# Model-agnostic clean-label backdoor mitigation in cybersecurity environments

Giorgio Severi  Northeastern University ,  Simona Boboila  Northeastern
University ,  John Holodnak  MIT Lincoln Laboratory ,  Kendra Kratkiewicz  MIT
Lincoln Laboratory ,  Rauf Izmailov  Peraton Labs and  Alina Oprea
Northeastern University

(2024)

###### Abstract.

The training phase of machine learning models is a delicate step, especially
in cybersecurity contexts. Recent research has surfaced a series of insidious
training-time attacks that inject backdoors in models designed for security
classification tasks without altering the training labels. With this work, we
propose new techniques that leverage insights in cybersecurity threat models
to effectively mitigate these clean-label poisoning attacks, while preserving
the model utility. By performing density-based clustering on a carefully
chosen feature subspace, and progressively isolating the suspicious clusters
through a novel iterative scoring procedure, our defensive mechanism can
mitigate the attacks without requiring many of the common assumptions in the
existing backdoor defense literature. To show the generality of our proposed
mitigation, we evaluate it on two clean-label model-agnostic attacks on two
different classic cybersecurity data modalities: network flows classification
and malware classification, using gradient boosting and neural network models.

††copyright: acmlicensed††journalyear: 2024††doi: XXXXXXX.XXXXXXX††conference:
Annual Computer Security Applications Conference; December 09–13, 2024;
Waikiki, HI††isbn: 978-1-4503-XXXX-X/18/06

##  1\. Introduction

Machine learning (ML) models power an ever growing variety of software
systems, including cybersecurity solutions intended to stop active adversaries
(Antonakakis et al., 2011; Oprea et al., 2018; Mirsky et al., 2018; Invernizzi
et al., 2014; Tamersoy et al., 2014; Microsoft, 2021; IBM, 2023; MalwareGuard
FireEye, 2020; Ingalls, 2021). The deployment of models in security-sensitive
contexts increases the relevance of adversarial machine learning risks, both
during inference, _evasion attacks_ , and during the training phase of the
model, _poisoning attacks_. Recent trends in ML practices, especially
concerning the growing size of datasets and increased reliance on data crowd-
sourcing (Carlini et al., 2024), and the widespread adoption of models as core
components in cybersecurity products have increased the public awareness (Siva
Kumar et al., 2020; ATLAS, 1999) of risks associated with training time
adversarial interference.

Existing research in this area of adversarial ML has primarily focused on the
computer vision domain. Seminal works such as (Biggio et al., 2012; Gu et al.,
2019), demonstrated different adversarial poisoning procedures designed for
various model architectures and targeted at achieving different adversarial
objectives. However, recent efforts by researchers have started exploring
possible strategies an adversary can use to compromise the integrity of models
developed for cybersecurity tasks through training process manipulation
(Severi et al., 2021; Yang et al., 2023; Severi et al., 2023).

We focus on mitigating backdoor attacks (Gu et al., 2019) in cybersecurity
settings. This type of attack aims to induce a victim model to memorize the
association between a predetermined data pattern – also called a _trigger_ or
backdoor – selected by the adversary, and a target class of the attacker’s
choice. If successful, the same pattern can then be presented to the model
during inference within any arbitrary data sample, triggering the target class
output.

We select backdoor attacks as our objective because we argue they pose a
particularly relevant threat to cybersecurity applications. These systems rely
on large datasets of labeled samples, often gathered through network
monitoring or crowdsourced feeds, providing opportunities for training data
manipulation. Moreover, backdoor attacks are inherently stealthy. The
adversary’s objective is not to simply disrupt the performance of a victim
model, which would lead to prompt discovery and potential remediation by the
model owners. Instead, the goal is to embed an arbitrary behavior – the
ability to trigger a desired output – in the learned model without altering
its normal behaviors on standard data points. This makes it particularly
difficult for a defender to realize that the victim model has been
compromised.

In this work, we consider two particularly insidious backdoor attacks
developed specifically to target ML models designed for cybersecurity tasks:
one aimed at subverting static malware classifiers (Severi et al., 2021), and
one geared towards automated traffic analysis systems (Severi et al., 2023).
Both attacks operate in a clean-label fashion, injecting the trigger pattern
only in a small amount of training points corresponding to benign data,
without requiring control over the training set labels. In addition, these
types of attacks are agnostic to the victim’s model type, and are applicable
to a variety of model architectures and data modalities used for security
classification tasks.

Our defensive approach leverages the information asymmetry between attacker
and defender in these scenarios to isolate the poisoned points while
maximizing the amount of _clean_ data retained for model training. Our method
revolves around an iterative scoring process on clustered data points in a
selected feature subspace, and we propose different analysis procedures to
remediate the effect of the poisoned clusters, able to reduce attack success
by up to 90% while preserving high utility, even at large poisoning rates up
to 5%. In contrast with most existing backdoor mitigation approaches, we do
not make specific assumptions on the victim model’s architecture, and our
approach is applicable to any classifier (not just neural networks). Moreover,
our defense removes another standard assumption often found in the literature:
requiring the defender to have access to a set of clean data points sampled
from the same distribution as the training data (Liu et al., 2018; Heng and
Soh, 2023; Qi et al., 2023).

To summarize, we make the following contributions:

  * •

We propose a novel defense mechanism against clean-label backdoor attacks in
cybersecurity domains. Our technique does not require access to clean trusted
data or knowledge of the victim’s model architecture, thus removing some
strong assumptions from previous works.

  * •

We demonstrate that our defense is generally applicable across various data
modalities (network flow traffic and binary files), and multiple model types,
such as neural networks, gradient boosting trees, and LightGBM classifiers.

  * •

We comprehensively evaluate our techniques against existing backdoor attacks
from previous literature. We show that our methods are able to reliably
identify and remove backdoor examples while preserving a high model utility
(F1 score) and low false positive rates.

  * •

For reproducibility, we evaluate our defense strategies on publicly available
datasets and open source attack implementations, and will release all the code
used to run the experiments in this paper.

##  2\. Related work

In this section, we provide related work on backdoor attacks and mitigations,
with a particular focus in the cybersecurity domain.

###  2.1. Backdoor attacks

Adversarial examples (Szegedy et al., 2014), also known as evasion attacks,
are the most well known typology of attacks, and likely the first line of
attack against modern machine learning models. In this setting, imperceptible
perturbations are applied to test samples in order to change the model’s
output label during deployment. Due to their immediate relevance in
adversarial contexts, these attacks have been studied in the security domain
for a relatively long time (Handley et al., 2001; Cao and Gong, 2017; Ayub et
al., 2020; Papadopoulos et al., 2021a; Chernikova and Oprea, 2022). More
recently, however, poisoning attacks against ML, which manipulate the training
set (or other training parameters), have emerged as a top concern in industry
(Siva Kumar et al., 2020). For a deep dive into adversarial machine learning
techniques we direct the interested reader to the comprehensive standardized
NIST taxonomy (Oprea and Vassilev, 2023).

In this work we focus on _backdoor_ poisoning attacks, a notably dangerous
technique that does not affect the model’s predictions on clean test data;
instead, by injecting a trigger pattern into a small fraction of the training
data, the adversary is able to control the model’s predictions whenever the
same trigger appears during model deployment. In their seminal work, Gu et al.
(Gu et al., 2019) used a small pixel-based trigger pattern to misclassify
images of handwritten digit and street sign classifiers. After that, more
realistic clean-label poisoning attacks that do not tamper with the label of
the backdoored examples have emerged (Shafahi et al., 2018; Turner et al.,
2019).

In cybersecurity, a series of backdoor attacks have been designed via packet-
level poisoning (Holodnak et al., 2022; Ning et al., 2022), feature-space
poisoning (Apruzzese et al., 2019; Li et al., 2018), and label flipping
(Papadopoulos et al., 2021b). Furthermore, model explanability techniques have
been used to develop clean-label backdoor attacks against malware classifiers
on Windows PE files, Android applications and PDF files (Severi et al., 2021).
Recently, Severi et al. (Severi et al., 2023) explored backdoor attacks on
network traffic, where data dependency constraints, which inherently exist in
traffic flows, make trigger mapping between feature and problem space
particularly difficult. While their attacks were shown to be successful in
various settings, no defense mechanism has been proposed.

###  2.2. Mitigations against backdoor attacks

Three main directions have emerged in the study of backdoor defenses. One
approach has focused on developing techniques to obtain certifiable robustness
guarantees to poisoning attacks, the second has looked at detecting and
filtering out poisoned samples before training the model, while the third aims
at directly purifying the poisoned model by unlearning the backdoor
association.

Certified defenses to poisoning attacks aim to provide rigorous mathematical
guarantees on model quality in the presence of poisons. In some of the first
work on certified defenses, Steinhardt et al. (Steinhardt et al., 2017)
construct approximate upper bounds on the loss using a defense based on
outlier removal followed by empirical risk minimization. They show that an
oracle defender who knows the true class mean is very powerful. However, a
data-dependent defender that uses the empirical means performs poorly at
filtering out attacks. Deep Partition Aggregation (DPA) (Levine and Feizi,
2021) splits the training dataset into $k$ partitions, which limits the number
of poisons that any one member of the ensemble can see. Unfortunately, the
number of partitions that are necessary can be high compared to the number of
poisons considered. To illustrate, using 250 partitions on CIFAR-10, DPA is
able to certify 50% of the dataset to just nine insertions/deletions applied
to the training set.

