Mitigating Backdoors via Decoy Shortcuts and Knowledge Decoupling

1 Introduction

With large-scale training data and powerful computational resources, deep neural networks (DNNs) have achieved remarkable performance and are widely deployed in real-world applications [He et al., 2016a; Wang et al., 2020; Zhang et al., 2020]. However, the high cost of collecting training data often drives developers to rely on third-party datasets, inadvertently exposing models to backdoor threats.

Backdoor attackers can manipulate models by poisoning a small subset of training data, embedding a specific trigger and assigning a corresponding target label. During training, the model implicitly learns this malicious association, causing any input containing the trigger to be misclassified as the target label at inference time. Deploying backdoored models can have severe consequences, especially in safety-critical applications such as autonomous driving. Prior work indicates that backdoors, once implanted, are difficult to erase or unlearn [Yu et al., 2025], making training-time countermeasures particularly important.

∗Corresponding author

PBE [Mu et al., 2023] and Neural Cleanse [Wang et al., 2019] show that backdoors tend to form shortcut connections in the model, directly associating trigger patterns with target labels. These methods exploit this property to detect and erase backdoors after training. Inspired by this, we are motivated to explore whether a decoy shortcut can be explicitly introduced during training to trap backdoor knowledge as it forms. Several studies [Tang et al., 2023; Liu et al., 2023] explore backdoor defense in NLP by confining backdoor knowledge within shallow layers or lightweight models, thereby preventing the main network from internalizing it. These approaches are primarily designed for scenarios where attackers fine-tune pre-trained clean models with poisoned data. In contrast, backdoor injection in image classification is typically performed during training from scratch. To illustrate this difference, Figure 1 compares feature distributions of poisoned samples crafted by BadNets [Gu et al., 2017] on CIFAR-10 [Alex, 2009], under both pre-trained and randomly initialized models. In the left subfigure (pretrained), poisoned samples cluster in a sparse and relatively isolated region, suggesting a degree of separation from benign ones. In contrast, in the right subfigure (from-scratch), poisoned and benign samples appear highly entangled, making separation more challenging and limiting the effectiveness of NLP-oriented defenses in this setting.

In our experiments, we find that backdoor knowledge can be readily captured by a simple parallel branch when training from scratch, as demonstrated in Section 4.1. Building on this observation, we propose a novel defense mechanism, Trapping and Removing (TR), that protects networks from backdoor attacks by trapping all backdoor knowledge within a dedicated "honeypot" branch. This honeypot is introduced prior to training and implemented as a lightweight shortcut running parallel to the original backbone. In early epochs, the shortcut can effectively capture backdoor knowledge, albeit along with a few benign knowledge. To better focus its learning on backdoor knowledge and direct the original network to solely learn benign knowledge in subsequent training, we design a knowledge decoupling strategy equipped with an entropy-based weight assignment module, which dynamically guides poisoned samples toward learning through the shortcut branch while benign samples are processed by the original network. In this manner, the backdoor can be effectively removed by discarding the shortcut after training without resorting to any additional data, while maintaining high performance on benign data. To facilitate practical deployment, we further introduce an adaptive shortcut generation strategy that automatically tailors the shortcut to the backbone network.

The main contributions of this paper are as follows:

• We reveal an inherent characteristic of backdoor attacks: backdoor knowledge tends to be learned through a simpler path during the early stages of training.
• Building on this insight, we propose TR, a training-time defense based on decoy shortcuts and knowledge decoupling, which enables clean model training under backdoor attacks without any additional data and generalizes to both training-from-scratch and fine-tuning attacks.
• We design an adaptive strategy to automatically generate shortcuts for backbone networks, enhancing generalization and facilitating practical deployment.
• We evaluate our method on multiple datasets and models against ten backdoor attacks, showing robust performance and outperforming ten state-of-the-art defenses.

