Mind Control through Causal Inference: Predicting Clean Images from Poisoned Data

Anti-backdoor learning, aiming to train clean models directly from poisoned datasets, serves as an important defense method for backdoor attack. While existing methods can prevent models from predicting the target label on backdoored samples, they face significant challenges in recovering backdoored samples to their original, correct labels. Additionally, their non-end-to-end training frameworks make them unsuitable for safeguarding the increasingly prevalent large pre-trained models. To bridge the gap, we first revisit the anti-backdoor learning problem from a causal perspective. Our theoretical causal analysis reveals that incorporating both images and the associated attack indicators preserves the model's integrity. Building on the theoretical analysis, we introduce an end-to-end method, Mind Control through Causal Inference (MCCI), to train clean models directly from poisoned datasets. This approach leverages both the image and the attack indicator to train the model. Based on this training paradigm, the model's perception of whether an input is clean or backdoored can be controlled. Typically, by introducing fake non-attack indicators, the model perceives all inputs as clean and makes correct predictions, even for poisoned samples. Extensive experiments demonstrate that our model can effectively and robustly recover the original true labels of backdoored images, without compromising clean accuracy. Our code can be found at https://github.com/xuanxuan03021/BKD BKD ICLR .