ECP: Error Cluster Pruning Against Backdoor Attacks in Image Classification

Backdoor attacks pose a serious threat to the security of deep neural networks (DNNs), as attackers inject trigger-embedded samples into the training data, causing the model to misclassify them into predefined target labels at inference stage. Existing defense methods against backdoor attacks often suffer from high computational costs and implementation complexity, while neglecting analysis from the perspective of data distribution. In this paper, we propose a novel post-hoc detection method, Error Cluster Pruning (ECP), to identify and remove poisoned samples in image classification tasks. Specifically, ECP applies unsupervised clustering in the feature space to reveal distributional differences between benign and triggered samples. This process allows for the identification of erroneous clusters associated with target labels. We then estimate the target label using probabilistic analysis and prune the samples within the corresponding clusters. Experimental results demonstrate that ECP accurately locates poisoned samples across various attacks, thereby effectively mitigating backdoor attacks while maintaining model performance on benign data. Moreover, ECP significantly outperforms several state-of-the-art defense baselines in terms of computational efficiency.