RePAIR reduces backdoor attack success in semantic segmentation while preserving clean performance
The claim
RePAIR substantially lowers backdoor attack success rates and largely maintains clean segmentation accuracy
Published as: “RePAIR: Inverting Backdoor Attacks in Semantic Segmentation”
So what
The method enables immediate mitigation of backdoor threats in deployed segmentation systems without costly retraining, which is valuable for safety-critical applications like autonomous driving.
The five-minute version
RePAIR cuts backdoor attack success rates to under 7.86% for DeepLabV3+ and under 0.54% for SegFormer on Cityscapes, while keeping benign segmentation quality near the original (mIoU-B ≈ 74.5% and 72.3%). It works post-hoc without retraining, using internal model representations to infer victim-target relations from unlabeled, possibly poisoned images. Evidence comes from experiments on three public benchmarks (Cityscapes, PASCAL VOC, ADE20K) and two architectures, showing consistent mitigation compared to pruning, fine-tuning, Segment Cleanse and ABL. The paper notes weaker mitigation on PASCAL VOC (ASR 5.4%-19.7%) and that ADE20K attacks were too weak to evaluate.
What they found 4
- RePAIR reduces attack success rate to below 7.86% for DeepLabV3+ across all evaluated attacks on Cityscapes.
“RePAIR consistently reduces the ASR to below 7.86% across all evaluated attacks.”
- RePAIR reduces attack success rate to below 0.54% (often zero) for SegFormer across all evaluated attacks on Cityscapes.
“RePAIR achieves lower ASR than all other evaluated defenses on all backdoor attacks, reducing the ASR to below 0.54% and frequently to zero.”
- RePAIR preserves benign segmentation performance, maintaining mIoU-B at 74.50% for DeepLabV3+ and 72.30% for SegFormer.
“RePAIR maintains mIoU-B at 74.50% for DeepLabV3+ and 72.30% for SegFormer”
- On PASCAL VOC, RePAIR lowers ASR but residual rates remain between 5.41% and 19.67%, indicating less complete mitigation.
“RePAIR reduces the remaining ASR to between 5.41% and 19.67%.”
What undercuts it the paper’s own results
- On PASCAL VOC the defense leaves up to 19.67% attack success, far higher than the sub-1% rates on Cityscapes.
- ADE20K attacks were too weak to produce a meaningful mitigation study, limiting evidence of effectiveness on that dataset.
Stated limits 2
- On ADE20K, the evaluated attack configurations do not produce a sufficiently strong backdoor effect in the undefended models to support a meaningful mitigation study.
- If too little reliable victim evidence remains, the defense does not construct a repair state.
What’s new here 4
- A post-hoc, label-free defense that does not require model retraining or modification.
- A theoretical formulation of backdoor attacks as directed probability transport and its approximate reversal.
- An attack-unaware method to build a clean reference set from potentially poisoned data by screening victim-target evidence.
- Architecture-specific internal semantic references (single layer for ConvNets, multi-layer for Transformers) to guide pixel-wise repair.
Artifacts & methods 5
- RePAIRsystem
- internal semantic reference (layer-wise representations)primitive
- victim-target pair inference from unlabeled imagesprimitive
- probability-transport theoretical frameworktheory
- Cityscapes / PASCAL VOC / ADE20K datasetsdataset