mnist-badnets-repaired

The Same MNIST Classifier After the Backdoor Was Removed

The "after" checkpoint from the BadNets demo: the same LeNet-5 classifier with the poisoned training session's influence removed via Authentrics exclude_training — attack success drops from 8.70% to 0.13%, at a real (small) clean-accuracy cost, and no retraining from scratch was needed.

Authentrics is a high-performance neural-network analysis library (Python wheel over a C++ core). It audits and maintains model checkpoints: parameter/behavioral drift, compliant data removal without full retraining, and loss-driven optimization without backprop. Analysis runs locally on your machine — only project metadata (names, descriptions) is exchanged with Authentrics servers, never your model weights.

What this demo shows

• exclude_training — compliance / unlearning: remove the effect of specific training session(s) (e.g. a sensitive/bad data slice) from the latest checkpoint without retraining from scratch.

Results

The fix: remove the poisoned training influence, without retraining

Once the backdoor has been localized to a single training session (see the poisoned model at authentrics/mnist-badnets-poisoned), the fix follows directly from that localization:

• exclude_training surgically removes that one training session's effect from the model — it strips out what epoch 2 taught, so attack success collapses from 8.70% (the final poisoned checkpoint, epoch_10.pt) to 0.13%. No retraining from scratch. This isn't free, though: clean accuracy dips slightly too, from 98.25% to 96.98% — removing one epoch's influence also removes whatever legitimate learning happened in it, not just the backdoor.
• ztom_analysis is the fallback for the harder, distributed case (where the trigger is present in every epoch and can't be localized to one session, so there's nothing for exclude_training to subtract). It gradient-free-optimizes the final checkpoint directly against a combined objective instead. It helps — but it's not removal, just suppression, and it costs more clean accuracy than the localized fix above.

Why this matters

Catching a backdoor while it's still localized to one training session is what lets you remove it almost for free. That's the whole point of treating a training run as a sequence of checkpoints you can investigate — rather than a single opaque artifact you can only accept or throw away.

This is a research/demonstration project, not a production security tool, and not a general claim that Authentrics (or any tool) detects arbitrary backdoors in arbitrary models. It reproduces a published, open-source TrojAI-style BadNets recipe to show a concrete forensics workflow end to end.

Reproduce this analysis

The public code and outputs behind this demo live in https://github.com/Authentrics-ai/trojai-authentrics-demo.

The corrected checkpoint is produced when you run the demo.

Weights: This is the corrected ("after") checkpoint from the reproducible BadNets demo, produced by exclude_training on the final poisoned checkpoint (epoch_10.pt). Compare it against the poisoned model at authentrics/mnist-badnets-poisoned. The checkpoint is included in this repository.

Reproduce it yourself

pip install authentrics            # Linux x86_64, Python 3.11–3.13
authrx init                        # paste API key (stored at ~/.local/state/authentrics/api_key)
# or, for CI / non-interactive:
export AUTHRX_API_KEY=<your_api_key>

Generate an API key and read the full docs at https://app.authentrics.ai/.

---

Produced with the Authentrics SDK v0.35.1 — checkpoint analysis that runs locally on your own hardware; only project metadata ever leaves your machine, never your weights.

Links

• App & API keys: https://app.authentrics.ai/
• Docs & API reference: https://app.authentrics.ai/docs
• Examples & user guide: https://github.com/Authentrics-ai/authentrics-analysis-examples
• Contact: [email protected]