2 RelatedWork

2.1 Backdoor Attack and Defense

Backdoor Attack. Based on the attack strategy, poisoningbased backdoor attacks can be broadly classified into nonoptimized and optimized attacks. Non-optimized attacks [Lv et al., 2023; Gao et al., 2024] craft poisoned samples before training and distribute them to victims, often via thirdparty datasets. Early methods [Gu et al., 2017; Chen et al., 2017] used simple, visible triggers, while later works such as WaNet [Nguyen and Tran, 2021] and Dynamic [Nguyen and Tran, 2020] introduced imperceptible or sample-specific triggers. To evade manual inspection, clean-label variants [Barni et al., 2019; Wu et al., 2025] embed triggers into benign samples under the target class. Optimized attacks [Li et al., 2021c; Cheng et al., 2024] instead generate and refine poisoned samples during the victim model's training process. These methods often rely on additional losses or cotrained trigger generators to enhance stealth. IBA [Li et al., 2021c] explicitly encourages backdoor invisibility in feature space, while LOTUS [Cheng et al., 2024] leverages partitionspecific training to control the backdoor behavior more precisely. Optimized attacks require control over the model training process, which is beyond the scope of this paper.

Backdoor Defense. Backdoor inhibiting [Zhu et al., 2023; Yu et al., 2025] and erasing [Li et al., 2021b; Liu et al., 2018] are two widely used defense strategies. Inhibiting-based defenses aim to suppress backdoor formation during training by modifying the training process. For example, CBD [Zhang et al., 2023] applies causal theory to prevent learning the backdoor path, DBD [Huang et al., 2022] decouples the training process, and ASD [Gao et al., 2023] continuously divides the training data. Erasing-based defenses focus on purifying poisoned models after backdoor training and typically require benign samples. FP [Liu et al., 2018] prunes lowactivation neurons and fine-tunes the model, while NAD [Li et al., 2021b] performs fine-tuning followed by knowledge distillation. The defense proposed in this paper falls into the inhibiting-based category.

2.2 Honeypot and Shortcut in Backdoor Defense

Several works adopt similar concepts of honeypots or shortcuts for backdoor defense, which differ from our approach. SSFT [Yang et al., 2023] erases backdoors by removing skip connections in ResNets and finetuning with 10% benign samples. T&R [Wang et al., 2022] baits the backdoor into a classification head and replaces it with another head finetuned on benign samples. DPoE [Liu et al., 2023] and [Tang et al., 2023] target NLP tasks, using shallow layers to absorb backdoor knowledge while preventing deeper layers from learning it. DPoE further combines this with a Product-ofExperts framework to isolate clean behavior. However, in NLP, backdoor injection is typically implemented by finetuning pre-trained clean models with poisoned data, where benign and backdoor knowledge are naturally decoupled, making defense more manageable. In contrast, we address the more challenging training-from-scratch injection, where benign and backdoor knowledge are entangled. Besides, we introduce a parallel shortcut branch as the honeypot, which is effective not only against training-from-scratch attacks but also against fine-tuning attacks.

2.3 Knowledge Decoupling

Feature decoupling [Wang et al., 2021; Yang and Yang, 2022] is a representative of knowledge decoupling, aiming to separate feature representations into independent components, minimize redundancy, and improve the model's ability to learn more discriminative information. For example, DeAOT [Yang and Yang, 2022] decouples object-agnostic and objectspecific features for better propagating annotations in semisupervised video object segmentation. FDTrack [Jin et al., 2023] applies feature decoupling to balance the conflicting feature requirements for detection and re-identification in multi-object tracking. The specific implementation and objectives of knowledge decoupling can vary depending on the task. In this paper, we propose to decouple the benign and poisoned knowledge during backdoor training for defending.

(a) BA and ASR of two branches under five attacks

Figure 2: Visualization of learning behaviors of original and shortcut branches under attacks.

3 Preliminaries

3.1 Poisoning-based Backdoor Attacks

We consider poisoning-based backdoor attacks in image classification. Let D = {(xi, yi)}Ni=1 be the training set with N samples, where each image xi ∈ {0, 1, . . . , 255}C×H×W and label yi ∈ {0, . . . ,K-1}. Here, K is the number of classes, and H, W, C denote image height, width, and channels. In a backdoor attack, the attacker selects a subset of D and applies a modification function G(·) to generate poisoned samples: Dm = {(x′ , yt)|x′ = G(x), (x, y) ∈ D \ Db}, where Db contains the remaining benign samples and yt is the target label. The resulting poisoned dataset is Dp = Dm∪Db, which victim users use unknowingly to train their models. At test time, the attacker triggers misclassification by applying G(·). The poisoning rate is defined as r = |Dm| |D| .