A related technique known as Deterministic Finite Aggregation (Wang et al.,
2022) provides modest improvements over DPA. In addition to the limited
guarantees, a large number of partitions may not be practical in many security
applications, as the number of malicious samples available is often small.
Randomized smoothing is a technique in which noise is added to the training
data to attempt “smooth-out” any adversarial perturbations introduced by an
attacker. However, the guarantees that are enabled are fairly small. Wang et
al. (Wang et al., 2020) are only able to certify 36% of MNIST against an
adversary that perturbs up to 2 pixels per image.

In the second category, a common detection strategy utilizes deep clustering,
which consists in partitioning on the learned representation of the neural
network. Chen et al. (Chen et al., 2018) propose _activation clustering_ , a
defense method that runs 2-means clustering on the activations of the last
hidden layer, then discards the smallest of the two clusters. Tran et al.
(Tran et al., 2018) propose a defense based on _spectral signatures_. This
method computes outlier scores using singular value decomposition of the
hidden layers, then removes the samples with top scores and re-trains. An
extension of this idea is used by the SPECTRE method (Hayase et al., 2021),
which introduces the idea of estimating the mean and covariance matrices of
the clean data, using robust statistics, and using these to whiten the data,
prior to computing the singular value decomposition.

The third category includes various pruning and fine-tuning methods aimed at
unlearning the backdoor pattern. Liu et al. (Liu et al., 2018) propose _fine-
pruning_ , a strategy that attempts to disable backdoor behavior by
eliminating less informative neurons prior to fine-tuning the model on a small
subset of clean data. Li et al. (Li et al., 2021) introduce _neural attention
distillation_ , a purifying method that utilizes a teacher network to guide
the fine-tuning of a backdoored student network on a small subset of clean
training data. In a recent study, Heng et al. (Heng and Soh, 2023) employ
_selective amnesia_ (SEAM), where catastrophic forgetting is induced by
retraining the neural network on randomly labeled clean data; after both
primary and backdoor tasks are forgotten, the randomized model is retrained on
correctly labeled clean data to recover the primary task. In Section 3.3
below, we evaluate a direct application of SEAM to the attacks we study, and
show the drawbacks of that defensive approach in our scenario. We note also
that a similar approach, based on randomized unlearning and detection is
proposed by Qi et al. (Qi et al., 2023).

Other approaches in the literature involve detecting if a model is backdoored
(ABS (Liu et al., 2019), MNTD (Xu et al., 2021)), detecting if a particular
label has been under attack (Neural Cleanse (Wang et al., 2019)), or
performing topological analysis of activations at multiple layers in a neural
network model (TED (Mo et al., 2024)). In cybersecurity settings, the only
defense we are aware of is Nested Training (Venkatesan et al., 2021; Ho et
al., 2022), a data sanitization method that relies on an ensemble of multiple
models, each based on different subsets of the training set. Nested Training
has been applied to poisoning availability and backdoor attacks in network
traffic and malware classifiers, but it incurs high cost and degradation in
model performance.

##  3\. Problem Statement

The goal of this paper is to study effective methods for defending against
backdoor attacks in cybersecurity environments. We are focusing on feasible
clean-label poisoning strategies that are not tailored to a specific model;
instead, they are applicable to a variety of model architectures and data
modalities used in security.

###  3.1. Setting

Compared to the task of protecting ML models designed for image classification
or natural language processing (NLP) tasks, operating in a security sensitive
environment presents both unique challenges and opportunities. To start with,
in this domain, an effective defensive approach has to be applicable to a wide
variety of models, such as decision-tree based ensembles, including Random
Forests and Gradient Boosting Trees, and neural network architectures. These
models are state-of-the-art in many security applications, such as malicious
domain classifiers (Oprea et al., 2018) and malware classification (Anderson
and Roth, 2018).

Moreover, the availability of a set of clean reference data points, a common
assumption in backdoor defense research (Zhu et al., 2023; Qi et al., 2023),
is not to be taken for granted. It may indeed be relatively simple for an
organization to obtain clean samples of images or natural language text, by
scraping the Internet or leveraging large scale crowd-sourcing systems such as
Amazon Mechanical Turk to gather annotations or filter out potentially
anomalous data points. However, ensuring that cybersecurity data has not been
tampered with requires potentially complex analyses by domain experts, which
is typically a significantly more expensive process.

Conversely, the intrinsic constraints of cybersecurity data modalities also
limit the attacker party. Thus, defensive measures designed for these models
can rely on different assumptions, which are unlikely to hold in other
domains. For instance, existing attacks (Severi et al., 2021, 2023) surfaced
feature importance estimation as a key component in the design of an effective
backdoor trigger. Triggers that do not leverage relevant features are usually
not effective to induce the mis-classification at deployment time, as
demonstrated by prior work (Severi et al., 2023). This intuition can, in turn,
be used by a defensive mechanism to reduce the scope of the detection task in
feature space.

Additionally, stealthy backdoor attacks on security classifiers tend to rely
on clean-label attack formulations, where the poison is injected in benign
data points, as the adversary often lacks the ability to interfere with the
labeling mechanism. This practice also has the added side effect of allowing
the poisoning points to blend in among the usually large variety of benign
points. While the variance in benign data can be problematic from a defensive
standpoint, this trend also implies that a defender can assume that the
poisoned samples are a subset of the benign training data.

###  3.2. Threat model

Our work focuses on defending binary classification models designed for
security applications, in particular tabular data classification on hand-
crafted feature representations. Therefore, the assumed _adversarial
objective_ is to ensure the ability to arbitrarily trigger the output of
_benign_ for an actually malicious data point chosen by the adversary. In a
practical setting this would correspond to the ability to evade the victim
classifier, and allow an undesired action on the system, such as the execution
of malware or the propagation of the malicious network flows.

Similarly, the _defender objective_ is to minimize, and potentially completely
disrupt, the success rate of the attacker. Parallel to this primary goal, the
defender also strives to minimize the side effects of their defensive strategy
on the performance of the model. Of high concern is the false positive rate
(FPR) — the fraction of benign points classified as malicious — of the model.
False positives are particularly expensive for security vendors, as they
result in direct interference with the normal operations of their clients, and
usually require a prompt investigation leading to overheads. Therefore, an
effective defensive mechanism should have minimal impact on the FPR of the
defended model.

####  3.2.1. Adversary capabilities

We consider different adversaries with the range of capabilities studied in
(Severi et al., 2021, 2023). In particular, the attacks assume the adversary
to be knowledgeable of the feature representation used by the victim model.
Moreover, the attacker is able to either query a version of the victim model,
or use a surrogate to estimate feature importance values. In all cases, the
attackers are also characterized by the ability to introduce a small amount of
poisoned samples in the training set, and a complete lack of control over the
labeling step of the training pipeline.

####  3.2.2. Defender capabilities

In contrast to previous work, we do not assume that the adversary is in
possession of a clean dataset distributed as the training set. While this
assumption can be true in some contexts (it is often rather easy to acquire,
or verify, clean data for image classification tasks), we argue that it
introduces large costs in the security domain, since manual analysis of the
data points is a task that requires domain experts. We do, however, assume the
defender has the computational resources required to perform clustering on the
training data and to train multiple models. Differently from computer vision
or natural language processing models, which are often billions of parameters
large, security models tend to be smaller, often based on ensembles of
decision trees and gradient boosting, making them relatively inexpensive to
re-train.

###  3.3. Challenges of existing defenses

Most backdoor defenses proposed in the literature are not immediately
applicable to cybersecurity. Security applications considered in this work
have unique characteristics, threat models, and assumptions that make applying
existing defenses difficult:

##### Different data modalities and model architectures

The majority of proposed mitigations have been specifically designed for the
computer vision domain where CNNs are state-of-the-art architectures (Chen et
al., 2018; Tran et al., 2018; Hayase et al., 2021; Mo et al., 2024).
Representative approaches for computer vision backdoor defenses are activation
clustering (Chen et al., 2018), spectral signatures (Tran et al., 2018), and
SPECTRE (Hayase et al., 2021) that perform outlier detection in the CNN
representation space via clustering, SVD decomposition, or robust statistics.
Prior work (Severi et al., 2021) tried to adapt these methods over the feature
space for defending against poisoning in malware classification, but they
showed that these defenses are not effective when they do not operate in the
model’s representation space.

##### Coarse-grained binary labels

The typical cybersecurity task is to distinguish malicious and benign samples,
resulting in a binary classification problem. Techniques that look for
shortcuts between classes in latent space and aim to identify a target attack
label, such as Neural Cleanse (Wang et al., 2019) and ABS (Liu et al., 2019),
require finer-grained labeling of the training data and thus cannot be readily
adapted to our setting.

##### Hard constraints on false positives

Models trained for cybersecurity tasks have hard constraints on false
positives to be deployed in production (Oprea et al., 2018). This requirement
rules out the application of certified defenses (Steinhardt et al., 2017; Wang
et al., 2020; Levine and Feizi, 2021; Wang et al., 2022) which largely degrade
model utility.

##### Applicable defenses

Among the defenses surveyed in Section 2.2, the only category that can be
applied in cybersecurity settings is the pruning or fine-tuning methods aimed
at unlearning the backdoor pattern (Liu et al., 2018; Li et al., 2021; Heng
and Soh, 2023; Qi et al., 2023). As discussed, all these approaches require
the availability of a clean dataset, an assumption not easily satisfied in our
setting. Nevertheless, we select a recent representative technique in this
category, Selective Amnesia (Heng and Soh, 2023), and show its limitations
when applied in this domain.

