Hui Li

CLEAR moves backdoor sample detection from single-layer activations to cross-layer extreme responses: batch normalization statistics align hidden-layer features to a common scale, each channel's spatial minimum becomes the anomaly representation, and particle swarm optimization searches layer weights. On CIFAR-10 and Tiny-ImageNet, CLEAR reaches average true positive rates of 97.54% and 99.54% with average false positive rates of 0.16% and 0.03%, above AC, SCALE-UP, AIBD and CCD; models retrained on its purified data stay close to benign accuracy.

CLEAR moves backdoor sample detection from single-layer activations to cross-layer extreme responses: batch normalization statistics align hidden-layer features to a common scale, each channel's spatial minimum becomes the anomaly representation, and particle swarm optimization searches layer weights. On CIFAR-10 and Tiny-ImageNet, CLEAR reaches average true positive rates of 97.54% and 99.54% with average false positive rates of 0.16% and 0.03%, above AC, SCALE-UP, AIBD and CCD; models retrained on its purified data stay close to benign accuracy.