3.2 Threat Model

Attacker's Capability. We consider a common threat scenario involving third-party datasets, where an attacker can arbitrarily modify the training data before releasing it to victim users, but has no access to information beyond the dataset itself, such as the model architecture or loss functions. The attacker's objective is to cause the trained model to predict a predefined target label for triggered inputs while maintaining correct predictions on benign inputs. We further consider adaptive attack scenarios in Appendix C, where the attacker is aware of the existence of our defense.

Defender's Capability. The defender is assumed to have full control over the training process, but no prior knowledge of the backdoor and no access to any additional samples. Whether the training dataset is poisoned is also unknown to the defender. The defense objective is to prevent the trained model from predicting triggered samples as the target label while preserving accuracy on benign data.

4 Method

4.1 Distinct Learning Behaviors of Dual Branches under Backdoor Attacks

In this subsection, we analyze the distinct learning behaviors of the original and shortcut branches under backdoor attacks and discuss their inherent mechanisms.

Settings. We conduct experiments on CIFAR-10 using a modified WRN-16-1 [Zagoruyko, 2016] architecture, augmented with a two-layer shortcut that directly connects the input to the classifier. During training, the final prediction is computed as the average of the outputs from both the shortcut and original branches (i.e., equal weights of 0.5). Figure 2a reports the benign accuracy (BA) and attack success rate (ASR) of both branches under five different attacks during the early training epochs. In addition, Figure 2b visualizes the feature distributions of BadNets-poisoned samples produced by the two branches after a single epoch. More detailed experimental settings can be found in Appendix A.3.

Results. As shown in Figure 2a, the shortcut branch exhibits higher ASR but lower BA than the original branch during early training. This disparity arises from intrinsic differences between benign and poisoned samples: benign samples contain complex, diverse feature patterns better captured by the deeper original branch, whereas poisoned samples share similar trigger patterns and require only a few neurons to associate with the target label [Liu et al., 2018]. Our theoretical analysis (Appendix B) further confirms that this structural asymmetry induces a gradient focusing effect (||∇θh || ≫ ||∇θo ||) for poisoned samples. This mechanism results in a pronounced simplicity bias, where the shortcut establishes a dominant gradient flow to preferentially capture backdoor knowledge. Figure 2b further corroborates this: in the shortcut branch's feature space, most poisoned samples form a tight cluster while clean samples are relatively scattered; conversely, in the original branch's space, clean samples of the same class form coherent clusters, and poisoned samples are more dispersed-often near their ground-truth classes. These results suggest that backdoor knowledge tends to be learned by the simpler shortcut, while benign knowledge is primarily captured by the more complex original branch.

4.2 Adaptive Shortcut Generation

As Figure 3 illustrates, our defense method consists of three steps. First, we add a simple honeypot shortcut that runs parallel to the original backbone before training. The modified network is denoted as {So, Sh, Sc}, where So is the original backbone, Sh is the honeypot shortcut, and Sc is the classifier. Next, we train the modified network on the poisoned dataset, carefully decoupling the knowledge between the original branch {So, Sc} and the shortcut branch

{Sh, Sc}, enabling the shortcut to stabilize with backdoorrelated information while allowing the original network to retain only benign knowledge. Finally, the backdoor can be easily erased by simply removing the shortcut from the model, without affecting the original network's benign performance.

We construct the honeypot shortcut as a direct path from the input to the final classifier. Specifically, each 2× downsampling operation in the backbone is replaced with a 3 × 3 convolution of stride 2, while matching the corresponding channel dimensions. For instance, two convolution blocks suffice for WRN-16-1, which has two downsampling operations, while ResNet-18 requires three. More details on shortcut designs for CNNs and ViTs are provided in Appendix A.4.

To help the shortcut capture backdoor knowledge more quickly and effectively, we incorporate a spatial attention mechanism to highlight key regions. Let f ∈ Rh×w×c be the feature map, where h, w, and c denote height, width, and channels. Following [Woo et al., 2018], the attention map M ∈ Rh× w is computed by applying a convolution to f with a single output channel. We then employ the attention map to highlight informative regions of the feature maps:

where ⊗ indicates element-wise multiplication and f ′ represents the output of the attention module.

For poisoned samples, spatial attention can quickly focus on trigger patterns due to their similarity and strong correlation with the target label. Consequently, each convolution block in the shortcut is structured as Conv-Attention-BNReLU to enhance its ability to capture backdoor knowledge.