### Limitations of Selective Amnesia

Figure 1. Selective Amnesia defense applied to the attack against the CTU-13
Neris botnet classifier. The plots compare in attack success rates before and
after recovery, and the F1 score on test data, for different sizes of the
clean dataset. Attack run with Entropy feature selection.

Selective Amnesia defense applied to the attack against the CTU-13 Neris
botnet classifier. The plots compare in attack success rates before and after
recovery, and the F1 score on test data, for different sizes of the clean
dataset. Attack run with Entropy feature selection.

We adapt the Selective Amnesia (SEAM) defense (Zhu et al., 2023) on one of our
security scenarios, the CTU-13 Botnet detection task. Conceptually, SEAM works
by forcing the model to forget the association with the trigger by inducing
catastrophic forgetting through fine-tuning on randomly assigned labels
different from the ground truth. Once the model has forgotten both the primary
classification task, and the backdoor association, SEAM proceeds to fine-tune
the model on a held out clean dataset until the accuracy of the model is
restored.

Selective amnesia was designed for multi-class classification in vision tasks,
therefore we had to re-implement the method adapting it for our binary
classification task on security data. Moreover, SEAM requires the ability to
fine-tune a model on both mis-labeled points during the forgetting phase, and
on clean data during the recovery phase. Thus, we only tested it on our neural
network classifier, as the process of fine tuning different types of
classifiers (e.g., Random Forests, Gradient Boosting Trees) is not well
defined.

Figure 1 reports the results of SEAM applied to clean-label backdoor attacks
on security data, for different sizes — expressed as percentage of the
training set — of the held-out clean dataset. We observe that SEAM’s success
as a mitigation technique is strongly dependent on the size of the clean
dataset: 1% recover set size is insufficient to prevent the attack, while 5%
clean dataset size decreases the attack success rate from approximately 0.65
to 0.30. The defense becomes more effective, but still does not completely
thwart the attack, as the clean dataset size reaches 10%. Since, for
cybersecurity tasks, acquiring and validating large volumes of data is
markedly more expensive than in other domains such as NLP or computer vision,
we believe that there is a need for a mitigation approach that doesn’t
directly rely on access to clean data.

Figure 2. Pipeline of our defense strategy.

Pipeline for our defense strategy.

##  4\. Defense strategy

Guided by the considerations presented in Section 3, we develop a defensive
strategy aimed at protecting models designed for security classification tasks
against stealthy clean-label poisoning attacks. Our procedure for sanitizing
the training dataset proceeds in several stages, outlined in Figure 2. A more
detailed pseudo-code of our strategy is presented in Algorithm 1. Before
detailing each stage in the defense pipeline, we provide some key insights
that enable us to address the limitations of prior methods.

Dimensionality reduction: First, motivated by the observation that most clean-
label poisoning attacks in cybersecurity leverage important features (Severi
et al., 2021, 2023), we perform dimensionality reduction by selecting the most
relevant features for classification. For this stage, we use an entropy metric
computed on a decision tree model fitted to a subset of the data for
identifying the top contributing features, and perform our subsequent analysis
in this reduced space.

Density-based clustering: In the second stage, we perform clustering of
samples with the benign label in the reduced space, to identity the clean-
label poisoned samples. Our main insight is that poisoned samples lay in a
different subspace of the benignly labeled samples and they will cluster
together as they have similar values in the trigger. We leverage density-based
clustering to partition the training data based on similarity in feature
space. In contrast to centroid-based methods, density-based clustering
determines the number of clusters dynamically, can detect irregularly-shaped
clusters, and can handle both dense and sparse regions.

Iterative cluster scoring: Due to the stealthy nature of poisoning attacks,
poisoned clusters will be small in size. We can thus assume that the largest
cluster (usually including at least $50\%$ of the training set) consists of
clean benign samples, an assumption we will validate and confirm
experimentally. Hence, we select the largest cluster to initialize the clean
set and conduct an iterative process where we gradually select clean clusters
and re-train the model. The main challenge is identifying the poisoned
clusters during this iterative process, so that we can exclude them from model
training. After adding a set of clean clusters to the model in a particular
iteration, we evaluate the model loss on the remaining clusters. Intuitively,
clusters with lowest loss are closer to the (clean) training set. With this
insight, we progressively grow the clean set by adding the lowest-loss
clusters at each iteration.

Sanitization of high-loss clusters: Lastly, we employ a data sanitization step
to either filter or patch the high-loss clusters to protect the model against
poisoning. For the filtering strategy, we either stop the iterative process
after including a fixed percentage (e.g., 80%) of clusters in the training
set, or select a subset of clusters to exclude via loss analysis. For the
patching strategy, we include all clusters in training, but apply a patch to
the most relevant features in the highest loss clusters.

We now describe in details each stage of the defense pipeline.

###  4.1. Dimensionality reduction

Clustering high-dimensional data is affected by the curse of dimensionality –
as dimensionality increases, data points become more dissimilar or farther
from each other (Steinbach et al., 2004). Therefore, before running a
clustering technique, we first reduce the dimensionality of the data points to
a feature subset $\mathcal{F}$. Here we leverage the following insight about
the attack process: strong backdoor attacks choose features with high impact
over a model’s decisions (Severi et al., 2021, 2023). Hence, we reduce the
data set to the top $\mathcal{|F|}$ most important features.

We would like to compute feature importance in a model-agnostic fashion. In
tree-based models, entropy is used to decide which feature to split on at each
step in building the tree. The lower the entropy, the more beneficial the
chosen feature is. We employ a similar technique by mapping a surrogate
decision-tree model on our data and computing entropy-based feature importance
to rank the features and select the top most relevant ones. Specifically, in
our experiments, we reduce the network traffic and binary files datasets from
approximately 1100 and 2300 features, respectively, to top 4 and 16 most
important features.

###  4.2. Clustering

Our defense relies on a clustering procedure to isolate the compromised
training points. While previous work such as Chen et al. (Chen et al., 2018)
is tailored to deep neural network models — they apply clustering on the last
hidden layer representation of the neural network model to distinguish between
poisonous and legitimate data — we design a model-agnostic strategy.

We perform density-based clustering operating in the reduced feature space
$\mathcal{F}$, ensuring a broader applicability to multiple classification
models. We use OPTICS (Ordering Points To Identify the Clustering Structure)
(Ankerst et al., 1999) to find high-density cores and then expand clusters
from them. OPTICS automatically identifies the number of clusters, $k$,
present in the data and works better than the commonly used density-based
method DBSCAN (Ester et al., 1996) on clusters with different densities, a
characteristic that is particularly useful for our defense.

This approach reliably isolates the poisoned points into a few clusters.
However, the defender still does not know which clusters are corrupted.
Therefore, the next step of our defense consists of designing scoring and
filtering systems that can leverage the information advantage gained through
clustering.

###  4.3. Cluster loss analysis

Prior to discussing our cluster scoring methodology, we provide some intuition
as to how model loss behaves on the clustered dataset. Our strategy takes into
account two defining characteristics of stealthy backdoor attacks. First, the
adversary strives to minimize the attack footprint, i.e., the number of attack
points introduced in the training data. Therefore, we can conclude that
poisoned data points generally reside in relatively small clusters, while
larger clusters are mostly clean. Second, in an attempt to camouflage the
poisons as benign, the adversary inserts the backdoor into data points
belonging to the _benign_ class. Based on this insight, we compute the
clusters only over $D_{y=0}$ – target-class (benign) data, while the non-
target (malicious) training points $D_{y=1}$ can be assumed clean (i.e., not
containing the backdoor), and used to train surrogate models.

We anticipate that models trained on clean data will exhibit very high loss on
clusters containing poisoned data and models trained on poisoned data will
exhibit very low loss on clusters containing poisoned data. Assuming that the
largest cluster (which we denote as $C_{0}$) is likely to be clean, we
consider comparing the loss of a model on cluster $j$, when the models is
trained on $C_{0}\bigcup D_{y=1}$ versus when it is trained on $C_{0}\bigcup
C_{i}\bigcup D_{y=1}$, for each cluster $i$. If cluster $j$ contains poisons,
we anticipate that the change in loss will be small, apart from those few
clusters $i$ that also contain poisons. An example of carrying out this
procedure on a poisoned dataset that the defender has clustered is shown in
Figure 3, where cluster 11 consists of poisoned data and the remaining
clusters consist of clean data. The twenty clusters shown (out of about 700)
are those with the highest loss for a model trained on $C_{0}\bigcup D_{y=1}$.
Note that the model has high loss on cluster eleven when trained on
$C_{0}\bigcup D_{y=1}$ and exhibits almost no improvement except when the
model is trained on $C_{11}$. We observed that this method was often effective
at identifying clusters in our experiments, but it carries a high
computational cost as a model must be trained for each cluster. In some of our
experiments, we observed more than 1000 clusters, which motivated us to search
for a more efficient method to identify the poisoned clusters.

Figure 3. Row 0: Log-loss of model trained on $C_{0}\bigcup D_{y=1}$ and
evaluated on clusters $C_{j}$. Rows 1-20: Log-loss of model trained on
$C_{0}\bigcup C_{i}\bigcup D_{y=1}$ and evaluated on clusters $C_{j}$. Note
that cluster 11 consists of poisoned data and the remainder contain only clean
data. Experiment on CTU-13, gradient boosting classifier, attack run with
entropy feature selection.

