical Avg

85.12 83.26 79.75 82.04

96.03 99.97 88.64 94.21

72.15 8.43 65.02 19.50 77.09 76.15 71.89 34.69

67.67 63.50 61.19 64.12

81.20 19.45 68.14 20.03 16.33 6.37 55.22 15.28

78.68 77.12 78.37 78.06

5.98 6.12 5.18 5.76

BadNets Blended Physical Avg

73.92 70.16 74.76 72.95

46.56 58.13 48.65 51.78

70.06 7.65 67.11 15.15 74.98 39.69 70.19 20.83

70.74 7.13 67.98 23.30 73.45 30.87 70.38 20.43

72.03 69.56 25.37 55.64

74.71 68.47 73.69 72.29

6.14 9.20 5.35 6.90

Attack Method

A2O

A2A

13.23 88.12 20.03 40.46

21.89 29.08 13.43 21.47

Figure 3: Grad-CAM ablation for single- and multi-trigger backdoor attacks. Top: GTSRB samples on ResNet-18 with a BadNets yellow square (class 1 → class 2) and a physicalstyle patch (class 1 → class 5). Bottom: ImageNet-10 samples on ResNet-50 with BadNets (Tench → Cassette Player) and physical (Tench → Gas Pump) triggers. Clean images exhibit coherent, object-centered attention, while backdoored images show localized or dispersed saliency shifts around injected patches. TRIM removes the dominant trigger in a single purification pass, realigning model attention with the true semantic object.

two settings: (i) a single-trigger BadNets yellow square that flips Speed Limit 30 (class 1) to Speed Limit 50 (class 2), and (ii) a multi-trigger configuration that combines the same BadNets patch with a small physical-style noise square placed in the top-left corner, redirecting class 1 to Speed Limit 80 (class 5). In a realistic deployment, TRIM performs only one purification pass per image, removing the first detected trigger. Handling multiple triggers would require purifying and evaluating multiple image variants, which would increase inference time. As a result, in the two-

24 AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

(a) Poisoned Image.

(b) Cassette player door re- (c) Red piece removed (d) Black box at bottom moved (Class not changed). (Class not changed). right removed (Class not changed).

(e) Mouse removed (Class (f) Paper removed (Class (g) Base of PC monitor re- (h) Yellow square trigger not changed). not changed). moved (Class not changed). removed (Class changed to cassette player).

Figure 4: Qualitative inpainting results on the ImageNet-10 dataset. (a) Original image poisoned with a BadNets trigger flipping “Cassette Player door” to “Tench.” Subfigures (b– h) illustrate the effect of sequentially removing individual objects or regions until the trigger is detected and purified.

trigger scenario, the BadNets patch is consistently detected first—demonstrating that certain triggers exert stronger influence than others and that detection naturally proceeds from dominant to weaker triggers across test-time samples. A parallel evaluation on ImageNet-10 using ResNet-50 follows the same structure: a BadNets patch flips Tench to Cassette Player, and in the multi-trigger setting, a physical patch induces Tench to Gas Pump. Across both datasets, Grad-CAM visualizations reveal a consistent pattern: clean images show focused, object-centric attention; single- and multi-trigger images exhibit localized or dispersed saliency around the injected patches; and purified images restore attention to the true semantic object—returning to the center of the traffic sign in GTSRB and to the fish in ImageNet-10. These results confirm that TRIM reliably suppresses trigger-induced distortions and reinstates clean, human-aligned model reasoning, even under heterogeneous and stronger multi-trigger attacks.

E

Ablation Study on TRIM’s Detection and Purification Pipeline

To clearly illustrate how TRIM analyzes, isolates, and removes backdoor triggers, we provide a qualitative ablation study on both high-resolution ImageNet-10 samples and lowresolution GTSRB traffic-sign images. Figure 4 shows an ImageNet-10 example where the input is poisoned with a BadNets trigger (a yellow square in the bottom-right corner), causing the classifier to mislabel the image from “Cassette Player” to “Tench.” TRIM sequentially removes individual objects or regions (cassette-door, red piece, mouse, paper, monitor base, etc.). As shown in subfigures (b)–(g), removing benign captured regions does not change the predicted class, demonstrating that TRIM does not overreact to normal spatial variations.

AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES 25

(a) Original image with (b) Character O removed (c) Character P removed (d) Top sign pole removed physical-style trigger. (Class not changed). (Class not changed). (Class not changed).