4.3 Entropy-basedWeight Assignment

In the modified network, we define the final prediction P(x) as a weighted combination of the outputs from both two branches:

where Here, wo and wh represent the respective weights assigned to each branch's prediction. The classification loss is defined as follows:

where LCE denotes the cross-entropy loss.

Setting wo and wh is challenging: if wo is too large, the original branch may inadvertently learn backdoor knowledge, while a smaller wo may impede its learning of benign knowledge. Additionally, as indicated in Figure 2a, the shortcut initially captures some benign knowledge. Improper weight settings may cause this portion of benign knowledge to remain permanently embedded in the shortcut, resulting in the original network losing the opportunity to learn it.

To address this issue, we propose a dynamic weight assignment strategy based on prediction entropy. This entropy can be calculated by:

where p is the softmax prediction. For each sample x, we first pass it through both branches to obtain predictions Po(x) and Ph(x), then assign their contributions to the final prediction as follows:

During training, poisoned samples are initially learned by the shortcut branch, inevitably along with a few benign samples. For these poisoned and benign samples, the entropy E(Ph(x)) is low, and the weight wo is high, which gives the original branch an opportunity to learn the benign sample among them. Simultaneously, this weight assignment also enables the original branch to learn from the poisoned ones. To enhance the backdoor knowledge captured by the shortcut branch and prevent it from leaking to the original branch, we design a knowledge decoupling strategy in Section 4.4.

wo + wh = 1,

4.4 Knowledge Decoupling

Motivated by the distinct learning behaviors in Figure 2, we decouple the shortcut and original branches by enforcing constraints in both feature space and final predictions. Through this decoupling, we aim for the original branch to correctly predict only benign samples, while the malicious predictions for poisoned samples are provided by the shortcut branch.

For each sample x, we obtain feature vectors So(x) and Sh(x) from the original backbone and honeypot shortcut. We then encourage feature-level decoupling by maximizing their cosine distance:

where ⟨·, ·⟩ denotes cosine similarity. However, feature decoupling alone is insufficient, as the classifier Sc may still adjust itself to accommodate backdoor requirements. Therefore, we introduce an additional prediction-level decoupling loss that jointly constrains the classifier and feature extractors:

The cooperation between Ldpf and Ldpp effectively enables the original and shortcut branches to produce different predictions for each sample.

However, both losses only consider the decoupling state at the current epoch, and their constraints are satisfied as long as the two branches learn the same sample as different classes. This implies that if the shortcut branch fails to make the malicious prediction for a poisoned sample, the original branch may classify it as the target class due to the classification constraint, resulting in the learning of backdoor knowledge. This issue is more likely when trigger patterns are complex, making it difficult for the shortcut branch to capture stable backdoor knowledge in early epochs. In such cases, the original branch may continuously compete with the shortcut for backdoor knowledge, even snatching it from the shortcut by leveraging its greater learning capacity. To address this issue, we leverage previously learned knowledge to guide the current learning direction. Specifically, we construct a feature prototype set for each branch to summarize their knowledge from the previous epoch, as storing full features for all samples is memory-intensive. The prototypes are defined as follows:

where {xki }Nk i=1 denotes samples with label k, and St-1 o and St-1 h are the original and shortcut branches from the previous epoch. The prototype sets for the two branches are denoted as {cko }K-1 k=0 and {ckh }K-1 k=0 . We push the two branches to learn in different directions by adding a loss that maximizes the distance between their features and the corresponding prototypes of the other branch:

Additionally, we enhance the backdoor knowledge in the shortcut branch by encouraging it to learn along its previous direction, which can be interpreted as the backdoor direction:

Intuitively, Lh functions as an inertial constraint that encourages the shortcut branch to remain on its discovered backdoor learning trajectory, while its combination with Lg imposes an exclusivity constraint that prevents the original branch from "stealing" backdoor knowledge, without hindering its capacity to learn benign representations.

In summary, the training loss can be expressed as follows:

where α controls the strength of decoupling at the prediction level. Specifically, Lc is applied alone during the first epoch to warm up the network, allowing each branch to initially learn its respective knowledge. In the subsequent decoupling, the backdoor knowledge will be channeled into the shortcut branch, while the benign knowledge will flow to the original branch. This behavior is analyzed in Section 5.3, and the dynamic of wo and wh are further examined in Section 5.4.