Row 0: Log-loss of model trained on $C_{0}\bigcup D_{y=1}$ and evaluated on
clusters $C_{j}$. Rows 1-20: Log-loss of model trained on $C_{0}\bigcup
C_{i}\bigcup D_{y=1}$ and evaluated on clusters $C_{j}$. Note that cluster 11
consists of poisoned data and the remainder contain only clean data.
Experiment on CTU-13, gradient boosting classifier, attack run with entropy
feature selection.

###  4.4. Iterative cluster scoring

We develop an iterative scoring procedure where clean clusters are
progressively identified and added to the clean data set.

Our cluster scoring procedure is presented in Algorithm 1, lines 9-27. We
start by selecting the largest cluster $C_{0}$ out of the entire set of
clusters $C$ identified by OPTICS, and merging it with the malicious points,
to generate a temporary (small) clean training set, $D_{clean}\leftarrow
C_{0}\bigcup D_{y=1}$. Next, we train a clean model $f$ on $D_{clean}$, and
evaluate $f$’s average loss on each remaining cluster $C_{i}\in C\setminus
C_{0}$. We rank the clusters $C_{i}$ by loss, bearing in mind that, typically,
the lower the loss, the closer the cluster is to the training data
$D_{clean}$.

Having defined a fixed window size $w$ – we use $w=5\%$ of the clusters – we
construct an iterative filtering process as follows. We take the $w$ of the
clusters with the lowest average loss score on the clean model, and add their
data to the clean training set $D_{train}$. Then we re-train the surrogate
model $f$ on this new dataset and score the remaining clusters. This process
iteratively pushes the clusters that are less similar to the data assumed to
be clean to the bottom of the list, therefore isolating the clusters
containing poisoned data points.

At this point the defender could opt for a fixed threshold filtering strategy,
by stopping the iterative training and scoring process after a fixed
percentage of clusters has been added to $D_{clean}$. In our experiment, we
set this fixed threshold to 80% of the clusters, as we empirically find it to
be quite effective. However, based on the intuition developed in Section 4.3,
we expect the poisoned clusters to affect the loss of the model in a very
specific way when added to the training set. Therefore, we can proceed to look
for those clusters for which we observe significant changes between the loss
of the model computed on the cluster before it being introduced in $D_{clean}$
and after the model trained on it. By measuring these deltas in the loss for
each cluster, we can look for anomalous clusters using a standard statistical
approach, the Z-score111https://en.wikipedia.org/wiki/Standard_score.

In practice, we accumulate the loss deltas,
$\Delta_{i}=loss(f_{current},C_{i})-loss(f_{previous},C_{i})$, for each
cluster $i$ when it is included in $D_{clean}$ up to the 80% threshold. Then
we use the recorded values of $\Delta$ to compute mean $\mu$ and standard
deviation $\sigma$. Then we compute $z=\frac{x-\mu}{\sigma}$ for all the
clusters, define a threshold $z_{t}=2\sigma$, and apply our sanitization
procedure to those clusters with score $z<=z_{t}$.

###  4.5. Sanitization of high-loss clusters

The iterative process described above effectively isolates the poisoned
points. The final step of our defense consists in dealing with the isolated
clusters. We identify two main remediation procedures:  (i) discarding
clusters that have not been considered clean;  (ii) patching the data points
belonging to clusters that that have not been considered clean.  In Section 5
below, we show the effects of applying both strategies to the suspicious
clusters identified by each of the two methods, i.e., (a) clusters are
considered suspicious after a fixed number of iterations, and (b) the pre-
clustering loss deltas are analyzed to surface suspicious clusters.

The first strategy simply removes clusters that are considered suspicious from
the training set of the final model, thus preventing the poisoned points from
corrupting the model. This procedure has the advantage of being easy to
implement, but, depending on the number of clusters removed, may damage the
utility of the model, especially on uncommon test points.

The second approach aims at preserving as much utility of the model as
possible by still extracting information from points belonging to suspicious
clusters, while at the same time minimizing the effect of the attack. It
consists in applying a patch over the subspace of the $\mathcal{P}$ most
important features to each data point in the suspect clusters, while
maintaining unaltered the rest of the vector. Note that in general
$|\mathcal{P}|\geq|\mathcal{F}|$, as the defender can be conservative and
patch a larger portion of the feature space than the one used for clustering.

In our implementation, we randomly sample values for the patched features from
the set of points in $D_{clean}$, when $D_{clean}$ includes 80% of the
clusters. With the continuous evolution of generative modeling for tabular
data – for instance with applications of diffusion models to tabular
modalities –, however, the defender could design patching mechanisms that
could potentially lead to even larger gains in model utility. We leave the
exploration of this interesting research thread for future work.

1

2

Data: $D$: training data set in feature space;
$D_{y=0}$: the subset of $D$ labeled benign (examples may include trigger);
$D_{y=1}$: the subset of $D$ labeled malicious

3

4Procedure  _Defense(_$D$_)_:

5

6 // reduce the data set to the most important features

7 $\mathcal{F}\leftarrow\textsc{dimensionality\\_reduction}(D_{y=0})$

8 // partition the data set into clusters

9 $C\leftarrow\textsc{density\\_based\\_clustering}(\mathcal{F})$

10 // initialize the clean set with the largest cluster

11 $C_{0}\leftarrow max(C)$

12 // use model loss to isolate clusters that contain poisons

13 do

14

15 // current clean data (both benign and malicious)

16 $D_{clean}\leftarrow C_{0}\bigcup D_{y=1}$

17 // train a new clean model $f$ on $D_{clean}$

18 $f\leftarrow\textsc{train}(D_{clean})$

19 // remaining clusters to be scored and filtered

20 $C_{r}\leftarrow C\setminus C_{0}$

21 // dictionary of loss per cluster

22 $\mathcal{L}=\\{\\}$

23 //evaluate loss for each remaining cluster

24 for  _$i\in range(|C_{r}|)$_ do

25

26 // evaluate the average loss over all data points

27 // in cluster $C_{i}$ using the current clean model $f$

28 $\mathcal{L}[i]=\textsc{compute\\_loss}(f,C_{i})$

29 end for

30

31 // add cluster(s) with lowest loss to $C_{0}$ and repeat

32 $C_{l}\leftarrow\text{lowest loss cluster(s) from}\mathcal{L}$

33 $C_{0}\leftarrow C_{0}\bigcup C_{l}$

34 while  _$C_{0}\neq D||stop\\_condition$_ ;

35 // consider remaining clusters as suspicious

36 $C_{r}\leftarrow C\setminus C_{0}$

37 $C_{r}\leftarrow\textsc{patch\\_or\\_discard}(C_{r})$

38 // train the final purified model

39 $D_{clean}\leftarrow C_{0}\bigcup C_{r}\bigcup D_{y=1}$

40 $f\leftarrow\textsc{train}(D_{clean})$

41 $\texttt{{\bf return }}f$

42

43

Algorithm 1 Mitigation Procedure

##  5\. Evaluation

In this section we report the results obtained in our experimental evaluation.
We start with describing the experimental setup, and then we explore the
settings of network flows and binary files classification.

###  5.1. Experimental setup

We report here the results of evaluating our defensive approach on the attacks
proposed in (Severi et al., 2021, 2023). We use the experimental conditions
reported in the papers, and, following the original works, we test our defense
on different model types, such as neural networks, gradient boosting trees,
and LightGBM classifiers.

For generality, we apply our defense to two types of data: network flow
traffic and binary files. In particular, we run the network data poisoning
attack on the CTU-13 dataset for the Neris botnet detection task (García et
al., 2014), and the executable poisoning on the EMBER malicious Windows
Portable Executable file dataset (Anderson and Roth, 2018). Due to the large
number of experiments we run, to speed up the experimental phase, we subset
the EMBER dataset selecting randomly 10% of the original 600,000 labeled data
points, preserving the 50% class split.

####  5.1.1. Feature representation.

The network traffic datasets consist of NetFlow data, i.e., connection events
that have been extracted from packet-level PCAP files using the Zeek
monitoring tool (Paxson, 1999). The classifier uses a subset of the Zeek log
fields, which can be more effectively associated with intrusion, such as: IP
address, port, number of packets and payload bytes (for both originator and
responder), as well as protocol, service, timestamp, duration, and connection
state.

A sequence of this network log data (e.g., 30s time window) is mapped to a
feature-space data point using statistic-based aggregation techniques.
Statistical features are commonly used to analyse large volumes of traffic and
detect suspicious network activity (Moore et al., 2005; Yang et al., 2021;
Burkhart et al., 2010). In line with previous work (Ongun et al., 2021; Severi
et al., 2023), the statistical features we use are aggregated by time window,
internal IP and destination port and include several count-based metrics such
as: counts of connections per transport protocol and connection state, counts
of distinct external IPs communicating with each internal IP (as either
originator or responder). Sum, min, and max statistics of traffic volume
(packets/bytes) are also included.

For malware binary files, the classifier operates in the feature space
provided by the EMBER dataset (Anderson and Roth, 2018). A feature-space data
point contains information regarding both metadata (e.g., image, linker and
operating system version), as well as statistical information (e.g., number of
URLs and file system paths, and number of read, write and execute sections).

The full list of features is presented in Section A.1.

####  5.1.2. Attacks.

We evaluate our defense on the backdoor attacks proposed by Severi et al.
(Severi et al., 2023) against network flow classifiers. The attacks explore
both the entropy-based feature selection – through a surrogate decision tree –
method, and SHAP (Lundberg and Lee, 2017), a game-theory inspired explanation
technique that queries the model to compute feature relevance coefficients.
Two types of triggers are considered: 1) full trigger, a contiguous subset of
log connections where the backdoor pattern is embedded in the most important
features, and 2) generated trigger, a stealthier variant where poisons
resemble benign data. The generative trigger is constructed using Bayesian
network models with the goal of preserving data dependencies in the network
traffic, while attempting to blend the poisoned data with the underlying
training distribution.