(e) Character T removed (f) Character S removed (g) Bottom sign pole re- (h) Trigger removed (Class (Class not changed). (Class not changed). moved (Class not changed). changed to Stop Sign).

Figure 5: Qualitative inpainting results for the GTSRB dataset. (a) Original image poisoned with a physical-style trigger flipping “Stop Sign” to “Turn Left.” Subfigures (b–h) show the effect of sequentially removing individual objects or regions until the trigger is detected and purified.

However, once the yellow-square trigger region is removed (Fig. 4h), the model’s prediction immediately corrects to the true label “Cassette Player,” confirming that TRIM successfully isolates the malicious region responsible for misclassification. Similarly, Figure 5 illustrates the step-by-step purification process on a poisoned GTSRB sample, where a physical-style trigger flips a “Stop Sign” to “Turn Left.” Subfigures (b)–(g) illustrate the removal of alphabetic characters or structural elements of the sign— none of which affect the model’s prediction. Only when the physical-style trigger is removed (Fig. 5h) does the label revert from the attacker-enforced target (“Turn Left”) back to the correct class (“Stop Sign”). This validates that TRIM reliably detects trigger-induced perturbations even under low-resolution, highly compressed settings. Across both datasets of different resolutions, TRIM (1) accurately localizes subtle, spatially blended, or physically printed triggers, (2) avoids modifying clean or semantically essential regions, and (3) restores correct predictions with minimal visual distortion. These ablations highlight the robustness and precision of TRIM’s region-level detection and purification mechanism.

F

Evaluating TRIM’s Effectiveness Against Modern Typographic Attacks

Typographic attacks [2, 15] and the recently introduced SCAM dataset [46] embed adversarial text directly into the visual scene, creating small but highly influential labels. These

26 AHMED ABDELNABY AND MOHAMED ELMAHALLAWY: BEYOND SMALL PATCHES

Figure 6: Qualitative evaluation of TRIM against real and synthetic typographic attacks. The top row (before purification) shows that adversarial text cues—including bicycle, cow, cable, and slow—successfully mislead modern ViT classifiers and VLMs by overriding the true semantics of fire extinguishers, hats, signs, glasses, kettles, and clocks. Real SCAM attacks (handwritten labels) and Synth-SCAM attacks (digitally created labels) both produce strong misclassification. The bottom row (after purification) demonstrates that TRIM reliably removes these malicious triggers while preserving the underlying visual content, restoring correct, object-consistent predictions across all settings. blended texts exploit the strong textual biases learned by vision transformer (ViT) classifiers and Vision–Language Models (VLMs) [25, 34], causing predictions to align with the injected text rather than the underlying object. Figure 6 illustrates this vulnerability across three settings: No Scam (clean images with a blank sticky note), SCAM (handwritten labels), and Synth-SCAM (digitally composited labels). Even in the No Scam case, the model misclassifies a fire extinguisher as a car before purification, highlighting inherent fragility in the visual backbone. In the before-purification row, models are consistently misled: a fire extinguisher labeled as car, hats as bicycle, no smoking sign as cow, glass as cable, and household items as slow or cow, demonstrating that minimal text cues or learned biases can override robust visual evidence. After applying TRIM, adversarial text cues are effectively removed while preserving natural image structures. In the No Scam case, TRIM restores the correct label fire extinguisher, with similar recovery across SCAM and Synth-SCAM examples. The after-purification row confirms that predictions return to object-consistent labels for all categories, including fire extinguisher, hat, no-smoking sign, glasses, kettle, and clock. These results demonstrate that TRIM generalizes beyond pixel-level triggers, reliably defending against multimodal semantic manipulations. Overall, TRIM provides a unified, model-agnostic defense suitable for both white-box and black-box settings, significantly enhancing the robustness and trustworthiness of modern Vision–language systems.

Related documents

• Benign on Label, Malicious by Design: Clean-Label Dormant-to-Activated Backdoor via Machine Unlearning with Removable Camouflage#414046
• An Empirical Study of Output-to-Input Loops for Black-Box Backdoor Detection in Fine-Tuned Open-Weight LLMs#447893
• Retrofit: Continual Learning with Controlled Forgetting for Binary Security Detection and Analysis#612876
• Retrofit: Continual Learning with Controlled Forgetting for Binary Security Detection and Analysis#611399
• OPBackdoor: Opportunistic Backdoors via Alibi-Aligned Reasoning#1051225