Improving the sensitivity of backdoor detectors through class subspace orthogonalization (CSO)

The researchers propose a plug-and-play class subspace orthogonalization (CSO) method to improve the sensitivity of post-training backdoor detectors. The method uses a small number of clean samples per class for constrained optimization; while optimizing the detection statistic, it suppresses class-intrinsic features through orthogonalization, greatly reducing the statistics of non-target classes, while the backdoor target class still retains the contribution from the trigger. The researchers evaluated CSO under challenging scenarios such as mixed-label attacks and adaptive attacks.