In addition, we evaluate our defense against backdoor attacks that target
malware classifiers on Windows PE (Portable Executable) files. These attacks
are presented in (Severi et al., 2021). They leverage SHAP-based
explainability methods to guide the attacker towards the most informative
features used in the classification process. We have run these attacks using
their publicly available source code from GitHub.

####  5.1.3. Evaluation metrics.

In our experiments we are interested in a few key metrics. First we keep track
of the _attack success rate_ (ASR), that is defined in (Severi et al., 2021,
2023) as the percentage of backdoored test points, which would otherwise be
correctly classified as malicious by a clean model, which are misclassified as
benign by the poisoned model. We are also interested in recording the fraction
of poisoning points that manages to slip through our defenses, so we report
the _fraction of poisoning points_ that ends up being included in $D_{clean}$.

In addition to these metrics oriented at measuring the effect of the
mitigation on the attack, we also want to measure the side effects of our
mitigation on model utility. Therefore, we report the measured _F1 score_ and
_false positive rate_ (FPR) of the defended model on clean test data.

###  5.2. Evaluation on network traffic classification

Figure 4. Iterative scoring on the CTU-13 botnet classification task for the
_gradient boosting_ model. The plot shows average metrics for a set of
experiments: SHAP and Entropy attacker feature selection, for the Full trigger
attack, at 5 different poisoning rates.

Iterative scoring on the CTU-13 botnet classification task for the _gradient
boosting_ model. The plot shows average metrics for a set of experiments: SHAP
and Entropy attacker feature selection, for the Full trigger attack, at 5
different poisoning rates.

Figure 5. Iterative scoring on the CTU-13 botnet classification task for the
_neural network_ model. The plot shows average metrics for a set of
experiments: SHAP and Entropy attacker feature selection, for the Full trigger
attack, at 5 different poisoning rates.

Iterative scoring on the CTU-13 botnet classification task for the _neural
network_ model. The plot shows average metrics for a set of experiments: SHAP
and Entropy attacker feature selection, for the Full trigger attack, at 5
different poisoning rates.

Figure 4 and Figure 5 show the dynamics of the metrics we tracked across the
iterations, assuming a window size of 5% of the clusters. The reported metrics
are aggregated through averaging over multiple experiments, with two different
attack feature selection strategies (Entropy and SHAP), for the Full trigger
attack. The results are shown at 5 different poisoning percentages, and each
experiment is repeated 5 times with different random seeds.

####  5.2.1. Fixed threshold filtering

We start by considering the fixed threshold sanitization baseline. From the
figures we can observe that in the case of the full trigger attack, for both
gradient boosting model and neural network, interrupting the training when 80%
of the clusters has been added to the training set represents a good baseline
heuristic that filters out the vast majority of poisoning points. We also note
that the poisoning fraction used by the attacker has little influence on the
effectiveness of this procedure.

The generated trigger, on the other hand, is much stealthier, and a larger
fraction of poisoning points manages to pass through the filtering process at
these pre-defined thresholds, as highlighted in Figure 8 in Section A.2.
However, given that this attack is designed for stealthiness rather than
effectiveness, the attack success rate is limited even if a fraction of the
contaminants ends up in the training data. Finally, we note here that, as
initially observed in (Severi et al., 2023), the generated trigger for the
neural network model has a strong adversarial example effect at inference
time. That is, the trigger pattern itself induces the classifier to
misclassify the point, even if no poisoning attack took place. Therefore, this
case falls outside the scope of our defense, which is targeted at countering
backdoor poisoning attacks.

While effective at removing the poisons (ASR is ranging from 0.0% to 6.45%),
this baseline remediation strategy may reduce the utility of the models as a
side-effect of discarding the entire clusters below the threshold (including
their clean data). The F1 and FPR utility metrics reported in Table 7, Section
A.4 average from 0.02% to 0.21% for FPR, and 86% to 97% for F1.

####  5.2.2. Patching.

Table 1. Comparison of patching and filtering sanitization approaches at fixed
threshold = 80%. Gradient boosting model on the CTU-13 dataset. Also showing
the Base ASR value for the undefended attack. Results are averages of 5 runs
on different random seeds, for two attack strategies Entropy and SHAP.

Sanitization Poisoning Base ASR ASR Test FPR Test F1 Filtering 0.1% 50.70%
0.00% 0.21% 85.93% 0.5% 85.80% 6.45% 0.04% 94.84% 1% 88.45% 0.15% 0.04% 95.43%
2% 85.75% 0.00% 0.18% 87.13% 5% 79.90% 0.00% 0.02% 96.50% Patching 0.1% 50.70%
0.00% 0.08% 90.61% 0.5% 85.80% 10.95% 0.05% 93.19% 1% 88.45% 9.75% 0.03%
93.37% 2% 85.75% 9.30% 0.05% 92.64% 5% 79.90% 10.95% 0.00% 95.27%

The patching-based sanitization strategy addresses the degradation in utility
metrics. Considering the same threshold at 80%, we can directly compare the
effects of patching to filtering for the experiment with the gradient boosting
model on CTU-13. Table 1 shows that using patching generally leads to higher
average values of the F1 score on test data (91% - 95%), and a lower false
positive rate (0% - 0.08%). On the other hand, as expected, patching is
slightly less effective than complete filtering in reducing the attack success
(0% - 11% ASR). Therefore, the defender can adopt the patching approach if
they want to trade-off some defensive effectiveness for reduced degradation in
model utility.

####  5.2.3. Loss analysis and sanitization

We performed the loss deltas analysis outlined in Section 4.4 applying it to
the experiments on the CTU-13 dataset with the gradient boosting model. For
this experiment we use a threshold Z-score of 2, that is, we mark as
suspicious any cluster whose loss delta is lower than 2 times the standard
deviation of the observed loss deltas during the initial training iterations,
up to 80%. The results of both filtering and patching sanitization strategies
are reported in Table 6, Section A.3.

This approach leads to a significant improvement of the F1 and FPR scores,
especially for the filtering sanitization. In this case, we observe up to a
0.2% (95% relative improvement) decrement in FPR and up to 11% increase (12.5%
relative improvement) in the F1 score on the test set. However, the attack
success remains relatively high, and therefore fixed threshold filtering may
be preferable in this scenario. We note here that the defender can always
trade off smaller improvements in F1 and FPR scores for a stronger protection
from the attack, by increasing the value of the threshold, for instance using
$z_{t}=1\sigma$.

###  5.3. Evaluation on malware classification

Figure 6. Iterative scoring on the EMBER malware classification task for the
_LightGBM_ model. The plot shows average metrics for a set of experiments:
MinPopulation and CountAbsSHAP attack strategies, at 4 different poisoning
rates.

Iterative scoring on the EMBER malware classification task for the _LightGBM_
model. The plot shows average metrics for a set of experiments: MinPopulation
and CountAbsSHAP attack strategies, at 4 different poisoning rates.

Table 2. Comparison of patching and filtering sanitization approaches at fixed
threshold = 80%. LightGBM model on the EMBER dataset. Also showing the Base
ASR value for the undefended attack. Results are averages of two runs on
different random seeds, for the two Independent attack strategies.

Sanitization Poisoning Base ASR ASR Test FPR Test F1 Filtering 0.5% 24.53%
6.19% 2.03% 98.21% 1% 34.27% 7.04% 2.08% 98.20% 2% 59.42% 20.98% 2.13% 98.16%
4% 98.67% 6.22% 2.05% 98.20% Patching 0.5% 24.53% 25.66% 1.65% 98.31% 1%
34.27% 25.13% 1.64% 98.29% 2% 59.42% 68.18% 1.64% 98.34%

We observe similar trends in our experiments on the malware classification
task, as summarized in Figure 6. These experiments were run attacking the
LightGBM classifier, proposed with the EMBER dataset, using the two strongest
attack strategies, based on independent feature and value selection:
CountAbsSHAP and MinPopulation. Each experiment was run twice with different
random seeds, and we tested 4 different poisoning rates from 0.5% to 4%.

####  5.3.1. Fixed threshold filtering

In this scenario we observe a quicker rise in the fraction of poisoning points
included in $D_{clean}$ after the 80% threshold. Notwithstanding, in general
the fixed threshold heuristic is still quite effective in thwarting the
attack. Compared to the experiments on the network classification task, the
changes in both F1 and FPR scores are sharper at higher percentages of
included clusters, even if the absolute values of the decrements is generally
smaller. We report 2% FPR and 98% F1 on average, across various poisoning
rates, while the ASR has been reduced to 6%-21%.

In this scenario too, the stealthiest version of the attack, using the
Combined SHAP strategy, leads to a larger fraction of poisoning points
included in $D_{clean}$ before the fixed threshold. However, as shown in
Figure 8, Section A.2, the attack success rate remains relatively low unless
high poisoning percentages are used.

####  5.3.2. Patching.

The patching strategy performs relatively poorly at preventing the attack in
this scenario, especially at higher poisoning rates. Conversely, as in the
experiments on network data, it outperforms the pure filtering approach for
what concerns preserving model utility. In particular, the FPR obtained
through patching are consistently better, with an average gain of about 0.5%,
than those obtained with filtering at different poisoning rates, as shown in
Table 2.

