Pu Zhao, Pin-Yu Chen, Payel Das, Karthikeyan Natesan Ramamurthy and Xue Lin (2020), International Conference on Learning Representations (ICLR 2020) — ARXIV-2005.00060
Key takeaways
- Path connection repairs tampered models. Given two models backdoored with the same poisoned data, a quadratic Bezier path trained on a small bonafide set has models near its ends (t = 0.1 or 0.9) with near-original clean accuracy and backdoor success near 0% (Fig. 2). On CIFAR-10 VGG with 2,500 clean samples the model at t = 0.1 has 88% clean accuracy and 1.1% backdoor success. With 50 samples it has 63% and 2.5%, against 46% clean accuracy for fine-tuning (Table 2).
- The same holds for injected weight errors. On the path between two fault-sneaking-attacked models, injection success is 0% at every data size tested while clean accuracy stays at 88–96% (Table 3).
- Robustness has a barrier where loss does not. On paths trained with the standard loss between two regular models, a regular and an adversarially trained model, or two adversarially trained models, the standard loss is flat but the PGD robustness loss rises mid-path. Its shape tracks λ_max of the input Hessian, with Pearson correlations 0.71, 0.88 and 0.86 (Fig. 4). The authors read the regular–robust barrier as geometric evidence for the “no free lunch” view of adversarial robustness.
- An adaptive attacker who trains a poisoned path and releases its endpoints does not break the defence: models at t ∈ [0.25, 0.75] are still repaired (Appendix J).
Standing in the record
Filed on 2026-10-03 with the owner’s mode-connectivity batch (ADR-027). It
is the batch’s earliest work after the foundations, and its only one on
security. The record has no word for adversarial robustness or model
tampering, so loss-landscapes is the only subject tag. That gap is
reported with the batch rather than filled by stretching
society-and-governance, whose “security” is institutional.
It extends Garipov et al. (LIT-673). It trains Garipov’s quadratic Bezier curve with Garipov’s uniform-t objective (its Eqs. 2 and 4), and its contribution is what lies along such a curve when the endpoints are tampered. It names Draxler et al. (LIT-653) among the works showing flat paths between minima. Later papers in the batch cite it as the robustness application of mode connectivity: Lubana et al. (LIT-669), Sonthalia et al. (LIT-659), Bo Zhao et al. (LIT-655) and Tran et al. (LIT-670). Its repair result, that leaving a basin along a trained curve sheds an unwanted behaviour, anticipates Lubana et al.’s argument that staying linearly connected to a model keeps its mechanism.
It carries an instruction for practice (repair a suspect pretrained model by path connection with a little clean data), so it is flagged for the anthology.