5 Experiments

5.1 Experimental Settings

Datasets and Models. In the main paper, we evaluate our defense on CIFAR-10 with WRN-16-1 and on GTSRB [Stallkamp et al., 2011] with ResNet-18 to demonstrate effectiveness across architectures. To further evaluate generalization across datasets and architectures, we include additional experiments on CIFAR-100 [Alex, 2009], ImageNet1k [Deng et al., 2009], as well as on PreActResNet-18 [He et al., 2016b], VGG-16 [Simonyan and Zisserman, 2014], and ViTs [Dosovitskiy et al., 2020] in Appendix D. Dataset details are provided in Appendix A.1.

Attack Configures. We consider ten state-of-the-art backdoor attacks, including six dirty-label methods: BadNets, Blend [Chen et al., 2017], WaNet [Nguyen and Tran, 2021], Dynamic [Nguyen and Tran, 2020], DataFree [Lv et al., 2023], and DUBA [Gao et al., 2024], and four clean-label attacks: SIG [Barni et al., 2019], CL [Turner et al., 2019], Narcissus [Zeng et al., 2023], and PCBA [Wu et al., 2025]. All attacks are implemented according to their released code to ensure strong performance. Target labels are set to 0 for CIFAR-10 and 1 for GTSRB, with a default poisoning rate of 10%. Implementation details are provided in Appendix A.2.

Defense Configures and Training Details. We compare our method with ten state-of-the-art defenses: FP [Liu et al., 2018], NAD [Li et al., 2021b], ABL [Li et al., 2021a], DBD [Huang et al., 2022], CBD [Zhang et al., 2023], ASD [Gao et al., 2023], V&B [Zhu et al., 2023], PIPD [Chen et al., 2024], PDB [Wei et al., 2024], and ESTI [Yu et al., 2025]. FP and NAD require 5% local benign samples, while ASD, PDB, and ESTI use 0.2%, 10%, and 1% of the training data as seed samples, respectively. Our model is trained for 200 epochs using SGD with an initial learning rate of 0.1, decayed by a factor of 10 every 50 epochs. The weighting factor α is set to 1 for CIFAR-10 and linearly decreased from 2 to 1 over the first 50 epochs for GTSRB.

EvaluationMetrics. We evaluate the defense performance using two metrics: Benign Accuracy (BA) on clean data and Attack Success Rate (ASR) on poisoned data. The lower the ASR and the higher BA, the more effective the defense.

5.2 Effectiveness and Efficiency

We compare TR with ten SOTA defenses in Table 1. No Defense serves as the attack baseline. Overall, TR achieves the best average BA and ASR on both datasets, even compared with defenses requiring benign samples. It consistently reduces ASR to below or near 1% (often 0%) while maintaining high BA, especially on clean datasets. TR also remains robust under different poisoning rates, as shown in Appendix E.1.

Defenses based on data partitioning, such as ABL, DBD, ASD, V&B, and ESTI, inevitably treat a portion of the training samples as poisoned, even when the dataset is clean, which leads to degraded BA. Moreover, all other defenses can be ineffective under certain attack settings, resulting in higher ASR or reduced BA. As for TR, when the data is clean, the shortcut branch captures only a few of easily learned benign information and does not interfere with the main branch in learning generalizable features from harder samples. When the data is poisoned, the shortcut rapidly absorbs backdoor knowledge, thereby preventing the main network from learning it. We further analyze class-wise BA in Appendix E.2, showing that TR has minimal impact on benign performance.

We report the training cost of TR in Appendix Table 5, showing that TR is more efficient than others. This efficiency stems from introducing only a shallow shortcut, without repeated data partitioning or iterative multi-network training.

Results on a broader range of dataset-architecture combinations, reported in Appendix Tables 6, 7, 8, 9, and 10, further demonstrates the generalization capability of TR, including our adaptive shortcut generation strategy. Notably, the Table 7 and 10 results also verify that our method remains effective against fine-tuning attacks.

5.3 Performance of the Two Branches

To better illustrate the decoupling process, Figure 4 presents BA and ASR of the original and shortcut branches. The original branch's BA steadily increases, while that of the shortcut decreases, with both eventually stabilizing. Although the shortcut retains a small amount of benign knowledge (BA ≈ 10%), it does not impede the original branch due to entropybased weight assignment. In early epochs, the shortcut's ASR is markedly higher than the original's, indicating it captures most backdoor knowledge. As training progresses, the original branch's ASR rapidly drops to 0%, while the shortcut remains at 100%, demonstrating that the shortcut effectively traps backdoor behavior and shields the original branch.