####  5.3.3. Loss analysis and sanitization

Table 3. Comparison of patching and filtering sanitization approaches after
loss analysis, using $z_{t}=2\sigma$. LightGBM model on the EMBER dataset.
Also showing the Base ASR value for the undefended attack. Results are
averages of two runs on different random seeds, for different strategies.

Sanitization Attack - Poisoning Base ASR ASR Test FPR Test F1 Filtering
Independent 0.5% 24.53% 5.60% 2.01% 98.22% 1% 34.27% 6.51% 2.08% 98.18% 2%
59.42% 6.38% 2.12% 98.15% 4% 98.67% 7.03% 2.04% 98.21% Combined 0.5% 3.89%
1.37% 2.08% 98.24% 1% 9.09% 1.84% 2.29% 98.15% 2% 19.20% 1.49% 2.22% 98.16% 4%
49.04% 1.45% 2.43% 98.11% Patching Independent 0.5% 24.53% 19.46% 1.68% 98.33%
1% 34.27% 36.11% 1.68% 98.31% 2% 59.42% 47.22% 1.67% 98.33% Combined 0.5%
3.89% 19.86% 1.65% 98.29% 1% 9.09% 36.04% 1.76% 98.32% 2% 19.20% 36.41% 1.84%
98.27%

Table 3 shows the results of applying our loss analysis to identify the
clusters to sanitize. The results are reported for a threshold Z-score of 2
standard deviations. This approach reflects the general trends observed
before, but improves on the fixed threshold method discussed above when
applied with both the filtering and patching sanitization approaches.

##  6\. Discussion and Limitations

Defensive mechanisms are always subject to limitations and the general problem
of defending from arbitrary poisoning attacks is far from being solved. With
this work we address clean-label backdoor attacks, and propose an effective
mitigation approach for existing threats.

Differently from provable defenses, our method is heuristic in nature, trading
off protection guarantees for large improvements in retained model utility. In
contrast to other heuristic mitigation approaches introduced in the context of
computer vision systems, our method relaxes some strong assumptions on clean
data availability and victim model architectures that are difficult to satisfy
in the cybersecurity domain.

While we defend against the attack formulations proposed in literature,
adaptive attacks against our defense are possible. For instance, an adversary
could change the feature selection process in the attacks to choose a fraction
of relevant features and a fraction of non-relevant ones. While this would
likely reduce the attack success rate, it may also reduce the likelihood of
poisoning points clustering together in the relevant feature subspace.
Therefore, this would allow the attacker to arbitrarily trade-off attack
success to reduce the likelihood of being discovered.

##  7\. Conclusions

In this work we introduce a mitigation mechanism against clean-label backdoor
poisoning attacks targeted at cybersecurity classifiers. Our method eliminates
many of the most common assumptions used in other defensive techniques against
backdoor attacks. Namely, we remove the need for separate clean datasets,
which can be difficult to obtain for cybersecurity tasks, and any assumptions
on the architecture of the models used. Our defense effectively reduces the
attack success rate in multiple scenarios, while also preserving a high model
utility and a low false positives rate.

## Acknowledgements

This research was sponsored by MIT Lincoln Laboratory, the U.S. Army Combat
Capabilities Development Command Army Research Laboratory (DEVCOM ARL) under
Cooperative Agreement Number W911NF-13-2-0045, and the Department of Defense
Multidisciplinary Research Program of the University Research Initiative
(MURI) under contract W911NF-21-1-0322.

