The ISC International Journal of Information Security

Abstract Backdoor attacks pose a significant threat to deep learning systems by injecting hidden malicious behavior to the model while preserving high accuracy on clean data. Such attacks are particularly dangerous in scenarios where users rely on pre-trained models or outsource training to untrusted parties. In this work, we propose a practical defense strategy that assumes no knowledge of the backdoor trigger or the training process, relying on a small trusted clean dataset. Our method introduces a two-stage pipeline: First, we aggregate predictions from multiple potentially compromised models to train an intermediate Teacher-Aggregation (TA) model; then, we distill this knowledge into a compact light-weight student model. This multi-stage approach effectively alleviates backdoor effects while preserving clean accuracy. Experimental results on MNIST and CIFAR-10 demonstrate that our method significantly reduces the Attack Success Rate (ASR)—to approximately 0.1% on MNIST and 2.6% on CIFAR-10—outperforming baseline ensemble defenses. Furthermore, our lightweight student model is suitable for edge deployment, providing a generic and scalable defense that remains robust under minimal assumptions, making it well-suited for real-world applications in adversarial environments. Our code is available at: https://github.com/mr-pylin/backdoor-toolbox

Abstract Face manipulation techniques have raised widespread public concern. Although conventional convolutional neural networks (CNNs) demonstrate satisfactory performance, they exhibit limitations in capturing the critical features that are directly affected by manipulation artifacts. Fake faces often exhibit unnatural correlations between feature maps, particularly in local patterns. The Gram matrix can illustrate these irregularities in feature map relationships and support discrimination between real and fake images. In this paper, we show that the relationships among convolutional neural network feature maps typically display natural and coherent patterns; in contrast, manipulated faces tend to disrupt this consistency, which can be effectively captured by analysing the Gram matrix of the feature maps. Experimental results demonstrate that the proposed correlation-based features achieve satisfactory performance in both single-dataset and cross-dataset validation.