5.4 Ablation Studies

Weight Assignment. To evaluate our entropy-based weight assignment, we replace it with several fixed schemes in Table 3. Assigning equal weights (0.5) to both branches reduces ASR to 0%, but results in lower benign accuracy, as benign knowledge captured by the shortcut is not learned by the original branch. To address this, we gradually increase wo and decrease wh, which improves BA (e.g. with 0.8/0.2 and 0.9/0.1) but also raises ASR. This highlights the difficulty of balancing BA and ASR using fixed weights. Without the entropy-based weight assignment, certain benign knowledge may be sacrificed and permanently retained in the shortcut branch to obtain a clean original network. In the last column, we reverse the roles of wo and wh in Equation 6, which also lowers BA. As indicated in Figure 2a, the shortcut inevitably losses is essential for achieving robust defense performance.

captures some easy benign samples early on. In the reversed setting, a consistently higher wh limits the original branch from learning these samples, resulting in BA degradation.

Figure 5 illustrates the weight dynamics in our defense. For benign samples, wo starts high and quickly reaches 1, as the shortcut initially learns little benign knowledge constrained by its limited capacity. The decoupling loss then drives the shortcut toward confidently incorrect predictions, reflected in its low BA in Figure 4.

For poisoned samples, wh is initially low because the shortcut strongly learns the backdoor, confidently predicting poisoned samples as the target label, as reflected in its high initial ASR in Figure 4. Given the low wh, poisoned samples are learned primarily through the original branch. However, the decoupling loss Ldpp prevents the original branch from mimicking the shortcut's malicious predictions, increasing the uncertainty and entropy of the original branch for poisoned samples, which further reduces wh. Since the shortcut possesses strong backdoor knowledge and is reinforced by Lh, it is easier to shift the predictions of the original branch for poisoned samples than those of the shortcut. Consequently, the original branch increasingly predicts non-target labels for poisoned samples with high confidence (evidenced by its reduced ASR in Figure 4), as detailed in the case study in Appendix E.6.

To better clarify these weight dynamics, we provide a detailed analysis in Appendix E.5, and visualize the decoupling process in Appendix E.7.

Loss Effect. In Table 2, we examine the impact of each additional loss on the defense performance. First, we train the network without any additional losses as the baseline in row 3, which fails to defend against all attacks. Rows 4∼6 reveal that the defense is ineffective in most cases when either Ldpf or Ldpp is omitted, highlighting the necessity of decoupling both in feature space and prediction results. Relaying solely on feature decoupling fails in all cases, as the classifier can adapt to satisfy the backdoor requirements. Similarly, decoupling only predictions proves ineffective against complex attacks, such as WaNet and Dynamic (noisy mode). Without constraints in the feature space, the original branch eventually learns these complex patterns, even if the shortcut captures them initially, thereby undermining defense performance.

Rows 7∼9 explore the role of learning direction guidance losses Lh and Lg, where all cases against WaNet and Dynamic fail. For these two complex attacks, Lh allows the shortcut sufficient epochs to capture stable backdoor knowledge, while Lg helps prevent the original branch from learning leaked backdoor knowledge during this period by preventing it from learning along the poisoned direction. Without Lg, although the shortcut initially learns backdoor knowledge well against BadNets, the original branch may still become contaminated by several leaked poisoned samples. For the clean-label attack SIG, backdoor knowledge is more delicate due to competition between the trigger and the target-class ground-truth pattern. Here, strengthening the shortcut's captured knowledge is critical, as applying Lg alone will disrupt the backdoor knowledge in the shortcut, causing too many poisoned samples to leak to the original branch. Ultimately, all four losses are required for a robust defense. The selection of loss weight α is provided in Appendix E.3.

6 Conclusions

We reveal that backdoor knowledge can be naturally captured by a parallel shortcut branch and propose TR, a simple and effective defense. By introducing a honeypot shortcut and a decoupling mechanism, TR isolates backdoor knowledge from benign ones, enabling backdoor removal via post-training shortcut pruning without requiring additional data. We further incorporate an adaptive shortcut generation strategy to enhance generalization. Extensive experiments demonstrate the effectiveness and robustness of our TR. Future work will extend TR to counter optimized attacks with higher semantic complexity that may challenge the shortcut-based capture.