## References

  * (1)
  * Anderson and Roth (2018) Hyrum S Anderson and Phil Roth. 2018.  Ember: an open dataset for training static pe malware machine learning models.  _arXiv preprint arXiv:1804.04637_ (2018).
  * Ankerst et al. (1999) Mihael Ankerst, Markus M. Breunig, Hans peter Kriegel, and Jörg Sander. 1999.  OPTICS: Ordering Points To Identify the Clustering Structure. ACM Press, 49–60.
  * Antonakakis et al. (2011) Manos Antonakakis, Roberto Perdisci, Wenke Lee, Nikolaos Vasiloglou, and David Dagon. 2011.  Detecting Malware Domains at the Upper DNS Hierarchy. In _Proceedings of the 20th USENIX Conference on Security_ (San Francisco, CA) _(SEC’11)_. USENIX Association, USA, 27.
  * Apruzzese et al. (2019) Giovanni Apruzzese, Michele Colajanni, Luca Ferretti, and Mirco Marchetti. 2019.  Addressing Adversarial Attacks Against Security Systems Based on Machine Learning. In _2019 11th International Conference on Cyber Conflict (CyCon)_ , Vol. 900. 1–18.  https://doi.org/10.23919/CYCON.2019.8756865
  * ATLAS (1999) MITRE ATLAS. 1999.  _VirusTotal Poisoning 2020_.  https://atlas.mitre.org/studies/AML.CS0002
  * Ayub et al. (2020) Md. Ahsan Ayub, William A. Johnson, Douglas A. Talbert, and Ambareen Siraj. 2020.  Model Evasion Attack on Intrusion Detection Systems using Adversarial Machine Learning. In _2020 54th Annual Conference on Information Sciences and Systems (CISS)_. 1–6.  https://doi.org/10.1109/CISS48834.2020.1570617116
  * Biggio et al. (2012) Battista Biggio, Blaine Nelson, and Pavel Laskov. 2012.  Poisoning attacks against support vector machines. In _Proceedings of the 29th International Coference on International Conference on Machine Learning_. 1467–1474.
  * Burkhart et al. (2010) Martin Burkhart, Mario Strasser, Dilip Many, and Xenofontas Dimitropoulos. 2010.  SEPIA: Privacy-Preserving Aggregation of Multi-Domain Network Events and Statistics. In _19th USENIX Security Symposium (USENIX Security 10)_. USENIX Association, Washington, DC.  https://www.usenix.org/conference/usenixsecurity10/sepia-privacy-preserving-aggregation-multi-domain-network-events-and
  * Cao and Gong (2017) Xiaoyu Cao and Neil Zhenqiang Gong. 2017.  Mitigating Evasion Attacks to Deep Neural Networks via Region-Based Classification. In _Proceedings of the 33rd Annual Computer Security Applications Conference_ (Orlando, FL, USA) _(ACSAC ’17)_. Association for Computing Machinery, New York, NY, USA, 278–287.  https://doi.org/10.1145/3134600.3134606
  * Carlini et al. (2024) Nicholas Carlini, Matthew Jagielski, Christopher A Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tramèr. 2024.  Poisoning Web-Scale Training Datasets is Practical. In _2024 IEEE Symposium on Security and Privacy (SP)_. IEEE Computer Society, 176–176.
  * Chen et al. (2018) Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. 2018.  Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering.  arXiv:1811.03728 [cs.LG]
  * Chernikova and Oprea (2022) Alesia Chernikova and Alina Oprea. 2022.  FENCE: Feasible Evasion Attacks on Neural Networks in Constrained Environments.  _ACM Trans. Priv. Secur._ 25, 4, Article 34 (jul 2022), 34 pages.  https://doi.org/10.1145/3544746
  * Ester et al. (1996) Martin Ester, Hans-Peter Kriegel, Jörg Sander, and Xiaowei Xu. 1996.  A density-based algorithm for discovering clusters in large spatial databases with noise. In _Proceedings of the Second International Conference on Knowledge Discovery and Data Mining_ (Portland, Oregon) _(KDD’96)_. AAAI Press, 226–231.
  * García et al. (2014) S. García, M. Grill, J. Stiborek, and A. Zunino. 2014.  An Empirical Comparison of Botnet Detection Methods.  _Computers and Security_ 45 (Sept. 2014), 100–123.  https://doi.org/10.1016/j.cose.2014.05.011
  * Gu et al. (2019) T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg. 2019.  BadNets: Evaluating Backdooring Attacks on Deep Neural Networks.  _IEEE Access_ 7 (2019), 47230–47244.  https://doi.org/10.1109/ACCESS.2019.2909068
  * Handley et al. (2001) Mark Handley, Vern Paxson, and Christian Kreibich. 2001.  Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics. In _10th USENIX Security Symposium (USENIX Security 01)_. USENIX Association, Washington, D.C.  https://www.usenix.org/conference/10th-usenix-security-symposium/network-intrusion-detection-evasion-traffic-normalization
  * Hayase et al. (2021) Jonathan Hayase, Weihao Kong, Raghav Somani, and Sewoong Oh. 2021.  SPECTRE: defending against backdoor attacks using robust statistics. In _Proceedings of the 38th International Conference on Machine Learning_ _(Proceedings of Machine Learning Research, Vol. 139)_ , Marina Meila and Tong Zhang (Eds.). PMLR, 4129–4139.  https://proceedings.mlr.press/v139/hayase21a.html
  * Heng and Soh (2023) Alvin Heng and Harold Soh. 2023.  Selective Amnesia: A Continual Learning Approach to Forgetting in Deep Generative Models. In _NeurIPS_ , Vol. 36. 17170–17194.
  * Ho et al. (2022) Samson Ho, Achyut Reddy, Sridhar Venkatesan, Rauf Izmailov, Ritu Chadha, and Alina Oprea. 2022.  Data Sanitization Approach to Mitigate Clean-Label Attacks Against Malware Detection Systems. In _MILCOM 2022 - 2022 IEEE Military Communications Conference (MILCOM)_. 993–998.  https://doi.org/10.1109/MILCOM55135.2022.10017768
  * Holodnak et al. (2022) John T. Holodnak, Olivia Brown, Jason Matterer, and Andrew Lemke. 2022.  Backdoor Poisoning of Encrypted Traffic Classifiers. In _2022 IEEE International Conference on Data Mining Workshops (ICDMW)_. 577–585.  https://doi.org/10.1109/ICDMW58026.2022.00080
  * IBM (2023) IBM. 2023.  IBM Security QRadar XDR.  https://www.ibm.com/qradar.
  * Ingalls (2021) Sam Ingalls. 2021.  Top XDR Security Solutions for 2022.  https://www.esecurityplanet.com/products/xdr-security-solutions/.
  * Invernizzi et al. (2014) Luca Invernizzi, Sung ju Lee, Stanislav Miskovic, Marco Mellia, Ruben Torres, Christopher Kruegel, Sabyasachi Saha, and Giovanni Vigna. 2014.  Nazca: Detecting Malware Distribution in Large-Scale Networks. In _NDSS_.
  * Levine and Feizi (2021) Alexander Levine and Soheil Feizi. 2021.  Deep Partition Aggregation: Provable Defenses against General Poisoning Attacks. In _9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021_. OpenReview.net.  https://openreview.net/forum?id=YUGG2tFuPM
  * Li et al. (2018) Pan Li, Qiang Liu, Wentao Zhao, Dongxu Wang, and Siqi Wang. 2018.  Chronic Poisoning against Machine Learning Based IDSs Using Edge Pattern Detection. In _2018 IEEE International Conference on Communications (ICC)_. 1–7.  https://doi.org/10.1109/ICC.2018.8422328
  * Li et al. (2021) Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. 2021.  Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks. In _9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021_. OpenReview.net.
  * Liu et al. (2018) Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018.  Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. In _Research in Attacks, Intrusions, and Defenses_. 273–294.
  * Liu et al. (2019) Yingqi Liu, Wen-Chuan Lee, Guanhong Tao, Shiqing Ma, Yousra Aafer, and Xiangyu Zhang. 2019.  ABS: Scanning Neural Networks for Back-doors by Artificial Brain Stimulation. In _Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security_ (London, United Kingdom) _(CCS ’19)_. Association for Computing Machinery, New York, NY, USA, 1265–1282.  https://doi.org/10.1145/3319535.3363216
  * Lundberg and Lee (2017) Scott M Lundberg and Su-In Lee. 2017.  A Unified Approach to Interpreting Model Predictions. In _Advances in Neural Information Processing Systems_ , I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (Eds.), Vol. 30. Curran Associates, Inc.  https://proceedings.neurips.cc/paper_files/paper/2017/file/8a20a8621978632d76c43dfd28b67767-Paper.pdf
  * MalwareGuard FireEye (2020) MalwareGuard FireEye 2020.  MalwareGuard: FireEye’s Machine Learning Model to Detect and Prevent Malware.  https://www.fireeye.com/blog/products-and-services/2018/07/malwareguard-fireeye-machine-learning-model-to-detect-and-prevent-malware.html.
  * Microsoft (2021) Microsoft. 2021.  Microsoft Defender for Endpoint $|$ Microsoft Security.  https://www.microsoft.com/en-us/security/business/threat-protection/endpoint-defender
  * Mirsky et al. (2018) Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. 2018.  Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. In _Proceedings 2018 Network and Distributed System Security Symposium_. Internet Society, San Diego, CA.  https://doi.org/10.14722/ndss.2018.23204
  * Mo et al. (2024) X. Mo, Y. Zhang, L. Zhang, W. Luo, N. Sun, S. Hu, S. Gao, and Y. Xiang. 2024.  Robust Backdoor Detection for Deep Learning via Topological Evolution Dynamics. In _2024 IEEE Symposium on Security and Privacy (SP)_. IEEE Computer Society, Los Alamitos, CA, USA, 174–174.  https://doi.org/10.1109/SP54263.2024.00174
  * Moore et al. (2005) Andrew Moore, Denis Zuev, and Michael Crogan. 2005.  _Discriminators for Use in Flow-Based Classification_.  Technical Report. Queen Mary and Westfield College, Department of Computer Science.
  * Ning et al. (2022) Rui Ning, Chunsheng Xin, and Hongyi Wu. 2022.  TrojanFlow: A Neural Backdoor Attack to Deep Learning-based Network Traffic Classifiers. In _IEEE INFOCOM 2022 - IEEE Conference on Computer Communications_. 1429–1438.  https://doi.org/10.1109/INFOCOM48880.2022.9796878
  * Ongun et al. (2021) Talha Ongun, Oliver Spohngellert, Benjamin Miller, Simona Boboila, Alina Oprea, Tina Eliassi-Rad, Jason Hiser, Alastair Nottingham, Jack Davidson, and Malathi Veeraraghavan. 2021.  PORTFILER: Port-Level Network Profiling for Self-Propagating Malware Detection. In _2021 IEEE Conference on Communications and Network Security (CNS)_. 182–190.  https://doi.org/10.1109/CNS53000.2021.9705045
  * Oprea et al. (2018) Alina Oprea, Zhou Li, Robin Norris, and Kevin Bowers. 2018.  MADE: Security Analytics for Enterprise Threat Detection. In _Proceedings of Annual Computer Security Applications Conference_ _(ACSAC)_.  https://doi.org/10.1145/3274694.3274710
  * Oprea and Vassilev (2023) Alina Oprea and Apostol Vassilev. 2023.  _Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (Draft)_.  Technical Report NIST AI 100-2e2023 ipd. National Institute of Standards and Technology.
  * Papadopoulos et al. (2021a) Pavlos Papadopoulos, Oliver Thornewill von Essen, Nikolaos Pitropakis, Christos Chrysoulas, Alexios Mylonas, and William J. Buchanan. 2021a.  Launching Adversarial Attacks against Network Intrusion Detection Systems for IoT.  _Journal of Cybersecurity and Privacy_ 1, 2 (June 2021), 252–273.  https://doi.org/10.3390/jcp1020014
  * Papadopoulos et al. (2021b) Pavlos Papadopoulos, Oliver Thornewill von Essen, Nikolaos Pitropakis, Christos Chrysoulas, Alexios Mylonas, and William J. Buchanan. 2021b.  Launching Adversarial Attacks against Network Intrusion Detection Systems for IoT.  _Journal of Cybersecurity and Privacy_ 1, 2 (2021), 252–273.  https://doi.org/10.3390/jcp1020014
  * Paxson (1999) Vern Paxson. 1999.  Bro: a System for Detecting Network Intruders in Real-Time.  _Computer Networks_ 31, 23-24 (1999), 2435–2463.  http://www.icir.org/vern/papers/bro-CN99.pdf
  * Qi et al. (2023) Xiangyu Qi, Tinghao Xie, Jiachen T. Wang, Tong Wu, Saeed Mahloujifar, and Prateek Mittal. 2023.  Towards A Proactive {}ML{} Approach for Detecting Backdoor Poison Samples. In _32nd USENIX Security Symposium (USENIX Security 23)_. 1685–1702.
  * Severi et al. (2023) Giorgio Severi, Simona Boboila, Alina Oprea, John Holodnak, Kendra Kratkiewicz, and Jason Matterer. 2023.  Poisoning Network Flow Classifiers. In _Proceedings of the 39th Annual Computer Security Applications Conference_ _(ACSAC ’23)_. Association for Computing Machinery, New York, NY, USA, 337–351.  https://doi.org/10.1145/3627106.3627123
  * Severi et al. (2021) Giorgio Severi, Jim Meyer, Scott Coull, and Alina Oprea. 2021.  Explanation-Guided Backdoor Poisoning Attacks Against Malware Classifiers. In _30th USENIX Security Symposium (USENIX Security 21)_. 1487–1504.
  * Shafahi et al. (2018) Ali Shafahi, W. Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. 2018.  Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networks. In _Advances in Neural Information Processing Systems_.
  * Siva Kumar et al. (2020) Ram Shankar Siva Kumar, Magnus Nyström, John Lambert, Andrew Marshall, Mario Goertzel, Andi Comissoneru, Matt Swann, and Sharon Xia. 2020.  Adversarial Machine Learning-Industry Perspectives. In _2020 IEEE Security and Privacy Workshops (SPW)_. 69–75.  https://doi.org/10.1109/SPW50608.2020.00028
  * Steinbach et al. (2004) Michael Steinbach, Levent Ertöz, and Vipin Kumar. 2004.  _The Challenges of Clustering High Dimensional Data_.  Springer Berlin Heidelberg, Berlin, Heidelberg, 273–309.  https://doi.org/10.1007/978-3-662-08968-2_16
  * Steinhardt et al. (2017) Jacob Steinhardt, Pang Wei Koh, and Percy Liang. 2017.  Certified defenses for data poisoning attacks. In _Proceedings of the 31st International Conference on Neural Information Processing Systems_ (Long Beach, California, USA) _(NIPS’17)_. Curran Associates Inc., Red Hook, NY, USA, 3520–3532.
  * Szegedy et al. (2014) Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. 2014.  Intriguing properties of neural networks. In _2nd International Conference on Learning Representations, ICLR 2014, Banff, AB, Canada, April 14-16, 2014, Conference Track Proceedings_ , Yoshua Bengio and Yann LeCun (Eds.).  http://arxiv.org/abs/1312.6199
  * Tamersoy et al. (2014) Acar Tamersoy, Kevin Roundy, and Duen Horng Chau. 2014.  Guilt by Association: Large Scale Malware Detection by Mining File-Relation Graphs. In _Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining_ (New York, New York, USA) _(KDD ’14)_. Association for Computing Machinery, New York, NY, USA, 1524–1533.  https://doi.org/10.1145/2623330.2623342
  * Tran et al. (2018) Brandon Tran, Jerry Li, and Aleksander Madry. 2018.  Spectral Signatures in Backdoor Attacks. In _Neural Information Processing Systems_.  https://api.semanticscholar.org/CorpusID:53298804
  * Turner et al. (2019) Alexander Turner, Dimitris Tsipras, and Aleksander Madry. 2019.  Label-Consistent Backdoor Attacks.  arXiv:1912.02771 [stat.ML]
  * Venkatesan et al. (2021) Sridhar Venkatesan, Harshvardhan Sikka, Rauf Izmailov, Ritu Chadha, Alina Oprea, and Michael J. de Lucia. 2021.  Poisoning Attacks and Data Sanitization Mitigations for Machine Learning Models in Network Intrusion Detection Systems. In _MILCOM 2021 - 2021 IEEE Military Communications Conference (MILCOM)_. 874–879.  https://doi.org/10.1109/MILCOM52596.2021.9652916
  * Wang et al. (2020) B. Wang, X. Cao, J. Jia, and N. Z. Gong. 2020.  n certifying robustness against backdoor attacks via randomized smoothing. In _CVPR 2020 Workshop on Adversarial Machine Learning in Computer Vision_.
  * Wang et al. (2019) Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. 2019.  Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. In _2019 IEEE Symposium on Security and Privacy (SP)_. 707–723.  https://doi.org/10.1109/SP.2019.00031
  * Wang et al. (2022) Wenxiao Wang, Alexander Levine, and Soheil Feizi. 2022.  Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation. In _International Conference on Machine Learning, ICML 2022, 17-23 July 2022, Baltimore, Maryland, USA_ _(Proceedings of Machine Learning Research, Vol. 162)_ , Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvári, Gang Niu, and Sivan Sabato (Eds.). PMLR, 22769–22783.  https://proceedings.mlr.press/v162/wang22m.html
  * Xu et al. (2021) Xiaojun Xu, Qi Wang, Huichen Li, Nikita Borisov, Carl A. Gunter, and Bo Li. 2021.  Detecting AI Trojans Using Meta Neural Analysis. In _2021 IEEE Symposium on Security and Privacy (SP)_.
  * Yang et al. (2021) Kun Yang, Samory Kpotufe, and Nick Feamster. 2021.  Feature Extraction for Novelty Detection in Network Traffic.  https://doi.org/10.48550/arXiv.2006.16993 arXiv:2006.16993 [cs]
  * Yang et al. (2023) L. Yang, Z. Chen, J. Cortellazzi, F. Pendlebury, K. Tu, F. Pierazzi, L. Cavallaro, and G. Wang. 2023.  Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers. In _2023 IEEE Symposium on Security and Privacy (SP)_. IEEE Computer Society, Los Alamitos, CA, USA, 719–736.  https://doi.org/10.1109/SP46215.2023.10179347
  * Zhu et al. (2023) Rui Zhu, Di Tang, Siyuan Tang, XiaoFeng Wang, and Haixu Tang. 2023.  Selective Amnesia: On Efficient, High-Fidelity and Blind Suppression of Backdoor Effects in Trojaned Machine Learning Models. In _2023 IEEE Symposium on Security and Privacy (SP)_. IEEE Computer Society, 682–700.  https://doi.org/10.1109/SP46215.2023.00070

