Backdoor detection stops reading only the last layer: CLEAR fuses cross-layer extreme responses for 99.54% average TPR on Tiny-ImageNet
Synopsis
CLEAR moves backdoor sample detection from single-layer activations to cross-layer extreme responses: batch normalization statistics align hidden-layer features to a common scale, each channel's spatial minimum becomes the anomaly representation, and particle swarm optimization searches layer weights. On CIFAR-10 and Tiny-ImageNet, CLEAR reaches average true positive rates of 97.54% and 99.54% with average false positive rates of 0.16% and 0.03%, above AC, SCALE-UP, AIBD and CCD; models retrained on its purified data stay close to benign accuracy.
Interpretation
Backdoor sample detection no longer relies only on penultimate-layer activations; channel-wise extreme responses from several hidden layers are concatenated into one cross-layer representation that captures diluted trigger traces. Most prior detectors use features from a single hidden layer or input-output mappings, so under low poisoning rates, stealthy triggers and A2A or UT attacks the anomalous signal is spread across depths and single-layer features miss it. On CIFAR-10 and Tiny-ImageNet, CLEAR reaches average true positive rates of 97.54% and 99.54% with average false positive rates of 0.16% and 0.03%, while AC, SCALE-UP, AIBD and CCD reach average true positive rates of 11.96%, 28.36%, 39.21% and 41.23% on Tiny-ImageNet.
Layer weights are not set by hand; particle swarm optimization searches them under clustering-stability feedback so layers sensitive to backdoor responses receive larger weight. Choosing and weighting layers previously depended on prior knowledge or fixed rules, and generalization dropped when the poisoning rate varied or the trigger form was unknown. Each particle position is a set of layer attention weights, and fitness is the stability score of the most stable HDBSCAN microcluster after UMAP projection among clusters below the size threshold τ; experiments use 30 particles, 50 iterations and τ of 0.15.
Density clustering finally selects the most stable anomalous microcluster as the poisoned set, without a clean validation set or attack priors. Spectral-signature methods rely on SVD global principal components that benign features can overwhelm at low poisoning rates, and activation clustering assumes a predefined cluster structure and size distribution. On CIFAR-10 under A2A and UT, AC's true positive rate is generally near 0, whereas CLEAR reaches 100.00%, 99.43%, 99.92% and 95.66% on A2A BadNets, Blend, Trojan and WaNet.
Perspective
Experiments cover the CIFAR-10 and Tiny-ImageNet image-classification datasets, attacks BadNets, Blend, Trojan and WaNet, paradigms A2O, A2A and UT, a default poisoning rate of 10%, and mainly ResNet-18 with supplementary VGG-19 and MobileNet v2; the authors propose future work on text and speech tasks, DenseNet and Transformer architectures, and lower poisoning rates, multiple triggers, multiple targets and clean-label attacks.
On CIFAR-10 under UT, the Blend attack still shows a 42.71% attack success rate after CLEAR purification and retraining, which the authors say leaves a stronger residual backdoor effect warranting further study; VGG-19's shallower structure may reduce feature discriminability and misclassify some benign samples under untargeted attacks, and the authors suggest adjusting the anomalous-microcluster threshold to lower false positives.