# US 2026/0087134 A1 · Countermeasures for backdoor attacks of deep learning systems

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2026/0087134 A1
- Document ID: US20260087134A1
- Status: Published application
- Kind: A1
- Application number: 18/892,934
- Filed: 2024-09-23
- Published: 2026-03-26
- Earliest claimed: 2024-09-20
- Assignees: Vinai Artificial Intelligence Application and Research Joint Stock Company
- Applicants: Vinai Artificial Intelligence Application and Research Joint Stock Company
- Inventors: Tuan Anh Tran; Ngoc Tran Huynh; Dang Khoa Doan; Huy Tung Pham; Hai Hung Bui
- Web page: https://patentgrep.com/patent/US20260087134A1

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06N 20/00: Machine learning
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Training countermeasures for a backdoor attack on a deep learning model is provided. The method includes defining a maximum learning rate and a minimum learning rate to train the deep learning model against backdoor attacks. The subject model is initialized to run a learning process using the minimum learning rate. The learning process of the deep learning model is cycled through the maximum learning rate and the minimum learning rate. The cycling process is interleaved using a first data set of clean data and a second data set of poisoned data until a threshold value of defense is reached.

## Claims

### Claim 1

A method of training countermeasures for a backdoor attack on a deep learning model, comprising:
defining a maximum learning rate and a minimum learning rate to train the deep learning model against backdoor attacks;
initializing the subject model to run a learning process using the minimum learning rate;
cycling the learning process of the deep learning model through the maximum learning rate and the minimum learning rate; and
interleaving the cycling of the learning process using a first data set of clean data and a second data set of poisoned data until a threshold value of defense is reached.

### Claim 2 (depends on 1)

The method of claim 1, wherein the interleaving step includes alternating the use of the clean data for one epoch of training with the use of the poisoned data for one epoch of training.

### Claim 3 (depends on 2)

The method of claim 2, wherein the interleaving step is performed until a convergence of the threshold value of defense is reached.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
determining whether the convergence of the threshold value of defense is reached after each epoch of training; and
repeating the finetuning process before a next epoch of training using either the clean data set or the poisoned data set in the event that convergence of the threshold value is not reached.

### Claim 5 (depends on 4)

The method of claim 4, further comprising determining that the deep learning model is trained for a defense to backdoor attacks in the event that convergence of the threshold value of defense is reached after one or more of the epochs of training.

### Claim 6 (depends on 1)

The method of claim 1, wherein the cycling step includes progressing the learning process until the deep learning model uses the maximum learning rate before performing the interleaving step.

### Claim 7 (depends on 6)

The method of claim 6, further comprising linearly decreasing the learning process until the deep learning model returns to the minimum learning rate before performing the interleaving step.

### Claim 8

A computer program product for training countermeasures for a backdoor attack on a neural network model, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, wherein an execution of the program instructions by a computer processor cause a computing device to:
receive definitions of a maximum learning rate and a minimum learning rate to train the deep learning model against backdoor attacks;
initialize the subject model to run a learning process using the minimum learning rate;
cycle the learning process of the deep learning model through the maximum learning rate and the minimum learning rate; and
interleave the cycling of the learning process using a first data set of clean data and a second data set of poisoned data until a threshold value of defense is reached.

### Claim 9 (depends on 8)

The computer program product of claim 8, wherein the execution of the program instructions further causes the computing device to alternate the use of the clean data for one epoch of training with the use of the poisoned data for one epoch of training, during the interleaving step.

### Claim 10 (depends on 8)

The computer program product of claim 8, wherein the execution of the program instructions further causes the computing device to perform the interleaving step until a convergence of the threshold value of defense is reached.

### Claim 11 (depends on 10)

The computer program product of claim 10, wherein the execution of the program instructions further causes the computing device to:
determine whether the convergence of the threshold value of defense is reached after each epoch of training; and
repeat the cycling process before a next epoch of training using either the clean data set or the poisoned data set in the event that convergence of the threshold value is not reached.

### Claim 12 (depends on 11)

The computer program product of claim 11, wherein the execution of the program instructions further causes the computing device to determine that the deep learning model is trained for a defense to backdoor attacks in the event that convergence of the threshold value of defense is reached after one or more of the epochs of training.

### Claim 13 (depends on 8)

The computer program product of claim 8, wherein the execution of the program instructions further causes the computing device to progress the learning process until the deep learning model uses the maximum learning rate before performing the interleaving step.

### Claim 14 (depends on 13)

The computer program product of claim 13, wherein the execution of the program instructions further causes the computing device to linearly decrease the learning process until the deep learning model returns to the minimum learning rate before performing the interleaving step.

### Claim 15

A computing server configured to train countermeasures against a backdoor attack on a neural network model, comprising:
a computer processor operating a backdoor model countermeasure training engine; and
a memory coupled to the computer processor, the memory storing instructions to cause the computer processor to perform acts comprising:
defining a maximum learning rate and a minimum learning rate to train the deep learning model against backdoor attacks;
initializing the subject model to run a learning process using the minimum learning rate;
cycling the learning process of the deep learning model through the maximum learning rate and the minimum learning rate; and
interleaving the cycling of the learning process using a first data set of clean data and a second data set of poisoned data until a threshold value of defense is reached.

### Claim 16 (depends on 15)

The computing server of claim 15, wherein the instructions cause the processor to perform further acts comprising alternating the use of the clean data for one epoch of training with the use of the poisoned data for one epoch of training, during the interleaving step.

### Claim 17 (depends on 15)

The computing server of claim 15, wherein the instructions cause the processor to perform further acts comprising performing the interleaving step until a convergence of the threshold value of defense is reached.

### Claim 18 (depends on 15)

The computing server of claim 15, wherein the instructions cause the processor to perform further acts comprising:
determining whether the convergence of the threshold value of defense is reached after each epoch of training; and
repeating the cycling process before a next epoch of training using either the clean data set or the poisoned data set in the event that convergence of the threshold value is not reached.

### Claim 19 (depends on 15)

The computing server of claim 15, wherein the instructions cause the processor to perform further acts comprising progressing the learning process until the deep learning model uses the maximum learning rate before performing the interleaving step.

### Claim 20 (depends on 19)

The computing server of claim 19, wherein the instructions cause the processor to perform further acts comprising linearly decreasing the learning process until the deep learning model returns to the minimum learning rate before performing the interleaving step.