##  Appendix A Appendix

###  A.1. Data features

For network data (CTU-13 dataset), the Zeek logs are partitioned in 30s
windows and aggregated by internal IP and destination port. Each data point is
comprised of several statistical features, which are summarized in Table 4.
The final feature count for this data representation is 1152.

Table 4. Statistical features for network data. Feature types
---
Counts of connections per transport protocol
Counts of connections for each conn_state
Sum, min, max over packets sent and received
Sum, min, max over payload bytes sent and received
Sum, min, max over duration of connection event
Counts of distinct external IPs
Count of distinct destination ports

For malware binary files (EMBER dataset), we leverage both metadata (e.g.,
version number), as well as statistical information (e.g., number of urls).
The features used are presented in Table 5. The resulting vectors contain 2351
features.

Table 5. Statistical features for binary files. Feature types
---
Major and minor image version
Major and minor linker version
Major and minor operating system version
Minor subsystem version
Binary size and timestamp
MZ signature
Number of read and execute sections
Number of write sections
Number of unnamed sections
Number of zero-size sections
Counts of distinct file system paths
Counts of distinct registries
Counts of distinct URLs

###  A.2. Additional results for iterative scoring

We include here visualizations for the iterative scoring process when applied
to the stealthier, but less effective, versions of the backdoor poisoning
attacks we consider.

Figure 7. Iterative scoring on the CTU-13 botnet classification task for the
gradient boosting model. The attack was conducted with the _generated trigger_
strategy. The plot shows average metrics for the SHAP and Entropy attacker
feature selection, at 5 different poisoning rates.

Iterative scoring on the CTU-13 botnet classification task.

Figure 8. Iterative scoring on the EMBER malware classification task for the
LightGBM model. The plot shows average metrics for the set of experiments on
the _Combined SHAP_ attack strategy at 4 different poisoning rates.

Iterative scoring on the EMBER malware classification task.

In Figure 8 we show the dynamics of the iterative scoring process, with
increments of 5% of the clusters added to the training set, on the attack
carried out with the generative trigger strategy. The vertical line indicates
the fixed threshold at 80% of included clusters. Similarly to Figure 4, each
line shows the average value over runs with 5 different random seeds, and two
attacker feature selection strategies: SHAP and entropy.

Figure 8 reports the effect of applying our iterative scoring strategy to the
attack on EMBER malware classification carried out using the stealthier
_Combined SHAP_ strategy. Each iterative step adds 5% of the clusters, and the
vertical line indicates the fixed threshold at 80% of included clusters. Here
too, each line is an average of two observations obtained with different
random seeds.

###  A.3. Additional results for loss analysis and sanitization

We report in Table 6 the effects of patching and filtering sanitization
approaches when applied on the clusters identified through the analysis of the
loss deltas. The experiments are run for the gradient boosting model, with two
types of trigger refinement strategies, full trigger and generated trigger. We
report the averages of 5 runs with different seeds and two feature selection
strategies (SHAP, entropy), for a total of 10 experiments per value.

Table 6. Comparison of patching and filtering sanitization approaches after
loss analysis, using $z_{t}=2\sigma$. Gradient boosting model on the CTU-13
dataset. Results are averages of 5 runs on different random seeds, with two
feature selection approaches, for different trigger refinement strategies.

Sanitization Attack - Poisoning Base ASR ASR Test FPR Test F1 Filtering Full
0.1% 50.70% 0.00% 0.01% 96.94% 0.5% 85.80% 30.15% 0.00% 97.07% 1% 88.45%
45.80% 0.00% 96.54% 2% 85.75% 53.00% 0.00% 96.85% 5% 79.90% 43.15% 0.00%
96.75% Generated 0.1% 29.75% 35.80% 0.01% 96.80% 0.5% 42.05% 40.95% 0.01%
96.62% 1% 51.65% 39.40% 0.01% 96.97% 2% 51.25% 46.20% 0.01% 96.82% 5% 62.05%
42.95% 0.01% 96.46% Patching Full 0.1% 50.70% 3.05% 0.00% 95.46% 0.5% 85.80%
38.05% 0.00% 96.09% 1% 88.45% 44.20% 0.00% 95.52% 2% 85.75% 51.70% 0.00%
96.60% 5% 79.90% 33.85% 0.00% 95.38% Generated 0.1% 29.75% 30.25% 0.00% 96.63%
0.5% 42.05% 44.10% 0.00% 96.32% 1% 51.65% 48.50% 0.00% 96.91% 2% 51.25% 49.50%
0.00% 96.85% 5% 62.05% 60.65% 0.00% 96.51%

###  A.4. Additional metrics for threshold filtering

In Table 7 we report a complete breakdown of the tracked utility metrics for
the defended models at different fixed thresholds. All results reported in the
table are average percentages over 10 experiments, with two attacker feature
selection strategies (entropy and SHAP) and 5 random seeds.

Trigger type Model type Poisoning % F1 at 80.0% FPR at 80.0% Poisons in
$D_{clean}$ at 80.0% Full Neural Network 0.1% 48.19% 1.45% 10.99% 0.5% 45.97%
1.62% 31.71% 1% 52.31% 1.30% 13.89% 2% 49.33% 1.36% 12.03% 5% 64.55% 0.83%
20.51% Gradient Boosting 0.1% 85.93% 0.21% 0.00% 0.5% 94.84% 0.04% 2.72% 1%
95.43% 0.04% 0.62% 2% 87.13% 0.18% 0.01% 5% 96.50% 0.02% 0.03% Generated
Gradient Boosting 0.1% 93.26% 0.07% 30.99% 0.5% 88.51% 0.18% 49.64% 1% 93.16%
0.08% 48.59% 2% 89.12% 0.17% 38.49% 5% 90.10% 0.14% 65.36%

Table 7. Average model utility metrics on CTU-13. Results reported for
different victim architectures, at different poisoning percentages. All
results are averages of 10 runs, with two attack strategies and 5 random
seeds.

Average model utility metrics on CTU-13 Neris detection expressed in
percentage. Results reported for different victim architectures, at different
poisoning percentages. All results are averages of 10 runs, with two attack
strategies and 5 random seeds.